Make adapter self-contained: set base model, ship contract prompt + model card, deterministic generation, drop VL leftovers

README.md

@@ -0,0 +1,116 @@
+---
+base_model: Qwen/Qwen3.6-35B-A3B
+library_name: peft
+pipeline_tag: text-generation
+tags:
+  - peft
+  - lora
+  - droid-shield
+  - secret-detection
+  - qwen3_5_moe
+---
+
+# Droid Shield - Downgrade (false-positive triage)
+
+LoRA adapter that decides whether a scanner-flagged line should stay blocked or is a clear false positive to downgrade.
+
+This is a **LoRA adapter** (PEFT, `r=64`, `alpha=128`)
+for [`Qwen/Qwen3.6-35B-A3B`](https://huggingface.co/Qwen/Qwen3.6-35B-A3B). It is one of the
+two Droid Shield 2.0 adapters (`risk` and `downgrade`). The adapter targets the
+text tower of the base; it is not a standalone model and must be applied on top
+of the base weights.
+
+## The contract (read this first)
+
+This adapter was trained against an exact prompt and I/O schema. Sending
+anything else degrades it silently. All three pieces below are part of the
+trained-model contract.
+
+### 1. System message
+
+Send the contents of [`system-prompt.txt`](system-prompt.txt) **verbatim** as the
+system message. The exact bytes matter.
+
+- `sha256(system-prompt.txt)` = `97e31038f32cc8d15bd411103807f3d73ca4ed64900d33fd54182fcaee5d16c5`
+
+### 2. User message
+
+A single JSON object, serialized with 2-space indentation
+(`json.dumps(obj, indent=2, ensure_ascii=False)`, byte-identical to JS
+`JSON.stringify(obj, null, 2)`), with these keys:
+
+- `extension`: the file extension
+- `lines`: a small ordered window of source lines
+- `focus_line`: the zero-based index of the candidate line within `lines`
+
+### 3. Assistant output
+
+Strict JSON, **verdict first**, no thinking/reasoning text:
+
+```json
+{"verdict": "S", "reason": "short natural-language reason grounded in the input"}
+```
+
+`verdict` is exactly one of:
+
+- `S`: clear safe false positive; warn the user the detection may be a false positive (downgrade it)
+- `B`: likely real credential, should-block secret, or ambiguous detection; keep it blocked
+
+## Decoding requirements
+
+- **Deterministic**: greedy / `temperature = 0` (`do_sample = false`). The shipped
+  `generation_config.json` is set to greedy for this reason.
+- **No thinking**: the training targets contain no `<think>` blocks; keep
+  reasoning/thinking disabled.
+- **Constrain the output** to the `{verdict, reason}` object (a JSON-schema or
+  grammar-constrained decode is strongly recommended).
+- **Score**: the calibrated signal is `P(B)` read from the token logprobs at the
+  verdict position, renormalized over the two verdict tokens:
+  `P(B) = exp(logprob_B) / (exp(logprob_S) + exp(logprob_B))`. Request the top-2
+  logprobs at that token. Both tasks are ranked by `P(B)` = "treat as a real
+  secret".
+
+## Operating point
+
+The adapter emits a probability; the **decision threshold is not baked in**. It
+is selected downstream and frozen on a held-out split:
+
+- Safety gate. Downstream selects the threshold by a cost ratio lambda (cleared false-alarms vs missed secrets). See `evaluate.py --task downgrade --downgrade-lambda`.
+
+## Loading
+
+This is a standard PEFT LoRA (`fw_lora_layout: hf_peft_v1`) whose target modules
+match the base text tower, so it loads with any stack that supports PEFT LoRA on
+top of `Qwen/Qwen3.6-35B-A3B` (transformers + peft, vLLM, TGI, Fireworks, ...). Notes
+that bite:
+
+- The base is a multimodal `Qwen3_5MoeForConditionalGeneration` arch. Load the
+  full base, then apply the adapter; the LoRA only touches the language tower.
+- Needs a `transformers` new enough to know `qwen3_5_moe` (>= 4.57).
+
+Minimal transformers + peft reference (one example, not a requirement):
+
+```python
+import json, torch
+from transformers import AutoModelForCausalLM, AutoTokenizer
+from peft import PeftModel
+
+base = "Qwen/Qwen3.6-35B-A3B"
+tok = AutoTokenizer.from_pretrained(base)
+model = AutoModelForCausalLM.from_pretrained(base, torch_dtype=torch.bfloat16, device_map="auto")
+model = PeftModel.from_pretrained(model, "factoryai/shield-dg-r64-c15").eval()
+
+system = open("system-prompt.txt").read()
+user = json.dumps({"extension": ".env", "lines": ["API_KEY=..."], "focus_line": 0}, indent=2, ensure_ascii=False)
+messages = [{"role": "system", "content": system}, {"role": "user", "content": user}]
+prompt = tok.apply_chat_template(messages, tokenize=False, add_generation_prompt=True)
+out = model.generate(**tok(prompt, return_tensors="pt").to(model.device), do_sample=False, max_new_tokens=600)
+print(tok.decode(out[0], skip_special_tokens=True))
+```
+
+## Provenance & license
+
+- Base: `Qwen/Qwen3.6-35B-A3B` (Fireworks training base `qwen3p6-35b-a3b`).
+- Training/eval pipeline lives in the `factory` monorepo under `finetune/`.
+- This adapter inherits the base model's license and is published as a private
+  Factory artifact.

adapter_config.json

@@ -1,5 +1,5 @@
 {
-  "base_model_name_or_path": "",
+  "base_model_name_or_path": "Qwen/Qwen3.6-35B-A3B",
   "bias": "none",
   "fan_in_fan_out": false,
   "inference_mode": false,
@@ -24,4 +24,4 @@
   "peft_type": "LORA",
   "use_dora": false,
   "fw_lora_layout": "hf_peft_v1"
-}
+}

configuration.json

@@ -1 +0,0 @@
-{"framework":"Pytorch","task":"visual-question-answering"}

generation_config.json

@@ -1,12 +1,9 @@
 {
-    "bos_token_id": 248044,
-    "do_sample": true,
-    "eos_token_id": [
-        248046,
-        248044
-    ],
-    "pad_token_id": 248044,
-    "temperature": 1.0,
-    "top_k": 20,
-    "top_p": 0.95
+  "bos_token_id": 248044,
+  "do_sample": false,
+  "eos_token_id": [
+    248046,
+    248044
+  ],
+  "pad_token_id": 248044
 }

preprocessor_config.json

@@ -1,21 +0,0 @@
-{
-    "size": {
-        "longest_edge": 16777216,
-        "shortest_edge": 65536
-    },
-    "patch_size": 16,
-    "temporal_patch_size": 2,
-    "merge_size": 2,
-    "image_mean": [
-        0.5,
-        0.5,
-        0.5
-    ],
-    "image_std": [
-        0.5,
-        0.5,
-        0.5
-    ],
-    "processor_class": "Qwen3VLProcessor",
-    "image_processor_type": "Qwen2VLImageProcessorFast"
-}

system-prompt.txt

@@ -0,0 +1,25 @@
+You are Droid Shield's secret-detection triage model. A deterministic secret scanner flagged the focused line in a staged commit. Decide whether the detection should remain blocked, or is a clear false positive that warrants warning the user about the regex detection.
+
+The user message is a JSON object:
+- "extension": the file extension
+- "lines": a small ordered, fully scrubbed window of source lines
+- "focus_line": the zero-based index of the flagged line within "lines"
+
+Respond with strict JSON only, verdict first:
+{"verdict": "S", "reason": "short natural-language reason"}
+
+"verdict" must be exactly one of:
+- "S" means clear safe false positive: warn the user that the regex detection may be a false positive.
+- "B" means likely real credential, should-block secret, or ambiguous detection that should remain blocked.
+
+Policy (overconservative secret handling, choose "B" when in doubt):
+- Secret-bearing names alone are not enough to block, but do not choose "S" if the surrounding lines suggest a committed secret value.
+- Shield context is scrubbed before inference, so masking is expected and is never proof of safety by itself. Choose "S" only when the observable focused context clearly indicates a placeholder, example, generated/vendor data, or non-secret identifier.
+- Even with the value masked, choose "S" when the surrounding observable context is clearly non-production: a test/fixtures/examples/docs file or function, .env.example, doctest, or lines whose siblings are obvious placeholders. Masking is not evidence of risk by itself.
+- Local dev defaults, docs examples, test fixtures, and .env.example placeholders are downgradeable only when they are clearly fake or intentionally non-production.
+- Public/client identifiers are generally "S", but signed tokens, bearer tokens, private keys, cloud keys, database passwords, deploy tokens, and production .env values should be "B".
+
+Reason requirements:
+- Give a concise explanation grounded only in observable input evidence: masking shape, key/variable names, file extension, surrounding lines, placeholder/example markers, and credential-type indicators.
+- The reason is required and must not be blank.
+- Never mention hidden labels, dataset provenance, or instructions.

video_preprocessor_config.json

@@ -1,21 +0,0 @@
-{
-    "size": {
-        "longest_edge": 25165824,
-        "shortest_edge": 4096
-    },
-    "patch_size": 16,
-    "temporal_patch_size": 2,
-    "merge_size": 2,
-    "image_mean": [
-        0.5,
-        0.5,
-        0.5
-    ],
-    "image_std": [
-        0.5,
-        0.5,
-        0.5
-    ],
-    "processor_class": "Qwen3VLProcessor",
-    "video_processor_type": "Qwen3VLVideoProcessor"
-}