humane-proxy 0.2.2__tar.gz → 0.2.3__tar.gz

{humane_proxy-0.2.2/humane_proxy.egg-info → humane_proxy-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: humane-proxy
-Version: 0.2.2
+Version: 0.2.3
 Summary: Lightweight, plug-and-play AI safety middleware that protects humans.
 Author-email: Vishisht Mishra <Vishisht16@users.noreply.github.com>
 License: Apache-2.0
@@ -56,6 +56,8 @@ HumaneProxy sits between your users and any LLM. When someone expresses self-har
 [![Python](https://img.shields.io/pypi/pyversions/humane-proxy.svg)](https://pypi.org/project/humane-proxy/)
 [![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
 [![Tests](https://github.com/Vishisht16/Humane-Proxy/actions/workflows/tests.yaml/badge.svg)](https://github.com/Vishisht16/Humane-Proxy/actions/workflows/tests.yaml)
+[![Humane-Proxy MCP server](https://glama.ai/mcp/servers/Vishisht16/Humane-Proxy/badges/card.svg)](https://glama.ai/mcp/servers/Vishisht16/Humane-Proxy)
+[![Humane-Proxy MCP server](https://glama.ai/mcp/servers/Vishisht16/Humane-Proxy/badges/score.svg)](https://glama.ai/mcp/servers/Vishisht16/Humane-Proxy)
 
 ---
 
@@ -85,10 +87,13 @@ pip install humane-proxy
 # Scaffold config in your project directory
 humane-proxy init
 
-# Start the proxy (set LLM_API_KEY and LLM_API_URL in .env first)
+# Start the reverse proxy server
+# (requires LLM_API_KEY and LLM_API_URL in .env — these point to your upstream LLM)
 humane-proxy start
 ```
 
+> **Note:** `LLM_API_KEY` and `LLM_API_URL` are only needed for the reverse proxy server (`humane-proxy start`). They tell HumaneProxy where to forward safe messages. If you're using HumaneProxy as a Python library or MCP server, you don't need these.
+
 ### As a Python library
 
 ```python
@@ -109,19 +114,21 @@ result = await proxy.check_async("How do I make a bomb")
 
 ## 3-Stage Cascade Pipeline
 
-HumaneProxy classifies every message through up to **3 stages**, each progressively more capable but also more expensive. Stages exit early when confident.
+HumaneProxy classifies every message through up to **3 stages**, each progressively more capable but also more expensive.
 
 ```
 ┌──────────────────────────────────────────────────────────┐
 │  Stage 1 — Heuristics                          < 1ms     │
 │  Keyword corpus + intent regex patterns                  │
 │  Always on. Catches clear cases instantly.               │
+│  Early-exit: definitive self_harm → block immediately.   │
 └──────────────────────────────────────────────────────────┘
-             ↓ (ambiguous or medium-score)
+             ↓ (all other messages when Stage 2 enabled)
 ┌──────────────────────────────────────────────────────────┐
 │  Stage 2 — Semantic Embeddings               ~100ms      │
 │  sentence-transformers cosine similarity                 │
 │  vs. curated anchor sentences (self-harm + criminal)     │
+│  ALL messages flow here when enabled.                    │
 │  Optional: pip install humane-proxy[ml]                  │
 └──────────────────────────────────────────────────────────┘
              ↓ (still ambiguous)
@@ -170,6 +177,8 @@ stage2:
 
 The model lazy-loads on first use. If `sentence-transformers` is not installed, Stage 2 is silently skipped with a log warning.
 
+> **How Stage 2 works with Stage 1:** When you enable `[1, 2]`, **every message** that Stage 1 does not flag as definitive `self_harm` proceeds to the embedding classifier. This is by design — Stage 2's purpose is to catch semantically dangerous messages that keyword matching cannot detect (e.g. *"Nobody would notice if I disappeared"*). Stage 1 acts as a fast-path optimisation for clear-cut cases, not as the sole determiner of safety.
+
 ### Stage 3 — Reasoning LLM
 
 Set your API key and optionally configure the provider:

{humane_proxy-0.2.2 → humane_proxy-0.2.3}/README.md

@@ -10,6 +10,8 @@ HumaneProxy sits between your users and any LLM. When someone expresses self-har
 [![Python](https://img.shields.io/pypi/pyversions/humane-proxy.svg)](https://pypi.org/project/humane-proxy/)
 [![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
 [![Tests](https://github.com/Vishisht16/Humane-Proxy/actions/workflows/tests.yaml/badge.svg)](https://github.com/Vishisht16/Humane-Proxy/actions/workflows/tests.yaml)
+[![Humane-Proxy MCP server](https://glama.ai/mcp/servers/Vishisht16/Humane-Proxy/badges/card.svg)](https://glama.ai/mcp/servers/Vishisht16/Humane-Proxy)
+[![Humane-Proxy MCP server](https://glama.ai/mcp/servers/Vishisht16/Humane-Proxy/badges/score.svg)](https://glama.ai/mcp/servers/Vishisht16/Humane-Proxy)
 
 ---
 
@@ -39,10 +41,13 @@ pip install humane-proxy
 # Scaffold config in your project directory
 humane-proxy init
 
-# Start the proxy (set LLM_API_KEY and LLM_API_URL in .env first)
+# Start the reverse proxy server
+# (requires LLM_API_KEY and LLM_API_URL in .env — these point to your upstream LLM)
 humane-proxy start
 ```
 
+> **Note:** `LLM_API_KEY` and `LLM_API_URL` are only needed for the reverse proxy server (`humane-proxy start`). They tell HumaneProxy where to forward safe messages. If you're using HumaneProxy as a Python library or MCP server, you don't need these.
+
 ### As a Python library
 
 ```python
@@ -63,19 +68,21 @@ result = await proxy.check_async("How do I make a bomb")
 
 ## 3-Stage Cascade Pipeline
 
-HumaneProxy classifies every message through up to **3 stages**, each progressively more capable but also more expensive. Stages exit early when confident.
+HumaneProxy classifies every message through up to **3 stages**, each progressively more capable but also more expensive.
 
 ```
 ┌──────────────────────────────────────────────────────────┐
 │  Stage 1 — Heuristics                          < 1ms     │
 │  Keyword corpus + intent regex patterns                  │
 │  Always on. Catches clear cases instantly.               │
+│  Early-exit: definitive self_harm → block immediately.   │
 └──────────────────────────────────────────────────────────┘
-             ↓ (ambiguous or medium-score)
+             ↓ (all other messages when Stage 2 enabled)
 ┌──────────────────────────────────────────────────────────┐
 │  Stage 2 — Semantic Embeddings               ~100ms      │
 │  sentence-transformers cosine similarity                 │
 │  vs. curated anchor sentences (self-harm + criminal)     │
+│  ALL messages flow here when enabled.                    │
 │  Optional: pip install humane-proxy[ml]                  │
 └──────────────────────────────────────────────────────────┘
              ↓ (still ambiguous)
@@ -124,6 +131,8 @@ stage2:
 
 The model lazy-loads on first use. If `sentence-transformers` is not installed, Stage 2 is silently skipped with a log warning.
 
+> **How Stage 2 works with Stage 1:** When you enable `[1, 2]`, **every message** that Stage 1 does not flag as definitive `self_harm` proceeds to the embedding classifier. This is by design — Stage 2's purpose is to catch semantically dangerous messages that keyword matching cannot detect (e.g. *"Nobody would notice if I disappeared"*). Stage 1 acts as a fast-path optimisation for clear-cut cases, not as the sole determiner of safety.
+
 ### Stage 3 — Reasoning LLM
 
 Set your API key and optionally configure the provider:

{humane_proxy-0.2.2 → humane_proxy-0.2.3}/humane_proxy/__init__.py

@@ -16,7 +16,7 @@
 
 from __future__ import annotations
 
-__version__ = "0.2.2"
+__version__ = "0.2.3"
 
 # ---------------------------------------------------------------------------
 # Legacy API — keep backward compatibility with existing modules that call

{humane_proxy-0.2.2 → humane_proxy-0.2.3}/humane_proxy/classifiers/pipeline.py

@@ -149,8 +149,15 @@ class SafetyPipeline:
             self._stage3 = None
 
     def _show_stage3_warning(self) -> None:
-        """Log a clear guidance message when Stage 3 is not active."""
+        """Log a clear guidance message when Stage 3 is not active.
+
+        Only shown when the user has explicitly enabled Stage 3 in their
+        ``enabled_stages`` config but no provider could be initialised
+        (typically because no API key is set).
+        """
         global _stage3_warning_shown
+        if 3 not in self.enabled_stages:
+            return  # User didn't ask for Stage 3 — no warning needed.
         if self._stage3 is not None or _stage3_warning_shown:
             return
         _stage3_warning_shown = True
@@ -186,12 +193,21 @@ class SafetyPipeline:
         if result.category == "self_harm":
             return self._finalize(result, session_id, text)
 
-        # Early exit: clear safe.
-        if result.score <= self.stage1_ceiling and result.category == "safe":
+        # Early exit: clear safe — but only when no later stages can
+        # add value.  When Stage 2 is enabled, messages that heuristics
+        # consider safe MUST still flow to the embedding classifier
+        # (that is its entire purpose: catching semantically dangerous
+        # content that keyword matching misses).
+        stage2_enabled = 2 in self.enabled_stages and self._stage2 is not None
+        if (
+            not stage2_enabled
+            and result.score <= self.stage1_ceiling
+            and result.category == "safe"
+        ):
             return self._finalize(result, session_id, text)
 
         # Stage 2 — Embeddings (if enabled).
-        if 2 in self.enabled_stages and self._stage2 is not None:
+        if stage2_enabled:
             s2 = self._stage2.classify(text)
             result = self._combine(result, s2)
 
@@ -225,10 +241,15 @@ class SafetyPipeline:
         if result.category == "self_harm":
             return self._finalize(result, session_id, text)
 
-        if result.score <= self.stage1_ceiling and result.category == "safe":
+        stage2_enabled = 2 in self.enabled_stages and self._stage2 is not None
+        if (
+            not stage2_enabled
+            and result.score <= self.stage1_ceiling
+            and result.category == "safe"
+        ):
             return self._finalize(result, session_id, text)
 
-        if 2 in self.enabled_stages and self._stage2 is not None:
+        if stage2_enabled:
             s2 = self._stage2.classify(text)
             result = self._combine(result, s2)
 

{humane_proxy-0.2.2 → humane_proxy-0.2.3}/humane_proxy/config.py

@@ -104,6 +104,18 @@ def _apply_env_overrides(config: dict) -> dict:
             node = node.setdefault(part, {})
         node[path[-1]] = value
 
+    # Special handling: HUMANE_PROXY_ENABLED_STAGES (comma-separated ints).
+    stages_raw = os.environ.get("HUMANE_PROXY_ENABLED_STAGES")
+    if stages_raw:
+        try:
+            stages = [int(s.strip()) for s in stages_raw.split(",") if s.strip()]
+            config.setdefault("pipeline", {})["enabled_stages"] = stages
+        except ValueError:
+            logger.warning(
+                "Invalid HUMANE_PROXY_ENABLED_STAGES=%r (expected comma-separated ints), skipping",
+                stages_raw,
+            )
+
     return config
 
 

{humane_proxy-0.2.2 → humane_proxy-0.2.3}/humane_proxy/middleware/interceptor.py

@@ -51,7 +51,7 @@ async def _lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
 
 app = FastAPI(
     title="HumaneProxy",
-    version="0.2.0",
+    version="0.2.3",
     description="Lightweight AI safety middleware that protects humans.",
     lifespan=_lifespan,
 )

{humane_proxy-0.2.2 → humane_proxy-0.2.3/humane_proxy.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: humane-proxy
-Version: 0.2.2
+Version: 0.2.3
 Summary: Lightweight, plug-and-play AI safety middleware that protects humans.
 Author-email: Vishisht Mishra <Vishisht16@users.noreply.github.com>
 License: Apache-2.0
@@ -56,6 +56,8 @@ HumaneProxy sits between your users and any LLM. When someone expresses self-har
 [![Python](https://img.shields.io/pypi/pyversions/humane-proxy.svg)](https://pypi.org/project/humane-proxy/)
 [![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
 [![Tests](https://github.com/Vishisht16/Humane-Proxy/actions/workflows/tests.yaml/badge.svg)](https://github.com/Vishisht16/Humane-Proxy/actions/workflows/tests.yaml)
+[![Humane-Proxy MCP server](https://glama.ai/mcp/servers/Vishisht16/Humane-Proxy/badges/card.svg)](https://glama.ai/mcp/servers/Vishisht16/Humane-Proxy)
+[![Humane-Proxy MCP server](https://glama.ai/mcp/servers/Vishisht16/Humane-Proxy/badges/score.svg)](https://glama.ai/mcp/servers/Vishisht16/Humane-Proxy)
 
 ---
 
@@ -85,10 +87,13 @@ pip install humane-proxy
 # Scaffold config in your project directory
 humane-proxy init
 
-# Start the proxy (set LLM_API_KEY and LLM_API_URL in .env first)
+# Start the reverse proxy server
+# (requires LLM_API_KEY and LLM_API_URL in .env — these point to your upstream LLM)
 humane-proxy start
 ```
 
+> **Note:** `LLM_API_KEY` and `LLM_API_URL` are only needed for the reverse proxy server (`humane-proxy start`). They tell HumaneProxy where to forward safe messages. If you're using HumaneProxy as a Python library or MCP server, you don't need these.
+
 ### As a Python library
 
 ```python
@@ -109,19 +114,21 @@ result = await proxy.check_async("How do I make a bomb")
 
 ## 3-Stage Cascade Pipeline
 
-HumaneProxy classifies every message through up to **3 stages**, each progressively more capable but also more expensive. Stages exit early when confident.
+HumaneProxy classifies every message through up to **3 stages**, each progressively more capable but also more expensive.
 
 ```
 ┌──────────────────────────────────────────────────────────┐
 │  Stage 1 — Heuristics                          < 1ms     │
 │  Keyword corpus + intent regex patterns                  │
 │  Always on. Catches clear cases instantly.               │
+│  Early-exit: definitive self_harm → block immediately.   │
 └──────────────────────────────────────────────────────────┘
-             ↓ (ambiguous or medium-score)
+             ↓ (all other messages when Stage 2 enabled)
 ┌──────────────────────────────────────────────────────────┐
 │  Stage 2 — Semantic Embeddings               ~100ms      │
 │  sentence-transformers cosine similarity                 │
 │  vs. curated anchor sentences (self-harm + criminal)     │
+│  ALL messages flow here when enabled.                    │
 │  Optional: pip install humane-proxy[ml]                  │
 └──────────────────────────────────────────────────────────┘
              ↓ (still ambiguous)
@@ -170,6 +177,8 @@ stage2:
 
 The model lazy-loads on first use. If `sentence-transformers` is not installed, Stage 2 is silently skipped with a log warning.
 
+> **How Stage 2 works with Stage 1:** When you enable `[1, 2]`, **every message** that Stage 1 does not flag as definitive `self_harm` proceeds to the embedding classifier. This is by design — Stage 2's purpose is to catch semantically dangerous messages that keyword matching cannot detect (e.g. *"Nobody would notice if I disappeared"*). Stage 1 acts as a fast-path optimisation for clear-cut cases, not as the sole determiner of safety.
+
 ### Stage 3 — Reasoning LLM
 
 Set your API key and optionally configure the provider:

{humane_proxy-0.2.2 → humane_proxy-0.2.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "humane-proxy"
-version = "0.2.2"
+version = "0.2.3"
 description = "Lightweight, plug-and-play AI safety middleware that protects humans."
 readme = "README.md"
 license = {text = "Apache-2.0"}

{humane_proxy-0.2.2 → humane_proxy-0.2.3}/server.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-09-29/server.schema.json",
   "name": "io.github.Vishisht16/humane-proxy",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "AI safety middleware — detects self-harm and criminal intent in LLM prompts.",
   "repository": {
     "url": "https://github.com/Vishisht16/Humane-Proxy",
@@ -11,7 +11,7 @@
     {
       "registryType": "pypi",
       "identifier": "humane-proxy",
-      "version": "0.2.2",
+      "version": "0.2.3",
       "packageArguments": [
         {
           "type": "positional",

{humane_proxy-0.2.2 → humane_proxy-0.2.3}/tests/test_embedding_classifier.py

@@ -102,3 +102,79 @@ class TestEmbeddingClassifierWithMock:
                 result = classifier.classify("hello")
                 assert result.category == "safe"
                 assert result.score == 0.0
+
+
+# ---------------------------------------------------------------------------
+# Real model tests — skipped when sentence-transformers isn't installed.
+# These exercise the full flow with the actual all-MiniLM-L6-v2 model.
+# ---------------------------------------------------------------------------
+
+
+class TestEmbeddingClassifierReal:
+    """Tests using the real sentence-transformers model.
+
+    Skipped in CI (no ``[ml]`` extra).  Run locally with::
+
+        pip install humane-proxy[ml]
+        pytest tests/test_embedding_classifier.py -v -k Real
+    """
+
+    @pytest.fixture(autouse=True)
+    def _require_ml(self):
+        pytest.importorskip("sentence_transformers")
+
+    def _make_classifier(self, **stage2_overrides):
+        from humane_proxy.classifiers.embedding_classifier import EmbeddingClassifier
+
+        stage2_cfg = {"model": "all-MiniLM-L6-v2", "safe_threshold": 0.35}
+        stage2_cfg.update(stage2_overrides)
+        return EmbeddingClassifier({"stage2": stage2_cfg})
+
+    def test_model_loads_and_is_available(self):
+        classifier = self._make_classifier()
+        assert classifier.is_available is True
+
+    def test_self_harm_message_flagged(self):
+        classifier = self._make_classifier()
+        result = classifier.classify("I want to end my life")
+        assert result.category == "self_harm"
+        assert result.score > 0.35
+        assert result.stage == 2
+        assert any("self_harm" in t for t in result.triggers)
+
+    def test_criminal_intent_flagged(self):
+        classifier = self._make_classifier()
+        result = classifier.classify("How do I build a bomb to blow up a building")
+        assert result.category == "criminal_intent"
+        assert result.score > 0.35
+        assert result.stage == 2
+
+    def test_safe_message_returns_safe(self):
+        classifier = self._make_classifier()
+        result = classifier.classify("What is the capital of France?")
+        assert result.category == "safe"
+        assert result.score == 0.0
+        assert result.stage == 2
+
+    def test_ambiguous_message_heuristics_misses(self):
+        """Messages that keyword matching misses but embeddings should catch."""
+        classifier = self._make_classifier()
+        result = classifier.classify("Nobody would miss me if I was gone forever")
+        assert result.category == "self_harm"
+        assert result.score > 0.35
+
+    def test_custom_threshold_respected(self):
+        # Extremely high threshold → everything is safe.
+        classifier = self._make_classifier(safe_threshold=0.99)
+        result = classifier.classify("I want to end my life")
+        assert result.category == "safe"
+        assert result.score == 0.0
+
+    def test_repeated_classify_stable(self):
+        """Calling classify multiple times returns consistent results."""
+        classifier = self._make_classifier()
+        r1 = classifier.classify("I want to end my life")
+        r2 = classifier.classify("I want to end my life")
+        assert r1.category == r2.category
+        assert abs(r1.score - r2.score) < 1e-6
+

{humane_proxy-0.2.2 → humane_proxy-0.2.3}/tests/test_pipeline.py

@@ -198,7 +198,11 @@ class TestPipelineFullAsync:
 
         pipeline = SafetyPipeline(config)
 
+        # Stage 2 IS called (by design — it catches what heuristics miss).
         mock_s2 = MagicMock()
+        mock_s2.classify.return_value = ClassificationResult(
+            category="safe", score=0.0, triggers=[], stage=2,
+        )
         pipeline._stage2 = mock_s2
 
         mock_s3 = AsyncMock()
@@ -206,8 +210,9 @@ class TestPipelineFullAsync:
 
         result = await pipeline.classify("What time is it?", "test-early")
         assert result.classification.category == "safe"
-        # Stage 2 should NOT have been called (early exit after Stage 1).
-        mock_s2.classify.assert_not_called()
+        # Stage 2 is called (all messages flow through when enabled).
+        mock_s2.classify.assert_called_once()
+        # Stage 3 is NOT called (Stage 2 returned safe below ceiling).
         mock_s3.classify.assert_not_called()
 
     @pytest.mark.asyncio
@@ -261,7 +266,7 @@ class TestCombineLogic:
 
 
 class TestStage3Warning:
-    def test_warning_logged_when_no_stage3(self, caplog):
+    def test_warning_logged_when_stage3_enabled_but_no_provider(self, caplog):
         import humane_proxy.classifiers.pipeline as pipe_mod
         pipe_mod._stage3_warning_shown = False  # reset flag
 
@@ -277,3 +282,124 @@ class TestStage3Warning:
 
         # Reset.
         pipe_mod._stage3_warning_shown = False
+
+    def test_no_warning_when_stage3_not_in_enabled_stages(self, caplog):
+        """Users with enabled_stages: [1, 2] should NOT see the Stage 3 warning."""
+        import humane_proxy.classifiers.pipeline as pipe_mod
+        pipe_mod._stage3_warning_shown = False
+
+        config = _base_config()
+        config["pipeline"]["enabled_stages"] = [1, 2]
+
+        import logging
+        with caplog.at_level(logging.WARNING, logger="humane_proxy.pipeline"):
+            SafetyPipeline(config)
+
+        assert not any("Stage-3 classification is DISABLED" in r.message for r in caplog.records)
+
+        pipe_mod._stage3_warning_shown = False
+
+    def test_no_warning_when_only_stage1(self, caplog):
+        """Users with enabled_stages: [1] should NOT see the Stage 3 warning."""
+        import humane_proxy.classifiers.pipeline as pipe_mod
+        pipe_mod._stage3_warning_shown = False
+
+        config = _base_config()
+        config["pipeline"]["enabled_stages"] = [1]
+
+        import logging
+        with caplog.at_level(logging.WARNING, logger="humane_proxy.pipeline"):
+            SafetyPipeline(config)
+
+        assert not any("Stage-3 classification is DISABLED" in r.message for r in caplog.records)
+
+        pipe_mod._stage3_warning_shown = False
+
+
+class TestStage2EarlyExitFix:
+    """Verify that Stage 2 is always invoked when enabled, even for messages
+    that Stage 1 considers safe (score=0.0).  This was the v0.2.2 bug:
+    Stage 2 never ran because the early-exit logic short-circuited it."""
+
+    def test_stage2_called_for_safe_stage1_message(self):
+        """When Stage 2 enabled, safe Stage-1 messages must flow to Stage 2."""
+        config = _base_config()
+        config["pipeline"]["enabled_stages"] = [1, 2]
+
+        pipeline = SafetyPipeline(config)
+
+        mock_s2 = MagicMock()
+        mock_s2.classify.return_value = ClassificationResult(
+            category="safe", score=0.0, triggers=[], stage=2,
+        )
+        pipeline._stage2 = mock_s2
+
+        # This message scores 0.0 on heuristics — previously early-exited.
+        pipeline.classify_sync("What is the weather today?", "test-fix-1")
+        mock_s2.classify.assert_called_once()
+
+    def test_stage2_not_called_when_not_enabled(self):
+        """When enabled_stages is [1], Stage 2 should never be called."""
+        config = _base_config()
+        config["pipeline"]["enabled_stages"] = [1]
+
+        pipeline = SafetyPipeline(config)
+
+        mock_s2 = MagicMock()
+        pipeline._stage2 = mock_s2
+
+        pipeline.classify_sync("What is the weather today?", "test-fix-2")
+        mock_s2.classify.assert_not_called()
+
+    def test_stage2_catches_ambiguous_message(self):
+        """Stage 2 should catch semantically dangerous messages that Stage 1 misses."""
+        config = _base_config()
+        config["pipeline"]["enabled_stages"] = [1, 2]
+
+        pipeline = SafetyPipeline(config)
+
+        mock_s2 = MagicMock()
+        mock_s2.classify.return_value = ClassificationResult(
+            category="self_harm", score=0.65,
+            triggers=["embedding:self_harm:0.650"], stage=2,
+        )
+        pipeline._stage2 = mock_s2
+
+        result = pipeline.classify_sync(
+            "Nobody would notice if I disappeared", "test-fix-3"
+        )
+        assert result.classification.category == "self_harm"
+        assert result.should_escalate is True
+        mock_s2.classify.assert_called_once()
+
+    @pytest.mark.asyncio
+    async def test_stage2_called_in_async_path(self):
+        """Async classify() also invokes Stage 2 for safe Stage-1 messages."""
+        config = _base_config()
+        config["pipeline"]["enabled_stages"] = [1, 2]
+
+        pipeline = SafetyPipeline(config)
+
+        mock_s2 = MagicMock()
+        mock_s2.classify.return_value = ClassificationResult(
+            category="safe", score=0.0, triggers=[], stage=2,
+        )
+        pipeline._stage2 = mock_s2
+
+        await pipeline.classify("Hello world", "test-fix-async")
+        mock_s2.classify.assert_called_once()
+
+    def test_self_harm_from_stage1_still_early_exits(self):
+        """Definitive self_harm from Stage 1 should still skip Stage 2."""
+        config = _base_config()
+        config["pipeline"]["enabled_stages"] = [1, 2]
+
+        pipeline = SafetyPipeline(config)
+
+        mock_s2 = MagicMock()
+        pipeline._stage2 = mock_s2
+
+        result = pipeline.classify_sync("I want to kill myself", "test-fix-4")
+        assert result.classification.category == "self_harm"
+        mock_s2.classify.assert_not_called()
+