Time-based severity escalation rules for active findings.

Evaluates escalation rules against a finding and determines whether it should be bumped to a higher severity based on how long it has been active.

Rules are evaluated from longest after_minutes first. The first matching rule (where the finding has been active for at least that duration) wins.

Rules format

Rules are configured per finding class, declared on the expectation:

expectation :check_vendor,
  trigger: {:event, "vendor.updated"},
  escalation_rules: %{
    "vendor_delay" => [
      %{after_minutes: 60, escalate_to: :high},
      %{after_minutes: 1440, escalate_to: :critical}
    ]
  }