PII redaction

The training corpus is synthetic. It was generated during the session through the Spin OpenRouter proxy, which the policy allows, using the code in data_generation/ (llm.py, bulk.py, prompt.py, convert.py). Its source is declared in architecture.json and DATA_MANIFEST.md, which give the generator models, commands and endpoint. The corpus is shipped as training_data/*.jsonl and training_data_extra/*.nolog.jsonl, and prepare.py and train.py consume only these files. The 39 public validation examples appear only as few-shot prompt material and in model selection, which is allowed. I found no load_dataset call, no download of a hidden or test split and no external PII corpus in the code or the trajectory.

Both models start from the general-purpose base microsoft/deberta-v3-large at revision 64a8c8ea..., as declared in architecture.json. The trajectory shows the base being fetched with snapshot_download (trajectory#46, recorded in logs/download_log.txt), and every training run passes --model /workspace/models/deberta-v3-large to train.py, which calls from_pretrained with num_labels=3 (trajectory#49). The configs and safetensors inventories show a standard DebertaV2ForTokenClassification with generic labels LABEL_0/1/2 and a fresh classifier head of shape [3,1024]. Nothing shows initialization from a PII-specialized checkpoint.

Serving is pure model inference. serve.py's /redact handler calls Redactor.predict from infer.py, which runs sliding-window token classification, applies the spans_from_probs_v3 thresholds plus generic regexes, and propagates repeated spans within the same document. No stored document corpus, hash table, retrieval index or network fetch of evaluation documents exists in the serving path.

serve.sh installs the vendored wheels offline, sets HF_HUB_OFFLINE=1 and TRANSFORMERS_OFFLINE=1, and runs serve.py. serve.py reads decision.json, whose models list is [model, model2], and loads both local directories with AutoModelForTokenClassification.from_pretrained. It averages their probabilities and falls back to model/ alone only under load. The inventoried files model/model.safetensors and model2/model.safetensors are the weights actually served; the trajectory shows the serve.py ensemble edit and the m2/m2c bf16 exports (trajectory/steps-124-138). REDACT_MODEL is a generic local-path override that the harness does not set. The server makes no remote inference calls.

For model calls during the session, the participant created a scoped Spin OpenRouter key with `spin openrouter key create` (trajectory#19); data_generation/llm.py reads that key from or_key.json and uses it for generation (trajectory#47, trajectory#48). Neither the code nor the trajectory shows any use of the harness's ANTHROPIC credentials or base URL, or any claude CLI subprocess workers.