docs: enterprise refactor plan with ralph specs

.ralph/specs/legacy/notifications.md

@@ -0,0 +1,64 @@
+# ABE — Notifications Specification
+
+## Purpose
+When ABE finds an anomaly autonomously, notify the team immediately.
+
+## Supported Channels
+
+### 1. Slack Webhook
+Environment variable: `ABE_SLACK_WEBHOOK_URL`
+
+Payload sent to Slack on anomaly:detected:
+```json
+{
+  "text": "🐛 ABE found a bug!",
+  "blocks": [
+    {
+      "type": "section",
+      "text": {
+        "type": "mrkdwn",
+        "text": "*ABE Bug Report*\n*Severity:* 🔴 HIGH\n*Type:* http_error\n*Description:* Form returns HTTP 500 on empty email\n*Session:* sess_abc123\n*Target:* http://localhost:3000"
+      }
+    },
+    {
+      "type": "actions",
+      "elements": [
+        {
+          "type": "button",
+          "text": { "type": "plain_text", "text": "View Report" },
+          "url": "http://localhost:5173/anomalies/anom_abc123"
+        }
+      ]
+    }
+  ]
+}
+```
+
+Only send for severity: high or critical (configurable via `ABE_NOTIFY_MIN_SEVERITY`).
+
+### 2. Generic Webhook
+Environment variable: `ABE_WEBHOOK_URL`
+
+POST request with the full IAnomaly object as JSON body.
+Includes header: `X-ABE-Event: anomaly.detected`
+
+## Implementation
+
+Create `src/server/notifications/`:
+- `NotificationService.ts` — main service, called after anomaly is persisted to DB
+- `SlackNotifier.ts` — implements Slack webhook
+- `WebhookNotifier.ts` — implements generic webhook
+
+NotificationService.notify(anomaly) is called from the API server
+after every anomaly:detected event from the engine.
+
+## Configuration (environment variables)
+```
+ABE_SLACK_WEBHOOK_URL=https://hooks.slack.com/services/xxx/yyy/zzz
+ABE_WEBHOOK_URL=https://myapp.com/webhooks/abe
+ABE_NOTIFY_MIN_SEVERITY=high   # low | medium | high | critical
+```
+
+## Notification record
+Every notification attempt (success or failure) is saved to the notifications table in SQLite.
+Failed notifications are retried once after 60 seconds.