gemma4-12b-dcr-v7 — a senior-grade Drupal reviewer that knows how sure it is
A 12B Gemma-4 model fine-tuned to review Drupal 10/11 pull requests the way a senior maintainer would — and, new in v7, to attach a calibrated confidence and a citation to every finding.
Runs locally. The q8 GGUF here is ~12.7 GB and works on a 16 GB Mac via Ollama. 0% data leaves your machine.
What it does
Give it a PHP/Drupal diff; it returns JSON only:
1{
2 "verdict": "issues_found",
3 "findings": [
4 {
5 "severity": "high", "category": "drupal_api",
6 "file": "src/Service/Importer.php", "line": 42,
7 "message": "Entities are loaded one-by-one inside the loop (N+1). Use loadMultiple().",
8 "suggestion": "$nodes = $storage->loadMultiple($ids);",
9 "confidence": 0.85,
10 "citation": "https://api.drupal.org/.../EntityStorageInterface::loadMultiple"
11 }
12 ]
13}
It catches the Drupal-specific things a generic code model misses: missing #cache metadata, \Drupal:: static calls that should be injected, deprecated APIs, render/XSS, access/CSRF gaps, entity-load-in-loops, and security regressions (it even recognises specific SA-CORE advisories).
What's new in v7 — calibrated confidence
Earlier versions emitted a flat confidence (every finding ≈ 0.7), which made the score useless for gating. v7 emits genuinely varied, calibrated confidence — higher for citable, clear-cut defects, lower for plausible-but-unverified ones. That lets you auto-keep the high-confidence findings and route the rest to a human, turning the model from a noisy second opinion into a trustworthy second reviewer.
Benchmarks
On a held-out set of real Drupal merge-request pairs (pre-fix code with a real defect vs the clean post-fix code), single-call:
| metric | v7 |
|---|
| recall (real defects caught) | 0.70 |
| specificity (no false alarm on clean code) | 0.95 |
| per-finding confidence | varied 0.68–0.85 (was flat ~0.7) |
On real merge requests it flags things like SA-CORE information-disclosure regressions (with the advisory cited), N+1 entity loads, dependency-injection anti-patterns and deprecated-API usage — each with a confidence and a source.
What worked
A senior Drupal reviewer's judgement — grounded in real api.drupal.org docs, coding standards, change-records and security advisories — was distilled into the model, supervising not just what to flag but how confident to be and which rule to cite. v7 is a focused continuation of our prior Drupal reviewer, so it keeps that model's breadth and gains the confidence calibration.
Run it
1ollama pull hf.co/bartek-flp/gemma4-12b-dcr-v7-GGUF
2ollama run hf.co/bartek-flp/gemma4-12b-dcr-v7-GGUF
The matching LoRA adapter (for vLLM serving or further training) is at bartek-flp/gemma4-12b-dcr-v7-lora.
Notes
- Best used as a CI / second-reviewer assistant, not an autonomous gate — it surfaces issues for a human and now tells you which ones it's sure about.
- Base model:
unsloth/gemma-4-12B-it (Gemma terms apply).
