score_process

Risk scoring, plus two subsystems added since the original write-up: rule-based verdict explanation (scoring/explanation/ — composes the analyst/reporter "why this verdict" text) and the deterministic narration safety-lock and prompt builder (scoring/narration/) the ai_narration connector calls. TheHive/MISP pushes and reporter SMTP notification now happen via the connectors framework's case_finalised event, not inline here.

Allow-lists take part in scoring as votes: collect.collect_votes builds one engine.Vote per analyzer and score_case applies the allow-list-majority rule to them. See Allow-lists.