feat: Alert notification system (webhook, email, Slack)

[notyorch]

Overview

A SIEM without outbound notifications is incomplete. When the detection engine flags a threat, there is currently no mechanism to alert the operator in real time outside of the dashboard UI.

Problem

• Operators must actively watch the dashboard to catch alerts
• No integration with existing incident response workflows
• High-severity detections (e.g. prompt injection, jailbreak) go unnoticed if the dashboard tab is closed

Proposed Solution

Add a notification service to tup-manager that dispatches alerts to one or more channels when a detection event exceeds a severity threshold.

Supported Channels (Phase 1)

Channel	Trigger	Config
Webhook	Any alert	ALERT_WEBHOOK_URL env var
Email (SMTP)	Severity >= HIGH	SMTP_* env vars
Slack	Severity >= HIGH	SLACK_WEBHOOK_URL env var

Notification Payload Example

{
  "event_id": "uuid",
  "timestamp": "2026-06-24T20:00:00Z",
  "model_id": "meta/llama-3.1-8b-instruct",
  "severity": "HIGH",
  "detection_type": "prompt_injection",
  "confidence": 0.91,
  "summary": "Potential prompt injection detected in user input"
}

Changes Required

• Add notifications/ module inside tup-manager
• Implement WebhookNotifier, SlackNotifier, EmailNotifier classes
• Add ALERT_MIN_SEVERITY env var (default: MEDIUM)
• Wire notifiers into the detection pipeline post-classification
• Add notification config to .env.example
• Add /api/v1/notifications/test endpoint to validate config
• Document in README

Acceptance Criteria

• Slack message received within 5s of HIGH severity detection
• Webhook POST includes full event payload
• Notifications are non-blocking (async, don't delay detection response)
• Failed notification logged but does not crash manager

Priority

🟠 Medium — required for real incident response workflows