A LoRA adapter for Qwen/Qwen2.5-Coder-14B-Instruct. It is the Reviewer used by trace, a research system that turns known upstream security fixes into merge-ready nixpkgs evidence bundles.

Given a machine-authored security backport patch and the human upstream fix it claims to reproduce, the adapter emits an accept or reject verdict with a short grounded rationale. It checks that the backport transcribes the upstream fix, addresses the stated CVE, keeps the change minimal, and does not invent claims the artifacts do not support. It is trained to review a patch it did not write, from a different model family than the one that authored it, so the reviewer and the patcher never share context.

It is not a general-purpose code reviewer or a vulnerability scanner. It answers one narrow question inside the trace contract: does this backport match the ground-truth fix. Outside that setup its verdicts carry no meaning.

QLoRA on the reviewer-lora-data corpus: valid review bundles as positives and constructed wrong-patch examples as negatives, all derived from the trace corpus. Version 1.10 passes the pilot gate (9/9 canary, 11/11 held-out test).

The review prompt and the surrounding contract live in the trace repository. Run the adapter with that prompt; a bare instruction will not reproduce the trained behaviour.

Apache-2.0, matching the base model.