fix anon

tests/test_anomaly.py

@@ -24,6 +24,62 @@ class AnomalyTests(unittest.TestCase):
         self.assertGreaterEqual(findings[0].score, 60)
         self.assertIn(findings[0].severity, {"high", "critical"})
 
+    def test_entity_scope_feedback_suppresses_anomaly_even_without_field_deviations(self):
+        events = [
+            parse_log_line(f'type=traffic srcip=10.0.0.{i} dstip=1.1.1.1 service=https action=accept sentbyte=100 rcvdbyte=100')
+            for i in range(1, 8)
+        ]
+        events.extend(
+            parse_log_line(
+                'type=utm subtype=ips srcip=8.8.8.8 dstip=10.0.0.10 service=https '
+                'action=blocked severity=critical sentbyte=0 rcvdbyte=0'
+            )
+            for _ in range(5)
+        )
+        # Confirm it would normally fire (no field_deviations involved at all).
+        self.assertTrue(detect_source_anomalies(events))
+
+        feedback = [{"scope": "entity", "entity": "8.8.8.8", "status": "false_positive"}]
+        findings = detect_source_anomalies(events, feedback=feedback)
+
+        self.assertEqual(findings, [])
+
+    def test_entity_scope_feedback_does_not_affect_other_sources(self):
+        events = [
+            parse_log_line(
+                'type=utm subtype=ips srcip=8.8.8.8 dstip=10.0.0.10 service=https '
+                'action=blocked severity=critical sentbyte=0 rcvdbyte=0'
+            )
+            for _ in range(5)
+        ]
+        events.extend(
+            parse_log_line(
+                'type=utm subtype=ips srcip=9.9.9.9 dstip=10.0.0.11 service=https '
+                'action=blocked severity=critical sentbyte=0 rcvdbyte=0'
+            )
+            for _ in range(5)
+        )
+
+        feedback = [{"scope": "entity", "entity": "8.8.8.8", "status": "false_positive"}]
+        findings = detect_source_anomalies(events, feedback=feedback)
+
+        self.assertEqual([finding.subject for finding in findings], ["9.9.9.9"])
+
+    def test_missing_feedback_preserves_default_behavior(self):
+        events = [
+            parse_log_line(
+                'type=utm subtype=ips srcip=8.8.8.8 dstip=10.0.0.10 service=https '
+                'action=blocked severity=critical sentbyte=0 rcvdbyte=0'
+            )
+            for _ in range(5)
+        ]
+
+        with_none = detect_source_anomalies(events, feedback=None)
+        without_param = detect_source_anomalies(events)
+
+        self.assertEqual([f.subject for f in with_none], [f.subject for f in without_param])
+        self.assertTrue(with_none)
+
     def test_summary_counts_severities(self):
         events = [
             parse_log_line(

tests/test_dashboard.py

@@ -94,6 +94,21 @@ class DashboardTests(unittest.TestCase):
         self.assertIn("openDetailIds", HTML)
         self.assertIn("addEventListener('toggle'", HTML)
 
+    def test_dashboard_has_anomaly_bulk_bar(self):
+        self.assertIn('id="anomalyBulkBar"', HTML)
+        self.assertIn('anomaly-select', HTML)
+        self.assertIn('id="selectAllAnomalies"', HTML)
+        self.assertIn('id="anomalyBulkSubmit"', HTML)
+
+    def test_dashboard_anomaly_bulk_requires_expiry_and_only_ever_posts_entity_scope(self):
+        self.assertIn('at least 1 day', HTML)
+        start = HTML.index("getElementById('anomalyBulkSubmit')")
+        end = HTML.index('};', start)
+        submit_handler = HTML[start:end]
+        self.assertIn("scope: 'entity'", submit_handler)
+        self.assertIn('days <= 0', submit_handler)
+        self.assertIn('confirm(', submit_handler)
+
     def test_dashboard_field_deviations_are_collapsible_and_open_by_default(self):
         start = HTML.index("Field Baseline Deviations")
         preceding = HTML[max(0, start - 80):start]

tests/test_monitor.py

@@ -5,6 +5,7 @@ from pathlib import Path
 from unittest.mock import patch
 
 from fgai.config import ConfigStore
+from fgai.feedback import FeedbackStore
 from fgai.history import StatusSnapshotStore
 from fgai.history import FieldDiscoveryStore
 from fgai.monitor import add_llm_assessment, build_status, cached_status_with_error, monitor_cycle_timeout_seconds, write_refreshing_status, write_status
@@ -38,6 +39,27 @@ class MonitorTests(unittest.TestCase):
             self.assertFalse(status["status_cache"]["served_from_cache"])
             self.assertGreaterEqual(len(status["anomalies"]), 1)
 
+    def test_entity_scope_feedback_suppresses_anomaly_in_build_status(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            log_path = Path(tmp) / "fg.log"
+            log_path.write_text(
+                "\n".join(
+                    [
+                        'type=utm subtype=ips srcip=8.8.8.8 dstip=10.0.0.10 service=https action=blocked severity=critical',
+                        'type=utm subtype=ips srcip=8.8.8.8 dstip=10.0.0.10 service=https action=blocked severity=critical',
+                        'type=utm subtype=ips srcip=8.8.8.8 dstip=10.0.0.10 service=https action=blocked severity=critical',
+                    ]
+                ),
+                encoding="utf-8",
+            )
+            feedback_store = FeedbackStore(str(Path(tmp) / "feedback.json"))
+            feedback_store.add({"scope": "entity", "entity": "8.8.8.8", "status": "false_positive", "expires_at": 9999999999})
+
+            with patch("fgai.monitor.FeedbackStore", return_value=feedback_store):
+                status = build_status(str(log_path), incident_path=str(Path(tmp) / "incidents.json"))
+
+            self.assertNotIn("8.8.8.8", [item["subject"] for item in status["anomalies"]])
+
     def test_write_status_creates_parent_directory(self):
         with tempfile.TemporaryDirectory() as tmp:
             output = Path(tmp) / "state" / "status.json"