Fixed the incident ack/resolve behavior.

src/fgai/incidents.py

@@ -52,7 +52,7 @@ def build_incidents(anomalies: list[AnomalyFinding], field_deviations: dict[str,
         severity = "critical" if score >= 85 else "high" if score >= 60 else "medium" if score >= 35 else "low"
         streams = sorted({stream for item in group["correlations"] for stream in item.get("streams", [])} | {str(item.get("stream_name") or item.get("stream_title") or item.get("stream_id", "")) for item in group["fields"] if item.get("stream_id") or item.get("stream_name") or item.get("stream_title")})
         timeline = sorted(group["timeline"], key=lambda item: str(item.get("timestamp", "")))[:20]
-        incident_id = hashlib.sha256(json.dumps({"entity": entity, "streams": streams, "evidence": list(dict.fromkeys(str(item) for item in group["evidence"] if item))[:4]}, sort_keys=True).encode("utf-8")).hexdigest()[:16]
+        incident_id = hashlib.sha256(json.dumps({"entity": entity, "streams": streams}, sort_keys=True).encode("utf-8")).hexdigest()[:16]
         incidents.append({
             "id": incident_id,
             "entity": entity,

tests/test_incidents.py

@@ -32,3 +32,8 @@ class IncidentTests(unittest.TestCase):
 
             self.assertEqual(applied_again["lifecycle_status"], "acknowledged")
             self.assertEqual(applied_again["note"], "checking vpn logs")
+
+    def test_incident_id_is_stable_when_evidence_changes(self):
+        first = build_incidents([], {"alice": [{"score": 15, "reason": "new login country", "stream_id": "windows"}]}, [])[0]
+        second = build_incidents([], {"alice": [{"score": 25, "reason": "new source ip", "stream_id": "windows"}]}, [])[0]
+        self.assertEqual(first["id"], second["id"])