dos-enforce-tunelisted

# dos-enforce-tune — the loop where DOS tunes its OWN enforcement, from outcomes > **DOS is a sound PDP with no feedback from the PEP.** The kernel decides an > intervention verdict, a host acts on it, the act is journaled — but nothing fed > *whether the act was right* back into the policy that drove it. This loop closes > that. It learns the enforcement thresholds from the journal's own ground truth: > a deny the operator **later overrode** is a false-DENY (too aggressive); a deny > that stood is a held catch. The loop tunes the policy to drive false-DENIES down > while holding the catches — and keeps an edit **only if the kernel, not the > agent, measures that it helped.** This is [[dos-self-improve]] pointed at the enforcement policy, with one twist: the metric is not a generic count, it is the docs/143 `net_task_delta` of the policy over labelled cases the loop did not author. > A self-tuner's fatal failure mode is grading its own homework — relabelling its > outcomes so its policy edit looks good. `dos enforce-tune` closes that hole the same > way `dos improve` does: the metric is computed BY THE KERNEL from cases the loop did > not author (a frozen corpus ∪ the live enforcement journal). The loop **cannot keep > a policy edit by claiming it is better.** The only path to KEEP is to actually move > `net_task_delta`. ## What the kernel decides vs. what you do | Step | Who | What | |---|---|---| | **Read the outcomes** | `dos enforce-outcomes` | the live false-DENY /