try new correlation af packet bridge mode

backend/src/Models/packets.py

@@ -1,11 +1,26 @@
 """Pydantic model for packet rows returned by the backend."""
 
 from datetime import datetime
-from typing import Optional, Union
+from typing import Literal, Optional, Union
 
 from pydantic import BaseModel, ConfigDict, Field, IPvAnyAddress
 
 
+class PacketObservationModel(BaseModel):
+    """One raw-capture or telemetry observation that contributed to a packet row."""
+
+    observation_type: Literal["capture", "telemetry"]
+    source: str
+    iface: Optional[str] = None
+    timestamp: Optional[str] = None
+    event_type: Optional[str] = None
+    capture_mode: Optional[str] = None
+    capture_session_id: Optional[str] = None
+    session_label: Optional[str] = None
+    session_kind: Optional[str] = None
+    reason: Optional[str] = None
+
+
 class PacketDBModel(BaseModel):
     """Normalized packet representation used across DB and API layers."""
 
@@ -48,6 +63,18 @@ class PacketDBModel(BaseModel):
                 "dpi_metadata": {"method": "GET"},
                 "capture_metadata": {"capture_mode": "tc_ingress", "packet_id": "123456"},
                 "telemetry_metadata": {"event_type": "egress", "iface": "eth1", "packet_id": "123456"},
+                "capture_observations": [
+                    {
+                        "observation_type": "capture",
+                        "source": "af_packet",
+                        "iface": "eth0",
+                        "timestamp": "2026-03-05T12:34:56.789000+00:00",
+                        "capture_mode": "af_packet",
+                        "capture_session_id": "session-1",
+                        "session_label": "br0",
+                        "session_kind": "bridge",
+                    }
+                ],
                 "verdict": "accept",
                 "verdict_reason": "egress-observed",
                 "verdict_confidence": "high",
@@ -92,6 +119,10 @@ class PacketDBModel(BaseModel):
     dpi_metadata: Optional[dict] = Field(None, description="Raw metadata from DPI/flow enrichment.")
     capture_metadata: Optional[dict] = Field(None, description="Raw-capture metadata from the bridge tc ingress exporter.")
     telemetry_metadata: Optional[dict] = Field(None, description="Kernel telemetry details from eBPF collector.")
+    capture_observations: Optional[list[PacketObservationModel]] = Field(
+        None,
+        description="Ordered list of raw-capture and telemetry observations merged into this packet row.",
+    )
     verdict: Optional[str] = None
     verdict_reason: Optional[str] = None
     verdict_confidence: Optional[str] = None