depwire-slm

LoRA adapter for Qwen3.6-35B-A3B (MoE, 4-bit MLX), fine-tuned to reason over codebase dependency-graph facts produced by the Depwire CLI — impact analysis, security findings, dead code, blast radius — with every answer deterministically verified against the same graph engine.

v0.2 — facts-in / reasoning-out, oracle-verified. The model is given graph facts in the prompt (computed deterministically by depwire-cli). It reasons over them — prioritizing, sequencing, explaining risk — and never produces graph facts from its weights. Every claim is checked against the same depwire-cli engine via a deterministic oracle harness on a held-out set of 40 real repositories.

v0.1 (archived) was a template-based proof of concept trained on generated pairs with a keyword-based benchmark. It is superseded by v0.2.

The architecture (why this is different)

depwire-cli (ground truth graph facts)
        │
        ▼
facts-in prompt ──► SLM reasons (priority, sequence, risk) ──► typed JSON answer
        │                                                       │
        └──────────────────► oracle_eval.py verifies claims ────┘

• Facts go in the prompt, never invented by the model. If a file, symbol, or number is not in the prompt's FACTS block, the model must not claim it.
• Every claim is oracle-checked. claims fields are compared deterministically against live depwire output (exact enums, exact counts, subset-of-truth file lists).
• The reasoning fields are free text — judged by quality, never able to cause a grounding failure.

Results (v0.2) — oracle grounding on held-out repos

131 evaluation cases across 40 held-out repositories (disjoint from all training repos). Every case: prompt contains real depwire facts; model answer checked against live depwire output.

Task	Grounding	Cases
Impact	98.4%	62/63
Security	90.0%	27/30
Dead code	94.7%	36/38
Overall	95.4%	125/131

• Critical hallucinations: 0
• Phantom vulnerabilities: 0
• Oracle errors (excluded): 0
• Best checkpoint: iter 4000, val loss 0.107

Baseline context: the same oracle harness measured the v0.1 template model at 1.0% grounding on held-out impact cases — it could not produce verifiable answers about code it wasn't given facts for. v0.2's 95.4% measures a different, deliberately narrower capability: given the facts, reason over them without contradicting the oracle.

Usage (MLX on Apple Silicon)

Important: this is a facts-in model. You must provide the graph facts in the prompt. It will not (and should not) invent them.

pip install mlx-lm
mkdir -p lora-adapters
huggingface-cli download atefataya/depwire-slm adapters.safetensors \
  adapter_config.json \
  --local-dir lora-adapters

mlx_lm.generate \
  --model mlx-community/Qwen3.6-35B-A3B-4bit \
  --adapter-path lora-adapters \
  --prompt "FACTS (from depwire):
Target file: src/auth/service.ts
Total affected: 3
Affected: src/api/users.ts, src/api/admin.ts, src/api/auth.ts

Task: Which affected files should be checked first and why? Answer as JSON."

For production use, the Depwire CLI computes the facts; this adapter reasons over them. The eval harness (scripts/oracle_eval.py) is Apache-2.0 and calls depwire-cli as an external subprocess.

Training Data

5,234 oracle-passing teacher-distilled pairs across three tasks, generated from real depwire-cli output on 1,495 non-held-out repositories:

• Impact (54.6%): affected-files analysis from live depwire affected
• Dead code (27.5%): dead-symbol analysis from depwire dead-code
• Security (17.9%): vulnerability findings from depwire security

Every training completion passed the same oracle harness used for evaluation (teacher = DeepSeek; outputs filtered through oracle_eval.py; contradictions discarded). Training data is strictly disjoint from the 40 evaluation repos.

Metric	Value
Oracle-passing pairs generated	5,234
Training split (mlx/train.jsonl)	4,573
Validation split (mlx/valid.jsonl)	241
LoRA	rank 8, 16 layers, scale 20.0
Base	Qwen3.6-35B-A3B-4bit (MoE, 4-bit)
Max seq	1,024 tokens
Loss	val 0.107 (iter 4000)

Limitations

• Facts-in only. The model produces graph facts from its weights at ~0% accuracy — by design. Always feed it the FACTS block; never ask it to recall a repository's structure from memory.
• Reasoning ceiling = teacher's. Distillation means the model's reasoning quality is bounded by the teacher model used to generate completions.
• It does not read code. It reasons about graph numbers you provide (dependents, in-degree, severity, dead-code confidence).
• Non-English prompts are out of scope.
• Java, Ruby, C++, Swift, Kotlin graphs were excluded from training (tree-sitter WASM parser crashes); the adapter has not seen those graphs.

Repository

Pipeline, oracle harness, and eval are open source: https://github.com/atef-ataya/depwire-slm (tag v0.2)

License

Apache 2.0. Base model (mlx-community/Qwen3.6-35B-A3B-4bit) is subject to its own license — check the Qwen model card before use.