pi-smart-router 1.0.0 → 1.2.0

package/.pi/extensions/smart-router/command-formatters.ts

@@ -184,11 +184,12 @@ export function parseSmartRouterArgs(args: string): ParsedSmartRouterCommand {
   }
 
   if (tokens[0] === 'export' && tokens[1] === 'telemetry-contrib') {
-    const { limit } = parseExportTelemetryContribArgs(tokens.join(' '));
+    const { limit, includeEmbeddings } = parseExportTelemetryContribArgs(tokens.join(' '));
     return {
       command: 'export',
       subcommand: 'telemetry-contrib',
       limit: Math.min(limit, DEFAULT_TELEMETRY_CONTRIB_EXPORT_LIMIT),
+      includeEmbeddings,
     };
   }
 

package/.pi/extensions/smart-router/commands.ts

@@ -21,7 +21,7 @@ import { FLEET_MODE_ENTRY_TYPE } from './session-lifecycle.js';
 import type { SmartRouterRuntime } from './types.js';
 
 export const SMART_ROUTER_USAGE =
-  '/smart-router [status] | history [limit] | stats [limit] | mode scoped|all | pricing refresh | export dataset [--limit N] | export telemetry-contrib [--limit N] | feedback good|bad | unpin | plan [--json] | doctor';
+  '/smart-router [status] | history [limit] | stats [limit] | mode scoped|all | pricing refresh | export dataset [--limit N] | export telemetry-contrib [--limit N] [--embeddings] | feedback good|bad | unpin | plan [--json] | doctor';
 
 type CompletionItem = { value: string; label: string };
 
@@ -237,6 +237,7 @@ export function registerSmartRouterCommand(
             store: runtime.store,
             cwd: ctx.cwd,
             limit: parsed.limit,
+            includeEmbeddings: parsed.includeEmbeddings,
           });
           if (!result.path) {
             ctx.ui.notify(

package/.pi/extensions/smart-router/types.ts

@@ -39,7 +39,13 @@ export type SmartRouterCommand =
   | { command: 'mode'; mode: FleetMode }
   | { command: 'pricing'; subcommand: 'refresh' }
   | { command: 'export'; subcommand: 'dataset'; limit: number }
-  | { command: 'export'; subcommand: 'telemetry-contrib'; limit: number }
+  | {
+      command: 'export';
+      subcommand: 'telemetry-contrib';
+      limit: number;
+      /** Include captured 384-dim embeddings in contrib rows (SP-285, #170). */
+      includeEmbeddings?: boolean;
+    }
   | { command: 'feedback'; rating: 'good' | 'bad' }
   | { command: 'unpin' };
 

package/README.md

@@ -225,7 +225,7 @@ Cursor models bill against your **Cursor Pro subscription quota**, not per-token
 | `/smart-router mode all` | Route among **all authenticated models** in the registry |
 | `/smart-router pricing refresh` | Manually fetch LiteLLM pricing from `LITELLM_PRICING_URL`, persist to SQLite, and rebuild the fleet with updated rates |
 | `/smart-router export dataset [--limit N]` | Export opt-in routing dataset as JSONL (requires `SMART_ROUTER_DATASET=1`) |
-| `/smart-router export telemetry-contrib [--limit N]` | Export privacy-safe community telemetry JSON for calibration contributions |
+| `/smart-router export telemetry-contrib [--limit N] [--embeddings]` | Export privacy-safe community telemetry JSON for calibration contributions (`--embeddings` opts in to captured 384-dim embedding rows) |
 | `/smart-router feedback good\|bad` | Label the last auto-routed request outcome (requires `SMART_ROUTER_DATASET=1`) |
 | `/smart-router unpin` | Clear the current session pin (in-memory and SQLite) so the next request runs the full routing pipeline |
 | `/smart-router plan [--json]` | **Read-only** local placement report: encoder resident status, local model warm/cold, RAM/disk constraints, cold vs warm TPS, and bottleneck guess. `--json` prints the schema-stable report for automation |
@@ -440,6 +440,7 @@ Cluster IDs are stable reason-code prefixes (`cluster_low_stakes_general`, `clus
 | `SMART_ROUTER_LOG_ROUTING` | (unset) | Set to `1` to log each routing decision to stderr as JSON (debugging dogfood sessions). Canonical payload builder (`buildRoutingDecisionLogPayload`) includes top-level `stage`, `reason_code`, `low_intensity_score`, `tier_hint`, `local_eligible_reason`, and `cluster_id` (plus nested `cluster_summary` / `features`). The pi extension’s live stderr logger is still a slim subset — see [LOG_ROUTING field checklist](#log_routing-field-checklist) |
 | `SMART_ROUTER_DATASET` | (unset) | Set to `1` to opt in to privacy-safe routing dataset capture (metadata and feature fields only; 30-day / 10k-row retention). Prompt text, messages, and tool arguments are never stored. Required for outcome labels and P(success) training export. See [#8](https://github.com/beettlle/pi-smart-router/issues/8). |
 | `SMART_ROUTER_DATASET_FINGERPRINT` | (unset) | Set to `1` (requires `SMART_ROUTER_DATASET=1`) to store an install-local HMAC-SHA256 fingerprint of each normalized prompt for duplicate detection within this install. The install pepper lives in `.pi-smart-router/.dataset-key` (gitignored) and is never exported. **Warning:** short or common prompts are vulnerable to offline rainbow-table guessing; use only when you accept that tradeoff. See [#10](https://github.com/beettlle/pi-smart-router/issues/10). |
+| `SMART_ROUTER_DATASET_EMBEDDINGS` | (unset) | Set to `1` (requires `SMART_ROUTER_DATASET=1`) to capture the raw 384-dim HyDRA encoder embedding on each dataset row (derived dense vector of the metadata-prefixed routing input — never prompt text). Embeddings stay local until you additionally export with `--embeddings`; they exist so the hydra_projection ≥100-row training floor can ever be met. See [#170](https://github.com/beettlle/pi-smart-router/issues/170). |
 | `MODELS_YAML_PATH` | `./config/models.yaml` | Fleet catalog path (library API only) |
 | `SMART_ROUTER_PLANNING_TURN_BUFFER` | `2` | SAAR planning buffer: frontier planning turns allowed before hard-lock ([v0.2.0 Continuity](https://github.com/beettlle/pi-smart-router/issues/72)) |
 | `SMART_ROUTER_PLANNING_DELEGATE_ENABLED` | `true` | Enable cache-preserving planning delegate ([#71](https://github.com/beettlle/pi-smart-router/issues/71)) |
@@ -720,9 +721,13 @@ Optional `feedback_good` / `feedback_bad` only refine labels when the operator c
 
 **Sample floor:** collect at least **≥30** labeled **economical-tier** rows (`minimum_training_samples.p_success_weights` / `isotonic_calibrator` in [`config/routing-calibration.json.example`](config/routing-calibration.json.example)) before relying on non-neutral `P(success)` or isotonic. Below that floor the classifier returns neutral `P_success_cheap = 0.5`.
 
-**Provenance today (honest defaults, v1.0.0):** checked-in `config/p-success-weights.json` and `config/routing-calibration.json` ship **neutralized** (`trained_sample_count: 0` for P(success), isotonic, and triage; HyDRA remains 0/≥100). Serve-time routing uses **structural tier hints** and `P_success_cheap = 0.5` until a verifier-graded retrain clears hard ECE gates (`holdout_ece_calibrated ≤ holdout_ece_raw`, absolute ECE ≤ 0.10, non-degenerate `y_knots`). Scripted `scripts/qa/dogfood-gather.sh` labels are **quarantined** (`scripted_intent`) and must not feed ship trains. Bootstrap routing centroids remain in the bundle. TwinRouterBench CI corpus soft-fail (`mean_over_routing_rate ≈ 0.87` vs 0.15) is a **harness adapter artifact** ([#112](https://github.com/beettlle/pi-smart-router/issues/112) / [`over-routing-analysis.md`](spine-tasks/_authoring/release-v0.11.0/over-routing-analysis.md)), not a live-pipeline measurement — absolute release gates stay fixture-backed; frugality stays. [#95](https://github.com/beettlle/pi-smart-router/issues/95) / [#110](https://github.com/beettlle/pi-smart-router/issues/110) stay open for human dogfood + verifier-graded recalibration.
+**Label provenance (SP-281 / [#168](https://github.com/beettlle/pi-smart-router/issues/168)):** every labeled export/contrib row may carry `label_provenance` — `human_feedback` (human-rated dogfood turn, [#95](https://github.com/beettlle/pi-smart-router/issues/95)), `llm_judge` (adversarial harness graders, [#169](https://github.com/beettlle/pi-smart-router/issues/169)), or `scripted_intent` (scripted pack intent / exit heuristics). **Ship-claim sample floors count only `human_feedback` | `llm_judge` rows** — `scripted_intent` and untagged (legacy) rows never count toward ship floors, and trainers skip `scripted_intent` rows entirely. `scripts/qa/dogfood-gather.sh` auto-tags all of its export output `scripted_intent`; `routing:calibration-aggregate` prints the provenance breakdown, rejects unknown grades, and `--ship-grade-only` emits just the verifier-grade rows for ship trains. Provenance is never invented — absent stays absent (untagged).
 
-**SP-206 / hybrid interim:** July dogfood and a Sept hybrid were explored during the 1.0 train; Sept isotonic collapsed (same-x PAV overwrite) and scripted gather labels failed #110 honesty. Code now pools same-x scores and skips null labels; shipped artifacts stay honest-untrained until post-1.0 verifier-graded trains land.
+**Provenance today (v1.1.0 trained ship):** checked-in `config/p-success-weights.json` and `config/routing-calibration.json` ship `provenance.source: verifier_grade_train_2026-09-12` with `trained_sample_count: 243` for P(success)/isotonic, triage threshold **5** (57 samples, serve-active via #171 loader), HyDRA still 0/≥100. Serve-time routing uses trained expected-cost tier hints (no longer neutral `P=0.5`). Scripted `scripts/qa/dogfood-gather.sh` labels stay **quarantined** (`scripted_intent`) and must not feed ship trains. TwinRouterBench CI corpus soft-fail remains a **harness adapter artifact** ([#112](https://github.com/beettlle/pi-smart-router/issues/112)). [#95](https://github.com/beettlle/pi-smart-router/issues/95) / [#110](https://github.com/beettlle/pi-smart-router/issues/110) stay open for human dogfood volume and HyDRA embeddings.
+
+**v1.1.0 update:** Sep 12 hard gates **PASSED** (ECE cal 0.0645) on 147 `human_feedback` + 96 live `llm_judge` packs — decision record [`hard-gate-pass-2026-09-12.md`](spine-tasks/_authoring/release-v1.1.0/hard-gate-pass-2026-09-12.md) and [migration guide](docs/migration-v1.md#behavioral-calibration-artifacts-110--168). Session-holdout ECE is implemented but not yet ship-cleared ([`session-holdout-retrain-2026-09-12.md`](spine-tasks/_authoring/release-v1.1.0/session-holdout-retrain-2026-09-12.md)). Issue bookkeeping: [`operator-notes-issues.md`](spine-tasks/_authoring/release-v1.1.0/operator-notes-issues.md) — no encoder/frugality default flips; `modernbert_k4` (#96) stays deferred.
+
+**SP-206 / hybrid interim:** July dogfood and a Sept hybrid were explored during the 1.0 train; Sept isotonic collapsed (same-x PAV overwrite) and scripted gather labels failed #110 honesty. Code now pools same-x scores and skips null labels; v1.1 ships verifier-graded weights after the Sep 12 PASS.
 
 **Zero-manual-label path (aggregate → train → verify):**
 
@@ -735,6 +740,7 @@ SMART_ROUTER_DATASET=1
 
 # 2) Aggregate privacy-safe contrib / exports (reject tainted payloads)
 npm run routing:calibration-aggregate -- --contrib-dir data/contrib
+#    Verifier-grade trains: add --ship-grade-only (human_feedback | llm_judge rows only)
 
 # 3) Train when ≥30 economical-tier labeled rows exist
 npm run routing:train-p-success -- --input path/to/export.jsonl --output config/p-success-weights.json
@@ -771,7 +777,7 @@ npm run routing:train-calibration -- --input path/to/aggregated.jsonl
 
 Reload is file-based: replace `config/p-success-weights.json` (and optionally `config/routing-calibration.json` for isotonic) and restart the host agent — no prompt text is ever written into training artifacts.
 
-**Isotonic calibration (shipped since v1.0.0):** serve-time isotonic calibration loads from `config/routing-calibration.json` (`isotonic_calibrator`). The checked-in bundle ships an **honest-untrained** calibrator (`trained_sample_count: 0` — identity knots), so serve-time `p_success_calibrated` / `p_success_cheap` stay at neutral `0.5` with structural tier hints until a verifier-graded retrain clears hard ECE gates (calibrated ECE ≤ raw, absolute ECE ≤ 0.10, non-degenerate `y_knots`). Operators who retrain should pass `--calibration-output` or run `routing:train-calibration` with ≥30 labeled samples (not `dogfood-gather.sh` scripted_intent). Explain and telemetry still expose `p_success_raw` vs `p_success_calibrated` / `p_success_cheap`.
+**Isotonic calibration (shipped trained since v1.1.0):** serve-time isotonic calibration loads from `config/routing-calibration.json` (`isotonic_calibrator`). The checked-in bundle ships a **trained** calibrator (`trained_sample_count: 243`, provenance `verifier_grade_train_2026-09-12`). Below the ≥30 floor or when the bundle is missing, serve-time falls back to identity / neutral `0.5`. Operators who retrain should run `routing:train-calibration` with verifier-grade labels only (not `dogfood-gather.sh` scripted_intent) and `--require-hard-gates`. Explain and telemetry still expose `p_success_raw` vs `p_success_calibrated` / `p_success_cheap`.
 
 Library helpers (see `src/domain/routing/p-success-classifier.ts`):
 
@@ -785,13 +791,19 @@ Library helpers (see `src/domain/routing/p-success-classifier.ts`):
 When `SMART_ROUTER_DATASET=1`, you can export privacy-safe scalar routing features (plus outcome labels) for community calibration training. The export never includes prompt text, messages, raw session identifiers, or install-local pepper fields.
 
 ```bash
-/smart-router export telemetry-contrib [--limit N]
+/smart-router export telemetry-contrib [--limit N] [--embeddings]
 # or from shell (cwd must contain .pi-smart-router/state.db):
-npx pi-smart-router export telemetry-contrib [--limit N]
+npx pi-smart-router export telemetry-contrib [--limit N] [--embeddings]
 ```
 
 This writes schema-valid JSON to `.pi-smart-router/exports/telemetry-contrib-<timestamp>.json`. Each row conforms to [`telemetry-contrib.schema.json`](specs/001-build-smart-router/contracts/telemetry-contrib.schema.json).
 
+**Feature-complete rows (v1.1.0, [#170](https://github.com/beettlle/pi-smart-router/issues/170)).** Contrib rows now carry additive optional fields within format v2:
+
+- `row_id` — stable per-install HMAC-SHA256 of `request_id` (domain-separated `row:` prefix; raw request ids are never exported). Aggregation dedupes overlapping exports by `row_id`, and training splits stay reproducible as files are added or removed.
+- `prompt_length_chars` / `message_count` — count-only envelope fields that feed the P(success) prompt-length feature and edit-distance proxies (previously dropped on this path, starving the feature to zero).
+- `embedding` — **double opt-in**: captured only when `SMART_ROUTER_DATASET_EMBEDDINGS=1` was set at routing time, and exported only when you pass `--embeddings`. This is the raw 384-dim encoder vector HyDRA projection training needs to reach its ≥100-row floor; it is a derived dense vector of the metadata-prefixed routing input, never prompt text. `calibration-aggregate` reports how many aggregated rows carry embeddings and warns while the count is below the hydra_projection floor (honest-untrained defaults remain until the floor is met).
+
 **Export schema v2 — session-hash migration (v0.21.0, [#146](https://github.com/beettlle/pi-smart-router/issues/146)).** The contrib export schema was bumped **v1 → v2** (`TELEMETRY_CONTRIB_VERSION = 2` in `src/cli/smart-router-cli.ts`). In v1, `session_id_hash` was an **unsalted SHA-256** of the raw session id; in v2 it is an **HMAC-SHA256 keyed with an install-local pepper** (`hashSessionIdForTelemetryExport` in `src/infra/telemetry.ts`). The pepper is generated once per install at `.pi-smart-router/.dataset-key` (mode 0600) and is **never** included in export payloads — ingest strips pepper fields before aggregation. Consequences for operators comparing exports:
 
 - Hashes are **stable per install** (same session → same hash within one install/cwd) but **not correlatable across installs** — two machines routing the same prompt produce different hashes.
@@ -979,6 +991,28 @@ Set the encoder in operator config:
 
 MiniLM remains the default fallback when `encoder` is omitted. Both encoders produce 384-dim vectors compatible with the SP-115 learned projection head.
 
+**Opt-in per-prompt encoder cascade ([#173](https://github.com/beettlle/pi-smart-router/issues/173), v1.2.0 — default OFF).** Instead of a process-wide single encoder, an opt-in gate routes prompts whose estimated token count reaches a threshold to the long-context encoder, avoiding MiniLM's 512-token truncation on long turns:
+
+```json
+{
+  "hydra": {
+    "artifact_cache_path": ".pi-smart-router/models/",
+    "encoder": "minilm",
+    "encoder_cascade": {
+      "enabled": true,
+      "long_context_encoder": "granite",
+      "token_threshold": 512
+    }
+  }
+}
+```
+
+- **Default off** — existing single-encoder installs are unaffected and pay zero added cost (the gate is pre-embedding arithmetic, ~sub-microsecond p50 in replay).
+- **Lazy memory** — the Granite ONNX session loads only on the first over-threshold prompt; short prompts keep using the same MiniLM session, so their routing decisions are identical to the MiniLM-only baseline.
+- **Degrade, never mix** — encoders embed into different vector spaces. If Granite is unavailable at request time, routing continues on MiniLM with `granite_fallback` telemetry; the cascade never compares cross-encoder vectors. Per-encoder artifacts: bootstrap Granite centroids with `npm run routing:bootstrap-centroids -- --encoder granite` (namespaced `config/routing-centroids.granite.json`); `npm run routing:verify-calibration` rejects mixed-encoder bundles, and Granite-side projection ships honest-untrained.
+- **Telemetry** — cascade-enabled decisions carry `encoder_selected`, `token_estimate`, `cascade_threshold`, and `cascade_fallback_reason` on the feature sidecar.
+- **Evidence, not a default flip** — see the cascade replay report [`docs/qa/encoder-cascade-replay-v1.2.0.md`](docs/qa/encoder-cascade-replay-v1.2.0.md). Promoting the cascade (or Granite) to a default is a future ticket gated on the #173 eval table.
+
 **Latency budget:** the HyDRA embedding stage targets ~80–120 ms per turn. Compare MiniLM vs Granite on held-out agent turn samples:
 
 ```bash
@@ -988,6 +1022,62 @@ npm run benchmark:encoder
 
 The script reports p50/p95 latency for each encoder and asserts Granite p50/p95 stay within the 120 ms budget ceiling. Requires `@huggingface/transformers` and a one-time ONNX artifact download.
 
+#### Granite opt-in dogfood runbook ([#167](https://github.com/beettlle/pi-smart-router/issues/167))
+
+Operator enablement for the Granite 97M long-context encoder on dogfood installs. **MiniLM remains the shipped default** — this runbook never flips `encoder` defaults; promotion is decided only through [#96](https://github.com/beettlle/pi-smart-router/issues/96) with dogfood evidence. The code path already shipped in [#80](https://github.com/beettlle/pi-smart-router/issues/80); do not reimplement it.
+
+**1. Fetch the model.** No manual download step is required — the ONNX artifact fetches on demand:
+
+| Item | Value |
+|------|-------|
+| Runtime HF ONNX id | `onnx-community/granite-embedding-97m-multilingual-r2-ONNX` (`GRANITE_ONNX_MODEL` in `src/domain/matching/embedding-provider.ts`) |
+| Upstream weights | `ibm-granite/granite-embedding-97m-multilingual-r2` (384-dim, long context) |
+| Cache dir | `hydra.artifact_cache_path` (default `.pi-smart-router/models/` — gitignored) |
+| Fetch trigger | First HyDRA embed with `encoder: granite`, **or** `npm run benchmark:encoder` (downloads on demand) |
+| Offline | One-time Hugging Face download; fully offline after cache warm (see Supply-chain below for pin modes) |
+
+Expected cache layout after fetch:
+
+```text
+.pi-smart-router/models/onnx-community/granite-embedding-97m-multilingual-r2-ONNX/
+```
+
+**2. Switch config (operator).** Edit `config/operator-config.json` on the dogfood host:
+
+```json
+{
+  "hydra": {
+    "artifact_cache_path": ".pi-smart-router/models/",
+    "encoder": "granite",
+    "hydra_heads": "learned_projection"
+  }
+}
+```
+
+Keep `hydra_heads: learned_projection` — Granite stays 384-dim compatible with the SP-115 projection (`config/hydra-projection-weights.json`). Do **not** enable `modernbert_k4` (still blocked on trained `config/modernbert-k4-heads.json`; tracked by #96).
+
+**3. Verify resident.** After a routed request, run `/smart-router plan` or `/smart-router doctor` to confirm the Granite encoder model and cache path are loaded. Smoke-check that routing still selects tiers and that there is **no silent MiniLM fallback** — if the encoder errors or exceeds budget, the neural stage fails open by design (#119 / #148) and telemetry/`reason_code` surfaces it; a crash or silent downgrade is a bug, not expected behavior.
+
+**4. Measure and archive.** Run the encoder benchmark and archive output for the issue trail:
+
+```bash
+mkdir -p .pi-smart-router/measurements/
+npm run benchmark:encoder | tee .pi-smart-router/measurements/benchmark-encoder-$(date +%Y%m%d).txt
+# optional: --fixtures path --cache .pi-smart-router/models/
+```
+
+Expectation: Granite p50/p95 within the ≤120 ms HyDRA embedding-stage budget (SP-204 go/no-go measured ~17 ms p50 for both encoders; [artifact](spine-tasks/_authoring/release-v0.11.0/encoder-gonogo-artifact.md)). `.pi-smart-router/measurements/` is gitignored — post a short summary comment on #167 with the numbers.
+
+**5. Post-switch follow-ups (feed #96 — evidence only, no default flip).** Track after Granite is live on the dogfood host:
+
+- **Latency regression watch** — HyDRA stage stays within ~80–120 ms on dogfood hardware vs SP-204 baselines; re-run `npm run benchmark:encoder` after fleet/catalog changes.
+- **Centroid / cluster space** — centroids were bootstrapped with MiniLM (`npm run routing:bootstrap-centroids`). Same 384-dim space, but embedding geometry differs; dry-run compare cluster match quality under Granite and document whether `config/routing-centroids.json` / the calibration bundle need refresh **before** any default flip.
+- **Projection / calibration** — SP-115 weights were trained on MiniLM embeddings. Run `npm run routing:calibration-dry-run` under Granite; if holdout ECE worsens, retrain the projection **or** keep MiniLM as the shipped default.
+- **Truncation / quality signal** — confirm long agent turns no longer hit MiniLM's 512-token wall (the primary motivation); note any residual encoder truncation surfaced in explain/telemetry.
+- **Degraded / fail-open path** — with Granite ONNX missing or slow, confirm neural failover still fails open (#119 / #148) rather than crashing the host agent.
+- **Feed #96** — after dogfood evidence, comment on #96 with *promote Granite as default?* yes/no + evidence. Only then open a separate issue/PR to flip defaults — never from dogfood alone (see `docs/qa/shadow-dogfood-protocol.md`).
+- **Do not conflate with ModernBERT** — K=4 stays blocked on trained `config/modernbert-k4-heads.json` (SP-218/219); out of scope here.
+
 #### Supply-chain: artifact pins, offline cache, and audit posture
 
 **Digest pinning (SP-259, [#147](https://github.com/beettlle/pi-smart-router/issues/147)).** The embedder verifies cached ONNX artifacts against SHA-256 pins before they are used. Pins live in [`config/onnx-artifact-pins.json`](config/onnx-artifact-pins.json) (`pins[modelId][cacheRelativePath] = sha256`; digests are the HuggingFace LFS oids for the default quantized artifacts). Pin mode is controlled by `SMART_ROUTER_ONNX_PIN_MODE`:

package/bin/pi-smart-router.mjs

@@ -33,9 +33,11 @@ function getRouterStateDbPath(cwd) {
 
 function printUsage() {
   console.error(`Usage:
-  pi-smart-router export telemetry-contrib [--limit N]
+  pi-smart-router export telemetry-contrib [--limit N] [--embeddings]
 
-Run from a directory with pi routing state (default: ./.pi-smart-router/state.db).`);
+Run from a directory with pi routing state (default: ./.pi-smart-router/state.db).
+--embeddings includes captured 384-dim encoder embeddings (opt-in; rows only carry
+embeddings when SMART_ROUTER_DATASET_EMBEDDINGS=1 was set at routing time).`);
 }
 
 async function main() {
@@ -46,14 +48,14 @@ async function main() {
   const sqlite = await loadDist('dist/infrastructure/persistence/sqlite-store.js');
 
   if (cli.isExportTelemetryContribInvocation(args)) {
-    const { limit } = cli.parseExportTelemetryContribArgs(args);
+    const { limit, includeEmbeddings } = cli.parseExportTelemetryContribArgs(args);
     const cwd = process.cwd();
     const { store } = sqlite.createResilientStore({
       dbPath: getRouterStateDbPath(cwd),
       models: [],
     });
 
-    const result = await cli.exportTelemetryContrib({ store, cwd, limit });
+    const result = await cli.exportTelemetryContrib({ store, cwd, limit, includeEmbeddings });
     if (result.path) {
       console.log(`Exported ${result.recordCount} telemetry-contrib record(s) to ${result.path}`);
       return;

package/config/benchmark-profiles.json

@@ -7,8 +7,8 @@
       "livecodebench": "https://livecodebench.github.io/leaderboard.html",
       "bfcl": "https://gorilla.cs.berkeley.edu/leaderboard.html"
     },
-    "scrape_date": "2026-09-10",
-    "catalog_freeze_date": "2026-09-10"
+    "scrape_date": "2026-09-13",
+    "catalog_freeze_date": "2026-09-13"
   },
   "aliases": {
     "anthropic/claude-opus-4": "claude-opus-4-5",

package/config/operator-config.json.example

@@ -21,6 +21,13 @@
   "hydra": {
     "artifact_cache_path": ".pi-smart-router/models/",
     "encoder": "minilm",
+    "_encoder_documentation": "Encoder switch — minilm (shipped default) | granite (opt-in trial, #80/#167). Granite: ibm-granite/granite-embedding-97m-multilingual-r2 ONNX, 384-dim long-context drop-in; fetches on first use into artifact_cache_path. See README 'HyDRA model cache → Granite opt-in dogfood runbook (#167)' for fetch/switch/measure/follow-ups. Do NOT flip the shipped default here — promotion is decided only via #96.",
+    "encoder_cascade": {
+      "enabled": false,
+      "long_context_encoder": "granite",
+      "token_threshold": 512
+    },
+    "_encoder_cascade_documentation": "SP-291 (#173) — opt-in per-prompt encoder cascade. Default OFF: every prompt uses hydra.encoder (MiniLM) and existing installs are unaffected. When enabled, prompts whose estimated token count reaches token_threshold are embedded with long_context_encoder (Granite 97M, long-context) instead of MiniLM (512-token window), avoiding truncation on long prompts. The gate is pure pre-embedding arithmetic (~zero overhead) and reuses the turn-envelope token estimator (estimated_input_tokens ?? prompt_text.length). Hard constraint: encoders embed into different vector spaces — never mix per-encoder artifacts (routing centroids, learned projection); per-encoder artifact sets and the cascading embedder land with SP-292.",
     "hydra_heads": "learned_projection",
     "_onnx_artifact_pins_documentation": "SP-259 (#147) — ONNX artifact supply-chain pinning. Digests live in config/onnx-artifact-pins.json (SHA-256 per cached artifact). Enable with env SMART_ROUTER_ONNX_PIN_MODE=verify (verify configured pins; unpinned models still download) or =enforce (CI/prod: pins required for the loaded model — missing pin file, missing pins, missing cached artifact, or any digest mismatch fails closed). Default off preserves first-run unpinned dogfood downloads. Override pin file path with SMART_ROUTER_ONNX_PIN_FILE. See README 'HyDRA model cache → Supply-chain' for offline cache warm and audit posture.",
     "_hydra_heads_documentation": {

package/config/p-success-weights.json

@@ -13,18 +13,25 @@
     "routing_latency_norm",
     "economical_tier"
   ],
-  "intercept": 0,
+  "intercept": -0.5222003136513049,
   "coefficients": [
-    0,
-    0,
-    0,
-    0,
-    0,
-    0,
-    0,
-    0,
-    0,
-    0
+    -0.2956545771757284,
+    7.784841874649057,
+    3.5433520874221505,
+    4.8383314206088155,
+    0.38566078028982864,
+    7.26315059735526,
+    -4.790294638202887,
+    0,
+    -1.6830999767157413,
+    -1.3270549117026749
   ],
-  "trained_sample_count": 0
+  "trained_sample_count": 243,
+  "provenance": {
+    "source": "verifier_grade_train_2026-09-12",
+    "note": "v1.1.0 verifier-grade ship (2026-09-12): train on 147 human_feedback contrib + 96 llm_judge live packs (SP-282 campaign + panel adjudication). All isotonic hard gates PASS (ece_cal=0.0645, ece_raw=0.1142). See spine-tasks/_authoring/release-v1.1.0/hard-gate-pass-2026-09-12.md. Closes #168 ship precondition.",
+    "trained_at": "2026-09-12",
+    "hard_gates_passed": true,
+    "trained_sample_count": 243
+  }
 }

package/config/routing-calibration.json

@@ -1175,8 +1175,8 @@
   },
   "triage_thresholds": {
     "version": 1,
-    "cyclomatic_threshold": 15,
-    "trained_sample_count": 0
+    "cyclomatic_threshold": 5,
+    "trained_sample_count": 57
   },
   "p_success_weights": {
     "version": 1,
@@ -1193,35 +1193,163 @@
       "routing_latency_norm",
       "economical_tier"
     ],
-    "intercept": 0,
+    "intercept": -0.5222003136513049,
     "coefficients": [
-      0,
-      0,
-      0,
-      0,
-      0,
-      0,
-      0,
-      0,
-      0,
-      0
+      -0.2956545771757284,
+      7.784841874649057,
+      3.5433520874221505,
+      4.8383314206088155,
+      0.38566078028982864,
+      7.26315059735526,
+      -4.790294638202887,
+      0,
+      -1.6830999767157413,
+      -1.3270549117026749
     ],
-    "trained_sample_count": 0
+    "trained_sample_count": 243
   },
   "isotonic_calibrator": {
     "version": 1,
     "min_training_samples": 30,
     "x_knots": [
       0,
+      0.4931564466862494,
+      0.49429102457530366,
+      0.4949099107727396,
+      0.4973855925869458,
+      0.5533629738338711,
+      0.5534649562964067,
+      0.5580493828890756,
+      0.5757897994300778,
+      0.5808212286637637,
+      0.6050649262180884,
+      0.8246138426581088,
+      0.825447772179378,
+      0.9687181641984473,
+      0.970743664095184,
+      0.9723800899966535,
+      0.9829037979927008,
+      0.9899734425367577,
+      0.9900120052118988,
+      0.9900504210635419,
+      0.9900886906392573,
+      0.9901268144846618,
+      0.9901647931434236,
+      0.9902403170659917,
+      0.9902778634074517,
+      0.990932091551219,
+      0.9923781893493379,
+      0.9931065498824946,
+      0.9944060334221272,
+      0.9957179579486877,
+      0.9988841927456904,
+      0.9988885226774248,
+      0.9988928358253212,
+      0.9989014120290056,
+      0.9989056752138725,
+      0.9989099218730609,
+      0.9989183658698353,
+      0.9989225633345237,
+      0.9989267445277392,
+      0.9992992382276508,
+      0.9997094887571614,
+      0.999710617024703,
+      0.9997117409116203,
+      0.9997128604349119,
+      0.9997139756115103,
+      0.9999977750941793,
+      0.9999977756250997,
+      0.9999977788459334,
+      0.9999977797978844,
+      0.9999977799872095,
+      0.9999977835743561,
+      0.9999977870462493,
+      0.9999977879784937,
+      0.9999977895779203,
+      0.9999977897416097,
+      0.9999977928146635,
+      0.9999977939558492,
+      0.9999977953947778,
+      0.9999978029719648,
+      0.9999978049176854,
+      0.9999978073738002,
+      0.999997809369306,
+      0.9999978098952513,
+      0.9999978806395697,
+      0.9999978879421653,
       1
     ],
     "y_knots": [
       0,
+      0,
+      0.25,
+      0.25,
+      0.5,
+      0.5,
+      0.625,
+      0.625,
+      0.6666666666666666,
+      0.6666666666666666,
+      0.6976744186046512,
+      0.6976744186046512,
+      0.95,
+      0.95,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
       1
     ],
-    "trained_sample_count": 0,
-    "holdout_ece_raw": null,
-    "holdout_ece_calibrated": null
+    "trained_sample_count": 243,
+    "holdout_ece_raw": 0.11415615868987086,
+    "holdout_ece_calibrated": 0.06453883879133059
   },
   "routing_centroids": {
     "version": 1,
@@ -2794,13 +2922,18 @@
     ]
   },
   "provenance": {
-    "source": "neutralized_for_v1_honesty",
-    "labeled_samples_p_success": 0,
-    "labeled_samples_triage": 0,
-    "labeled_samples_isotonic": 0,
+    "source": "verifier_grade_train_2026-09-12",
+    "labeled_samples_p_success": 243,
+    "labeled_samples_triage": 57,
+    "labeled_samples_isotonic": 243,
     "hydra_trained_sample_count": 0,
-    "note": "v1.0 honesty neutralize (2026-09-10): hybrid Sept P(success)/July isotonic rejected for ship. Scripted dogfood-gather labels are not #110 evidence. Serve-time p_success/isotonic/triage floors unmet so structural tier hints resume. PAV same-x pooling + null-label skip landed in code. Verifier-graded recalibration tracked post-1.0 (spine SP-280+). TwinRouterBench corpus over-routing ~0.87 is harness adapter artifact (#112), not live pipeline.",
-    "trained_at": "2026-09-10",
-    "neutralize_reason": "hybrid_harms_sept_distribution_and_scripted_labels"
+    "note": "v1.1.0 verifier-grade ship (2026-09-12): train on 147 human_feedback contrib + 96 llm_judge live packs (SP-282 campaign + panel adjudication). All isotonic hard gates PASS (ece_cal=0.0645, ece_raw=0.1142). See spine-tasks/_authoring/release-v1.1.0/hard-gate-pass-2026-09-12.md. Closes #168 ship precondition.",
+    "trained_at": "2026-09-12",
+    "gate_report": "data/calibration/verifier-grade-gate-report.json",
+    "hard_gates_passed": true,
+    "holdout_ece_raw": 0.11415615868987086,
+    "holdout_ece_calibrated": 0.06453883879133059,
+    "contrib_ship_eligible": 147,
+    "pack_rows": 96
   }
 }

package/data/contrib/example.json

@@ -1,7 +1,8 @@
 [
   {
-    "version": 1,
-    "timestamp": "2026-07-07T12:00:00.000Z",
+    "version": 2,
+    "timestamp": "2026-09-11T12:00:00.000Z",
+    "row_id": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
     "session_id_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
     "turn_type": "main_loop",
     "stage": "hydra_match",
@@ -11,6 +12,8 @@
     "routing_latency_ms": 12,
     "estimated_cost_usd": 0.001,
     "estimated_input_tokens": 60,
+    "prompt_length_chars": 240,
+    "message_count": 1,
     "has_tool_context": false,
     "compaction_flag": false,
     "triage_verdict": "ambiguous",

package/dist/cli/smart-router-cli.d.ts

@@ -24,6 +24,13 @@ export declare const TELEMETRY_CONTRIB_STRIP_KEYS: readonly ["request_id", "sess
 export declare const TELEMETRY_CONTRIB_REJECT_KEYS: readonly ["session_id", "prompt_text", "messages", "prompt", "prompt_fingerprint"];
 /** Mirrors SP-116 tainted key pattern for ingest-safe export. */
 export declare const TELEMETRY_CONTRIB_TAINTED_KEY_PATTERN: RegExp;
+/**
+ * Privacy-safe count-only fields that the tainted pattern would otherwise
+ * reject by name (SP-285, #170). These carry integer counts — never content —
+ * so they are explicitly allowed: `prompt_length_chars` feeds the P(success)
+ * prompt_length feature; `message_count` feeds envelope-shape features.
+ */
+export declare const TELEMETRY_CONTRIB_TAINTED_KEY_ALLOWLIST: readonly ["prompt_length_chars", "message_count"];
 export declare class TelemetryContribValidationError extends Error {
     readonly name = "TelemetryContribValidationError";
     constructor(message: string, options?: ErrorOptions);
@@ -47,6 +54,8 @@ export interface ExportTelemetryContribOptions {
     readonly limit?: number;
     readonly cwd?: string;
     readonly writeFile?: boolean;
+    /** Include captured 384-dim embeddings in contrib rows (SP-285, #170). */
+    readonly includeEmbeddings?: boolean;
 }
 export interface ExportTelemetryContribResult {
     readonly path: string | null;
@@ -57,6 +66,8 @@ export interface TelemetryContribExportContext {
     readonly store: StorePort;
     readonly cwd: string;
     readonly limit: number;
+    /** Include captured embeddings (SP-285, #170 --embeddings flag). */
+    readonly includeEmbeddings?: boolean | undefined;
 }
 /** Returns true when args invoke `/smart-router unpin`. */
 export declare function isUnpinInvocation(args: string): boolean;
@@ -64,6 +75,7 @@ export declare function isUnpinInvocation(args: string): boolean;
 export declare function isExportTelemetryContribInvocation(args: string): boolean;
 export declare function parseExportTelemetryContribArgs(args: string): {
     readonly limit: number;
+    readonly includeEmbeddings: boolean;
 };
 /**
  * Clear the current session pin via SessionPinner.breakPin().
@@ -71,17 +83,23 @@ export declare function parseExportTelemetryContribArgs(args: string): {
  */
 export declare function executeUnpinCommand(ctx: UnpinCommandContext): UnpinCommandResult;
 /** Map a dataset row plus linked outcomes to a privacy-safe telemetry contrib record. */
-export declare function toTelemetryContribRecord(record: RoutingDatasetRecord, outcomes?: readonly RoutingOutcomeRecord[], pepper?: Buffer): Record<string, unknown>;
+export declare function toTelemetryContribRecord(record: RoutingDatasetRecord, outcomes?: readonly RoutingOutcomeRecord[], pepper?: Buffer, options?: {
+    readonly includeEmbeddings?: boolean | undefined;
+}): Record<string, unknown>;
 export declare function formatTelemetryContribJson(records: readonly Record<string, unknown>[]): string;
 export declare function formatTelemetryContribJsonl(records: readonly Record<string, unknown>[]): string;
 export declare function formatTelemetryContribExportTimestamp(date?: Date): string;
 export declare function getTelemetryContribExportPath(cwd: string, timestamp: string): string;
 /** Defense-in-depth validation using SP-116 contrib safety checks. */
 export declare function validateTelemetryContribRecord(record: unknown, context?: string): Record<string, unknown>;
-export declare function buildTelemetryContribRecords(datasetRecords: readonly RoutingDatasetRecord[], outcomeRecords?: readonly RoutingOutcomeRecord[], pepper?: Buffer): Record<string, unknown>[];
+export declare function buildTelemetryContribRecords(datasetRecords: readonly RoutingDatasetRecord[], outcomeRecords?: readonly RoutingOutcomeRecord[], pepper?: Buffer, options?: {
+    readonly includeEmbeddings?: boolean | undefined;
+}): Record<string, unknown>[];
 export declare function exportTelemetryContrib(ctx: TelemetryContribExportContext, options?: Pick<ExportTelemetryContribOptions, 'writeFile'>): Promise<ExportTelemetryContribResult>;
 /** Join dataset export shape with outcome labels, then strip to contrib-safe fields. */
-export declare function datasetExportRowToTelemetryContrib(exportRecord: Record<string, unknown>, outcomes: readonly RoutingOutcomeRecord[], pepper?: Buffer): Record<string, unknown>;
+export declare function datasetExportRowToTelemetryContrib(exportRecord: Record<string, unknown>, outcomes: readonly RoutingOutcomeRecord[], pepper?: Buffer, options?: {
+    readonly includeEmbeddings?: boolean | undefined;
+}): Record<string, unknown>;
 export declare const smartRouterCliSubcommands: {
     readonly unpin: typeof executeUnpinCommand;
     readonly exportTelemetryContrib: typeof exportTelemetryContrib;