[sh1pt-actions-fleet]

Adds hf.co/profullstack/not-a-lawyer-agent-GGUF to the house-models manifest, so every node pulls and serves it by default (operators opt out as before).

• Qwen2.5-0.5B-Instruct + LoRA trained on the c0mpute network (infernet.text.train, worker bonita, receipt output hash = adapter sha256), from rssamplifier law topics (law, legal, lawyer, lawsuit, court, copyright, contract-law, legal-tech) and the pit.world corpus: 5,963 documents, 400 steps, held-out perplexity 35.4 to 20.6.
• digest sha256:f935882b… and size from ollama pull on dev2 (/api/tags).
• Model card and system prompt say it is not a lawyer and not legal advice. w3bs ask legal (w3bs ask: legal agent (not-a-lawyer-agent) + agent disclaimers; 0.1.21 profullstack/w3bs.org#280) prints that disclaimer under every answer.

Tests: vitest run tests/house-models.test.js 34 pass (asserts the new entry). tax-guy-agent follows in its own PR once its network run finishes.

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

40 finding(s)

HIGH/CRITICAL: 6 | MEDIUM: 14 | LOW: 20

Severity	Rule	Location
HIGH	js-electron-node-integration	apps/desktop/electron/main.js:27
HIGH	secret-generic-api-key	apps/web/app/getting-started/page.js:136
HIGH	secret-generic-api-key	docs/book/01-introduction/getting-started.md:40
HIGH	secret-database-url	docs/MIGRATIONS.md:56
HIGH	secret-database-url	ipips/ipip-0013.md:187
HIGH	sensitive-file-committed	sample.env:1
MEDIUM	secret-hex-token	apps/mobile/src/context/AuthContext.js:170
MEDIUM	secret-hex-token	apps/mobile/src/context/AuthContext.js:239
MEDIUM	secret-hex-token	apps/web/app/docs/page.js:293
MEDIUM	js-unescaped-html-sink	apps/web/app/layout.js:148
MEDIUM	js-open-redirect	apps/web/app/order/order-view.js:43
MEDIUM	js-unescaped-html-sink	apps/web/components/pit-footer.js:30
MEDIUM	js-indirect-code-sink	apps/web/lib/operator-vault.js:33
MEDIUM	js-indirect-code-sink	apps/web/lib/operator-vault.js:34
MEDIUM	js-indirect-code-sink	apps/web/lib/operator-vault.js:38
MEDIUM	sh-remote-script-execution	install.sh:583
MEDIUM	sh-remote-script-execution	install.sh:721
MEDIUM	sh-remote-script-execution	install.sh:971
MEDIUM	sh-predictable-temp-path	install.sh:1306
MEDIUM	redos-nested-quantifier	packages/gpu/src/interconnect.js:177
LOW	secret-generic-credential	docs/book/04-building-apps/index.md:33
LOW	secret-generic-credential	tests/auth-parse-body.test.js:43
LOW	secret-generic-credential	tests/auth-parse-body.test.js:46
LOW	secret-generic-credential	tests/auth-parse-body.test.js:64
LOW	secret-generic-credential	tests/auth-parse-body.test.js:70
LOW	secret-generic-credential	tests/auth-parse-body.test.js:73
LOW	secret-hex-token	tests/cli-peers.test.js:51
LOW	secret-jwt	tests/cpr-canary.test.js:26
LOW	secret-hex-token	tests/cpr-receipts.test.js:179
LOW	secret-hex-token	tests/cpr-receipts.test.js:182
LOW	secret-generic-api-key	tests/deploy-providers-foundation.test.js:220
LOW	secret-private-key	tests/liquid-agent.test.js:88
LOW	secret-hex-token	tests/node-commands-auth.test.js:68
LOW	secret-hex-token	tests/node-commands-auth.test.js:69
LOW	secret-generic-api-key	tests/operator-vault.test.js:62
LOW	secret-generic-credential	tests/profile-signup.test.js:53
LOW	secret-generic-credential	tests/profile-signup.test.js:65
LOW	secret-generic-credential	tests/profile-signup.test.js:90
LOW	secret-generic-credential	tests/reservation-orders.test.js:152
LOW	secret-generic-credential	tests/reservations.test.js:263

Snippets are redacted; ThreatCrush never prints matched credential material.