multi-entity stream profiles.

tests/test_incidents.py

@@ -1,5 +1,8 @@
 import unittest
-from fgai.incidents import build_incidents
+import tempfile
+from pathlib import Path
+
+from fgai.incidents import IncidentStore, build_incidents
 from fgai.models import AnomalyFinding
 
 class IncidentTests(unittest.TestCase):
@@ -16,3 +19,16 @@ class IncidentTests(unittest.TestCase):
     def test_incident_uses_stream_name_for_field_deviation(self):
         result = build_incidents([], {"alice": [{"score": 15, "reason": "new login country", "stream_id": "6a3993", "stream_name": "Windows"}]}, [])
         self.assertEqual(result[0]["correlated_streams"], ["Windows"])
+
+    def test_incident_store_persists_lifecycle_state(self):
+        with tempfile.TemporaryDirectory() as directory:
+            store = IncidentStore(str(Path(directory) / "incidents.json"))
+            incident = build_incidents([], {"alice": [{"score": 15, "reason": "new login country", "stream_id": "windows"}]}, [])[0]
+            applied = store.apply([incident])[0]
+            self.assertEqual(applied["lifecycle_status"], "open")
+
+            store.update(str(applied["id"]), "acknowledged", "checking vpn logs")
+            applied_again = store.apply([incident])[0]
+
+            self.assertEqual(applied_again["lifecycle_status"], "acknowledged")
+            self.assertEqual(applied_again["note"], "checking vpn logs")