docs(23): add Classification Disposition + Per-Client Automation Gate phase

Scoping a dedicated "User Awareness" verdict for confirmed phishing-simulation
reports (KnowBe4/Breach Secure Now) plus a per-company automation gate for the
parse/classify/report-to-ticket pipeline stages. Surfaced live during Phase 22
review of a real Breach Secure Now report (ticket 699415).

.planning/ROADMAP.md

@@ -368,6 +368,7 @@ of a functional dependency on Phase 21.
 - [x] **Phase 20: Remediation, Approval & Audit Safety** — Proposed-only remediation actions, approve/remediate/mark-false-positive APIs, idempotent re-run, full audit trail (completed 2026-07-16)
 - [x] **Phase 21: Autotask Triage Note** — Sanitized internal triage note posted via existing safe note-write path, or returned via API if no such path exists (completed 2026-07-16)
 - [x] **Phase 22: Approval UI (LiveLink)** — Ticket-ID-addressable Pulse page (Autotask LiveLink target) showing campaign timeline, evidence, and classification, with approve/remediate/mark-false-positive wired to the Phase 20 APIs (completed 2026-07-16)
+- [ ] **Phase 23: Classification Disposition + Per-Client Automation Gate** — Dedicated "User Awareness" verdict for confirmed phishing-simulation-vendor reports (currently forced into generic UNWANTED), plus an admin UI gate controlling per-company whether the phishing pipeline (parse/classify/report-to-ticket) runs automatically or requires manual trigger
 
 ## Phase Details
 
@@ -525,6 +526,16 @@ Phases execute in numeric order. v1.0 (Phases 1-9.1) shipped 2026-07-10. v2.0 (P
 - [x] 22-06-PLAN.md — Review page + campaigns list page + nav entry (REVIEW-01, REVIEW-05, REVIEW-06)
 **UI hint**: yes
 
+### Phase 23: Classification Disposition + Per-Client Automation Gate
+
+**Goal:** Add a dedicated "User Awareness" verdict for confirmed phishing-simulation-vendor (KnowBe4/Breach Secure Now) reports — today forced into the generic UNWANTED bucket despite the classifier already detecting the simulation vendor and explicitly skipping the THREAT tier — and add an admin UI gate page letting an admin choose, per Autotask company, whether the phishing pipeline's parse/classify/report-to-ticket stages run automatically (now that the previously-dead Autotask webhook is fixed) or require the existing manual Analyze/Classify/triage-note triggers.
+**Requirements**: TBD
+**Depends on:** Phase 17, Phase 18, Phase 19, Phase 20, Phase 21, Phase 22
+**Plans:** 0 plans
+
+Plans:
+- [ ] TBD (run /gsd-plan-phase 23 to break down)
+
 ---
 *Roadmap created: 2026-05-03*
 *v2.0 phases added: 2026-07-10*

.planning/STATE.md

@@ -99,6 +99,13 @@ Recent decisions affecting current work:
   classification, with approve/remediate/mark-false-positive wired to the
   Phase 20 APIs. Depends on Phase 19 + Phase 20 only; not functionally
   dependent on Phase 21 despite being numbered after it.
+- Phase 23 added: Classification Disposition + Per-Client Automation Gate —
+  dedicated "User Awareness" verdict for confirmed phishing-simulation-vendor
+  reports (currently forced into generic UNWANTED), plus an admin UI gate
+  for per-company automatic vs. manual phishing pipeline execution. Surfaced
+  live during Phase 22 review of a real Breach Secure Now report (ticket
+  699415) — the classifier already detects the simulation vendor and skips
+  the THREAT tier, but has no distinct outcome to reflect it.
 
 ### Pending Todos