feat(aegis): acquired tolerance + PRIVILEGED surface state — the monitor learns

[opencdlee-dotcom]

Two layers from the 55-incident triage session — the monitor now learns from the operator's own verdicts, and stops mistaking an OS privilege wall for a broken sensor.

Acquired tolerance — identity-level immune memory over typed dismissals

The exact-fingerprint reattach tolerates identical re-observations and _category_dismissal_weights decays a noisy category's risk weight, but nothing in between existed: a vendor updater rewriting the same plist presents a new content hash every release, so the same reviewed identity re-opened a fresh HIGH incident per update, forever (that per-identity churn was 55 of 55 triaged incidents, and 12 more opened during the session itself).

• Only human benign-positive verdicts teach: >=3 distinct dismissed incidents on one hash-stripped identity inside 180 days. false-positive labels tune rules instead; machine verdicts write no dismissal row, so tolerance cannot feed on itself and backtest precision stays human-labeled.
• Antigen-specific: identity = fingerprint minus its trailing content hash; only hash-churning categories are eligible (allowlist). A beacon's endpoint, a path, a marker set are facts — new one = new incident, always.
• Inflammation overrides: never CRITICAL, never above the reviewed severity, never attack-defined evidence (decoy:/latch:/canary:), never while the identity has an active incident.
• Visible, disputable: incident still created with full evidence, closed auto-tolerated citing precedent count, shown as TOLERATED + a footer on the active listing; one reopen re-alerts and revokes (it deletes the dismissal rows the count was built on).

Live: the operator's existing dismissal history already confers tolerance on the four OneDrive updater plists (4 verdicts each) — the next OneDrive release closes itself instead of opening 4 HIGH alerts.

BTM: PRIVILEGED surface state for admin-only sfltool dumpbtm

macOS 26 moved dumpbtm behind system.privilege.admin; the unprivileged harvest the sensor was built on no longer exists there. The sensor reported that permanent OS wall as a broken sensor — DEGRADED x543 consecutive failures feeding one immortal HIGH coverage incident.

• The authorization signature (never a bare non-zero exit) now returns SURFACE_PRIVILEGED: a named permanent coverage gap — i in doctor/status, never green, never an incident. Transient failures keep the old None -> DEGRADED -> escalate contract exactly.
• Never forges last_ok_at, never adopts a denied read as baseline, auto-resolves the existing degraded incident with the honest privileged-only resolution.
• Live-verified on the machine that hit it: surface.btm PRIVILEGED failures=0, incident #26 self-resolved.

Verification

• 20 new tests (tests/test_tolerance.py, tests/test_btm_privileged.py): verdict floor, severity escalation, dispute-by-reopen, stale-verdict expiry, no-feedback-loop, auth-signature detection, transient-vs-permanent health, no-fabricated-findings.
• Full suite: 873 passed, 4 skipped (platform-scoped), 11 subtests.
• Deployed to the live monitor and verified: queue went 55 -> 0, DEGRADED churn stopped.

🤖 Generated with Claude Code