DECNET

Files

anti 6a4592a8f5 test(clustering): low/very-low tier safety + F1/F2 ratchets

Pins down the tier-discipline contract end-to-end:

- Credentials-only overlap doesn't fuse observations (F1 in
  miniature).
- ASN-only overlap doesn't fuse observations (F2 in miniature).
- All three weak tiers (medium + low + very-low) stacked still
  don't fuse — only a high-tier signal does.
- F1 (shared_wordlist) at identity-level: no false merges, every
  row is its own predicted cluster, homogeneity = 1.0.
- F2 (vpn_hopping): 5 distinct ASNs collapse into 1 predicted
  cluster, proving JA3 / HASSH dominate ASN as the design
  requires.

The combination math itself was wired in commit 5; this commit is
the failure-mode regression suite that gates future tuning of the
tier weights.

2026-04-26 08:25:23 -04:00

__init__.py

feat(clustering): UKC phase enum + synthetic campaign factory + metric harness

2026-04-26 06:29:10 -04:00

fixture_harness.py

test(clustering): fixture 7 slow_burn + recency_decay reference

2026-04-26 07:58:23 -04:00

metrics.py

feat(clustering): UKC phase enum + synthetic campaign factory + metric harness

2026-04-26 06:29:10 -04:00

test_campaign_factory.py

test(clustering): factory honors ip_pool: rotating + 3-level truth labels