Correlation engine approved on review — 916-line module with 3-layer processing (entity resolution, cross-stage link graph, timeline builder) integrated as Stage 5.5 between Normalizer and Reporter. Tested with 16 events producing 11 cross-source links (5 HIGH confidence).
review-required handoff: ```json { "changed_files": [ "/home/kanfl/.hermes/background-check/correlation.py", "/home/kanfl/.hermes/background-check/orchestrator.py" ], "new_module_lines": 916, "orchestrator_changes": "3 patches: import block, docstring, Stage 5.5 insertion + reporter section", "test_output": "verified with realistic sample unified JSON (16 events, 11 links, 3 entities resolved)", "graceful_degradation": "verified with empty JSON — produces empty report gracefully", "decisions": [ "fuzzy matching uses thefuzz if available, stdlib fallback otherwise (no pip install required)", "addresses pre-merged by city+state before link generation to deduplicate Phase 0b scraper overlap", "links deduplicated by (source, target, link_type) key", "entity confidence: HIGH=3+ sources, MEDIUM=2, LOW=1 — counts identity match, AKA matches, and social profile matches", "timeline sorts unknown-date events to end, current events last" ] } ``` **What was built:** correlation.py (916 lines) — 3-layer correlation engine: - **Layer 1 (Entity Resolution):** Fuzzy name matching across Phase 0b + Maigret profiles. Resolves name variants (full, AKA, reversed) into unified entities with source counts and confidence scores. - **Layer 2 (Cross-Stage Link Graph):** Links Phase 0b addresses → Maigret profile locations (HIGH/MEDIUM/LOW confidence by match quality), Holehe registrations → h8mail breaches (by email), WHOIS domain → registrations, phone → address, social → breach cross-references. Produces 11 links from our test case (5 HIGH, 2 MEDIUM, 4 LOW). - **Layer 3 (Timeline Builder):** Chronologically orders all dated findings across stages (breach dates, registration dates, profile creation dates, WHOIS dates, addresses). 16 events in test case, 11 with dates spanning 2018–2027. **Integration:** - New Stage 5.5 in orchestrator between Normalizer and Reporter - Reporter now auto-includes Section 11 (Cross-Source Correlation) when correlation data exists - Graceful degradation if correlation module not importable (no crash) **Key highlight example:** "HIGH CONFIDENCE: 2 sources confirm address at Kingston, OK" — exactly matching the requested format.