Started the roadmap with incident grouping.

src/fgai/incidents.py

@@ -0,0 +1,17 @@
+from __future__ import annotations
+
+from .models import AnomalyFinding
+
+
+def build_incidents(anomalies: list[AnomalyFinding], field_deviations: dict[str, list[dict[str, object]]], correlations: list[dict[str, object]]) -> list[dict[str, object]]:
+    correlation_by_ip = {str(item.get("source_ip")): item for item in correlations}
+    incidents = []
+    for anomaly in anomalies:
+        fields = field_deviations.get(anomaly.subject, [])
+        correlation = correlation_by_ip.get(anomaly.subject)
+        evidence = [*anomaly.reasons, *[str(item.get("reason", "")) for item in fields]]
+        score = min(100, anomaly.score + min(15, sum(int(item.get("score", 0)) for item in fields)))
+        if correlation:
+            score = min(100, score + 10); evidence.append(f"observed across {len(correlation.get('streams', []))} streams")
+        incidents.append({"entity": anomaly.subject, "score": score, "severity": anomaly.severity, "evidence": evidence[:8], "field_deviations": len(fields), "correlated_streams": correlation.get("streams", []) if correlation else []})
+    return sorted(incidents, key=lambda item: int(item["score"]), reverse=True)