feat(notifications): Slice 2 — transaction-log rule-regression projector

[remyluslosius]

Summary

Notifications Slice 2 (per the change-driven design §3/§9): the bell's headline use case — a rule that was passing is now failing. Slice 1 wired the durable per-user feed + the alert-engine channel (host unreachable/recovered, drift). This adds the second producer: a transaction-log regression projector.

When a scan flips passing rules to failing, the operator gets one grouped per-host notification — web-01: 3 rules regressed (1 critical) — severity-ranked and deep-linked to the host, instead of nothing (the alert engine doesn't classify rule-level changes).

What it does

• internal/notifyfeed/projector.go — Projector.ProjectScan(scanID, hostID) reads the scan's transactions for the host and records one grouped rule_regression notification per active recipient:
  • Regression = state_changed → fail (a passing/skipped/errored rule now fails).
  • New critical finding = first_seen → fail only when severity=critical and the host has prior scan history. On a host's first scan every rule is first_seen (baseline) — counting those would flood the bell with "N rules regressed", so they're suppressed.
  • Grouping: group_key = rule_regression:<host> — a burst of N rules in one scan is one row, and a later scan's regressions collapse onto (and re-surface unread) the same row rather than piling up. Severity = highest among regressed rules; title summarizes counts.
• internal/worker/scan_worker.go — RegressionProjector interface + nil-safe Config/field; called best-effort after Writer.Apply succeeds. A feed-write failure logs and is swallowed — it never fails or retries the scan (the compliance state already persisted).
• Wiring in both scan-worker boot paths: cmd/openwatch/main.go (serve, reusing the Slice-1 feed store) and cmd/openwatch/worker.go (dedicated worker).

Spec & tests

• system-notifications v1.4.0: new C-07 + AC-12/13/14 (grouping/severity-rank, first-scan suppression, no-op + collapse). specter check green (114 specs); specter coverage --strictness annotation = system-notifications 14/14 ACs, 100%.
• DB-backed tests in internal/notifyfeed/projector_test.go (grouping, severity ranking, first-scan suppression, recovery/severity-churn no-op, two-scan collapse + re-surface).

Scope notes

• No frontend change — the new rows render in the existing Slice-1 bell drawer (generic title/body/severity/link).
• Recipient scoping stays Slice-1 (all active users): host:read is granted to every role today, so "users who can see the host" is everyone. Finer per-host scoping awaits a host-ACL model (design §7) and is deferred.
• Band drops (design §3) come from the scheduler/posture producer, not the transaction log — out of this projector's scope.

🤖 Generated with Claude Code