bartek-flp/gemma4-12b-dcr-v7-GGUF

gemma4-12b-dcr-v7 — a senior-grade Drupal reviewer that knows how sure it is

A 12B Gemma-4 model fine-tuned to review Drupal 10/11 pull requests the way a senior maintainer would — and, new in v7, to attach a calibrated confidence and a citation to every finding.

Runs locally. The q8 GGUF here is ~12.7 GB and works on a 16 GB Mac via Ollama. 0% data leaves your machine.

What it does

Give it a PHP/Drupal diff; it returns JSON only:

{
  "verdict": "issues_found",
  "findings": [
    {
      "severity": "high", "category": "drupal_api",
      "file": "src/Service/Importer.php", "line": 42,
      "message": "Entities are loaded one-by-one inside the loop (N+1). Use loadMultiple().",
      "suggestion": "$nodes = $storage->loadMultiple($ids);",
      "confidence": 0.85,
      "citation": "https://api.drupal.org/.../EntityStorageInterface::loadMultiple"
    }
  ]
}

It catches the Drupal-specific things a generic code model misses: missing #cache metadata, \Drupal:: static calls that should be injected, deprecated APIs, render/XSS, access/CSRF gaps, entity-load-in-loops, and security regressions (it even recognises specific SA-CORE advisories).

What's new in v7 — calibrated confidence

Earlier versions emitted a flat confidence (every finding ≈ 0.7), which made the score useless for gating. v7 emits genuinely varied, calibrated confidence — higher for citable, clear-cut defects, lower for plausible-but-unverified ones. That lets you auto-keep the high-confidence findings and route the rest to a human, turning the model from a noisy second opinion into a trustworthy second reviewer.

Benchmarks

On a held-out set of real Drupal merge-request pairs (pre-fix code with a real defect vs the clean post-fix code), single-call:

metric	v7
recall (real defects caught)	0.70
specificity (no false alarm on clean code)	0.95
per-finding confidence	varied 0.68–0.85 (was flat ~0.7)

On real merge requests it flags things like SA-CORE information-disclosure regressions (with the advisory cited), N+1 entity loads, dependency-injection anti-patterns and deprecated-API usage — each with a confidence and a source.

What worked

A senior Drupal reviewer's judgement — grounded in real api.drupal.org docs, coding standards, change-records and security advisories — was distilled into the model, supervising not just what to flag but how confident to be and which rule to cite. v7 is a focused continuation of our prior Drupal reviewer, so it keeps that model's breadth and gains the confidence calibration.

Run it

ollama pull hf.co/bartek-flp/gemma4-12b-dcr-v7-GGUF
ollama run hf.co/bartek-flp/gemma4-12b-dcr-v7-GGUF

The matching LoRA adapter (for vLLM serving or further training) is at bartek-flp/gemma4-12b-dcr-v7-lora.

Notes

• Best used as a CI / second-reviewer assistant, not an autonomous gate — it surfaces issues for a human and now tells you which ones it's sure about.
• Base model: unsloth/gemma-4-12B-it (Gemma terms apply).