# Phase 7 Temporal Security-aware Metapath Trimming

Trimming selects evidence paths under each metapath before prompt construction.
It is not random sampling and not BFS truncation.

## Main Scoring Dimensions

- structural relevance;
- metapath diffusion similarity or its current explicit scaffold;
- temporal proximity to the target;
- behavior rarity;
- semantic similarity to target process/file/network context;
- path length penalty;
- security-stage relevance;
- rare path, parent-child, endpoint, or file interaction signals;
- valid target-relative time window.

## Output Contract

Each selected evidence path must include:

- `path_id`;
- `metapath_type`;
- ordered event IDs;
- ordered entity/event node IDs;
- timestamps;
- raw actions;
- selected reason;
- trimming score;
- summary status.

## Ablations

Random neighbors, shortest path only, BFS-only, no temporal term, and no
security-aware term are ablation or baseline settings only.