Implemented cleanup/triage direction. ui, and baselinbe days

tests/test_baseline.py

@@ -130,3 +130,20 @@ class BaselineTests(unittest.TestCase):
 
             self.assertLessEqual(len(rare), 5)
             self.assertTrue(all(item["score"] >= 15 for item in rare))
+
+    def test_training_days_gate_profile_deviations(self):
+        with tempfile.TemporaryDirectory() as directory:
+            store = BaselineStore(str(Path(directory) / "baseline.sqlite3"))
+            profiles = parse_profiles([{"stream_id": "windows", "entity_field": "username", "categorical_fields": ["action"]}])
+            now = int(time.time())
+            for index in range(12):
+                event = parse_log_line(f"fgai_stream_id=windows username=alice action=failed baseline={index}")
+                store.ingest_profile_fields([event], profiles, observed_at=now - 86400 + index * 300)
+
+            burst = [
+                parse_log_line(f"fgai_stream_id=windows username=alice action=failed burst={index}")
+                for index in range(5)
+            ]
+
+            self.assertNotIn("alice", store.profile_deviations(burst, profiles, min_training_days=7))
+            self.assertIn("alice", store.profile_deviations(burst, profiles, min_training_days=0))

tests/test_triage.py

@@ -0,0 +1,27 @@
+import unittest
+
+from fgai.triage import build_triage_queue
+
+
+class TriageTests(unittest.TestCase):
+    def test_builds_compact_queue_from_raw_deviations(self):
+        queue = build_triage_queue(
+            [{"id": "abc", "entity": "alice", "score": 42, "severity": "medium", "correlated_streams": ["Windows"], "evidence": ["login burst"]}],
+            {
+                "alice": [
+                    {"score": 60, "detector": "auth_failure_burst", "stream_name": "Windows", "reason": "auth failure burst"},
+                    {"score": 0, "detector": "rare_value", "stream_name": "DNS", "reason": "known", "feedback": "expected"},
+                ]
+            },
+            [{"entity": "alice", "streams": ["Windows", "DNS"], "security_events": 2}],
+            [],
+        )
+
+        self.assertEqual(queue[0]["entity"], "alice")
+        self.assertEqual(queue[0]["active_deviation_count"], 1)
+        self.assertIn("auth_failure_burst", queue[0]["detectors"])
+        self.assertEqual(queue[0]["next_action"], "investigate cross-source activity")
+
+
+if __name__ == "__main__":
+    unittest.main()