Feedback becomes a training candidate
When you tell the console that a decision was right or wrong, that verdict does not silently become training truth. It becomes a candidate that has to pass a check first. This page explains the loop: how your feedback is captured, the fidelity gate it must clear, and why nothing trains automatically.
Your verdict starts the loop
After an incident you can record a verdict on it, and only two are accepted:
- Attack: the system was right to act.
- Legitimate: it was a false alarm.
Recording a verdict marks the incident as a feedback candidate. It changes no status on the device, triggers nothing on the machine, and is invisible to the daemon. You can also correct a verdict you gave earlier.
The fidelity gate
A verdict only becomes a usable candidate if the evidence behind it is trustworthy. Each candidate is checked, and dropped if it fails:
- Has a diff: a candidate with no stored redacted change is dropped.
- Faithful diff: the stored change must provably correspond to the text that was actually judged; an unrecognised or absent fidelity marker is dropped.
- Counted, not hidden: dropped candidates are tallied by reason, never silently discarded.
A candidate, not a training run
Passing the gate does not train anything. The step that gathers candidates is read-only: it writes nothing back to the device and nothing back onto the record. Your verdict still has to pass the same independent re-check as any other label before it can enter a dataset. There is no automatic training, no model change, and no silent flip.
What a candidate carries
A candidate is the incident reduced to what a re-check needs:
| Field | Meaning |
|---|---|
path | The file the incident was on |
redactedDiff | The judged change, redacted and added-only |
diffFidelity | The provenance marker the gate checks |
danger | The graded danger value, when present |
verdict | Your judgment: attack or legitimate |
submittedAt | When the verdict was recorded |
Read next
Where the incidents and verdicts live: incidents and audit. What the redacted diff actually contains: what Cloud mode sends. The hold your verdict is about: user confirmation prompts.
Your judgment counts, and is still checked.
Feedback becomes a re-checked candidate, gated by fidelity, never blind training. Reviewed in the console.
Sign me up