qybaihe/mude-1.0

mude 1.0

mude 1.0 is a 2B-parameter decision model optimized for coding work. It is the decision model ("judge") of the coding agent mu. At dozens of decision points mu sends a small model a state and a few questions; mubench covers 37 of these points. Typical questions: is this command risky, does this turn need clarification, is the agent drifting from the goal, which lessons should it recall?

mude 1.0 answers all the questions in one forward pass with a probability for every answer: a choice, yes / no, or a score. It does not generate text. mu's own decision code turns those probabilities into actions.

It is a fine-tune of vllm-sr/d3-nano (Decision 3.0, built on Qwen/Qwen3.5-2B). It keeps 20 of d3-nano's 24 decoder layers and was trained on mu's decision requests.

Parameters	2B (1.98B loaded): text 1.65B, vision encoder 0.33B (inherited, unused by mu), decision readout 0.5M
Layers	20 decoder layers: layers 16–19 of the 24-layer model were removed, then recovered by a short fine-tune
Attention mode	prefix_noncausal: the state is read once per request, then only the question tails
Inputs	A text or JSON state plus questions in d3's System One format
Weights	model.safetensors (bf16) and readout.safetensors (the decision head)
Mac edition	qybaihe/mude-1.0-mlx-8bit (MLX, 8-bit, 1.76 GB)
License	MIT for this release; the base components are Apache-2.0 (see NOTICE and LICENSES/Apache-2.0.txt)

Internal name: d3n-l20-r7. First published as qybaihe/mude-2b; that address redirects here, and the weights are unchanged.

Use with mu

Serve the package with its own System One server. mu's typesafe judge type sends a key, so start the server with one:

pip install -r requirements.txt          # a CUDA GPU is recommended
export MUDE_KEY=$(python3 -c "import secrets; print(secrets.token_hex(16))")
DECISION_API_KEY=$MUDE_KEY python d3_server.py --port 8790 --name mude

Then make it mu's only judge in ~/.mu/agent/mu.json, and run mu with MUDE_KEY in its environment:

{
  "judges": {
    "mude": { "type": "typesafe", "baseUrl": "http://127.0.0.1:8790/v1/systemone", "model": "mude", "apiKeyEnv": "MUDE_KEY" }
  },
  "tiers": ["mude"]
}

The server binds to 127.0.0.1 by default. On a Mac, use the MLX edition, whose d3_server_mac.py serves the same API.

Use from Python

from transformers import AutoModel

model = AutoModel.from_pretrained("qybaihe/mude-1.0", trust_remote_code=True)
result = model.system_one(
    state={"goal": "Fix the failing date parser test",
           "recent_actions": ["run pytest tests/test_dates.py -> 1 failed", "read src/dates.py -> ok",
                              "edit src/dates.py -> ok"]},
    questions={
        "course": {
            "type": "choice",
            "instructions": "Where are `recent_actions` heading relative to `goal`?",
            "criteria": {"on_track": "Working towards the goal", "detour": "A side step the goal needs",
                         "drift": "Unrelated to the goal", "loop": "Repeating the same steps", "other": "None of these"},
        },
        "risky": {"type": "noul", "instructions": "Could the last action lose the user's work?"},
    },
)
print(result["answers"])

The question types are choice, noul (yes / no) and score. The model's code ships in this repository, so loading needs trust_remote_code=True.

There is no GGUF edition. llama.cpp implements neither d3's decision readout nor the prefix-noncausal attention mode, so a GGUF file would lose the decision head. Use the PyTorch or MLX edition.

Evaluation

All results are on mubench 1.0.0-rc11, the benchmark built alongside this model. mubench is an internal release candidate and is not public yet.

How mubench scores a judge:

1. It replays decision requests that mu really sent.
2. mu's own decision code turns each answer into an action.
3. Every action is costed against the reviewed label.
4. The score is the share of the cost of running mu with no judge at all that the judge removes (pooled; higher is better).

Scoring follows mu's default configuration and looks only at mu's actions.

judge	real test (3193 requests, 86 tasks)	constructed test (1591)
mude 24-layer (sp-c, before pruning)	66.0 (60.5–73.6)	79.8 (74.4–84.5)
mude 1.0 (this model)	64.9 (59.1–72.3)	81.3 (76.3–85.6)
Jev 1.14	63.1 (55.8–70.7)	80.1 (74.2–85.3)
Jev 1.13	61.5 (54.0–69.4)	76.0 (69.2–82.0)
d3-nano (as published)	31.9 (21.2–38.9)	57.1 (52.4–61.3)

Brackets show 95% bootstrap intervals; the real suite is resampled by task. The model was selected on the dev split, and each test split was run once.

The real test can be split by whether mu without a judge already does the right thing:

• Requests where a judge has to act (1043): mude 1.0 scores 75.1 (65.1–79.8) and Jev 1.14 scores 68.3 (51.6–76.3).
• Requests mu already gets right (2150): mude 1.0 turns 10.1% of them wrong and Jev 1.14 turns 6.9% wrong.

Caveats:

• Few tasks. The real test has only 86 tasks, so the gap to Jev 1.14 on the main score lies within the interval.
• Overlap with training. Some real test requests overlap textually with the training data. Without them, 2982 requests remain and mude 1.0 scores 64.5, against 62.0 for Jev 1.14.
• AI-reviewed labels. The real-suite labels were written by two independent AI reviewers, with an AI adjudicator for disagreements, not by people. A stratified check found an error rate of 0.7% (real) on the sampled items.
• Private labels. The test labels are not published.

Speed on a Mac (MLX 8-bit edition, Mac mini, on a sample of 242 mu requests):

• 0.22 s per decision on average, 0.39 s at p90;
• 3.9 GB peak process memory;
• 3 of 1048 dev questions are decided differently from this bf16 edition.

Training

Lineage, as recorded in NOTICE:

1. Fine-tunes of d3-nano on mu decision requests, then a uniform weight average of five of them.
2. A switch to the prefix-noncausal attention mode, two more fine-tunes, and a weight average of the two.
3. Removal of decoder layers 16–19.
4. A short recovery fine-tune.
5. A final fine-tuning round with additional scenarios.

Steps 4 and 5 trained decoder layers 12–19 only, at learning rate 3e-6 for one epoch.

Training data:

• Synthetic scenarios for mu's decision points.
• Real decision requests captured from scripted mu sessions on open-source repositories. These tasks are disjoint from mubench's dev and test splits.
• Excluded:
  • No outputs of Jev (TypeSafe); Jev appears only as a benchmark contestant.
  • No Terminal-Bench data. Decisions recorded in Terminal-Bench runs are kept for internal evaluation only.
  • No mubench test data.

The training data is not released.

Intended use and limitations

Intended use: the judge of mu. It may also suit other agent harnesses that ask d3-style System One questions about agent states.

Limitations:

• mu-specific. It was trained on mu's states and question wording; other agents need their own evaluation.
• Errors where mu's default is right. On the real test it turns 10.1% of those requests wrong, against 6.9% for Jev 1.14.
• Approvals. It can wrongly allow commands and tool calls (tool.risk, tool.approval). Keep a human in the loop for consequential actions.
• Long commands. Most training commands were under 400 characters. A probe hides 36 risky dev commands among read-only ones at 1,500 to 16,000 characters. On the short commands it gets 33 of 36 right. At those lengths it gets 21 to 25 right, and it wrongly allows up to 3.
• Weak decision points.
  • On the dev split it is weakest on output.drift (constructed) and board.read (real).
  • context.compact had no real training requests.
  • These three decision points are off in mu's default configuration.
• Languages. mu's prompts are English. User messages in the data are English and Chinese; other languages are untested.
• Base model. It inherits the limitations and biases of d3-nano and Qwen3.5-2B. The vision encoder was neither trained nor evaluated here.

License and attribution

mude 1.0 derives from d3-nano (Decision 3.0, vLLM Semantic Router Team) and Qwen/Qwen3.5-2B, both licensed under Apache-2.0.

• MIT. The fine-tuned weights (model.safetensors, readout.safetensors), the changed files (config.json, decision_config.json, d3_runtime.py) and this card are released under the MIT License (LICENSE), as Apache-2.0 §4 allows for derivative works.
• Apache-2.0. Files taken unchanged from d3-nano and Qwen3.5-2B stay under Apache-2.0, for example the tokenizer and the other runtime code.

The Apache-2.0 text is in LICENSES/Apache-2.0.txt. The upstream NOTICE is kept, extended with every modification.

中文简介

mude 1.0 是针对编程场景特别优化的决策模型，2B 参数（实际 19.8 亿），用作编程智能体 mu 的决策模型（judge）。它由 d3-nano 去掉 4 层后，在 mu 的决策请求上微调而来。一次前向就给出所有问题的概率，不生成文本。

原仓库名为 qybaihe/mude-2b，旧地址会自动跳转到这里，权重没有变。

• 评测：在 mubench 1.0.0-rc11 上（内部发布候选，尚未公开）：
  • real test 主分 64.9，Jev 1.14 为 63.1，两者区间重叠；
  • 需要 judge 出手的题上 75.1，Jev 1.14 为 68.3；
  • mu 本来就对的题里，它会弄错 10.1%，Jev 1.14 是 6.9%。
• Mac 版：MLX 8 位，平均每次判定 0.22 秒。
• 训练数据：
  • 针对 mu 各决策点的合成场景，以及开源仓库上的真实 mu 会话；
  • 没有用到：Jev 的输出、Terminal-Bench 数据、mubench 的 test 数据。
• 许可：微调后的权重和改动过的文件为 MIT；原样保留的底座文件仍为 Apache-2.0，见 NOTICE。