Build Week: Correlated cross-agent incident lifecycle

[CodeBuildder]

Objective

Create a truthful end-to-end incident lifecycle that connects Argus security evidence, Phoenix resilience activity, the Sentinel Operations Graph (SOG), and Sentinel operator decisions through stable correlation identifiers.

Problem

Findings, scenarios, healing runs, and incidents currently exist as adjacent records. A source finding can appear in Sentinel without a corresponding specialist incident, which makes counts and deep links easy to misinterpret. Judges need to follow one causal story across every agent without inferred or fabricated relationships.

Scope

• Define the correlation contract for incident, finding, scenario, and healing-run identifiers.
• Preserve producer-supplied correlation IDs at SOG ingestion.
• Correlate only records with explicit shared identity or deterministic, documented rules.
• Represent correlated cases separately from standalone evidence.
• Expose lifecycle stages: detected, assessed, decision pending, action taken, recovery observed, and verified.
• Preserve provenance: observed, simulator, Chaos Mesh, or replayed.
• Make source counts open the exact records behind them.
• Enable deep links only when the target specialist record genuinely exists.
• Add tests covering correlated and standalone evidence.

Acceptance criteria

• One correlation ID links all records in a demonstrated lifecycle.
• Standalone findings never appear as incidents.
• Incident counts equal actual correlated cases.
• Phoenix scenario/run links appear only for existing Phoenix records.
• Argus evidence retains its original event identity and provenance.
• Sentinel presents an ordered evidence-to-recovery timeline.
• Simulator, live Chaos Mesh, observed, and replayed records remain distinguishable.
• Backend tests and dashboard production build pass.

Demo proof

A deterministic test must show one Argus finding entering SOG, a related Phoenix resilience action, and one Sentinel incident whose timeline and identifiers can be inspected end to end.