Continued the Detection Quality roadmap.

tests/test_replay.py

@@ -0,0 +1,21 @@
+import unittest
+
+from fgai.logs import parse_log_line
+from fgai.replay import replay_events
+from fgai.stream_profiles import parse_profiles
+
+
+class ReplayTests(unittest.TestCase):
+    def test_replay_uses_temporary_profile_baseline(self):
+        profiles = parse_profiles([{"stream_id": "windows", "entity_field": "username", "categorical_fields": ["action"]}])
+        events = [
+            parse_log_line(f"timestamp={1_700_000_000 + index * 300} username=alice action=failed event={index}")
+            for index in range(12)
+        ]
+        events.extend(
+            parse_log_line(f"timestamp={1_700_003_600} username=alice action=failed burst={index}")
+            for index in range(5)
+        )
+        result = replay_events(events, profiles, stream_id="windows")
+        self.assertEqual(result["events"], 17)
+        self.assertGreaterEqual(result["field_detector_counts"].get("auth_failure_burst", 0), 1)