Verdict-to-corpus capture ring

[mostafa]

Summary

Add an opt-in bounded pre-dedup capture ring that retains contributing events for open incidents and, on analyst verdicts, spools TP/FP exemplar bundles to disk (including backtest expectation fragments and tune inputs) without persisting payloads in SQLite or exposing a query API.

Motivation

TP verdicts are exactly the regression exemplars rules need, but by verdict time the daemon has dropped event payloads. Capturing them as a byproduct of operations grows the corpus without a separate curation chore, while staying default-off and bounded.

Proposed approach

• Sink-path tap before alert-pipeline processing; two-stage ring (fingerprint then incident id).
• Force-retain events internally for capture, strip before sink dispatch unless the operator asked for events.
• On true_positive/false_positive verdicts, spool bundles under a configured directory with budgets (max incidents, events, TTL, bytes).
• Unlock rule tune --from-dispositions over the spool tree.
• Default off; no read endpoint; ring not persisted across restart (documented).

Out of scope

• Long-term event retention or searchable case storage.
• Auto-committing corpus into git.

Tasks

• Capture module, config, metrics, sink tap
• Verdict spool bundles and disk budgets
• Tune-from-dispositions CLI mode
• Tests, criterion bench for the tap, docs

References

• Alert pipeline grouping and disposition apply path
• Event payload strip helpers
• Backtest expectations schema and rule tune inputs