Add enrichment and SID coverage gates

docs/ROADMAP.md

@@ -76,9 +76,9 @@ Purpose: move from "tell me" to "help me act" without unsafe automation.
   fingerprint-bound (content kinds re-alert on further change), support an
   optional TTL, and are filtered at the daemon chokepoint, `fim-check`, and the
   dashboard integrity API.
-- Add richer false-positive suppression suggestions that can emit TOML snippets
+- ✅ Add richer false-positive suppression suggestions that can emit TOML snippets
   but never modify config automatically.
-- Add recovery checks:
+- ✅ Add recovery checks:
   "verify package", "re-run rootcheck", "confirm no persistence diff", and
   "confirm heartbeat/dashboard visible from watchdog".
 
@@ -173,12 +173,12 @@ turning Sentinel into a noisy rules dump.
   custom event rules against captured or fixture events.
 - ✅ Generate rule documentation from source defaults: SID, signature, classtype,
   event type, match fields, expected false positives, and drill coverage.
-- Require a fixture or safe red-team drill for every built-in SID, including
+- ✅ Require a fixture or safe red-team drill for every built-in SID, including
   event-only and correlation SIDs.
 - Add compatibility tests for rule JSON/event schema evolution.
-- Extend triage so false-positive suggestions are tied to SID/classtype and can
+- ✅ Extend triage so false-positive suggestions are tied to SID/classtype and can
   emit TOML snippets for allowlists, correlation windows, or severity overrides.
-- Add post-alert enrichment consistently across detections:
+- ✅ Add post-alert enrichment consistently across detections:
   package owner, executable hash, parent/ancestor chain, remote IP
   classification, file mode/owner, recent writes by same lineage, and current
   FIM/package/rootcheck status.