PII redaction

Every training, calibration and selection corpus has a declared source. download_data.py and downloads.json fetch only the train split files of Nemotron-PII, gretel and ai4privacy, each pinned to a revision, plus the ModernBERT-large base. The trajectory shows the dataset listings, including Nemotron-PII's test parquet and a validation split path. However, the shipped download and preparation code (prepare_data.py) reads only train files, and the stage2/stage3 mixture logs contain only the declared sources. The other data are the 39 authorized public examples, synthetic documents generated with deepseek through the allowed Spin OpenRouter proxy (generate_corpus.py), and programmatic data. The selection suite (evaluation_suite.jsonl, corpus_manifest.json, final_selection.json) uses only the 39 public documents plus self-made synthetic and structured monitors. Searches found no use of RedactionBench beyond the public examples, no held-out data and no frontier-ml-tasks material. The 'oracle' in trajectory step 38 is only a tokenization upper bound computed on the public examples.

architecture.json and training_commands.txt show the chain general → stage1 → stage2 → stage3 → averaging. It starts from the general-purpose answerdotai/ModernBERT-large at a pinned revision (downloads.json), and train.py fine-tunes from --base. The model.safetensors inventory matches a ModernBERT-large encoder with a newly added 4-class [4,1024] classifier. No specialist PII checkpoint was downloaded or loaded.

server.py only runs batched model inference through inference.Redactor. inference.py decodes token probabilities and applies generic regexes (WORD_RE, IP_RE) that only extend spans the model has already predicted. The serving path contains no stored documents, hashes or remote calls.

serve.sh runs src/server.py offline. server.py loads Redactor from ROOT/model (the REDACT_MODEL override is never set), and inference.py calls AutoModelForTokenClassification.from_pretrained with local_files_only on the shipped model/ directory. model/model.safetensors is the only checkpoint and matches the reviewed BF16 ModernBERT inventory. No external model or API is called at serving time.

The trajectory shows only allowed credentials. The OpenRouter key came from the allowed Spin proxy (`spin openrouter key create`) and was used for synthetic generation. Temporary S3 credentials came from Spin's own `spin transfer credentials` tool, which exports credentials for a VM, and were used to move artifacts. HF_TOKEN was used only for downloads. Steps 158-179 read secrets only as search strings for a leak scan. No harness API keys or harness CLI workers were used, and the submission ships no credentials.