#242 Session weak-signal correlator (raise-only)

[Anonymous]

Originally created by: fu351

Single low-risk signals are individually unactionable; in sequence they form the pattern that matters — untrusted ingress, then sensitive-path access, then external egress is the lethal trifecta. The decision log already persists everything needed (session_id, reason codes, risk, action type, path class, source context).

Build

• A small pattern engine over the last N decisions in the current session: YAML-declared boolean clauses, with shipped defaults for the lethal trifecta, an escalation chain, and a destructive flow.
• A match contributes a raised result through the normal combine() — AUTH by default, BLOCK for the trifecta in strict and paranoid — never a bypass of the execution rule. Fires once per (session, pattern). Reason code CORRELATED_<PATTERN>, with an explanation naming the contributing decision ids.
• Default patterns are a policy floor: removing or weakening one goes through the policy-weakening gate.
• Correlator failure adds nothing (verdicts untouched) — in a raise-only architecture the correlator can only add protection, so its failure mode is inherently safe.

Tests must prove: the trifecta across three decisions raises exactly once; the same signals across different sessions do not; an exception inside the correlator leaves verdicts untouched; pattern removal requires the weaken gate.

Prior art: Cisco DefenseClaw's session correlator (which hard-blocks around its own profile thresholds; ours stays inside combine). This is also the approval-fatigue lever: one correlated escalation replaces many weak per-event prompts.

[Anonymous]

Originally posted by: fu351

A council review of RAND's AI Security Guide (TLA4174-1) surfaced a signal this correlator is the natural home for, so recording it here rather than opening a separate issue.

RAND's control on limiting autonomous execution depth names a real gap: an agent — or a prompt-injected tool result — that fires many rapid, individually-low-risk actions. Each clears the per-action bar, and a homogeneous low-severity burst may match none of the content patterns planned here (lethal-trifecta, escalation chains, destructive flows). That's a velocity/volume blind spot the content patterns alone won't catch.

The fix belongs inside this correlator as one more weak signal, not as a standalone action-count cap: a reason-code-weighted count over the session window, feeding the same single escalation the content patterns feed. Keep it expressed inside the execution rule — a signal that can only raise — never a blind threshold that short-circuits the rule (the DefenseClaw mistake ADR 0058 rules out). Default it off or high and scope it per policy mode so a legitimate long run never trips it. Any tunable threshold tunes through the friction-telemetry path in [#243], never a hand-set number an agent can learn and stay under.

[Anonymous]

Originally posted by: fu351

Closing as shipped. The session correlator landed as [#365] (engine/correlator.py): correlated-trifecta and destructive-flow patterns over recent session decisions, raise-only, at the executor seam (ADR 0071 records why the seam, not decide()). The D2 task-match leg followed in [#369]. What this issue called "weak-signal correlation" beyond those two patterns now lives with [#243] (friction telemetry) and the detection-corpus work, which is where new correlated patterns will be justified by measurement rather than intuition.

[Anonymous]

Ticket changed by: fu351

• status: open --> closed