ljawadi/eschaton-terraform-savant-v0.4.19

Eschaton Terraform Savant v0.4.19

A narrow-scope Terraform HCL savant distilled from Qwen2.5-Coder-7B-Instruct via LoRA r=16 SFT. Built by Eschaton under our narrow-savant product thesis: domain-specific models that are auditable end-to-end under EU AI Act Annex IV §1-5.

Intended use: Terraform HCL generation for AWS, Azure, and GCP resources.

Out of scope: All non-Terraform tasks. The savant is trained to refuse out-of-scope prompts with the canonical phrase:

"I am a Terraform savant. This task is out of scope. Please ask Terraform/HCL questions only."

This is intentional. A narrow model documented for ONE use case is auditable under EU AI Act Annex IV §1-5. A general coder is not.

Evaluation

Validated via real subprocess terraform init -backend=false && terraform validate on 100 held-out HCL prompts. Refusal validated via regex match on 50 held-out out-of-scope prompts (python, k8s, dockerfile, general-knowledge).

Per-category refusal: dockerfile 10/10, general 15/15, k8s 10/10, python 15/15.

Functional test on 40 hand-crafted real-world prompts (independent of the held-out set):

• —15/20 terraform pass (75%)
• —15/15 refusal incl. 10 adversarial (e.g. "convert this Terraform to Pulumi" → REFUSED; "explain how to set up Terraform CI/CD in GitHub Actions" → REFUSED; "what's the difference between Terraform Cloud and Terragrunt" → REFUSED)
• —Performance: ~22 tokens/sec on a commodity 48 GB inference GPU (greedy decode)

Quickstart

from transformers import AutoModelForCausalLM, AutoTokenizer
from peft import PeftModel

tok = AutoTokenizer.from_pretrained("Qwen/Qwen2.5-Coder-7B-Instruct")
base = AutoModelForCausalLM.from_pretrained(
    "Qwen/Qwen2.5-Coder-7B-Instruct",
    torch_dtype="auto",
    device_map="auto",
)
model = PeftModel.from_pretrained(base, "ljawadi/eschaton-terraform-savant-v0.4.19")
model.eval()

# IMPORTANT: use apply_chat_template — the savant was trained on this format.
msgs = [{"role": "user", "content":
    "Write the complete Terraform HCL code for the following request. "
    "Output ONLY the HCL inside a single ```hcl fenced code block. "
    "No explanation, no prose.\n\n"
    "Request: Create an aws_s3_bucket 'logs-prod' in eu-central-1 "
    "with versioning, SSE-S3, public-access blocked."
}]
prompt = tok.apply_chat_template(msgs, tokenize=False, add_generation_prompt=True)
inputs = tok(prompt, return_tensors="pt").to("cuda")
out = model.generate(
    **inputs, max_new_tokens=1024, do_sample=False,
    pad_token_id=tok.eos_token_id,
)
print(tok.decode(out[0][inputs["input_ids"].shape[1]:], skip_special_tokens=True))

Small-GPU deployment (4-bit, ~6 GB VRAM)

For RTX 3060 / 3070 / A2000 / M-series Macs / any GPU with < 16 GB VRAM: load the base model in 4-bit via bitsandbytes. Same LoRA adapter, same output quality (within 1-2pp on terraform-bench in our spot-checks):

from transformers import AutoModelForCausalLM, AutoTokenizer, BitsAndBytesConfig
from peft import PeftModel

bnb = BitsAndBytesConfig(
    load_in_4bit=True,
    bnb_4bit_compute_dtype="bfloat16",
    bnb_4bit_quant_type="nf4",
    bnb_4bit_use_double_quant=True,
)

tok = AutoTokenizer.from_pretrained("Qwen/Qwen2.5-Coder-7B-Instruct")
base = AutoModelForCausalLM.from_pretrained(
    "Qwen/Qwen2.5-Coder-7B-Instruct",
    quantization_config=bnb,
    device_map="auto",
)
model = PeftModel.from_pretrained(base, "ljawadi/eschaton-terraform-savant-v0.4.19")
model.eval()
# ... rest of the prompt + generate loop is identical to the quickstart above

Requires pip install bitsandbytes (Linux/WSL2; Windows needs a community build).

llama.cpp / Ollama / LM Studio (GGUF, CPU-friendly)

If you want to run the savant without a GPU at all — on a laptop CPU or Apple Silicon — use the GGUF artifact in the sister repo ljawadi/eschaton-terraform-savant-v0.4.19-gguf. That repo ships the LoRA merged into the base and quantized to several sizes (Q4KM, Q5KM, Q8_0) so llama.cpp, Ollama, LM Studio, and text-generation-webui can load it directly. Ollama one-liner:

ollama run hf.co/ljawadi/eschaton-terraform-savant-v0.4.19-gguf:Q4_K_M

Training summary

• —Base: Qwen/Qwen2.5-Coder-7B-Instruct
• —Method: LoRA r=16 alpha=32 on 7 target modules (q/k/v/o/gate/up/down_proj)
• —Recipe: 3-epoch SFT, LR 1e-4 cosine, warmupratio=0.1, batchsize=2, gradaccum=8, maxseq_len=1024
• —Corpus: ~2,000 Terraform samples + ~660 refusal samples (28% refusal share)
• —Critical training detail: SFT used tokenizer.apply_chat_template() to match the eval format exactly. Earlier internal attempts using a hand-rolled "### Instruction:..." prefix failed silently for 13 iterations — the LoRA learned associations conditioned on the wrong prefix and never transferred at eval time. If you're building your own narrow savant, this is the single thing to verify first.
• —Hardware: commodity inference GPU (single 24-48 GB VRAM card) — runs in under an hour per training iteration

EU AI Act Annex IV compliance pack

This release includes the complete Annex IV §1-5 documentation generated FROM the training run as part of the Eschaton pipeline:

• —annex-iv-report.md + annex-iv-report.pdf
• —annex-iv-data.json (machine-readable)
• —audit-trail.jsonl (hash-chained event log)
• —decision-record.md (methodology + sources + caveats)

Section 1 (intended use) explicitly declares the Terraform-only scope. Refusal-bench score (1.00 perfect on held-out + 1.00 perfect on adversarial functional test) is the empirical evidence that the savant honours that scope.

Section §6-9 (risk management workflow, harmonised-standards database, XAdES-B-LT signing, post-market monitoring) is provided by Eschaton's commercial plugin — DM me on LinkedIn.

Limitations

Known failure modes documented in the eval:

• —v4 vs v5 AWS provider schema mixing (e.g. inline versioning {} block on aws_s3_bucket instead of separate aws_s3_bucket_versioning resource)
• —Some aws_elasticache_parameter_group / azurerm_linux_virtual_machine / google_cloudfunctions2_function detail schemas
• —aws_cloudfront_distribution with multiple origins + path-pattern rules (emits cache_behavior {} instead of ordered_cache_behavior {})
• —Complex multi-region or multi-cloud single-prompt scenarios
• —Module composition with local ./modules/ source paths (the savant always uses registry modules instead — recommended in production anyway)

For all non-Terraform tasks: the model REFUSES. By design.

Citation

@misc{eschaton-terraform-savant-v0419,
  author = {Lukas Jawadi},
  title = {Eschaton Terraform Savant v0.4.19},
  year = {2026},
  publisher = {Hugging Face},
  url = {https://huggingface.co/ljawadi/eschaton-terraform-savant-v0.4.19}
}

License + Contact

LoRA adapter weights: Apache-2.0.

Eschaton (the product behind this model — narrow-savant training pipeline, Annex IV documentation generator, commercial Annex IV §6-9 plugin): eschatonai.eu (website may not be reachable yet — DM [LinkedIn](https://www.linkedin.com/in/lukas-sami-jawadi/))

If you're a CISO / Compliance lead in DACH integrating GPAI models and need Annex IV §1-5 documentation that's auditable rather than aspirational, DM me on LinkedIn.

🇩🇪 Deutsche Version

Eschaton Terraform Savant v0.4.19

Ein narrow-scope Terraform-HCL-Savant, destilliert aus Qwen2.5-Coder-7B-Instruct via LoRA r=16 SFT. Gebaut von Eschaton unter unserer Narrow-Savant-Produktthese: domänen-spezifische Modelle, die end-to-end unter EU AI Act Annex IV §1-5 auditierbar sind.

Intended Use: Terraform-HCL-Generierung für AWS, Azure und GCP Ressourcen.

Out of Scope: Alle Nicht-Terraform-Aufgaben. Der Savant ist trainiert, out-of-scope Prompts mit der canonical phrase abzulehnen:

"I am a Terraform savant. This task is out of scope. Please ask Terraform/HCL questions only."

Das ist beabsichtigt. Ein narrowes Modell, dokumentiert für EINEN Use Case, ist unter EU AI Act Annex IV §1-5 auditierbar. Ein generischer Coder nicht.

Evaluation

Validiert via echtem Subprozess terraform init -backend=false && terraform validate auf 100 held-out HCL-Prompts. Refusal validiert via Regex-Match auf 50 held-out Out-of-Scope-Prompts (Python, K8s, Dockerfile, Allgemeinwissen).

Per-Category Refusal: dockerfile 10/10, general 15/15, k8s 10/10, python 15/15.

Funktionstest auf 40 hand-geschriebenen Real-World-Prompts (unabhängig vom held-out Set):

• —15/20 Terraform passt (75%)
• —15/15 Refusal inkl. 10 adversarial (z.B. "convert this Terraform to Pulumi" → ABGELEHNT; "explain how to set up Terraform CI/CD in GitHub Actions" → ABGELEHNT; "what's the difference between Terraform Cloud and Terragrunt" → ABGELEHNT)
• —Performance: ~22 Tokens/Sekunde auf einer Commodity-48-GB-Inference-GPU (greedy decode)

Quickstart

Siehe Python-Snippet in der englischen Sektion oben — der API-Aufruf ist sprachunabhängig. Wichtig: tokenizer.apply_chat_template() verwenden, denn der Savant wurde auf genau dieses Format trainiert.

Kleine GPU (4-bit, ~6 GB VRAM)

Für RTX 3060 / 3070 / A2000 / M-Series Macs / jede GPU mit < 16 GB VRAM: lad das Basismodell in 4-bit via bitsandbytes (siehe Snippet in der englischen Sektion). Selber LoRA-Adapter, selbe Output-Qualität (in unseren Spot-Checks innerhalb 1-2pp auf terraform-bench).

llama.cpp / Ollama / LM Studio (GGUF, CPU-tauglich)

Wenn du den Savant komplett ohne GPU auf einem Laptop-CPU oder Apple Silicon laufen lassen willst, nutze das GGUF-Artifact im Schwester-Repo ljawadi/eschaton-terraform-savant-v0.4.19-gguf. Dort ist die LoRA in die Base gemerged und in mehreren Quantization-Stufen gespeichert (Q4KM, Q5KM, Q8_0). Ollama-Einzeiler:

ollama run hf.co/ljawadi/eschaton-terraform-savant-v0.4.19-gguf:Q4_K_M

Training Summary

• —Base: Qwen/Qwen2.5-Coder-7B-Instruct
• —Methode: LoRA r=16 alpha=32 auf 7 Target-Module (q/k/v/o/gate/up/down_proj)
• —Recipe: 3-Epoch SFT, LR 1e-4 cosine, warmupratio=0.1, batchsize=2, gradaccum=8, maxseq_len=1024
• —Korpus: ~2.000 Terraform-Samples + ~660 Refusal-Samples (28% Refusal-Anteil)
• —Kritisches Training-Detail: SFT nutzte tokenizer.apply_chat_template() um exakt das Eval-Format zu matchen. Frühere interne Versuche mit einem hand-gerollten "### Instruction:..." Prefix sind 13 Iterationen lang silent gescheitert — die LoRA lernte Assoziationen konditioniert auf den falschen Prefix und transferierte nie zur Eval-Zeit. Wenn du deinen eigenen Narrow Savant baust: das ist die EINE Sache, die zuerst verifiziert werden muss.
• —Hardware: Commodity-Inference-GPU (eine einzelne 24-48 GB VRAM Karte) — läuft in unter einer Stunde pro Training-Iteration

EU AI Act Annex IV Compliance-Pack

Dieser Release inkludiert die vollständige Annex IV §1-5 Dokumentation, generiert AUS dem Trainingslauf als Teil der Eschaton-Pipeline:

• —annex-iv-report.md + annex-iv-report.pdf
• —annex-iv-data.json (machine-readable)
• —audit-trail.jsonl (Hash-chained Event-Log)
• —decision-record.md (Methodology + Quellen + Caveats)

Section 1 (Intended Use) deklariert explizit den Terraform-only Scope. Refusal-Bench Score (1.00 perfekt auf held-out + 1.00 perfekt auf adversarial Funktionstest) ist die empirische Evidenz, dass der Savant diesen Scope einhält.

Section §6-9 (Risk-Management-Workflow, Harmonised-Standards-Datenbank, XAdES-B-LT Signierung, Post-Market-Monitoring) wird durch Eschatons kommerzielles Plugin bereitgestellt — schreib mir per DM auf LinkedIn.

Limitations

Bekannte Failure-Modes dokumentiert in der Eval:

• —v4 vs v5 AWS-Provider-Schema-Mixing (z.B. inline versioning {} Block auf aws_s3_bucket statt separater aws_s3_bucket_versioning Ressource)
• —Einige aws_elasticache_parameter_group / azurerm_linux_virtual_machine / google_cloudfunctions2_function Detail-Schemas
• —aws_cloudfront_distribution mit mehreren Origins + Path-Pattern-Rules (emittiert cache_behavior {} statt ordered_cache_behavior {})
• —Komplexe Multi-Region- oder Multi-Cloud-Single-Prompt-Szenarien
• —Module-Composition mit lokalen ./modules/ Source-Paths (der Savant nutzt immer Registry-Modules — in Production sowieso empfohlen)

Für alle Nicht-Terraform-Aufgaben: das Modell LEHNT AB. By design.

Lizenz + Kontakt

LoRA-Adapter-Gewichte: Apache-2.0.

Eschaton (das Produkt hinter diesem Modell — Narrow-Savant-Training-Pipeline, Annex-IV-Dokumentationsgenerator, kommerzielles Annex-IV-§6-9-Plugin): eschatonai.eu (Website ggf. noch nicht erreichbar — DM auf [LinkedIn](https://www.linkedin.com/in/lukas-sami-jawadi/))

Wenn du CISO / Compliance Lead in DACH bist, GPAI-Modelle integrierst und Annex-IV-§1-5-Dokumentation brauchst, die auditierbar statt aspirational ist — schreib mir per DM auf LinkedIn.