depwire-slm

LoRA adapter for Qwen3.6-35B-A3B (MoE, 4-bit MLX), fine-tuned to reason over codebase dependency-graph facts produced by the Depwire CLI — impact analysis, security findings, dead code, blast radius — with every answer deterministically verified against the same graph engine.

v0.4 — facts-in / reasoning-out, 100% grounded on the 1.16.0 oracle. The model is given graph facts in the prompt (computed deterministically by depwire-cli). It reasons over them — prioritizing, sequencing, explaining risk — and never produces graph facts from its weights. Every claim is checked against the same depwire-cli engine via a deterministic oracle harness on a held-out set of 40 real repositories.

v0.3 (superseded) reached 94.7% on the corrected 1.9.2 oracle. v0.4 is retrained on 9,918 pairs from depwire-cli 1.16.0 raw graph snapshots. The corrected oracle excludes fabricated calls edges from dependency structure; v0.4 reaches 100.0% grounding (130/130) with no format-level failures.

v0.1 (archived) was a template-based proof of concept trained on generated pairs with a keyword-based benchmark. It is superseded.

The architecture (why this is different)

depwire-cli (ground truth graph facts)
        │
        ▼
facts-in prompt ──► SLM reasons (priority, sequence, risk) ──► typed JSON answer
        │                                                       │
        └──────────────────► oracle_eval.py verifies claims ────┘

• Facts go in the prompt, never invented by the model. If a file, symbol, or number is not in the prompt's FACTS block, the model must not claim it.
• Every claim is oracle-checked. claims fields are compared deterministically against live depwire output (exact enums, exact counts, subset-of-truth file lists).
• The reasoning fields are free text — judged by quality, never able to cause a grounding failure.

Results (v0.4) — oracle grounding on held-out repos

130 evaluation cases across 40 held-out repositories (disjoint from all training repos). Every case: prompt contains real depwire facts; model answer checked against live depwire output (depwire-cli 1.16.0 oracle). Import edges alone define dependency structure; calls edges are excluded.

Task	Grounding	Cases
Impact	100.0%	63/63
Security	100.0%	30/30
Dead code	100.0%	37/37
Overall	100.0%	130/130

• Critical hallucinations: 0
• Phantom vulnerabilities: 0
• Oracle errors (excluded): 0
• Schema/format failures: 0
• Best checkpoint: iter 4200, val loss 0.091
• The dead-code confidence casing, security severity casing, and token-limit failures observed in earlier versions are absent in this evaluation

Baseline context: the same oracle harness measured the v0.1 template model at 1.0% grounding on held-out impact cases — it could not produce verifiable answers about code it wasn't given facts for. v0.4's 100.0% measures a different, deliberately narrower capability: given the facts, reason over them without contradicting the oracle. The score applies to this fixed 130-case held-out set; it is not a claim of perfect behavior on arbitrary repositories or prompts.

Version history

Version	Oracle	Evaluation
v0.1	depwire-cli 1.8.7	55% keyword benchmark
v0.2	depwire-cli 1.8.7	95.4% oracle grounding
v0.2	depwire-cli 1.9.2	93.1% on corrected parser
v0.3	depwire-cli 1.9.2	94.7% oracle grounding
v0.4	depwire-cli 1.16.0	100.0% (130/130)

Usage (MLX on Apple Silicon)

Important: this is a facts-in model. You must provide the graph facts in the prompt. It will not (and should not) invent them.

pip install mlx-lm
mkdir -p lora-adapters
huggingface-cli download atefataya/depwire-slm adapters.safetensors \
  adapter_config.json \
  --local-dir lora-adapters

mlx_lm.generate \
  --model mlx-community/Qwen3.6-35B-A3B-4bit \
  --adapter-path lora-adapters \
  --prompt "FACTS (from depwire):
Target file: src/auth/service.ts
Total affected: 3
Affected: src/api/users.ts, src/api/admin.ts, src/api/auth.ts

Task: Which affected files should be checked first and why? Answer as JSON."

For production use, the Depwire CLI computes the facts; this adapter reasons over them. The eval harness (scripts/oracle_eval.py) is Apache-2.0 and calls depwire-cli as an external subprocess.

Training Data

9,918 oracle-passing teacher-distilled pairs across three tasks, generated from real depwire-cli 1.16.0 output on non-held-out repositories. The raw graph schema uses countable symbols and import-only dependency edges, removing fabricated call-edge relationships from the training facts:

• Impact: affected-files analysis from depwire facts
• Dead code: dead-symbol analysis from depwire facts
• Security: vulnerability findings from depwire facts

Every training completion passed the same oracle harness used for evaluation (teacher = DeepSeek; outputs filtered through oracle_eval.py; contradictions discarded). Training data is strictly disjoint from the 40 evaluation repos.

Metric	Value
Oracle-passing pairs generated	9,918
Training split (mlx/train.jsonl)	9,422
Validation split (mlx/valid.jsonl)	496
LoRA	rank 8, 16 layers, scale 20.0
Base	Qwen3.6-35B-A3B-4bit (MoE, 4-bit)
Max seq	1,024 tokens
Loss	val 0.091 (iter 4200)

Limitations

• Facts-in only. The model produces graph facts from its weights at ~0% accuracy — by design. Always feed it the FACTS block; never ask it to recall a repository's structure from memory.
• Reasoning ceiling = teacher's. Distillation means the model's reasoning quality is bounded by the teacher model used to generate completions.
• It does not read code. It reasons about graph numbers you provide (dependents, in-degree, severity, dead-code confidence).
• Non-English prompts are out of scope.
• Java, Ruby, C++, Swift, Kotlin graphs were excluded from training (tree-sitter WASM parser crashes); the adapter has not seen those graphs.
• Evaluation scope. The 100% result is on a fixed 130-case held-out set with facts supplied in the prompt and deterministic oracle grading. Broader prompt styles, repositories, and reasoning quality require separate evaluation.

Repository

Pipeline, oracle harness, and eval are open source: https://github.com/atef-ataya/depwire-slm (tag v0.4)

License

Apache 2.0. Base model (mlx-community/Qwen3.6-35B-A3B-4bit) is subject to its own license — check the Qwen model card before use.