autoresearch: global threshold search

[Techris93]

Automated local autoresearch run.

Baseline F1: 0.864995 (FP=447, FPR=0.3921)
Best score: 0.874385 | F1: 0.875039 (FP=373, FPR=0.3272)

Report: /Users/chrixchange/.openclaw/workspace/secopsai/results/autoresearch-20260411-220009.json

Reproduce:

1. source .venv/bin/activate
2. python scripts/autoresearch_search.py --iters 200 --seed 1337 --fp-max 999999 --penalty 0.002

[cloudflare-workers-and-pages]

Deploying secopsai with    Cloudflare Pages

Latest commit:	66f17f0
Status:	✅  Deploy successful!
Preview URL:	https://fa8a3e90.secopsai.pages.dev
Branch Preview URL:	https://autoresearch-global-20260411.secopsai.pages.dev

View logs

[cloudflare-workers-and-pages]

Deploying website with    Cloudflare Pages

Latest commit:	66f17f0
Status:	✅  Deploy successful!
Preview URL:	https://5d3c7371.website-bks.pages.dev
Branch Preview URL:	https://autoresearch-global-20260411.website-bks.pages.dev

View logs

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 66f17f0440

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve original source labels during normalization

normalize_source_fields remaps any source outside {openclaw, macos, linux, windows, correlated} to openclaw, which causes valid sources like the threat-intel pipeline’s "secopsai-intel" (emitted by secopsai/intel.py) to be mislabeled on sync. In that case the row is ingested as application/openclaw instead of its original source, which breaks downstream filtering/attribution and can mix intel findings with detector findings in the dashboard.

Useful? React with 👍 / 👎.