Add enrichment and SID coverage gates

enodia_sentinel/snapshot.py

@@ -173,6 +173,15 @@ def capture(alerts: list[Alert], state: SystemState, cfg: Config) -> Path:
     incident_id = incident.record(
         cfg, base.with_suffix(".log").name, alerts, lineage, now.timestamp(), host)
 
+    cutoff = int(time.time()) - 3600
+    recent_files = []
+    for root in cfg.watch_persistence:
+        try:
+            if os.path.isfile(root) and os.lstat(root).st_mtime > cutoff:
+                recent_files.append(root)
+        except OSError:
+            pass
+
     report = {
         "schema": schemas.ALERT_SNAPSHOT_V1,
         "time": now.isoformat(),
@@ -183,18 +192,14 @@ def capture(alerts: list[Alert], state: SystemState, cfg: Config) -> Path:
         "processes": [_pid_detail(state, p) for p in pids],
     }
 
-    cutoff = int(time.time()) - 3600
-    recent_files = []
-    for root in cfg.watch_persistence:
-        try:
-            if os.path.isfile(root) and os.lstat(root).st_mtime > cutoff:
-                recent_files.append(root)
-        except OSError:
-            pass
+    from . import enrich
+    report["enrichment"] = enrich.build(
+        report, state, cfg, lineage=lineage, recent_files=recent_files)
 
     ps_out = _run(["ps", "-eo", "pid,ppid,user,etimes,pcpu,pmem,stat,comm",
                    "--sort=-pcpu"])
     extras = {
+        "Post-alert enrichment": enrich.format_text(report["enrichment"]),
         "Process tree (top by CPU)": "\n".join(ps_out.splitlines()[:40]),
         "Sockets (ss -tanp)": "\n".join(_run(["ss", "-tanp"]).splitlines()[:80]),
         "/etc/ld.so.preload": (