Passing the gate doesn’t mean procurement is approved: how MiniCPM5-2B safeguards high-stakes reports
This edition of the Spark Program features Liu Liang, first-prize winner of the finals of the Agent Skill Innovation Competition co-hosted by Intel and ModelScope. His project is ClaimLedger, a pre-delivery evidence verification Skill for high-stakes reports running on Intel AI PCs. The main scenario is specific: major procurement, supplier renewal, and award approval submissions at central and state-owned enterprises and large manufacturers.
It doesn't decide for people; it answers one question — can an AI-drafted document actually be delivered? In this setup, ModelBest's MiniCPM5-2B sits in the lightweight language understanding layer: it understands verification tasks users pose in Chinese, organizes task parameters, and calls the claimledger-audit Skill as authorized. The public demo uses synthetic cases, driven by public problem prototypes, de-identified and restructured, with risks deliberately inserted — not real customer files. The goal is to make the same inputs, labels, and evidence locations repeatably checkable.
This article includes video content. Please view it in the original WeChat post.
What's wrong with a procurement report that "looks great"
In the demo, Liu Liang gave a weighty case: 12 million paper meal boxes procured each year, with a budget of 10.8 million yuan. The report to be submitted says supplier B gets a 70% official share, saving 1.68 million yuan per year. Judging only by the report, this is a beautiful "cost reduction and efficiency gain" conclusion.
But checking the report against the local evidence package item by item, three errors surface one after another:
The first is authorization overreach. The report says the committee approved B for 70%, but the third paragraph of the meeting minutes says "B supplies only 30% on trial, A retains 70%, and the matter will be revisited after the risk is closed." The report turns "trial supply" into "approval," crossing the committee's actual authorization boundary.
The second is reading the amount in the wrong direction. The report says B saves 1.68 million yuan per year, but cell C3 in the Excel shows that 721,600 yuan is actually B's annual cost increase relative to A, not a saving. In other words, the report turns "721,600 yuan more spending per year" into "1.68 million yuan saved per year."
The third is a timing error. The report says all quotes are valid through the end of September, but OCR locates B's scanned quotation, whose original states expiry on August 31.
These three errors land on authorization, amount, and timing, respectively. If such conclusions are wrong, they concern tens of millions in spending and decision responsibility. That is the pain point of high-stakes reports: once a conclusion is wrong, checking every item against the source documents by hand is costly and error-prone. And having a general model "read it once" may involve going online to fill in facts, or even making judgments for people. What enterprises need isn't another model that writes reports, but a verification process that stops risks before signing.
Let the lightweight model do its job: understand the task, not make judgments
So ClaimLedger separates "understanding the task" from "judging the facts."
MiniCPM5-2B handles the first half: understanding the verification task the user poses in Chinese, organizing task parameters, and calling the claimledger-audit Skill as authorized. The actual evidence location is done by OCR and deterministic rules; numbers, dates, units, entities, regions, and statistical definitions must be checked against Word paragraphs, Excel cells, PDF page numbers, or scan-page coordinates. The model cannot invent file names, page numbers, or quotations, nor make decisions on behalf of the procurement committee.
Every link in this process is especially clear:
ClaimLedger handles input pre-checks and hashing, report conclusion decomposition, local evidence recall, discrepancy verification, human decision records, and the delivery gate;
PaddleOCR recognizes scanned pages without a text layer and preserves page numbers and coordinates;
Human reviewers decide whether a risk holds, and choose to replace, reject, or waive.
From natural-language tasks to a traceable evidence chain
ClaimLedger takes a DOCX report to be delivered and a local evidence package provided by the user. The flow includes input pre-check and SHA-256 snapshot, conclusion decomposition, multi-format parsing, evidence recall, number and definition verification, human review, and the delivery gate. Every finding can be traced back to a Word paragraph, an Excel sheet and cell, a PDF page number, or scan-page coordinates.
In the model adaptation, MiniCPM5-2B understands the user's natural-language request and organizes Skill calls; evidence files are handled by ClaimLedger's local parsing and audit modules. Even if the model proposes a candidate conclusion, the system must verify it against evidence IDs and original text that actually exist.
After risks are found, decisions remain in human hands
Finding a risk is not the same as handling it. ClaimLedger records findings, human decisions, and final delivery separately:
accept means the risk is confirmed; high risks still block delivery;
reject requires the reviewer to explain why it is a false positive;
replace requires re-verifying the replacement text;
waive requires recording the reason, the responsible person, and the applicable period.
If high risks are not effectively handled, or evidence coverage is insufficient, or the input snapshot integrity check fails, the final draft is not generated. New decisions invalidate old artifacts, and the system must re-export the annotated Word, the Excel evidence ledger, the audit JSON, the Manifest, and a new delivery draft. The original report is never overwritten.
Liu Liang said something with restraint: "Passing the gate doesn't mean procurement is approved." ClaimLedger does one thing: separate "can it be delivered" from "should it be approved."
In a separate demo dataset for an operations monthly report task, the same Skill found: freight actually rose 5.7% but was written as an 8% decline; 74% for national warehouses was written as 82% for East China warehouses; 96 delayed shipments were written as "no major anomalies"; plus a mixed complaint-rate denominator and an expired insurance policy.
Procurement and operations materials differ, but they answer the same question: can the key conclusions in the report be traced back to evidence with a clear source, time, and scope? No human decision was executed in this task, so 11 high risks remain and the gate stays closed.
Both task sets ran on a Windows PC with an Intel Core Ultra 9 285H, and the verification flow, evidence location, and results were actually produced on this local machine. LightOCR uses the CPU; OpenVINO's CPU and GPU only completed fixed embedding micro-benchmarks, which cannot represent full audit acceleration. What it validates is a real chain of responsibility: a model can participate very closely, but can never sign for a person.
Putting the model in the right place is harder than making it bigger
ModelBest's on-device path is itself a choice about "position." In ClaimLedger, MiniCPM5-2B does not try to "read the entire procurement report"; it does the part it is best at: understanding what people say, organizing the task, and then stepping back behind the evidence chain and human decisions. It targets local deployment, provides tool calling and multiple local inference backends, and is open-sourced under Apache-2.0, so local verification in high-stakes scenarios can be reproduced, audited, and further refined by the community.
The open-source spirit is not just "releasing the weights"; it is putting a capability into a real responsibility process, subject to evidence, rules, and human review. Liu Liang closed ClaimLedger with one line: "Make conclusions traceable, make delivery accountable." The weight of that line lies not in the model itself but in the design red line — a model can participate very closely, but can never sign for a person. This is perhaps another underestimated spark of on-device AI: not making the model bigger to cover more, but putting the model in the right place, so intelligence happens where it should.