[FIX-3] Decision policy v3: AI-benign alerts close; retro-reopen on a related threat replaces the forward gates #348

Founder decision, 2026-11-09: "All benign must be closed; you figure it out, you are the technical leader." Decision policy v3, designed by the lead. It supersedes the FIX-1 and FIX-2 model-close gates. This is Phase 1 of the alert-fatigue plan.

Measured on dev run 2 (100 corpus_v1 Wazuh alerts, DeepSeek; 60 benign, 40 malicious):

29/60 is the ceiling for any rule based on the AI's verdict. The other 31 benign alerts get an "inconclusive" or "malicious" verdict from the model itself; Phase 2 (context, memory, skills) addresses those.

Policy v3: model-led close at tier auto_full_audit. The tier is per tenant and defaults to off. Close when all of these hold:

• the deep analysis verdict is benign, whatever its certainty;
• the fast tier did not say likely_threat;
• severity is info, low, medium or high (critical escalates);
• the alert is not in a never-close class (credential access including the vendor auth-failure groups, log clearing, tampering, ransomware, named persistence);
• there is no steering text and no recent true positive on its entities.

Removed:

• the 8/85 thresholds;
• the campaign block (_campaign_in_progress);
• the unmapped block for the model close. The vendor_unknown block stays.

Safety net (new):

1. Retro-reopen. When an alert on a host, user or source IP becomes a threat (plan_response, an escalation with a malicious or suspicious model verdict, an analyst true positive, or a blind-audit malicious label), every model_closed alert of the same tenant that shares one of those entities and was closed in the previous 24 h is:

   • reopened;
   • attached to that escalation as related;
   • audited as alert.reopened with reason related_threat.

   This replaces the forward-looking campaign check with a backward one, so a single attack step the model misjudged resurfaces as soon as the attack shows itself anywhere.

2. Audit. Every model close stays model_closed / ai_closed:audit_required, visible in the audit list, and enrolled in blind audit.

3. Correlation keeps showing such alerts as ai_closed_unaudited, never as benign.

Acceptance:

• Dev: rerun 100 alerts; benign closed is about 25/60 or more. Every malicious alert the model closes is reopened by retro-reopen once a related threat appears, or is listed and explained.
• Eval: corpus_v1 and adversarial_v2 at auto_full_audit (fake model plus DeepSeek simulation) report benign and malicious closes, both before and after retro-reopen.
• INV-03: amended with proofs (tier off never closes on the model's word; critical and never-close classes never close; retro-reopen fires on every threat path).
• Review: one adversarial review round. A sub-feature that fails twice is deferred.