bartek-flp/qwen3coder-30b-dcr-lora-v4

Qwen3-Coder-30B-A3B — DCR (Drupal Code Review) QLoRA adapter, v4

Fourth-round LoRA adapter for Qwen3-Coder-30B-A3B-Instruct, reviewing Drupal PHP diffs and emitting structured JSON findings. v4 = v3's data plus 41 rows mined from real Drupal bug-fix merge requests (the fix diff is inverted so it re-introduces the bug; a teacher labels what's wrong). Non-security logic and Drupal-API mistakes, not CVEs.

This is the recommended adapter — the one we deploy. v4 is the first round where real, varied data moved the result instead of landing in the noise. On a new non-security eval set it caught 8 of 13 real bugs versus v3's 4, while holding 100% specificity on the security set. Full honest report (including what v4 still misses and a note on run-to-run noise) ships in the project repo under docs/eval/dcr-qlora-v4-report.md.

Results (this session, base + v3 + v4 scored together, temperature 0)

Security set (n=32, 16 pos / 16 neg)

Metric	Base	v3	v4
Verdict accuracy	71.9% (23/32)	84.4% (27/32)	90.6% (29/32)
Positive recall	87.5% (14/16)	75.0% (12/16)	81.2% (13/16)
Negative specificity	56.2% (9/16)	93.8% (15/16)	100% (16/16)
Category match	56.2%	50.0%	56.2%
Invalid JSON	0/32	0/32	0/32

Non-security set (n=26, 13 pos / 13 neg)

Metric	Base	v3	v4
Verdict accuracy	65.4% (17/26)	61.5% (16/26)	76.9% (20/26)
Positive recall	69.2% (9/13)	30.8% (4/13)	61.5% (8/13)
Negative specificity	61.5% (8/13)	92.3% (12/13)	92.3% (12/13)
Category match	53.8%	23.1%	46.2%
Invalid JSON	0/26	0/26	0/26

The non-security recall jump (v3 4/13 → v4 8/13) and the non-security verdict gain (16/26 → 20/26) are four-case moves, beyond the run-to-run noise. The security specificity and verdict lead are smaller margins, but nothing regressed and they point the same way.

Training data

v3's 526 rows + 41 real bug-fix positive/negative rows (mined from merged Drupal MRs, inverted, teacher-labeled). QLoRA r=16 on q/k/v/o, batch 4 + grad-accum 4 + grad-ckpt, MAX_LEN=2048, 3 epochs, lr 2e-4. Trained on one H100, 114 steps, ~106 min.

Limitations

Real-defect recall is still ~60% on non-security and ~80% on security — roughly two in five non-security bugs slip through. Category match is mediocre (46–56%): the model is better at "something is wrong" than at naming the kind. Raw recall is higher on the untuned base, but base flags nearly half of all clean code (specificity 56–62%), which is why v4 is the better tool despite trading a little recall for usable specificity. Keep a human in the loop; this adapter is one component of a hybrid pipeline (static analyzers + RAG + the model).