An abundance of cyber-physical communication ecosystems can be found in modern automobiles. The interactions between CAN, ECU, and V2X create attack paths that flat intrusion labels or accuracy-only IDS evaluation can't safely handle in the process. The purpose of this research is to provide a five-stage intrusion detection approach for automotive networks that is aware of the context, centered on graphs, and regulated by robustness. Threat-Graph Entropy Mining (TGEM) is the initial component of the framework that has been developed. Attack surfaces, protocol artifacts, ECUs, and observable symptoms are all connected to one another through a multi-layer threat interaction graph in this procedure. Then, entropycentrality scoring finds the main attack families and unsolved defense gaps. The payload, temporal, and topological views are then aligned into a threat-priority-guided latent model via CMV-DD. This is accomplished by having the instructor and students distill the data. The Graph-TCN Transformer with Reliability-Gated Fusion (GTT-RGF) finds threats by combining ECU relationships, short-term temporal deviations, and long-range planned attack patterns. In order to accomplish this, it dynamically reduces the impact of views that are either fraudulent or highly noisy. When a minimum attack is utilized in a manner that is consistent with the graph, Counterfactual Attack-Path Verification (CAPV) monitors the situation to determine whether or not the alarms continue to be reliable. Under the Risk Calibration and Continuous Drift Governance (RCC-DG) system, detection data are converted into practical risk scores that are more precise. Additionally, the technology enables regulated updates to be made after drift has occurred. The findings of tests that were conducted with settings that were influenced by CAN and V2X revealed that F1- scores ranged from 93.9 to 96.2% in highway, urban, intersection, and mixed driving scenarios.