From 196416f3da67e5235199cc6b5ffbe0eb751c6d7d Mon Sep 17 00:00:00 2001
From: Vuong Hoang <vh@phasefinal.com>
Date: Mon, 14 Sep 2026 07:28:26 -0700
Subject: [PATCH] =?UTF-8?q?docs(cyberprev-seat):=20correct=20model=20linea?=
 =?UTF-8?q?ge=20=E2=80=94=20it=20is=20a=20cyber=20SFT=20finetune,=20not=20?=
 =?UTF-8?q?an=20abliteration?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Earlier commits and the compose header called cyberprev "an abliteration of
Qwen3.8-27B (refusal-direction weight edit, no finetune)". That was wrong. Per
the hotdogs model card (base_model_relation: finetune), cyberprev is an
offensive-security agentic tool-calling LoRA, merged at scale 1.0, trained on
hotdogs/cyber-sft-agent-qwen38 (8,400 rows across 22 pentest tools: nmap,
sqlmap, metasploit, hydra, crackmapexec, ...). The abliteration is INHERITED
from its base (hotdogs/Qwen3.8-27B-abliterated); the new capability in this
repo is the cyber SFT itself.

So the sec-seat lineage is: mog-sec = persona on stock weights; sentinel-r3 =
pentest-trajectory SFT on stock weights; cyberprev = cyber tool-calling SFT on
an abliterated base. All three are SFT-or-prompt variants; the earlier framing
of cyberprev as "not a finetune" was backwards.

Corrects the compose header lineage block, the homepage dashboard description,
and the gateway alias comment. No functional change; the running seat and its
weights are unchanged (label refreshes on next container recreate).
---
 stacks/cyberprev-seat/compose.yaml | 13 +++++++++----
 stacks/litellm/conf/config.yaml    |  3 ++-
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/stacks/cyberprev-seat/compose.yaml b/stacks/cyberprev-seat/compose.yaml
index ed14b93..20cc845 100644
--- a/stacks/cyberprev-seat/compose.yaml
+++ b/stacks/cyberprev-seat/compose.yaml
@@ -3,9 +3,14 @@
 # The THIRD sec-seat candidate, and the one that displaced sentinel-r3 (operator instruction
 # 2026-09-14). Lineage of the three, because the distinction is the whole point of the A/B:
 #   mog-sec     — persona system prompt on STOCK Qwen3.8-27B weights
-#   sentinel-r3 — a REAL SFT pentest finetune (proprietary licence); RETIRED for this seat
-#   cyberprev   — an ABLITERATION of Qwen3.8-27B (refusal-direction weight edit, no finetune)
-#                 aimed at the cyber-offense refusal surface specifically
+#   sentinel-r3 — a REAL SFT pentest finetune of STOCK weights (proprietary licence); RETIRED
+#   cyberprev   — a cyber offensive-security agentic TOOL-CALLING LoRA finetune
+#                 (base_model_relation: finetune, merged @ scale 1.0), trained on
+#                 hotdogs/cyber-sft-agent-qwen38 (8,400 rows, 22 pentest tools) on top of
+#                 an ABLITERATED base (hotdogs/Qwen3.8-27B-abliterated). So: abliteration is
+#                 INHERITED from the base; the NEW capability here is the cyber SFT itself.
+#                 All three are Apache-2.0 except sentinel. cyberprev "will not refuse" per
+#                 its card and emits <tool_call> XML for nmap/sqlmap/metasploit/hydra/etc.
 #
 # Quantized in-house to the same mixed recipe as mog-sec / sentinel / gen:
 # NVFP4 W4A4 on MLP layers 0-55 + FP8 W8A8 on attn / linear_attn / lm_head / MLP 56-63,
@@ -132,7 +137,7 @@ services:
       - homepage.group=AI - Inference
       - homepage.name=CyberPreview (abliterated sec)
       - homepage.icon=mdi-shield-bug
-      - homepage.description=Qwen3.8-27B abliterated for cyber-offense refusals, sec-seat candidate (fv-ml1 GPU 0)
+      - homepage.description=Cyber offensive-security tool-calling SFT (LoRA) on abliterated Qwen3.8-27B, sec seat (fv-ml1 GPU 0)
       - homepage.href=http://10.251.50.54:${CYBER_PORT:-8025}/docs
 
 networks:
diff --git a/stacks/litellm/conf/config.yaml b/stacks/litellm/conf/config.yaml
index 51af742..eb8fae9 100644
--- a/stacks/litellm/conf/config.yaml
+++ b/stacks/litellm/conf/config.yaml
@@ -970,7 +970,8 @@ model_list:
       mode: chat
 
   # cyberprev-27b -> hotdogs/Qwen3.8-27B-abliterated-cyber-preview (:8025, fv-ml1 GPU0).
-  # In-house mixed NVFP4 quant, dflash k=7. Replaced the retired sentinel-r3 seat 2026-09-14.
+  # Cyber offensive-security tool-calling SFT (LoRA finetune on an abliterated base), in-house
+  # mixed NVFP4 quant, dflash k=7. Replaced the retired sentinel-r3 seat 2026-09-14.
   # Sampler mirrors sec/sec-reasoning so an A/B isolates weights, not sampling. The retired
   # sentinel-r3 aliases were DELETED, not repointed — cyberprev weights under sentinel's name
   # would be silent substitution.