feat: wire QVAC local scam-pattern inference

[salazarsebas]

Summary

Implements issue #2. QvacScamDetectionAdapter keeps the keyword pre-filter and adds an optional on-device QVAC completion pass.

• Heuristic hits stay at confidence 0.6 unless the model raises them. The model never lowers a heuristic hit.
• Longer pastes with no keyword hit still go to the model, so paraphrases are not missed.
• Empty or obviously-short clean text skips the LLM.
• Model failures and invalid JSON fall back to heuristics. Analyze does not crash.
• @qvac/sdk is pinned at 0.19.0. Classification model: Llama 3.2 1B Instruct Q4_0.
• createQvacCompletionClient lives on the @custos/adapters-qvac/runtime export so Vite/apps/web does not bundle the SDK (Node, Bare, or Expo only).
• Unit tests inject a fake completion client. CI does not download a model.
• docs/performance-log.md lists the model and sample prompt. Run numbers stay pending until the submission device executes createQvacCompletionClient.

ScamDetectionPort is unchanged. apps/web still constructs the adapter without a client (heuristics only) until the host runtime can load QVAC.

Test plan

• pnpm --filter @custos/adapters-qvac test (11 tests)
• pnpm run build / typecheck
• pnpm --filter @custos/web build (QVAC is not in the Vite graph)
• On QVAC hardware: createQvacCompletionClient(), paste a paraphrased pig-butchering chat, confirm a match above 0.6, fill the performance-log run row

Closes #2

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 6d04eddc-cb5b-42bb-9899-ebc1f75e8557

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}