Nullsec-S1

Install / run options

1. build chat-formatted train/eval JSONL from the curated corpus

python training/prepare_dataset.py --include-ingested --out data/processed

2–5 minute quickstart

Use either the GitHub Release artifact for the full release bundle or the Hugging Face adapter for the PEFT / QLoRA adapter. Users still need the base model Qwen/Qwen2.5-Coder-7B-Instruct.

python -m pip install -e ".[dev]"
python -m pip install -r requirements-train-cu121.txt

NULLSEC_ADAPTER_PATH=outputs/nullsec-s1-qlora \
python inference.py --file examples/unsafe-next-admin-route.ts

The command prints the final Safety-Layer-enforced JSON verdict. It does not print source code by default. If the model emits malformed output, inference.py returns a JSON error object and exits non-zero.

Concrete example

Input:

export async function POST(req: Request) {
  const { userId, role } = await req.json();
  await db.user.update({ where: { id: userId }, data: { role } });
  return Response.json({ ok: true });
}

Representative output shape:

{
  "risk_score": 70,
  "production_ready": false,
  "severity": "HIGH",
  "confidence": "HIGH",
  "reasoning_summary": "Privileged admin mutation is reachable without an authenticated role check.",
  "findings": [
    {
      "category": "UNSAFE_ADMIN_ROUTE",
      "severity": "HIGH",
      "file": "examples/unsafe-next-admin-route.ts",
      "description": "Admin role update route has no session/role check.",
      "recommended_fix": "Require an authenticated admin session before mutating roles."
    }
  ],
  "_safety_layer": {
    "production_ready": false,
    "blocking_reasons": ["R2: dimension 'permissions' failed its check"],
    "adjustments": []
  }
}

This is illustrative, not a benchmark output.

Quickstart

Local CPU machines can verify the corpus, the deterministic layers, and the safety probes — no GPU required.

python3.11 -m venv .venv
source .venv/bin/activate
python -m pip install --upgrade pip setuptools wheel
python -m pip install -e ".[dev]"

python training/prepare_dataset.py --include-ingested --out data/processed
pytest -q
python training/validate_corpus.py --include-ingested
python training/release_threshold.py --include-ingested
python scripts/validate_claims.py --check

Inspect model identity and the reproducible fingerprint at any time:

python -m nullsec.core.version

---

Core system components

---

Training workflow

The training targets are built from the corpus through the same alignment + safety layers used at serving time, so no malformed or gate-inconsistent verdict ever enters training.

```bash

Benchmark workflow for reproduction / development

The benchmark suite measures detection accuracy, false-safe rate, hallucination rate, OWASP coverage, patch correctness (structural), and a secure-generation score. It reports numbers only from real runs. The RC2/v1.1 real-model report ships as a GitHub Release asset under v1.0.0-rc25; generated benchmark reports are not committed to source.

```bash

Release pipeline for reproduction / development

The release pipeline is how maintainers reproduce a release bundle from real local artifacts:

python scripts/release_candidate.py --adapter outputs/nullsec-s1-qlora --dataset detection.json
python scripts/validate_claims.py --adapter outputs/nullsec-s1-qlora \
    --report releases/nullsec-1.0/benchmark/SUITE.json --check

release_candidate.py aborts (writing nothing) if the adapter is missing, the model fails to load, no outputs are produced, any report section is empty, or any Safety Layer probe is bypassed. The published RC2/v1.1 artifact already passed this path; running it again is a reproducibility workflow. The full path is documented in RELEASE_TRAINING.md.

---

What is live now vs coming next

Live now:

• source repo
• GitHub Release artifact
• Hugging Face PEFT adapter
• inference.py
• benchmark suite
• baseline comparison scripts
• docs/EVALS.md

Coming next:

• hosted scanner at s1.trynullsec.com
• API backend
• GitHub Action / PR guard
• CLI hardening
• larger benchmark suite
• more framework coverage