DCR v5.1 — a Drupal code reviewer on Qwen3-Coder-30B-A3B
A QLoRA adapter that turns Qwen/Qwen3-Coder-30B-A3B-Instruct into a second reviewer for Drupal 10/11 pull requests. You feed it a diff, it hands back JSON findings: severity, category, file:line, and a suggested fix. It runs on your own hardware, so the code under review never leaves your network.
This is v5.1. It is the first adapter in the line that cleanly beats its predecessor (v4) on a test neither model had seen during training. Numbers below, including the caveats.
What it catches
- Drupal idioms that actually break things: missing dependency injection where it matters, absent cache metadata, a procedural hook that should be
#[Hook], a forgotten static create().
- Logic defects: null dereferences, an inverted or dropped guard, off-by-one access checks, foreach-by-reference traps.
- Security: XSS, SQL injection, access bypass, unsafe deserialization, IDOR.
One finding per issue, output kept to clean JSON, which is what a CI step or a git hook wants.
How v5.1 did against v4
We mined 40 paired examples from Drupal contrib projects (a buggy pre-fix diff plus its matched merged fix) that neither v4 nor v5.1 saw in training. Same base model, adapters hot-swapped in vLLM, scored pair-wise: a pair counts only when the model flags the buggy half and stays quiet on the clean one. That bar is harder to game than aggregate recall.
| model | pair-correct | positive recall | negative specificity | category match |
|---|
| base (no adapter) | 0.30 | 0.40 | 0.80 | — |
| v4 | 0.575 | 0.60 | 0.95 | 0.71 |
| v5.1 | 0.775 | 0.80 | 0.95 | 0.75 |
Positive recall went from 0.60 to 0.80. That was the whole point: catch more real non-security defects while keeping the false alarms down, and specificity held at 0.95. A paired sign-test on the disagreements lands at p ≈ 0.039, so this is a real gap, not a lucky run.
Straight talk on the limits. Forty pairs is a small board, and the set leans toward logic and null-handling bugs, because that is what fresh contrib fixes mostly are. A few hundred pairs would pin the confidence down harder. The direction, though, is not in question.
How it was trained
v5.1 is a warm start. Rather than train a fresh adapter from the base, we continued training the v4 adapter on a cleaned, slightly larger set, so it keeps what v4 already learned and grows from there.
The cleaning did more work than the extra volume. We dropped about 60 synthetic "architecture" positives that were really style preferences (legacy annotations, procedural hooks, a static service call), since they taught the model to flag perfectly idiomatic code. Eleven templated security labels also went, because they did not hold up on a second read. Then we added real, teacher-verified bug-fix pairs mined across the contrib ecosystem.
QLoRA at rank 16 on the attention projections (q/k/v/o), learning rate 1e-4, two epochs, gradient checkpointing. One A100 80GB, about an hour.
Run it
Serve the base with the adapter hot-loaded (vLLM):
1vllm serve Qwen/Qwen3-Coder-30B-A3B-Instruct \
2 --enable-lora --max-lora-rank 16 \
3 --lora-modules dcr-v51=bartek-flp/qwen3coder-30b-dcr-lora-v51 \
4 --max-model-len 8192 --port 8000
Then point your reviewer at --model dcr-v51. The full system (CLI, HTTP API, web UI, RAG over Drupal docs) lives in the Drupal CodeReviewer project.
Base and lineage
Base: Qwen/Qwen3-Coder-30B-A3B-Instruct (MoE, 3.3B active / 30B total, Apache 2.0). Earlier rounds: bartek-flp/qwen3coder-30b-dcr-lora-v4, -v3, -v2. v5.1 is the current pick.
License
Free to use.
Framework versions
