feat: local QLoRA-fine-tuned Llama model for cheap first-pass anomaly/log triage

[atomicdragonranch]

Motivation

Today every monitoring cycle calls the Claude API. Add a small, locally-run open model fine-tuned with QLoRA to do a narrow, high-volume task (anomaly / severity pre-classification, or log-line triage) as a cheap first-pass filter, so the expensive Claude diagnostic agent is only invoked when the local model flags something worth investigating. Cuts API cost + latency and adds an offline-capable path. (Complements the cost work in #57.)

Scope

• Dataset: build a labeled set from the event simulator's 6 anomaly scenarios (latency-spike, throughput-drop, error-burst, backpressure, checkpoint-timeout, memory-pressure) + synthetic metric/log samples; can also mine the incident audit trail (data/audit/incidents.jsonl). Held-out split for eval.
• Train: QLoRA (PEFT + bitsandbytes, 4-bit) on a small open model (e.g. Llama 3.1 8B, or a 1-3B for cheap local inference). Train LoRA adapters only; keep the run reproducible (config + seed).
• Eval: precision / recall / confusion matrix on held-out scenarios; compare against a simple rules/threshold baseline so the model has to earn its place.
• Serve: run locally (Ollama / vLLM / HF transformers); expose as an MCP tool or a pre-filter step ahead of the monitor agent's Claude call.
• Guardrail: it is a filter, not a decision-maker. Anything it flags still goes to the Claude diagnostic agent, preserving the draft-only / human-in-the-loop contract. A miss must fail safe (escalate on uncertainty, not suppress).

Deliverables

• Training script + config + dataset builder (in mcp-server/ or a new finetune/ module).
• Eval report (metrics vs baseline) checked into docs/.
• Integration: the local model as a first-pass filter, behind a config flag (default off until eval clears a bar).

Cost

GPU time to train (Colab / RunPod / local GPU), one-off. Inference is local -> $0 and reduces Claude spend.