Complete capstone exemplar: historical phishing triage

{
  "project": "phishing-triage",
  "selected_family": "forest",
  "threshold": 0.3,
  "training_seeds": [
    11,
    23,
    37,
    53,
    71
  ],
  "inner_cv_fits": 30,
  "evaluation": {
    "selected": "forest",
    "threshold": 0.3,
    "test_rows": 2107,
    "ensemble": {
      "method": "frozen_ensemble",
      "seed": null,
      "n": 2107,
      "tp": 883,
      "tn": 1089,
      "fp": 114,
      "fn": 21,
      "precision": 0.8856569709127382,
      "recall": 0.9767699115044248,
      "specificity": 0.9052369077306733,
      "selection_rate": 0.4731846226862838,
      "fpr": 0.09476309226932668,
      "balanced_accuracy": 0.941003409617549,
      "f1": 0.9289847448711205,
      "cost_per_1000": 103.93925011865211,
      "brier": 0.03998443666933738
    },
    "baseline": {
      "method": "training_prior",
      "seed": null,
      "n": 2107,
      "tp": 904,
      "tn": 0,
      "fp": 1203,
      "fn": 0,
      "precision": 0.4290460370194589,
      "recall": 1.0,
      "specificity": 0.0,
      "selection_rate": 1.0,
      "fpr": 1.0,
      "balanced_accuracy": 0.5,
      "f1": 0.6004649618067087,
      "cost_per_1000": 570.9539629805411,
      "brier": 0.2453431477663539
    },
    "test_labels_used_for_selection": false,
    "uncertainty": "Illustrative exact-profile bootstrap conditional on this split and fixed models; not domain/campaign independence or population coverage."
  },
  "split_sensitivity_run": true,
  "live_deployment_approved": false
}

Historical UCI Phishing Websites, DOI:10.24432/C51W2X, CC BY 4.0. No live URLs, customer records or credentials are used.

Hyperparameters use group CV inside training. Threshold/family choices use mean validation cost across the predeclared training seeds. Final labels select neither configuration nor seed.

Every stochastic run is reported; no best-seed cherry-picking. Seed standard deviation is conditional on fixed data and is not a confidence interval for generalization.

The profile bootstrap is illustrative and conditional on the split and frozen models; exact-profile grouping cannot establish domain/campaign/time independence.

Source-order monitoring is an offline rehearsal. The release decision rejects live deployment pending prospective evidence, feature-availability review and operational approval.