Your best model only hears real speech. And the routing gets signed.
Most of a voice call isn't speech that needs your top model. It's silence, hold music, background noise, touch-tone beeps. AFiR-Stream-Route checks each piece with a cheap classifier running at the edge, sends it to the cheapest model that can handle it, and locks that routing decision into the receipt for that piece. Your model costs drop. The real advantage is the proof: you know exactly which model handled which piece, signed, every time.
Squeezing the audio file smaller is the wrong fix. Routing it smarter is right, but only if you can prove it.
Audio is already compressed and already just a stream of bits. The real cost and delay come from the model doing its thinking, not from moving the audio around. What actually helps is sending less audio to your expensive model. Routing by content already exists elsewhere. What's missing is a tamper-proof record showing which model actually handled each piece. In regulated voice work, that record is what an auditor wants to see.
Wrong problem to fix
Shrinking audio that's already compressed doesn't make the model think faster, and it risks losing details the model needs. The real cost is in the model's thinking, not the file size. Compression fixes a problem you don't actually have.
No proof of the route
Sending silence to a cheaper model saves money. But with no signed record, you can't prove your compliant model actually handled the speech that carried health data. An unsigned log is just a claim, not proof.
Changes go unnoticed
A routing table sitting in a vendor's database, with nothing tamper-proof tracking each decision, means someone could quietly rewrite it later and claim a cheap-model piece went to the compliant model. Nobody would ever know. There's no audit trail you can carry with you.
Classify it, route it, sign it. The routing decision gets locked into the receipt for that piece.
A lightweight classifier runs right at the edge as pieces arrive from AFiR-Stream. Each piece gets a content type, gets sent to the cheapest model that can handle it, and the routing details (content type, which classifier decided, which model handled it, and the policy in effect) get locked into that piece's signature. This doesn't change the core signer at all. It just uses the live SiGR signer as is.
EDGE CLASSIFIER ROUTE BY CONTENT CLASS SIGN + VERIFY --------------- ---------------------- ------------- segment in --> content_class --+ ( AFiR-Stream segmentation ) | v +-------------------+ speech --> asr-frontier-compliant | classifier | overlap --> asr-frontier-diarize | mir:vad-class-v2 | silence --> drop ( no model ) +-------------------+ noise --> cheap-classifier | tones --> dtmf-decoder v materiality (AFiR-S) override? high-consequence segment always routes to compliant frontier model | v +------------------------+ +----------------------+ | routing block | ---> | ML-DSA-65 signature | <-- per segment | content_class | | bound into receipt | | classifier_ref | +----------------------+ | routed_to ( model ) | | | policy_id | v | materiality_override | offline, zero-secret verify +------------------------+ ( rewrite a route -> verify fails )
Each content type goes to the cheapest model that can handle it.
The policy in effect gets fingerprinted and locked into every receipt. Change the policy and the fingerprint changes too, so you can prove exactly what policy produced the route a customer was billed for.
Four guarantees. Each one tested. Each one catches tampering.
All four are locked into the same signature for each piece. Tamper with the content type, the model it went to, the policy fingerprint, or an override flag, and the check fails offline every time.
Every piece is tied to the model that actually handled it.
The content type, which classifier made the call, and which model the piece was routed to are all part of that piece's receipt. This link between a piece and its route is itself tamper-proof. Rewrite which model handled a piece, and the check fails.
- routing: { content_class, classifier_ref, routed_to }
- policy_id records the routing policy in effect
- tamper test: rewriting routed_to fails the offline check
- each piece is provably tied to the model that actually processed it
The compliant model handled every sensitive piece, and it's signed.
This is the real advantage. In regulated voice work, the question an auditor asks is: did a compliant model handle the speech that carried health data? Because routed_to names the verified compliance model and gets locked into the signature, you have a signed answer for every piece that nobody can fake.
- routed_to names the verified compliance model
- signed for every piece, checkable without sharing any secret
- you can prove the compliant model handled the sensitive piece
- this is an answer no unsigned routing log can give you
You never save money on the piece that actually matters.
A piece flagged as high-stakes by AFiR-S, like a payment instruction or a consent statement, always goes to your compliant top model. That overrides a borderline content classification. The override itself gets recorded and locked in, so you can prove the escalation happened.
- a consequence or stakes measurement can override the content type
- the materiality_override flag is locked into the receipt
- test case: a borderline noise piece with 9200bp of consequence got escalated
- you can prove the high-stakes piece got the compliant model
The receipt proves what it was routed to. It never claims the routing was the best possible choice.
The asserts field is set to routing_provenance_only. That proves the named piece was assigned a certain content type and sent to a certain model under a certain policy. It doesn't claim the routing was optimal, the classification was correct, or the transcript was accurate. We never claim more than what's true.
- asserts: "routing_provenance_only"
- this proves the assignment happened, not that it was the best choice
- whether the classification itself was correct is a separate, stated limit
- this works together with stream provenance and the post-quantum session lock
Built and tested. Real numbers. Tampering gets caught.
A twenty-piece call, classified and routed in a fresh run against the live signer. Six checks, all six passed. The numbers and fingerprints below are the real output of that test.
Checks passed 6 of 6 pass
- 1✓A mixed stream got classified and routed correctly, all twenty pieces
- 2✓Silence and noise got routed away from the top model
- 3✓Every receipt checks out offline, with no secret key, untampered
- 4✓Rewriting a cheap-model route to the compliant model breaks the signature
- 5✓A borderline, high-stakes piece got escalated to the compliant model
- 6✓One ML-DSA-65 signature per piece, with the routing details locked in
Signed test-run results
Twenty pieces total: 6 speech, 1 overlap, 7 silence, 4 noise, 2 non-speech tones. The top model saw 8 of 20. Seven silence pieces were dropped with no model at all. One borderline noise piece with 9200bp of consequence got escalated to the compliant model. All twenty receipts check out untampered.
Classify the piece. Route it. Sign the route. Check it offline.
Drop the classifier in front of your AFiR-Stream signer. Each piece gets routed to the cheapest model that can handle it and gets one post-quantum-locked receipt with the routing decision built in. Anyone with the public key can check the whole call offline.
import { classify, route, signSegment, verify } from "@hive/afir-stream-route" // 1. classify each piece at the edge: cheap, microseconds, no top-model cost const cls = classify(segment) // speech | silence | noise | non_speech_signal | overlap // 2. route to the cheapest model that can handle it. high-stakes pieces can override this const r = route(cls, { policy: ROUTING_POLICY, // policy_id = 0xa04681...32fe46 materiality_bp: segment.consequence_bp, // high-consequence -> compliant model }) // r.routed_to -> "mir:asr-frontier-compliant" (only for real speech) // silence -> "drop" noise -> cheap-classifier tones -> dtmf-decoder // 3. lock the routing details into the piece's signature: one post-quantum receipt per piece const receipt = await signSegment(segment, { routing: r, // content_class, classifier_ref, routed_to, policy_id asserts: "routing_provenance_only", // proves assignment, not that it was optimal }) // 4. anyone can check it offline: no shared secret, no calling home const { ok } = await verify(receipt, PUBLIC_KEY) // try to claim the compliant model handled a cheap piece by rewriting routed_to -> ok === false
Built for real-time voice that has to hold up under an audit.
Anywhere a regulated voice stream routes across models, and an auditor is going to ask which model handled the sensitive part.
HIPAA voice agents
Speech carrying health data is provably handled by the compliant model, piece by piece. Silence and hold music get routed away, so your model cost drops and the proof still holds.
PCI call centers
Payment-instruction pieces get escalated to the compliant model based on stakes, and it's signed. Touch-tone beeps go to a cheap decoder, never your top model.
Voice infrastructure and call-center platforms
Cut your top-model spend on the non-speech part of every call, while selling auditable routing proof to your regulated customers. The meter still runs on receipts.
Verified agents
Efficient real-time agents that can prove they routed efficiently: not overcharging by sending silence to the top model, and not cutting corners on what actually matters.
