add feedback scopes, revoke and precision metrics

Feedback rules now support value/field/entity/stream scope, require
expiry for broad suppressions, and can be revoked individually.
Adds an active-rules panel, detector precision metrics, and diagnostics.
This commit is contained in:
larssand
2026-09-07 19:51:54 +02:00
parent e9e0ab8a46
commit 7b94512abc
11 changed files with 393 additions and 32 deletions

View File

@@ -58,11 +58,11 @@ Acceptance: an analyst can open an incident, see an ordered multi-stream timelin
Goal: reduce repeat noise without hiding genuinely new behavior.
- [ ] Show active feedback rules, expiry, scope, author, and matching findings in the UI.
- [ ] Support feedback scope choices: exact value, entity and field, entire entity, or stream-wide rule.
- [ ] Require an expiry for broad suppressions and warn before a broad rule is saved.
- [ ] Track detector precision using confirmed versus false-positive feedback.
- [ ] Include feedback-derived precision and suppression counts in metrics and diagnostics.
- [x] Show active feedback rules, expiry, scope, author, and matching findings in the UI.
- [x] Support feedback scope choices: exact value, entity and field, entire entity, or stream-wide rule.
- [x] Require an expiry for broad suppressions and warn before a broad rule is saved.
- [x] Track detector precision using confirmed versus false-positive feedback.
- [x] Include feedback-derived precision and suppression counts in metrics and diagnostics.
Acceptance: a false-positive decision suppresses only the intended pattern and all suppressions are auditable and reversible.