mirror of
https://github.com/luxfi/aml.git
synced 2026-09-24 00:25:20 +00:00
zeekayandHanzo Dev
6024f38a0f
An alert is what a rule said about a transaction at the time it was judged. The case that cites it is durable now and so is the record it was raised against, so an alert store that empties on a rollout leaves a case naming evidence that is no longer there — and the replay that measures a rule's false-positive rate reads the same alerts to know which rules actually fired. Same shape as the case plane: an app means the durable shelf, no app means the map, and the map keeps its LRU bound because memory does. The durable shelf does not evict; an alert is evidence, and the retention plane is what decides when evidence goes. One JSON column rather than a column per field. An alert is only ever read whole — the route hands back a transaction's alerts, the replay reads which rules fired — so nothing filters on a score or a citation, and a column per field would be a second place the shape of an alert is declared. TestAlertsSurviveARestart writes two tenants' alerts on one transaction, takes the bytes, opens a second instance and reads them back per tenant: the org is what scopes the read, and it still is on the other side. All three planes are now durable and each has its restart test. LLM.md carries the table. Full suite green (18 packages). Co-authored-by: Hanzo Dev <[email protected]>