Doberman-Core / Tickets / #403 feat(policy): friction telemetry + gated tuning

#403 feat(policy): friction telemetry + gated tuning - doberman tune (closes #243)

Status: closed

Owner: nobody

Labels: None

Updated: 2026-08-18

Created: 2026-08-18

Creator: Anonymous

Private: No

Originally created by: fu351

Summary

Adds a friction report (interventions/session, top AUTH reasons, approval rates, weekly trend) plus standing-elevation proposals for AUTH classes approved every single time.
The report path (doberman tune) is pure aggregation and never applies anything by itself. doberman tune --accept <id> routes the proposal through the same possession-factor-gated weaken chokepoint as every other policy loosening (apply_standing_elevation, a structural sibling of apply_preferences_change), and only ever covers role_out_of_scope AUTHs — every security-relevant reason code is excluded by construction, not a per-code carve-out.
read_decisions/record_decision gain entity_id and session_id columns so the report can group by session.
tune is added to the control-plane subcommand block (shelling it out is the same tampering shape as revoke/2fa/taint) and to the CLI help-target matrix.
Also folds AGENTS.md's stale "Slice 0 - Bootstrap" section down to match CLAUDE.md's already-updated "bootstrap is done, read the real files" version — unrelated staleness noticed in passing, not touched by the feature itself.
Rebased onto latest main (post [#402]); resolved conflicts in README.md/CLI.md/CHANGELOG.md by keeping both sides' content.

Closes [#243].

[x] ruff check . / ruff format --check . — clean
[x] lint-imports — all 3 contracts kept
[x] python scripts/check_markdown_links.py — 46 files, no broken links
[x] Found and fixed a real gap during verification: the new tune command wasn't registered in test_cli_help.py's CLI_HELP_TARGETS allowlist, which failed test_cli_help_targets_cover_every_eager_command_and_group. Fixed.
[x] Scoped run across every touched module (friction, drift, log, cli-help, control-plane) — 226 passed, 0 failed
[ ] Full suite + coverage: this machine is currently too memory-constrained (~6GB free) to complete a full pytest -n auto --cov run locally without getting OOM-killed partway through (confirmed via two separate attempts); relying on CI for the full-suite gate

🤖 Generated with Claude Code