SwarmMarshal
Deterministic fast path
High-confidence bulk mail from non-VIP senders skips the model entirely — a tier-one deterministic pass fills the fields and moves on. The LLM is reserved for mail that actually needs judgment.
Technology deep dive
The message pipeline: one call, every answer, with proof.
Enrichment is the load-bearing AI pass in SwarmMarshal — it turns raw mail into threat verdicts, routing, summaries, commitments, facts, and memory. Because it runs on everything you receive, it gets the strictest engineering in the product: deterministic fast paths, calibration gates, replay harnesses, and cost governance.
One model call per message. Often zero.
A single consolidated pass emits every per-message AI field at once — threat, inbox routing, category, summary, entities, commitments, facts, action items, a reply draft, and memory candidates — instead of a fleet of per-field calls.
Prompt-cache boundary
The prompt is split so the static prefix — instructions, taxonomy, memory — is roughly 97% of input tokens and identical across messages, letting provider prompt caching absorb most of the cost of every call.
Validate, then persist
Model output is a draft. Deterministic validators check contract shape, enum legality, exact-quote grounding, and knowledge gates; a repair pass fixes what it can, and ungrounded claims are dropped before anything durable is written.
Headers are distilled, never dumped.
Raw mail headers are noisy enough to poison a classifier — a provider's own antispam headers contain brand names and digit runs that look exactly like impersonation signals. SwarmMarshal distills headers into compact, prompt-safe evidence instead.
Signals, not haystacks
Authentication verdicts, Reply-To and Return-Path alignment, list headers, provider spam scores, and brand-domain mismatch are extracted into a structured block. Raw header excerpts only surface when the signals are already suspicious.
Brand impersonation table
A curated brand-profile table backs impersonation checks — "claims to be Microsoft, sent from a domain Microsoft doesn't use" is a lookup, not a hunch.
No prompt or model change ships without passing the gauntlet.
The pipeline's prompt, validator, and scorer are bound to one shared taxonomy, and calibration renders through the exact production prompt path — byte-identical, never a hand-edited copy.
-
Build ground truth Real mail is sampled and labeled by a frontier model into calibration cases, alongside hand-seeded cases for known hard categories.
-
Score deterministically A weighted per-section scorer grades every output with critical / major / minor severities — a missed phishing verdict is not the same class of error as a bland summary.
-
Gate the promotion Promotion requires zero critical failures, zero parse failures, and pass-rate and weighted-score floors. Results are recorded by prompt hash and hardware key, and routing fails closed without passing proof.
Live traffic is never the experiment.
Production replay harness
Pipeline changes are proven by running the real registered production task — the actual validator, repair, and finalizer path — over a cloned throwaway profile with seeded fixtures. Not a mock of the pipeline; the pipeline.
Champion / challenger replay
The champion model always serves. Captured production prompts are periodically replayed offline against challenger candidates, and a judge decides whether a cheaper challenger reaches the same answers — promotion happens on evidence, demotion risk never touches your inbox.
A staged funnel, not a leaderboard.
Picking a local model for the pipeline is a decision system: refresh Model Scout priors → build hardware-fit candidates → run a structured-output compatibility probe → run the full seed suite only for survivors → promote and warm the winner, unload the losers. Runtime-repair failures are distinguished from genuine model incompatibility, and every verdict lands in a catalog keyed by prompt hash and hardware.
No inline benchmarking on the ingest path
Route guard admits or degrades every final route
5-minute circuit breaker when a route is down
Junk never earns a frontier model.
The pipeline treats spend as a design constraint: obvious junk is stopped cheaply, provider verdicts are trusted but verified, and learned senders never cost tokens again.
Quick junk precheck
New, untaught senders pass a cheap pre-pipeline gate — deterministic link, phone, and renewal-scam extraction plus a small prompt. A threat verdict short-circuits the heavyweight pipeline so obvious junk is never indexed or enriched.
Reverse spam rescue
Provider-flagged spam is reviewed for false positives — but only messages with independent innocence signals (clean authentication plus threading, contact, or transactional evidence) earn a model call. Everything else stays junked for free.
Sender skip masks
Teaching a sender sets skip masks that mark the AI processors complete without running them. Taught mail flows through the pipeline at zero model cost, forever.
Bulk classification pinned to no-marginal-cost models
Hard per-call and per-token caps on background work
Metered cloud fail-over is opt-in with a daily cap
The phishing detector patches itself.
Brand-impersonation and callback-scam heuristics live in one shared deterministic module — the same code in production and in analysis, so they can never drift apart. Around them runs a correction loop:
-
Diagnose A misclassification analyzer inspects false positives and false negatives and names the failure pattern.
-
Patch A prompt auto-improvement service injects versioned learned-guard overrides into the detection prompt — a targeted fix, not a rewrite.
-
Guard the regression A regression suite — including PII-filtered known-phishing cases published as a versioned bundle on this website — is replayed so a fixed mistake stays fixed.
Memory is reconciled, not just accumulated.
A background reconciliation agent merges, retires, and updates durable memories against evolving evidence instead of appending forever. Combined with the enrichment validators — knowledge-worthiness gates, grounded-quote requirements, trust-gated promotion — long-term memory stays an asset instead of becoming sediment.
Keep reading
The rest of the stack.
The pipeline feeds the knowledge graph and context engine; Model Scout decides what it runs on.