Implemented the feedback foundation.

src/fgai/monitor.py

@@ -9,6 +9,7 @@ from .baseline import BaselineStore
 from .config import ConfigStore
 from .correlation import correlate_source_ips
 from .event_context import build_event_context
+from .feedback import FeedbackStore
 from .graylog_mcp import GraylogMcpClient
 from .graylog_source import GraylogStreamSource
 from .history import HistoryStore
@@ -65,6 +66,14 @@ def build_status(
     baseline = BaselineStore(baseline_path) if baseline_path else None
     profiles = baseline.profiles({event.src_ip for event in events if event.src_ip}) if baseline else {}
     field_deviations = baseline.profile_deviations(events, stream_profiles) if baseline else {}
+    feedback = FeedbackStore().entries()
+    for entity, deviations in field_deviations.items():
+        for deviation in deviations:
+            match = next((item for item in feedback if item.get("entity") == entity and item.get("stream_id") == deviation.get("stream_id") and item.get("field") == deviation.get("field")), None)
+            if match:
+                deviation["feedback"] = match["status"]
+                if match["status"] in {"false_positive", "expected"}:
+                    deviation["score"] = 0
     anomalies = detect_source_anomalies(events, limit=anomaly_limit, baselines=profiles, field_deviations=field_deviations)
     baseline_events = baseline.ingest(events) if baseline else 0
     profile_baseline_fields = baseline.ingest_profile_fields(events, stream_profiles) if baseline else 0
@@ -118,6 +127,7 @@ def build_status(
         },
         "event_context": build_event_context(events),
         "field_deviations": field_deviations,
+        "feedback": feedback,
         "cross_source_correlations": correlate_source_ips(events),
         "anomalies": [
             {