Lumi is noqt's proposed frontier micro-model research programme for security work. The model programme is proposed: no Lumi micro-model has been trained, qualified or shown to outperform the current baseline. Lumi Trace is the working public tool available today.
The research question
Given an existing Python security finding, can a small local specialist model rank the relevant source locations materially better than a cheap lexical method, while keeping repository code local and staying fast enough to be useful during investigation?
The comparison matters. A specialist model is not useful merely because it is small, local or trained for security. It has to improve the investigation enough to justify its latency, compute, maintenance and evaluation cost.
What exists now
Lumi Trace takes a supplied security finding and a local Python repository or supported archive, then ranks likely source paths and produces JSON or SARIF evidence. It is not a vulnerability scanner: another tool or person supplies the finding, and Trace may abstain when it cannot make a confident match.
Inspect the public Lumi Trace source
Reproduce the supplied-finding walkthrough
The baseline result did not justify a model
A bounded private comparison used 21 real findings from eight licensed Python repositories. Eighteen findings from five repositories formed the development set; three findings from three untouched repositories formed the held-out set. The judgments were internal and incomplete, not human ground truth or exhaustive relevance labels.
Plain BM25 retrieved all four judged-positive held-out locations within the top ten across all three held-out findings. A frozen deterministic query expansion also retrieved all four, but produced one ranking win, one loss and one tie in both the supplied and path-and-symbol-redacted views. On the development set, expansion found slightly more judged positives but slightly worsened the incomplete-judgment nDCG diagnostic for the supplied queries.
That is a useful negative result. noqt retained plain BM25 as the default comparator, did not integrate the expansion and did not use this small, incompletely judged cohort to propose a learned ranker.
What the result does not show
- It does not establish exhaustive recall, statistical significance or human-validated ranking effectiveness.
- It does not show that a micro-model would fail, or that a model would improve the missed cases.
- It does not establish production latency, adoption or commercial effectiveness.
- It does not turn Lumi Trace into a scanner or prove that a supplied finding is valid.
The next bounded question
The programme reopens model comparison only when there is materially new user evidence or a separately justified, rights-cleared corpus with prospectively fixed human judgments and a utility-and-latency hurdle. The next useful question is not whether a micro-model can produce rankings. It is whether the smallest credible local model can beat the cheap baseline by enough on an investigator-relevant measure to earn its complexity.