An Auditable Review-Referral Framework for Public PE Malware Scores at Software Supply-Chain Gates

This study presents an auditable decision-governance procedure for converting existing malware-suspicion scores into additional-review referrals at software supply-chain gates under limits on false-positive rate (FPR), review capacity, and minimum recall. Instead of a new detector or selection rule, it applies constrained cost minimization on validation data only, freezes thresholds before testing, records versioned model, score, data, and approval links, and preserves every infeasible or failed result. EMBER, SOREL-20M, and BODMAS are generic benchmarks, not supplier-intake records. Of 1152 registered Policy Cβ profiles, 384 were infeasible because capacity and minimum recall conflicted arithmetically and 48 because no observed threshold met all limits. At minimum recall 0.90, all limits were retained on test in 28 of 112 validation-feasible EMBER profiles. For SOREL, retention was 0 of 128 on the prespecified official test-result file and 112 of 128 in a rescoring sensitivity analysis, which cannot validate the official result. Without verified file-level alignment, its cause is unresolved. A binding recall floor selected thresholds that then failed it on EMBER test data. Sensitivity analyses show, for the observed validation scores, when thresholds remain feasible over stated input ranges; an exploratory evidence gate adds pointwise margins, not guarantees. All results require prospective organizational validation.