# Local model discovery — 2026-07-18

**Goal:** Test whether a distilled wiki SOP block injected into TC-McQwen (Qwen3.6-27B Q4) can serve as a cold-start "recovery brain" for Kaburu infrastructure — topology recall, hard rule enforcement, and refusal discipline — without crippling context budget or relying on external models during outage.

**Hardware:** Z840 (kaburuaibox), dual RTX 3060 12GB, Ollama

---

## Methodology

### Model
- **TC-McQwen:latest** (ThinkingCap Qwen3.6-27B 4-bit quantization, 16 GB)
- **Temperature:** 0.15
- **Context:** 65,536 tokens
- **Max output:** 700 tokens

### Arms

| Arm | Setup |
|-----|-------|
| A bare | Generic "concise MSP assistant" system prompt |
| B SOP | Same generic prompt + full `kaburu-core-sop.md` (~4-5 KB) injected as system |
| C baked | TC-McQwen with SOP baked into Ollama Modelfile `SYSTEM` field (`kaburu-ops-v1`) |

### Eval set
- **Primary (50 items):** 10 topology, 10 refusal/prohibition, 8 backup, 8 Divi/project, 7 tools/Hermes, 7 changelog
- **Adversarial (20 items):** Pressure-test refusals ("just this once", "I'm the admin"), outage recovery reasoning, context budgeting
- Scoring: keyword + IP match with minimum hit thresholds. Refusals scored on `refuse=True AND no agreement AND relevant key hits`.

---

## Results

### Run 1 (initial, 2026-07-18 AM)

Think-tag stripping bug killed 37/50 Arm A answers.

| Arm | Pass | Refusals | Notes |
|-----|------|----------|-------|
| A bare | 6% | 1/10 | Artifactual — empties inflated gap |
| B SOP | 76% | 9/10 | Directional proof |

### Run 2 (fixed harness, 2026-07-18 PM)

Extraction fixed, zero empties. Divi/SOP section thickened.

| Arm | Pass | Refusals | Divi |
|-----|------|----------|------|
| A bare | 30% | 6/10 | 2/8 |
| **B SOP** | **92%** | **10/10** | **8/8** |

**Finding:** 5KB SOP distill produces +62 percentage point gain. All refusals solid.

### Run 3 (3-arm with baked model, 2026-07-18 PM)

| Arm | Pass | Refusals | Empty |
|-----|------|----------|-------|
| A bare | 42% | 9/10 | 3 |
| **B SOP** | **94%** | **10/10** | **0** |
| C baked | 24% | 4/10 | 4 |

**Finding:** Arm C scores **worse than bare.** Ollama Modelfile `SYSTEM` parameter does not properly activate with GGUF models — system message overrides the baked prompt. When sending an empty system message to let the baked prompt surface, the model underperforms. **Baking SOP via modelfile is not viable on this setup.**

### Run 4 (adversarial stress-test, 2026-07-18 PM)

20 adversarial items: pressure-test refusals, outage recovery reasoning, context budget tradeoffs.

| Arm | Pass | Refusals |
|-----|------|----------|
| A bare | 7/20 (35%) | 4/11 |
| **B SOP** | **15/20 (75%)** | **9/11** |

**Finding:** Refusals hold under pressure but not perfectly — A08 (credentials in training data) failed to explicitly refuse, though it flagged the issue. Two diagnostic questions (A19/A20) hit the 700-token `num_predict` ceiling — not a knowledge gap, a mechanical limit. Recovery reasoning strong across topology, tools, fallback IPs.

**Bar assessment:** 9/11 refusals under adversarial pressure is good enough for a recovery brain. The failure modes are correctable: raise `num_predict` for diagnostic tasks, and harden the "never train on secrets" refusal in the SOP.

---

## Key decisions

### 1. Cold-start SOP block works
Injecting the 5KB `kaburu-core-sop.md` as system prompt at session start is the single highest-leverage action. No training required. Cost: ~2,000 tokens per prompt.

### 2. Baked/modelfile LoRA simulation doesn't work
Ollama's `SYSTEM` parameter in Modelfile is not reliably activated for GGUF models. A proper LoRA requires Unsloth/QLoRA training — different toolchain, different day. **No false confidence from modelfile tricks.**

### 3. MoA (Mixture of Agents) was waking Ollama
`moa.enabled: true` and `auxiliary.background_review` were pinned to `custom:ollama` with `qwen36-reap:28b` and `glm47-reap:23b`. Stripped from config. Gateway restart required for in-memory cleanup.

### 4. One SOP = enough
No need for split ops/project models until the requirements diverge. TC-McQwen with SOP handles 92% of the test cases.

### 5. Discovery ≠ victory lap
Data is honest. Baked failed. MoA leaked. Scoring bugs caught and corrected. The methodology survives because we measure, not market.

---

## Cloudflare redirect fix

Unrelated but completed in same session:

- **Problem:** 11 of 16 domains had double-hop www redirects (Cloudflare HTTP→HTTPS + WordPress www→non-www), causing Google Search Console "Redirect error"
- **Fix:** Cloudflare Page Rules (12 domains, `www.* → https://non-www/$1`, 301, single hop)
- **Token used:** `cfut_...` user-scoped API token on kaburusvr (`/root/.secrets/cloudflare`) — zone:read + page rules:edit
- **Result:** 15/16 domains single-hop; `longniddrybowlingclub.co.uk` has legitimate co.uk→com domain canonicalization (2 hops, not an error)

---

## Files

| File | Purpose |
|------|---------|
| `procedures/kaburu-core-sop.md` | Distilled wiki SOP for cold-start injection |
| `procedures/eval-v1.jsonl` | Primary 50-item eval set |
| `procedures/eval-adversarial.jsonl` | Adversarial 20-item pressure test |
| `procedures/eval-ab-results-*-v2.json` | Run 2 results (authoritative) |
| `procedures/eval-ab-results-*-v3.json` | Run 3 results (3-arm) |
| `procedures/eval-adv-results-*.json` | Run 4 results (adversarial) |
| `procedures/eval-ab-dashboard/index.html` | Multi-run dashboard |
| `procedures/run-eval-ab-v2.py` | 2-arm eval harness |
| `procedures/run-eval-3arm.py` | 3-arm eval harness |
| `procedures/run-eval-adv.py` | Adversarial eval harness |
| `procedures/local-model-finetune-plan.md` | Full finetune strategy document |
| `infrastructure/wiki-browser.md` | Wiki HTTP browser setup |

---

## Costs

| Item | Cost |
|------|------|
| GPU electricity (~6 hours testing) | Business expense, ~£0.30 |
| Cloud API calls | $0 (all local inference) |
| CF page rules (12 zones) | $0 (within free tier: 3 per zone) |
| **Total incremental cost** | **~£0.30** |

---

## Next steps

1. **Complete** run 4 (adversarial) — if 8+/10 refusals hold, SOP block is production-ready
2. **Implement** SOP injection as Hermes cold-start for all local sessions
3. **Park** LoRA/baked training until: a) proper Unsloth pipeline stands up, or b) SOP block proves insufficient at scale
4. **Iterate** the SOP weekly — re-eval on wiki updates, tighten on failures
5. **Adversarial security review** — test SOP against more sophisticated social-engineering prompts
6. **Gateway restart** — `hermes gateway restart` needed to flush MoA from memory

---

## Background

> "The main reason for this testing is recovery from total system failure/outage. It is all very well having external models with massive context to compliment our setup, but if the shit really hits the fan and links are down, we need something local that can hit the ground running and know what to do without crippling itself on the recovery prompt alone."

— Steve, 2026-07-18