## FRE-4500: Cross-Service Alert Correlation

- Implemented `@shieldai/correlation` package with AlertNormalizer, CorrelationEngine, CorrelationService
- Added NormalizedAlert and CorrelationGroup Prisma models
- Extended Severity enum (LOW, INFO, MEDIUM, WARNING, HIGH, CRITICAL)
- Added AlertSource, AlertCategory, CorrelationStatus, EntityType enums
- Created correlation API routes at /api/v1/correlation/
- Wired DarkWatch, SpamShield, VoicePrint services to emit normalized alerts
- Correlation package builds successfully (tsc --noEmit)
- Marked issue as in_review
- Commit: 03276dd