> For the complete documentation index, see [llms.txt](https://osintelligence-llc.gitbook.io/osintelligence/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://osintelligence-llc.gitbook.io/osintelligence/part-iv-the-evidence-what-worked/13-sovereign-ioc-classifier.md). # 13 · Sovereign IOC Classifier > **A companion paper.** The origin story of the specialist fleet: the **first LoRA the stack ever trained**, and the precedent class every subsequent micro-agent inherits. In series terms it is the first-instance feasibility anchor for the Sovereign Pair's second half (in-weights specialization), joint-necessity-orthogonal with *Corpus-Sovereign Self-Distillation* (Chapter 18, the calibration-retention anchor at 9B scale). It is also the recursive moat's C₀ datum: the first cycle of the corpus-is-the-product loop the Flywheel formalizes. Cited in-series by title. > > **Status note.** The experiment was sealed 2026-04-11 at **Admiralty B2, capability probe** (small N, pipeline green end-to-end); this write-up was prepared for publication 2026-05-12 with the sealed numbers preserved verbatim. The N=9 caveat is carried in every section that touches a result, per the series' honesty discipline. The paper adds framing, prior art, and falsification design; it re-runs nothing. > **What is new here.** The contribution is the first proof, on this stack, that in-weights sovereign specialization is a deployable engineering pattern at the micro-agent scale, not an aspiration: a 0.74%-trainable-parameter LoRA over a 56-row operator-curated corpus, trained in 229.8 seconds on one consumer GPU, that classifies at 100% where the prompted 2B baseline scores 22.2% under strict type-and-value grading. The load-bearing novelty is not the score but the precedent class: this is the first LoRA the stack ever trained, and it established the ten-step template (sovereign dataset → train → merged GGUF → router preset → grammar-constrained output → A/B → quarantine respected → flag off → sealed) that every later specialist inherits by dated decision. Two design moves are stated as method, not boast: the grammar enforces output shape at the logit level while the adapter carries task content, a division of labor the format-tax literature predicts favours a base checkpoint on a classification task; and six spec deviations are sealed with rationale rather than patched after the fact, one of which (Base, not Instruct) makes the specialization claim structurally stronger. > > **Deepest water.** §4.2, the sealed 9-row A/B (accuracy 1.000 vs 0.222, F1 1.000 vs 0.152, 35% faster) read alongside §6's honest register, the Wilson 95% interval on 9-of-9 is \[0.701, 1.000], so this is a capability probe, not a population claim; §3.3, the six sealed deviations, especially D1 (Base not Instruct) and D5 (the quarantine rule forcing a cleaner gate than the spec proposed); and §7, the five pre-registered replication questions that gate promotion from Admiralty B2 to A1. ### Abstract \[Admiralty B2 capability probe; small-N caveat preserved verbatim] We report the design, training, and capability-probe evaluation of the first sovereign in-weights micro-agent in the OS-INTelligence ecosystem: an Indicator-of-Compromise (IOC) classifier trained as a LoRA adapter on a 0.8B hybrid Mamba-SSM + attention + vision base, served via llama.cpp Router Mode with adapter hot-load, output-constrained by a 665-byte GBNF grammar, and gated into the live pipeline through a feature-flagged standalone module that leaves the four quarantined Stage-1 files untouched. Training consumed **229.8 seconds of wall-clock on a single consumer RTX 5070** (12 GB sm\_120): seed 42, rank 16, alpha 32, dropout 0.05, all attention + MLP target modules, effective batch 16, lr 2e-4 cosine with 5-step warmup, paged AdamW 8-bit, 2,048-token sequences. The corpus was **56 sovereign-curated rows** (7-row validation split; 9-row held-out A/B set, de-scoped from the ≥50-row spec target and reported as such). **Trainable parameters: 6,389,760 of 859,375,680 (0.74 %).** Final loss **0.06** from 0.28. Adapter: 25 MB safetensors → **12.8 MB merged GGUF f16**. Against a prompted 2B baseline on identical prompts at temperature 0.01: *candidate accuracy 1.000, F1 macro 1.000, grammar-valid 1.000, p95 6,024 ms; baseline 0.222, 0.152, 1.000, p95 9,288 ms*\*: +77.8 pp accuracy, +84.8 pp F1, 35 % faster. Live-fire: **5 of 5** out-of-sample IOC types classified correctly at confidence 1.0. The N=9 result is a capability probe, not a statistical population claim; the Wilson 95 % interval on 9-of-9 is \[0.701, 1.000], and the stat-significant replication is pre-registered as RQ-1. \* The baseline's grammar-valid rate of 1.000 is achieved via free-form JSON mode: structurally valid output that is the wrong type or value 78 % of the time. Grammar validity is a necessary, not sufficient, criterion; the candidate's is enforced at logit level, where violating token sequences are unemittable. ### 1. Introduction #### 1.1 The thesis The Sovereign Pair principle pairs upstream-deterministic gates, where determinism is structurally possible, with in-weights sovereign specialization, where compliance must survive distribution-shaping under load. The series' synthesis papers establish that architecture; this paper is where its second half first touched ground. The claim at issue: corpus sovereignty plus in-weights specialization, at the *micro-agent* scale, is a deployable, reproducible engineering pattern rather than an aspiration. A 0.8B base, a 56-row sovereign corpus, 60 optimizer steps, and a sealed probe demonstrating that the architecture **produces a structurally-perfect classifier from a 0.74 %-trainable-parameter adapter on a single consumer GPU in under four minutes**. #### 1.2 Why the first micro-agent matters Stage-1 triage in the production pipeline was documented as running a prompted 2B model averaging \~5.2 s per classification at \~85 % accuracy. Both figures are the spec's stated prior rather than a measurement made here, and one of them did not survive contact: deviation D5 established that Stage 1 called no LLM classifier at all, and the prompted 2B measured in this study scores 22.2 % under strict type-and-value grading. The \~85 % figure should therefore not be read as the baseline this paper beat. The spec's research claim was that a LoRA-tuned 0.8B with grammar enforcement could beat it structurally. But the deeper motivation is the **precedent class**: P4 was the first LoRA trained on this stack, and every subsequent specialist inherits its template: sovereign dataset → train → merged GGUF → router preset → delegator routing → grammar-constrained output → A/B against baseline → pipeline quarantine respected → feature-flag OFF by default → sealed results. The CTI-NER adapter, the schema pipeline, the self-distillation pilot, and the pruning study all trace their lineage here. Had the first instance failed (random classification, grammar failing to bind, hot-load not working end-to-end), none of the successors would have proceeded. First-instance success is load-bearing on the entire downstream cascade, and the seal record shows this is not retroactive narrative: the original commit reads "first sovereign micro-agent forged." #### 1.3 Contributions (1) The first sovereign micro-agent, sealed with a complete reproducible recipe: base, corpus, adapter, GGUF, grammar, and manifest all SHA-anchored. (2) The capability-probe seal itself: structurally-perfect classification from 0.74 % trainable parameters. (3) The **pipeline-quarantine engineering precedent**: zero edits to the four locked Stage-1 files; the gate lives in a new standalone module. (4) **Six documented spec deviations**, each sealed with rationale rather than patched after the fact. (5) A hybrid-architecture feasibility demonstration: LoRA attaches only to the attention + MLP projections; the Mamba blocks and vision tower remain untouched, and for a structural classifier that coverage suffices. (6) The Sovereign Pair's second half anchored empirically at the smallest viable scale. (7) The recursive moat's first-cycle datum: the 56-row corpus is the precedent instance of the corpus-as-product principle. (8) A full reproducibility envelope, from spec to adapter binary. #### 1.4 Scope One capability probe: one micro-agent, one base, one GPU, one seed, one validator snapshot, reported at the small-N register throughout. Out of scope, each deferred to a pre-registered RQ: statistical claims on the 9-row set (RQ-1), multi-seed and cross-hardware variance (RQ-2), cross-corpus replication (RQ-3), base-vs-instruct ablation (RQ-4), quantization head-to-head (RQ-5), and production integration, for which the feature flag ships OFF and stays OFF pending operator authorization. ### 2. Background and Prior Art **Parameter-efficient fine-tuning** LoRA (Hu et al. 2021) freezes base weights and trains rank-decomposed updates at typically <1 % of base parameters; QLoRA (Dettmers et al. 2023) brings the recipe to consumer hardware via NF4 quantization of the frozen base plus the paged AdamW 8-bit optimizer this training run uses. The probe lands squarely in that regime, and illustrates its economy: **229.84 s of wall-clock** against the **106,324 s (29.5 h)** taken by the closest in-series sibling, the SSD pilot's 9B sovereign arm, at the same rank-16, alpha-32 adapter geometry over the same seven projection targets. The two runs differ in base scale, corpus, epoch count, and batch geometry, so this is an economy comparison and not a controlled one. What it establishes is narrower and sufficient: a specialist-training loop at this scale completes in minutes rather than in a day and a quarter, which is what makes a *daily-cadence* loop feasible on one GPU. LIMA (Zhou et al. 2023) anchors the corpus-quality-over-scale precedent behind the 56-row framing; Hugging Face Transformers (Wolf et al. 2020) and Datasets (Lhoest et al. 2021) and Unsloth's FastModel are the tooling substrate; AdamW and the cosine schedule trace to Loshchilov & Hutter (2017). **Small language models** Phi-3 (Abdin et al. 2024), Mistral 7B (Jiang et al. 2023), Gemma (2024), and Llama 2 (Touvron et al. 2023) establish the SLM class at 2–7B. The probe operates *below* that envelope, at 0.8B, and the claim is calibrated accordingly: not that the base is generally capable (it has no chat template at all), but that for a structurally tight task, base + adapter + grammar produces structurally-perfect output. Smallness is a feature: the router's LRU eviction loads and evicts the 1.5 GB base + 12.8 MB adapter in seconds, so the whole specialist family coexists with the heavyweight roster (9B orchestrator, 35B architect, 122B research brain) without permanent VRAM allocation. **Constrained decoding** Willard & Louf (2023) supply the logit-mask-over-FSM foundation; Beurer-Kellner et al. (2024, ICML) the constraint-distribution/training-distribution alignment principle; JSONSchemaBench (Geng et al. 2025), XGrammar (Dong et al. 2024), and llguidance round out the engine landscape. The 665-byte GBNF grammar here constrains the output to {type, value, confidence} with type in a six-value enum, so **no violating token sequence is emittable**. The **format-tax literature** is the disconfirming lane this design has to survive, and read closely it does more than permit the design; it anticipates it. Schall and de Melo (RANLP 2025), across eleven models and five architectures at 4–8B, report a divergence between base and instruction-tuned models under structural constraints: instruction-tuned models frequently degrade on generation tasks, while base models often *benefit*, the constraint acting as output guidance for a model that has none. They further find that classification tasks stay comparatively stable where generation tasks fall away, and that constrained decoding collapses without adapted prompts or sufficient in-context examples. This probe sits in the favorable cell on all three counts: a base checkpoint (deviation D1), a classification task over a six-value enum, and, in place of prompt adaptation, an adapter that carries the task in weights. Lee et al. (2026) sharpen the point from the other side, finding that the dominant cost of structured output enters at the prompt rather than at the decoder. Those results are on other model scales and benchmarks, so they corroborate rather than prove; the division of labor they imply is nonetheless the one built here. The grammar enforces output *shape* only; the trained adapter carries the *content* semantics. The shape-vs-content gap is closed by the model, not the grammar: the alignment principle satisfied by construction. Shin et al. (2025), on BPE/grammar boundary misalignment, remains the live caution. **Instruction tuning, CTI, and method norms** FLAN (Wei et al. 2022) and InstructGPT (Ouyang et al. 2022) anchor the base-vs-instruct question behind deviation D1; Constitutional AI (Bai et al. 2022) is the series' alignment-register complement. The IOC task sits lightly against the CTI literature (BERT-lineage NER; STIX 2.1; MITRE ATT\&CK) by design, because this is a capability-probe vehicle, not a NER-architecture contribution; the CTI-NER companion carries that weight. Munafò et al. (2017), Nosek et al. (2018), Wilson (1927), and ICD-203 analytic standards supply the pre-registration, interval, and calibrated-language discipline the paper operates under. ### 3. Methods #### 3.1 Substrate and provenance Single bare-metal workstation: i7-14700F, RTX 5070 12 GB sm\_120 Blackwell, 128 GB DDR5, patched llama.cpp serving build (the same substrate whose serving-path forensics the mRoPE companion documents). Training and evaluation ran on the same physical machine, the operator's primary workstation, at ≤ 45 °C peak GPU against an 85 °C ceiling, zero thermal events. Base: the Unsloth-patched 0.8B Base checkpoint (pre-instruction-tuned), converted in-session to GGUF f16 (1.51 GB); the full SHA chain from upstream checkpoint through corpus, adapter, merged GGUF, grammar, and training manifest is recorded in the sealed recipe. **Architecture caveat, carried honestly:** the base is a hybrid Mamba-SSM + linear-attention + full-attention + vision model; LoRA attaches only to the full-attention projections (q/k/v/o) and MLPs (gate/up/down); Mamba blocks and the vision tower are untouched. Sufficient for a structural classifier, as the probe confirms; a future agent needing sequence-model adaptation would want a text-only fork (which also drops \~400 MB of dead vision weight). #### 3.2 Corpus 56 sovereign-curated training rows + 7 validation + 9 held-out A/B rows, from the dataset-curation pilot's v3 release: operator-authored IOC examples across the canonical class set (IPv4/IPv6, domain, CVE, email, hash). The spec called for ≥500 training rows; the curation pilot delivered infrastructure before volume, and the de-scope is sealed as deviation D3 rather than smoothed over. | Hyperparameter | Value | Note | | -------------------------- | ------------------------------------ | ---------------------------------------------------------------- | | Rank / alpha / dropout | 16 / 32 / 0.05 | Effective LR multiplier α/r = 2 | | Target modules | q, k, v, o + gate, up, down | All attention projections + MLPs | | Epochs / steps | 15 / 60 | Deviation D2: spec's 3 epochs = 12 steps, warmup never completes | | Batch / accumulation | 4 × 4 (effective 16) | Gradient accumulation over 4 micro-batches | | LR / schedule / warmup | 2e-4 / cosine / 5 steps | Warmup rescaled with D2 | | Optimizer / seq len / seed | paged AdamW 8-bit / 2048 / 42 | Seed pinned in the training manifest | | Trainable parameters | **6,389,760 / 859,375,680 (0.74 %)** | Consistent with rank-16 fractions in the LoRA literature | ***Table 1.** Sealed training configuration.* #### 3.3 Six spec deviations, sealed at the experiment **D1 (Base, not Instruct):** operator-ruled; no chat template exists, so the trainer uses a plain scaffold and the raw completion endpoint. Structurally the *stronger* claim: specialization succeeded without any instruction-tuning intermediary (RQ-4 pre-registers the counterfactual). **D2 (hyperparameter rescale):** 3 epochs → 15, warmup 50 → 5, because the spec's numbers never complete warmup on a 56-row corpus; loss converged 0.28 → 0.06. **D3 (N=9 test set):** capability-probe scope, reported as raw counts. **D4 (f16, not Q8\_0):** the quantizer overflowed on zero-range Mamba/vision tensors; f16 is structurally clean and fits the budget with room (RQ-5 pre-registers the head-to-head once upstream fixes land). **D5 (the gate lives in a new module):** the spec proposed wiring into a quarantined file; Stage 1 turns out to call no LLM classifier at all (pure regex), and the quarantine rule locks those four files regardless, so the feature flag lives in a standalone gate importing from nothing in the locked path, OFF by default. **D6 (isolated training venv):** the main environment stays pinned for production compatibility; the segregation discipline carried to every subsequent training pipeline. #### 3.4 Grammar, export, serving, and harness The GBNF grammar (665 bytes, SHA-anchored) is generated from a Pydantic schema via llama.cpp's native JSON-schema conversion, with one sealed implementation lesson: resolve $ref references before conversion. Export: safetensors adapter → merged GGUF f16 (12.8 MB), atomic writes throughout. Serving: a router preset with the adapter's lora = key and a deliberately small 2,048-token context (\~200 in, \~50 out per classification); LRU eviction reloads the preset in \~2 s. The A/B harness runs the 9 rows through candidate (LoRA + GBNF) and prompted-2B baseline on identical prompts at temperature 0.01, recording accuracy, F1 macro, grammar validity, and latency; both raw per-row results and the diff report are preserved. ### 4. Results \[sealed 2026-04-11; small-N register] #### 4.1 Training run 229.84 s wall-clock; 60 steps; loss 0.28 → 0.06; zero CUDA OOM, step-failure, NaN, or thermal events; ≤ 45 °C peak. Structurally clean end to end. The wall-clock economy against the 9B sibling arm, minutes rather than a day and a quarter, is what converts the recursive moat from a batch process into a daily cadence. #### 4.2 Live-fire, 5/5 Five out-of-sample strings, present in neither training, validation, nor test sets, spanning every canonical type: 8.8.8.8→ip · evil.example.com→domain · CVE-2024-3094→cve · →email · d41d8cd9…8427e→hash. All correct, all at confidence 1.0, consistent with the adapter having learned deterministic class-to-output mappings on a structurally tight task. Confidence *calibration* (is 0.95 less reliable than 1.0?) is explicitly uncharacterizable at this N and deferred to RQ-1's calibration curve. | Metric | Baseline (prompted 2B) | Candidate (LoRA + GBNF) | Δ | | ----------------- | ------------------------ | ----------------------- | ---------------------------- | | Accuracy | 0.222 (2/9) | **1.000 (9/9)** | **+0.778** | | F1 macro | 0.152 | **1.000** | **+0.848** | | Grammar-valid | 1.000\* (free-form JSON) | 1.000 (logit-enforced) | parity, different guarantees | | Latency p50 / p95 | 5,457 / 9,288 ms | 3,618 / 6,024 ms | −33.7 % / −35.1 % | ***Table 2.** The sealed 9-row A/B. \* Baseline validity is shape-only: wrong type/value 78 % of the time. Candidate p95 (6,024 ms) misses the spec's 1-second target; RQ-2 owns that investigation. Both arms identical prompts, temperature 0.01.* #### 4.3 Grammar validity, 21/21 Across every candidate emission (9 A/B + 5 live-fire + 7 validation): zero parse failures, zero schema violations, zero malformed JSON. This decouples the two properties the architecture pairs: structural validity is *guaranteed* by the grammar regardless of learning; task semantics are *learned* by the adapter regardless of the grammar. The grammar prevents shape failures the adapter wasn't trained to avoid; the adapter learns content the grammar cannot express. #### 4.4 Deviation impact None of the six deviations weakens the sealed verdict, and one strengthens it: D1's Base-path success is stronger evidence than the Instruct counterfactual would have been (specialization with no instruction-tuning at all); D2's rescale was structurally necessary and converged cleanly; D5's quarantine-forced gate produced a cleaner architecture than the spec's own proposal: zero diffs to the four locked files at seal, verified. ### 5. Discussion **Verdict first: the capability is proven; the dataset is small; the discipline scales** At the B2 register, this is the first peer-review-grade demonstration on this stack that in-weights sovereign specialization works at the micro-agent scale: +77.8 pp accuracy, +84.8 pp F1, 35 % faster than the prompted baseline, with structural validity guaranteed at the logit level. The N=9 caveat travels with every restatement. **The precedent class** Every subsequent specialist inherits the ten-step template this seal established, and the inheritance is documented, not asserted: each successor's recipe traces its lineage to this commit explicitly. The two sealed Cycle-13 empirical anchors are joint-necessity-orthogonal at the Pair's second half: the SSD pilot carries calibration-property retention at 9B (its primary hypothesis falsified, its survivor finding standing), and this paper carries first-instance feasibility at 0.8B. Neither alone establishes what the two together establish. **The recursive moat's first cycle.** The 56-row corpus is C₀ of the corpus-is-the-product loop: operator and collaborator generate the training substrate as a byproduct of doing the work, each cycle refines the next, and no external dataset can replicate it because no one else has the workflow telemetry that generates it. Longitudinal compounding measurement is deferred to post-fleet instrumentation, honestly. **Constraint as substrate** The pipeline-quarantine rule could read as drag; deviation D5 demonstrates the opposite. Forcing the gate into a standalone module kept the broadcast path untouched (zero on-air risk introduced), decoupled the gate from the call-graph (callable from any layer), and made production integration an explicit operator decision rather than an implicit merge side-effect. The 219-hour zero-event envelope the sustainability companion cites exists in part because constraints like this prevent the failure modes ad-hoc integration would introduce. **Six axes on which this result does not generalize** without replication: statistical population (RQ-1), seed variance (RQ-1 sweep), substrate (single sm\_120 card), corpus (RQ-3), base-vs-instruct (RQ-4), and quantization (RQ-5). The result as sealed is a point estimate on a 9-row probe plus a 5-row live-fire: a strong existence proof for the pattern, not a population claim. ### 6. Limitations Stated under the same calibrated-language discipline the classifier's own paper trail enforces. **N=9:** the Wilson 95 % interval on 9-of-9 is \[0.701, 1.000]; the lower bound comfortably clears the 22.2 % baseline, but the width forbids a tight claim. **Single seed (42), single substrate, single base:** variance across any of the three is unmeasured; the tiny trainable-parameter count argues for seed stability but does not demonstrate it. **Hybrid coverage:** Mamba blocks and vision tower are un-adapted, sufficient here but potentially insufficient for sequence-modeling agents. **Narrow task:** five IOC classes plus the unknown fallback, the six values the enum admits; behavior on truly novel IOC types is uncharacterized beyond the grammar's unknown fallback. **Asymmetric baseline:** a fine-tuned 0.8B beat a *prompted* 2B, and that baseline ran in free-form JSON mode, precisely the format-requesting regime Lee et al. (2026) identify as carrying the dominant cost; some share of the 22.2 % is plausibly that tax rather than a capability gap. The fine-tuned-2B comparison is RQ-4's question, not this paper's claim. **Grade:** Admiralty B2, preserved verbatim; promotion to A1 requires RQ-1. ### 7. Falsification Design: Five Pre-Registered Replication Questions | RQ | Threshold | Failure mode / instrument | | ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | RQ-1 Stat-significant retrain | Accuracy ≥ 0.95, F1 ≥ 0.93, grammar 100 % on N ≥ 50 held-out rows; Wilson lower bound ≥ 0.90; McNemar vs baseline p < 0.05 Holm-adjusted | < 0.90 falsifies generalization → investigate label noise, epochs, or larger base; also carries the calibration curve + cross-seed sweep. Gates B2 → A1. | | RQ-2 Latency floor | p95 ≤ 1.0 s at production-cadence dispatch on the RQ-1 retrain | Persistent > 1 s → router eviction/reload cost, preset pinning, or the sm\_120 FlashAttention regression; paired Wilcoxon on per-row latency | | RQ-3 Cross-corpus | Accuracy ≥ 0.90 + grammar 100 % on a different operator-curated class set (≥ 50 rows) at matched hyperparameters | < 0.90 → corpus-specific effect; characterize the accuracy floor as a function of corpus diversity | | RQ-4 Base vs Instruct | Paired arms, fixed corpus + seed; parity band ±5 pp | Instruct dominates > 10 pp → D1 was a cost, not neutral; Base dominates > 10 pp → instruction-tuning interferes; parity → clean architectural choice | | RQ-5 Q8\_0 vs f16 | ±2 pp at same corpus + seed, with footprint comparison | > 5 pp degradation → f16 is the correct deployment quant for this hybrid architecture. Gated on the upstream Mamba-tensor quantizer fix. | ***Table 3.** All five pre-registered in the same commit as the paper; each independently falsifiable, none gated on this paper's conclusions. A separate hash-sealed pre-registration document was deliberately not authored, because the capability-probe scope is too narrow, and this table is the pre-registration record, stated plainly.* ### 8. Conclusion **The first sovereign micro-agent works.** A 0.74 %-trainable-parameter adapter over a 56-row sovereign corpus, trained in 229.8 seconds on one consumer GPU, produced a structurally-perfect probe (9/9, F1 1.000, grammar 21/21) and a 5-of-5 out-of-sample live-fire, against a prompted baseline at 22.2 %. What the seal buys beyond the numbers is **architectural confidence to scale**: the template, the recipe class, the deviation-honesty discipline, and the corpus substrate all travel, and every specialist since has inherited them. The reader who walks the trail, from spec to recipe to sealed results to gate code to adapter binary, inherits a complete record: hypothesis, probe, six documented deviations, quarantine compliance, harness numbers, falsification design, and the moat's first cycle. The capability is proven. The dataset is small. The discipline scales. ### System Update: July 2026 (appended; the sealed body above is unmodified) Three developments since the 2026-04-11 seal bear on claims the paper could only state prospectively. None of them alters a sealed number, and the Admiralty B2 grade is unchanged. **The adapter has been resident in the production roster for 105 days.** The router preset for this micro-agent, the 0.8B base with the v1 LoRA hot-loaded and GBNF-constrained, has stood in the serving preset file since the seal. An infrastructure probe on 2026-05-21 found it loaded among the live presets, and it remains in the preset file at the time of writing, a file actively maintained as recently as 2026-07-12 when a different model was retired from it. Fifteen weeks of residency is an availability record, not a performance claim, and no performance claim is made from it: what it establishes is that a 12.8 MB adapter trained in under four minutes has been a standing production asset rather than a one-off experiment. **The precedent-class claim has been exercised.** §1.2 asserted that every subsequent specialist would inherit this template. In April that was prospective. On 2026-05-22, by operator decision at architectural review, the trainer written for this probe was selected as the canonical template for the Watcher cascade classifier, and a competing embedding-based trainer was rejected in its favour. The Watcher classifier is a scale-up of this recipe: the same rank-16, alpha-32, seven-projection LoRA geometry and the same causal-LM-plus-grammar output discipline, moved from a 0.8B to a 2B base and from six enum values to thirteen. The CTI-NER specialist shares the same base model and the same preset pattern. The template propagated as claimed, and the record of it is a dated decision rather than an assertion by this paper. **The Stage-1 gate remains closed, and the scope statement in §1.4 stands unchanged.** The feature flag still defaults off, no configuration enables it, and automatic Stage-1 triage insertion has never been switched on. That distinction is preserved deliberately: the adapter is a live, routable production asset, while the pipeline integration the paper deferred to operator authorization remains deferred. No invocation-volume statistic is offered here, because the gate that would generate one has not opened. RQ-1 through RQ-5 remain open and unrun, and the promotion from B2 to A1 still waits on RQ-1. *** *The Sovereign Stack · Sovereign IOC Classifier · Chapter 13 · Part IV · v2.1.0 · License CC BY 4.0 · © Jamey Kistner, OSINTelligence LLC* **Citation (preferred):** Kistner, J. (2026). *Sovereign IOC Classifier: A Capability-Probe Demonstration of the First In-Weights Micro-Agent on Consumer-Hardware LoRA Substrate.* OSINTelligence LLC research whitepaper, version 2.1.0 (capability-probe seal, Admiralty B2; July 2026 System Update appended). Cited in-series by title. *The reference list and provenance follow as a sub-page of this chapter.*