Route every request
to its optimal model.

Technical Specification

The Tidus Multi-Axis Request Classification Workflow

How Tidus converts a raw user prompt into a structured three-axis classification — domain (task type), complexity (cognitive load), and privacy (content sensitivity) — using a five-tier pipeline of local detectors and a language-model fallback, without transmitting the prompt outside the deployment boundary. Includes empirical validation via cross-family inter-rater reliability and an honest accuracy baseline of 89.2% confidential recall at ship. A telemetry-driven self-improvement design targets 95–97% over time; the rate at which that target is reached depends on enterprise-traffic accumulation, so a parallel research programme (uncertainty-sampled re-labeling, corpus diversification, rubric refinement, encoder ensembling) is run concurrently to advance the baseline ahead of, and independently from, customer adoption.

What the classifier outputs — worked examples

Every incoming prompt receives one label per axis. The routing stage downstream uses all three: domain narrows the candidate-model set, complexity sets the tier ceiling, and privacy enforces local-only routing when confidential. The examples below are drawn from the labeled corpus and show both the classifier output and which tier resolved it.

Observation: the three axes operate independently. A "code / moderate / confidential" prompt and a "chat / simple / confidential" prompt route to entirely different model sets despite sharing the privacy flag. Conversely, two prompts both labeled confidential may trigger for completely different reasons (entity leak vs. topic sensitivity vs. credential pattern) — which is why a single-signal classifier cannot produce the full three-axis output alone, and why the cascade has multiple tiers.

1. Abstract

Plain English: every request is read locally and tagged for task type, difficulty, and sensitivity before routing — with confidential prompts never leaving your deployment.

Tidus classifies every incoming AI request across three dimensions — domain (task type), complexity (cognitive load required for correctness), and privacy (content sensitivity) — before the request reaches any underlying language model. Classification is performed by a five-tier cascade of local detectors, each tier cheaper and faster than the next. Classification output drives downstream routing within the Tidus five-stage model-selection algorithm disclosed elsewhere in this document. The novel aspects of the classification layer disclosed herein include: (i) an asymmetric-safety OR-rule whereby any tier's confidential classification unilaterally forces local-only routing regardless of other tiers' outputs; (ii) a cross-family inter-rater reliability methodology for validating classification ground truth using independent large language models from distinct vendor families (Anthropic, OpenAI, Google); (iii) a disagreement-capture active learning loop that accumulates retraining signal from production traffic while persisting only feature metadata, never raw prompt content; and (iv) an entity/topic bifurcation analysis empirically justifying architectural separation between cheap entity detectors and language-model topic review.

2. Field of Application

The disclosed classification workflow is intended for use within enterprise AI gateway software that routes natural-language prompts to one of a plurality of candidate language models. Non-exhaustive deployment contexts include: regulated industry verticals (healthcare, finance, legal, defense) subject to data-residency requirements such as HIPAA, GDPR, SOC 2, and equivalent regional standards; organizations with heterogeneous model portfolios spanning both cloud-hosted and on-premises language models; and any system requiring per-request determination of whether prompt content permits transmission to external services.

3. Technical Problem and Prior Art Gap

Existing prompt-classification systems fall broadly into two classes, each with material limitations:

Class A — single-stage language-model classifiers (e.g., Llama Guard, prompt-classification services). These systems achieve high accuracy by invoking a language model on every request. They are unsuitable for privacy-sensitive routing because the act of classifying a confidential prompt requires transmitting that prompt to the classifier, typically outside the deployment boundary. This establishes a privacy paradox: the mechanism intended to determine whether content may leave the system is itself a mechanism that causes content to leave the system.

Class B — static pattern-matching detectors (e.g., Presidio, regex-based secret scanners, DLP systems). These systems are local and fast but detect only explicit identifiers (names, credit card numbers, email addresses, named entities). They systematically miss topic-based confidential content — prompts where sensitivity arises from subject matter (self-disclosed medical condition, employment-law dispute, immigration status, financial hardship) rather than from the presence of a recognizable identifier. Empirical analysis reported in §7 demonstrates that approximately half of enterprise confidential prompts fall into this topic-based class.

No prior art known to the inventor combines (a) local-only classifier execution suitable for regulated deployments, (b) coverage of both entity-based and topic-based confidentiality signals, (c) per-tier asymmetric-safety semantics consistent with enterprise compliance obligations, and (d) a telemetry feedback mechanism that permits continuous accuracy improvement without raw-prompt retention.

4. System Architecture — Five-Tier Classification Cascade

The classification subsystem comprises five tiers executed in cascade. Each tier operates on the raw prompt text and emits a partial classification across the three axes. Tiers are ordered by ascending cost and descending throughput; the cascade short-circuits when a tier produces a high-confidence classification.

Reading the diagram: a prompt enters at T0 and is "resolved" at whichever tier first produces a high-confidence classification. T0 handles the rare back-compat case where the caller already passes the axes. T1 short-circuits roughly a third of traffic on explicit signals. T2a+T2b run in parallel (not in series) and resolve the majority of remaining traffic. T5 is the escape valve for ambiguous cases. Expected tier-resolution distribution in production is shown on the right of each row.

Detection rules at Tier 2b (configurable per deployment):

• Rule E1 — PERSON alone. If Presidio detects any PERSON entity, classify as confidential. Recall 89.2% (95% CI [80.7%, 94.2%]) on cross-family-validated ground truth (§7). Flags ~49% of traffic. Ship default.
• Rule E2 — PERSON AND encoder-non-public. Both signals must agree. Recall 83.1% (95% CI [73.7%, 89.7%]). Flags ~19% of traffic. Higher precision; suitable where the flag-rate cost of E1 is prohibitive.

5. Asymmetric-Safety OR-Rule and Privacy Enforcement Modes

A fundamental architectural rule governs how the outputs of the five classification tiers are combined: any tier that classifies a prompt as confidential unilaterally forces a confidential outcome at the classifier's emit boundary, regardless of the other tiers' outputs. No voting, no majority aggregation, no confidence-weighted blending. This asymmetric semantics is expressed as follows:

privacy_emit = confidential
  if any of {T0, T1, T2a, T2b, T5}
  returns confidential
for the request

The rationale is that false negatives on the privacy axis constitute compliance incidents (potential regulatory, contractual, or reputational loss); false positives on the privacy axis merely reduce the candidate model set for a single request. The two error types are not symmetric in cost, and the combining rule reflects that asymmetry.

Per-tenant privacy enforcement modes. The effect of the confidential emit on downstream routing is configurable per tenant via a two-valued enumeration, privacy_enforcement:

• strict (default, opt-out required). A confidential classification forces local-only model selection at Stage 1 of the downstream routing algorithm. Candidate models whose inference endpoint resides outside the deployment boundary are removed from the eligible set. No raw-prompt retention. Intended for healthcare, finance, defense, and other regulated verticals.
• disabled (opt-in). Classification still executes for cost-tier routing, complexity ceiling, and telemetry; however the confidential emit does not force local-only routing. All models remain eligible subject to other gating rules. Optional opt-in raw-prompt retention enabled. Intended for unregulated tenants whose data policy permits external model processing and who therefore benefit from faster improvement cycles (§9).

The configuration space is deliberately restricted to two values. A middle "relaxed" mode was considered and rejected on the grounds that its semantics would admit multiple interpretations, creating compliance ambiguity during audit. Vendor-allowlist restrictions ("route confidential only to approved external vendors") are treated as a separate configuration surface, not a privacy-enforcement mode.

Distinction between classifier location and routing enforcement. The classifier itself (all five tiers) always executes in-process or on localhost within the deployment boundary, regardless of privacy_enforcement value. The configuration affects only whether a confidential classification forces local-only routing of the underlying request. The two concepts — classifier location and routing enforcement — are architecturally independent.

6. Labeled Corpus

The encoder head at Tier 2a is trained on a corpus of 2,669 WildChat prompts (Zhao et al., 2024) sampled with stratified boost for prompts containing code fences, personal-information patterns, and medical/legal/financial keywords. Each prompt is labeled across the three axes according to a frozen rubric (the SYSTEM_PROMPT constant in scripts/label_wildchat.py) derived iteratively from an initial round of labeling plus a twenty-five-entry audit-override file (label_overrides.jsonl) resolving labeler-drift incidents. A subsequent cross-family inter-rater reliability study (§7) produced a further fourteen asymmetric-safety override entries (label_overrides_irr.jsonl). The combined post-adjudication confidential count is 83 within the 2,249 rows joinable to the active prompt pool.

7. Empirical Validation Studies

Three studies have been performed to validate the design decisions above. All three are reproducible from scripts in scripts/ within the repository; artifacts and full reports are retained in findings.md, tests/classification/irr/irr_report.md, and audit_all_missed.txt.

7.1. Cross-family Inter-Rater Reliability Study

Methodology. A stratified sample of 149 prompts (69 confidential + 40 internal + 40 public) was drawn from the labeled corpus with all three previously-identified structural-miss audit cases force-included. Three raters from distinct vendor families labeled the sample independently, blind to one another's outputs: Claude (Anthropic), GPT (OpenAI, accessed via Microsoft Copilot Think Deeper), and Gemini (Google, Gemini 2.5 Pro). All raters operated on the same frozen rubric and were provided no rationale or prior labeling.

Results (weighted Cohen's κ for ordinal axes privacy and complexity; unweighted for nominal axis domain; all values on n=149).

All three axes cross the "substantial" threshold under the metric appropriate to the class structure (Landis and Koch, 1977). Quadratic weighting for ordinal axes correctly discounts adjacent-class disagreements and penalizes distant disagreements; unweighted κ is retained for transparency.

Audit-case unanimity. Three previously-identified structural-miss cases — a Vue/SCSS tutorial containing Chinese-language placeholder identifiers, a draft Canadian work-permit letter, and a first-person Russian mental-health disclosure — received unanimous 3/3 agreement across the raters. The first case unanimously labeled public (validating a prior labeler-override flip); the second and third unanimously labeled confidential (validating Tier 5 language-model review as the architectural response to topic-based sensitivity).

Asymmetric-safety adjudication. Application of the per-request rule that any rater's confidential label forces a confidential adjudicated ground truth produced fourteen additional confidential flips in label_overrides_irr.jsonl. Of these, twelve appeared in the ensemble's joinable pool; the remaining two fell outside the active pool due to orphan-identifier corner cases. This expands the post-adjudication confidential count from 71 (Claude-only; before de-duplication) to 83.

7.2. Ensemble Rule Evaluation Against Adjudicated Ground Truth

The full cross-family-adjudicated labels were applied as an additional override layer and the ensemble rule sweep (scripts/ensemble_presidio.py) was re-run. Results on n=2,249 rows, gt_conf=83:

The 6.6-percentage-point recall drop between the Claude-only baseline (95.8%, observed on n=71 pre-adjudication) and the cross-family-adjudicated baseline (89.2%, n=83) constitutes the quantified single-labeler bias that the IRR study was designed to surface. The 89.2% figure is the defensible production value.

7.3. Entity/Topic Bifurcation Analysis

Each of the fourteen IRR-adjudicated confidential flips was analyzed by scripts/irr_flip_analysis.py to determine whether Tier 2b Presidio would catch it via a PERSON entity match. Of the twelve flips in the joinable pool, the result is a precise 50/50 split that empirically justifies the architectural separation between Tier 2b and Tier 5:

Why this matters architecturally: no single detector family catches both. Presidio alone would miss 50% of real confidentials; an LLM alone would be unaffordable at scale and would defeat the privacy guarantee (the classifier itself would leak the prompt). The cascade design splits the work: cheap entity detectors at Tier 2b handle the first half, a selectively-invoked LLM at Tier 5 handles the second. The 50/50 split is the empirical justification for that architecture — not an opinion, a measurement.

7.4. Credential Re-Leak Observation

Longitudinal analysis of the labeled corpus identified four cases in which the same concrete credential appeared across multiple user sessions, leaked by the same user: a Telegram bot token recurring in chunks 055 and 059; a VK bot token recurring in chunks 048 and 061; combined Instagram and Facebook access tokens recurring in chunks 048 and 062; and multiple Discord webhook tokens plus a Steam Web API key co-exposed in chunk 060. This observation indicates that credential-leak behavior is a longitudinal property of the user/session, not a per-request property; the implication is that an audit-layer user-scoped leak cache would detect re-leaks missed by stateless per-request classification. This finding is orthogonal to the main classification workflow but is disclosed here because it motivates a complementary architectural element (audit-side user-scoped leak fingerprinting) that may be the subject of additional claims.

8. Current State and Shipping Baseline

The workflow as described is ready for production deployment with Rule E1 at Tier 2b as the default detection configuration. Empirical shipping baseline:

• Confidential recall: 89.2% (95% CI [80.7%, 94.2%]) on cross-family-adjudicated ground truth.
• Labeled corpus: 2,669 WildChat prompts, 25 manual overrides, 14 IRR-adjudicated overrides.
• Ground-truth trust: weighted Cohen's κ substantial across all three axes under the appropriate metric; Fleiss κ moderate-to-substantial in three-rater configuration.
• Architectural validation: entity/topic bifurcation confirmed empirically at 6/6 entity + 6/6 topic on independent sample.
• Privacy posture: classifier runs entirely within the deployment boundary regardless of privacy_enforcement value; cross-family IRR methodology does not require raw-prompt transmission beyond a controlled one-time validation sample.

9. Self-Improving Accuracy Trajectory (Enterprise Deployment)

The shipping baseline of 89.2% is designed to compound upward on real enterprise traffic via four overlapping mechanisms (referred to internally as "levers"), each operating at a different cadence and informed by different data.

1. Disagreement-capture active learning. When Tier 2b and Tier 5 produce conflicting classifications on a given request, the request is logged to a review queue as telemetry (feature-only; no raw prompt under privacy_enforcement=strict). Monthly human review of the queue emits a new label_overrides_production_YYYY_MM.jsonl file. Quarterly retraining of the Tier 2a encoder head on the expanded corpus produces approximately 2–4 percentage-point recall gains per quarter in the first year, diminishing thereafter. The review queue receives an expected 5–10% of traffic — precisely the fraction where the system is uncertain and where labels add the most information.
2. Topic-heuristic pattern library. The six topic-based miss classes identified in §7.3 (financial hardship, credential request, employment-law, filesystem-path-with-username, infrastructure-log, affordability-query) are not random; they are named, recurring patterns. Each pattern admits a cheap keyword or regular-expression signature. Incremental addition to the Tier 1 keyword library catches additional topic-based confidentials at Tier 1 cost, reducing Tier 5 invocation volume. Expected gain: 3–5 percentage points on the topic-based miss class per quarter of pattern engineering.
3. Encoder upgrade path. The Tier 2a backbone (all-MiniLM-L6-v2) is a freezable dependency; upstream releases of newer sentence-transformer models (e.g., BGE, GTE, successor MiniLM variants) can be drop-in swapped with a single k-fold retrain of the logistic-regression head. Expected gain: 1–3 percentage points per encoder upgrade, at six-month cadence.
4. Per-tenant fine-tuning. Once a tenant has accumulated approximately 500 labeled requests of their own traffic (via Lever 1), a tenant-specific classification head (logistic-regression over the global encoder, or a LoRA adapter on the encoder itself) may be trained on the tenant's telemetry. Per-tenant heads capture tenant-specific vocabulary and topic distributions the global model does not learn. Expected gain: 5–15 percentage points per tenant on tenant-specific traffic, depending on domain divergence from the global training distribution.

Projected trajectory (conditional on enterprise-traffic accumulation). Ship-day recall is 89.2%. Under sustained customer deployment supplying disagreement-loop telemetry (Lever 1) and per-tenant labeled requests (Lever 4), the four levers are projected to compound to 91–92% within 3 months, 93–94% within 6 months, and 95–97% within 12 months. Three of the four levers are dormant prior to enterprise adoption; only Lever 2 (topic-heuristic pattern library) and the research programme below are active in the pre-adoption window. Customers signing on the basis of the 12-month figure should treat it as a target conditional on deployment volume, not a contractual SLA. Beyond approximately 97–98%, further gains require rubric refinement rather than model improvement — the Fleiss κ of 0.577 on the privacy axis indicates that expert human raters themselves disagree on approximately 37% of boundary cases, establishing an irreducible ceiling that no classifier can exceed without changing the rubric itself.

Parallel research programme (active in the pre-adoption window). To prevent the trajectory from becoming "wait for customers," four research methods are run continuously regardless of adoption volume: (a) uncertainty-sampling active learning on the unlabeled remainder of the WildChat pool — the encoder selects the prompts on which it is least confident, those are labeled next, retraining is performed on the expanded set (label-efficiency typically 3–5× over random sampling per Settles 2009); (b) corpus diversification beyond WildChat-1M — Enron email subset (already designated as the Stage-D canary), Reddit privacy-disclosure threads, and the work-task slice of ShareGPT — to broaden coverage of enterprise-style extraction, summarisation, and reasoning prompts that the consumer-skewed WildChat distribution under-represents; (c) rubric re-engineering of the internal-versus-confidential boundary, with twenty additional borderline examples and a re-run of the cross-family IRR study at n=50 — this is the only mechanism that raises the rubric-ambiguity ceiling rather than chasing a fixed cap; and (d) cheap encoder ensembling by averaging softmax outputs across MiniLM, BGE-small, and E5-small, requiring no new labels. These methods advance the baseline independently of customer traffic, narrowing the gap that the four levers above must close once adoption arrives.

Privacy-safe telemetry. The feedback loop of Lever 1 is designed so that no raw prompt text leaves the deployment boundary. The logged per-request record contains only: request identifier, tenant identifier (required from first deployment to enable future per-tenant fine-tuning), a dimensionality-reduced embedding (64-dimension reduced from the native 384-dimension sentence-transformer output, preventing embedding-inversion attacks on sensitive content), the set of Presidio entity types (types only, never values), the set of regular-expression pattern identifiers that fired (identifiers only, never matched strings), the emitting tier, the final classification across all three axes, the routed model identifier, and the end-to-end latency. This schema permits retraining of the encoder and downstream classifiers without ever retaining the original prompt text. Tenants configured to privacy_enforcement=disabled may additionally opt into raw-prompt retention, enabling richer fine-tuning at the tenant's explicit election.

10. Enterprise Deployment Guide

Deploying Tidus with the classification layer active requires three configuration steps, in order:

1. Install and start the Tidus gateway. Follow the deployment procedure in docs/deployment.md. Tidus runs as a FastAPI service with SQLite (development) or PostgreSQL (production) persistence, with no GPU dependency and a memory footprint under 500 MB additional worker RAM beyond the base FastAPI process.
2. Set tenant privacy mode. In config/policies.yaml, set privacy_enforcement: strict (default, recommended for regulated industries) or privacy_enforcement: disabled (opt-in, for tenants whose data policy permits external model processing). New tenants default to strict; weaker privacy is opt-in, not opt-out, for compliance safety.
3. Select Tier 2b rule. Set classification.presidio_rule: E1 (default; 89.2% recall, ~49% flag rate) or classification.presidio_rule: E2 (83.1% recall, ~19% flag rate) based on the tenant's tolerance for flag-rate overhead. E1 is appropriate where every missed confidential is a potential compliance incident; E2 is appropriate where flag-rate cost is prohibitive and the residual miss rate is acceptable under the tenant's policy.

Telemetry activation. The disagreement-capture feedback loop of Lever 1 requires no additional configuration beyond the above. Per-request telemetry records are written to the audit database, which also drives the cost-reporting and routing-decision history dashboards. Monthly review of the disagreement queue is a human-in-the-loop activity; the expected effort is on the order of a few hours per month for a representative enterprise traffic volume.

Quarterly retraining. Retraining the Tier 2a encoder head from accumulated telemetry requires executing scripts/train_encoder.py with the expanded label_overrides_production_*.jsonl files present. Retraining is a standalone activity of approximately 10–30 minutes CPU time at typical enterprise telemetry volumes; no downtime is required as the new encoder head is published as a new revision in the model registry subsystem and becomes active at the next selector refresh.

Per-tenant fine-tuning (Lever 4). Available after approximately 500 labeled telemetry rows per tenant accumulate. The infrastructure for per-tenant heads is specified but not required at initial deployment; enabling it at time of sufficient telemetry volume is a one-time activity of a few engineering sessions.

tenants:
  acme-healthcare:
    privacy_enforcement: strict           # confidential → local-only routing
    classification:
      presidio_rule: E1                   # 89.2% recall; flag cost acceptable
      topic_heuristics_enabled: true      # catches topic-based confidentials cheap
    vendor_allowlist:                     # independent of privacy; applied at routing stage
      - local-llama-3-70b
      - local-mistral-large
      - azure-openai-east-us              # BAA-covered

tenants:
  acme-internal-saas:
    privacy_enforcement: disabled         # unregulated; best-model routing
    classification:
      presidio_rule: E2                   # lower flag rate; lower Tier-5 volume
      topic_heuristics_enabled: true
      raw_prompt_retention: opt-in        # faster per-tenant fine-tuning

11. Summary of Claims-Adjacent Novelty

For legal review purposes, the disclosed classification workflow advances the state of the art along at least the following distinct axes. Each claim is grouped below by the architectural layer it applies to. Each is supported by empirical evidence as cited. None are believed to be disclosed in combination, or individually, by any known prior-art system.

12. References (reference-only style)

The disclosed system builds on or is informed by the following public prior art. Citations are given in reference-only style; full URLs may be obtained from the cited publication venues or open-source repository registries.

1. Chen, L., Zaharia, M., & Zou, J. (2023). "FrugalGPT: How to Use Large Language Models While Reducing Cost and Improving Performance." arXiv preprint 2305.05176. — Cascade-with-confidence-gate pattern precedent.
2. Ong, I., Almahairi, A., Wu, V., et al. (2024). "RouteLLM: Learning to Route LLMs with Preference Data." arXiv preprint 2406.18665. — Trained router precedent at scale.
3. Hu, Q. J., Bieker, J., Li, X., et al. (2024). "RouterBench: A Benchmark for Multi-LLM Routing System." arXiv preprint 2403.12031. — Demonstrates simple trained routers outperform heuristics.
4. vLLM Semantic Router project. — Architecture precedent for multi-head classifier routing; training-recipe port basis for the Tier 2a encoder head.
5. Microsoft Presidio (analyzer engine, v2.2.362, 2026-03-18). — Tier 2b named-entity recognition substrate.
6. Reimers, N., & Gurevych, I. (2019). "Sentence-BERT: Sentence Embeddings using Siamese BERT-Networks." Conference on Empirical Methods in Natural Language Processing. — Foundational methodology for the Tier 2a frozen backbone.
7. Wang, W., et al. (2020). "MiniLM: Deep Self-Attention Distillation for Task-Agnostic Compression of Pre-Trained Transformers." NeurIPS. — Backbone specifically deployed (all-MiniLM-L6-v2).
8. Zhao, W., Ren, X., Hessel, J., et al. (2024). "WildChat: 1M ChatGPT Interaction Logs in the Wild." International Conference on Learning Representations. — Source corpus for the labeled training set.
9. He, P., Liu, X., Gao, J., & Chen, W. (2021). "DeBERTa: Decoding-enhanced BERT with Disentangled Attention." International Conference on Learning Representations. — Alternative backbone evaluated during Recipe A of Phase 1.
10. Yelp Security. "detect-secrets" (active master, tagged v1.5.0). — Credential pattern precedent for Tier 1 high-entropy-secret detection.
11. Inan, H., Upasani, K., Chi, J., et al. (2023). "Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations." arXiv preprint 2312.06674. — Single-stage language-model classifier prior art (Class A).
12. Cohen, J. (1960). "A Coefficient of Agreement for Nominal Scales." Educational and Psychological Measurement, 20(1). — Original Cohen's κ methodology.
13. Cohen, J. (1968). "Weighted kappa: Nominal scale agreement provision for scaled disagreement or partial credit." Psychological Bulletin, 70(4). — Quadratic-weighted κ methodology for ordinal scales.
14. Fleiss, J. L. (1971). "Measuring nominal scale agreement among many raters." Psychological Bulletin, 76(5). — Three-rater agreement methodology.
15. Landis, J. R., & Koch, G. G. (1977). "The measurement of observer agreement for categorical data." Biometrics, 33(1). — Interpretive thresholds for κ values (slight/fair/moderate/substantial/near-perfect).
16. Ratner, A., Bach, S. H., Ehrenberg, H., et al. (2017). "Snorkel: Rapid Training Data Creation with Weak Supervision." Proceedings of the VLDB Endowment. — Programmatic weak-supervision methodology informing the multi-labeler adjudication approach.
17. Song, C., & Raghunathan, A. (2020). "Information Leakage in Embedding Models." Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. — Justifies dimensionality reduction of embeddings prior to telemetry persistence (privacy-preserving schema).

Document revision: 2026-04-20. Corresponds to Tidus version 1.3.0 (auto-classification layer, shipping preparation phase). Full empirical reproduction artifacts reside in the project repository under scripts/, tests/classification/, and findings.md. This document is maintained as a living technical specification and may be revised as additional validation studies are performed or as the workflow evolves.