@skyhook-io/radar-app 1.13.4 → 1.13.5

package/src/components/diagnose/investigationEvidence.ts

@@ -3,13 +3,17 @@ import {
   defaultConditionTone,
   displayKind,
   englishPlural,
+  hpaStateLabel,
+  hpaStateLevel,
   kindToPlural,
   stripAnsi,
+  type HPADiagnosisState,
   type Issue,
   type IssueRecentChange,
   type Topology,
 } from "@skyhook-io/k8s-ui";
 import { fnv1a32 } from "@skyhook-io/k8s-ui/utils/structure-hash";
+import type { TimeSeries } from "@skyhook-io/k8s-ui/components/charts";
 import { apiVersionToGroup } from "../../utils/navigation";
 
 import {
@@ -28,6 +32,7 @@ import {
 } from "./diagnoseEvidenceTypes";
 import type { RootCauseEvidence } from "../../api/diagnose";
 import { investigationResourceEvidenceSummary } from "./investigationResourceEvidenceModel";
+import { metricsUnitForExpression } from "./investigationMetrics";
 
 /**
  * The projection deliberately consumes only the small, structural portion of
@@ -92,7 +97,8 @@ export type InvestigationEvidenceKind =
   | "receipt"
   | "alerts"
   | "helm"
-  | "permissions";
+  | "permissions"
+  | "metrics";
 
 type InvestigationSemanticDomain = "issue" | "startup" | "crash" | "dns";
 
@@ -425,7 +431,13 @@ export type InvestigationEvidenceData =
       checked:
         "issues" | "events" | "changes" | "inventory" | "logs" | "alerts";
       scope: string;
-      message: string;
+      /**
+       * Only when there is something to add. The card already shows the title
+       * and the scope, so a line that restates either costs the reader a read
+       * and returns nothing; this carries the reason the answer is what it is,
+       * or the limit of what it proves.
+       */
+      message?: string;
     }
   | {
       type: "alerts";
@@ -445,7 +457,40 @@ export type InvestigationEvidenceData =
       truncated?: boolean;
       usedByPods?: string[];
       podsTotal?: number;
-    };
+    }
+  | InvestigationMetricsEvidence;
+/** One PromQL vector selector as the producer tokenized it. */
+export interface InvestigationMetricsSelector {
+  metric: string;
+  matchers: Array<{ label: string; op: string; value: string }>;
+}
+
+/**
+ * A Prometheus result captured during the investigation. `origin` says which
+ * producer ran the query; the shape is shared so every metrics card renders
+ * the same way. `subject` is set only when the query's selectors are all
+ * scoped to the investigation target.
+ */
+export interface InvestigationMetricsEvidence {
+  type: "metrics";
+  origin: "query" | "diagnose";
+  query: string;
+  mode: "range" | "instant";
+  start?: string;
+  end?: string;
+  step?: string;
+  unit?: string;
+  label?: string;
+  series: TimeSeries[];
+  truncated: boolean;
+  summary?: unknown;
+  note?: string;
+  selectors?: InvestigationMetricsSelector[];
+  selectorsUnknown?: boolean;
+  subject?: DiagnosisResourceRef;
+  pods?: number;
+  partial?: boolean;
+}
 
 export interface InvestigationEvidenceObservation {
   source: InvestigationEvidenceSource;
@@ -635,6 +680,8 @@ export function investigationEvidenceSubjectRef(
           namespace: data.subject.namespace,
           name: data.subject.name,
         };
+      case "metrics":
+        return data.subject;
       default:
         return undefined;
     }
@@ -671,6 +718,16 @@ export function investigationEvidenceSourceDomId(sourceId: string): string {
 
 const investigationEvidenceRefRe = /^ev_[a-z2-7]{26,128}_[a-z2-7]{26,128}$/;
 
+export function isInvestigationEvidenceRef(value: string): boolean {
+  return investigationEvidenceRefRe.test(value);
+}
+
+export function investigationSourceArgs(
+  source: InvestigationEvidenceSource,
+): Record<string, unknown> | undefined {
+  return record(source.args ? parseJSON(source.args) : undefined);
+}
+
 export function resolveInvestigationRootCauseEvidence(
   projection: InvestigationEvidenceProjection,
   evidence: RootCauseEvidence | undefined,
@@ -1270,6 +1327,7 @@ const INVESTIGATION_RESULT_LABELS: Readonly<Record<string, string>> = {
   get_prometheus_rules: "Alert rules",
   get_helm_release: "Helm release",
   get_subject_permissions: "Permissions",
+  query_prometheus: "Prometheus query",
 };
 
 function investigationResultLabel(source: InvestigationEvidenceSource): string {
@@ -1363,6 +1421,13 @@ class ProjectionBuilder {
     Set<InvestigationSemanticDomain>
   >();
 
+  /**
+   * Pods a target-scoped diagnose bundle listed as the workload's own, by
+   * controller ownership. Membership for an agent's pod-level Prometheus
+   * query is proved against this set, never inferred from a name.
+   */
+  readonly establishedTargetPods = new Set<string>();
+
   private readonly groupByIdentity = new Map<
     string,
     InvestigationEvidenceGroup
@@ -1585,7 +1650,7 @@ function addNarrowHint(
       source,
       label,
       label +
-        " was narrowed to keep this investigation bounded. Additional matching evidence may exist.",
+        " returned part of the matching results to keep this investigation fast. More may exist.",
       "truncated",
     );
   }
@@ -1608,7 +1673,7 @@ function addResourceContextLimitations(
     builder.limit(
       source,
       omitted.field,
-      `Resource context omitted: ${omitted.reason.replaceAll("_", " ")}.`,
+      `Radar left out part of the resource context (${omitted.reason.replaceAll("_", " ")}).`,
       omitted.reason === "budget_exceeded" ? "truncated" : "unknown",
     );
   }
@@ -1617,7 +1682,7 @@ function addResourceContextLimitations(
     builder.limit(
       source,
       "Relationships",
-      `Referenced-by relationships were truncated (${shown} of ${context.referencedBy.total} returned).`,
+      `Radar returned ${shown} of ${context.referencedBy.total} referenced-by relationships.`,
       "truncated",
     );
   }
@@ -1625,7 +1690,7 @@ function addResourceContextLimitations(
     builder.limit(
       source,
       "Application references",
-      "Additional stale Secret environment reference groups were omitted.",
+      "Radar returned part of the stale Secret references.",
       "truncated",
     );
   }
@@ -1640,7 +1705,7 @@ function addIssueLimitations(
     builder.limit(
       source,
       `Radar Issue ${value.id}`,
-      "The affected-resource member list was truncated.",
+      "Radar returned part of the affected-resource list.",
       "truncated",
     );
   }
@@ -1661,11 +1726,16 @@ function resourceObservationSummary(
   if (gitOps?.sync) return `Sync ${gitOps.sync}`;
   if (gitOps?.suspended) return "Reconciliation suspended";
   const replicas = context?.workloadSummary?.replicas;
+  const adverseScaler = adverseScalerStates(context)[0];
   if (replicas?.desired !== undefined) {
     const desired = replicas.desired;
     const ready = replicas.ready ?? 0;
-    return `${ready}/${desired} replicas ready`;
+    const readiness = `${ready}/${desired} replicas ready`;
+    return adverseScaler
+      ? `${readiness} · HPA: ${hpaStateLabel(adverseScaler)}`
+      : readiness;
   }
+  if (adverseScaler) return `HPA: ${hpaStateLabel(adverseScaler)}`;
   if (context?.statusSummary?.phase) return context.statusSummary.phase;
   if (context?.issueSummary?.topReason) return context.issueSummary.topReason;
   return (
@@ -1675,6 +1745,22 @@ function resourceObservationSummary(
   );
 }
 
+// A scaler that cannot act (no metrics, cannot read the target) or is pinned
+// at its ceiling is a captured Radar fact about the workload, so it lifts the
+// card the way an adverse condition does. Ordinary scale-ups and scale-downs
+// are the autoscaler working and stay as detail.
+function adverseScalerStates(
+  context: InvestigationResourceContext | undefined,
+): HPADiagnosisState[] {
+  return (context?.scaledBy ?? []).flatMap((scaler) => {
+    const state = scaler.hpaSummary?.state;
+    if (!state) return [];
+    return hpaStateLevel(state) === "unhealthy" || state === "limited_max"
+      ? [state]
+      : [];
+  });
+}
+
 function addResourceObservation(
   builder: ProjectionBuilder,
   source: InvestigationEvidenceSource,
@@ -1712,7 +1798,11 @@ function addResourceObservation(
         gitOpsDiagnosis.operationPhase?.toLowerCase() ?? "",
       )),
   );
-  const hasAdverseState = replicaShortfall || adverseCondition || gitOpsAdverse;
+  const hasAdverseState =
+    replicaShortfall ||
+    adverseCondition ||
+    gitOpsAdverse ||
+    adverseScalerStates(context).length > 0;
   const intendedTier: InvestigationEvidenceTier =
     critical && !hasDetailedCriticalIssue
       ? "key"
@@ -1833,9 +1923,8 @@ function addEvents(
   complete = true,
   emptyIsAuthoritative = false,
   relevance: InvestigationEvidenceRelevance = "broader",
-  emptyReceipt: { title: string; message: string } = {
-    title: "No matching warning events",
-    message: "The warning-event query completed and returned no groups.",
+  emptyReceipt: { title: string; message?: string } = {
+    title: "No warning events",
   },
 ): void {
   const scope = scopeFromArgs(source);
@@ -1933,13 +2022,12 @@ function addChanges(
       tier: evidenceTierForRelevance("checked", relevance),
       relevance,
       tone: "neutral",
-      title: "No tracked recent changes",
+      title: "No recorded changes in this window",
       summary: scope,
       data: {
         type: "receipt",
         checked: "changes",
         scope,
-        message: "The requested change window returned no tracked changes.",
       },
     });
     return;
@@ -2272,6 +2360,7 @@ function adaptDiagnose(
   });
   const relatedRelevance: InvestigationEvidenceRelevance =
     bundleRelevance === "target" ? "producer-related" : "broader";
+
   const bundledRowRelevance = (
     kind: string,
     name: string,
@@ -2381,14 +2470,12 @@ function adaptDiagnose(
       tier: evidenceTierForRelevance("checked", bundleRelevance),
       relevance: bundleRelevance,
       tone: "neutral",
-      title: "No classified workload issues",
+      title: "Radar's diagnosis found no live issues",
       summary: scope,
       data: {
         type: "receipt",
         checked: "issues",
         scope,
-        message:
-          "Radar's workload diagnosis completed without a classified live issue for this resource.",
       },
     });
   }
@@ -2407,9 +2494,14 @@ function adaptDiagnose(
   if (Array.isArray(blockersRaw)) {
     for (const { blocker, pods, foldedInto } of blockerGroups) {
       if (foldedInto) continue;
+      // One blocker keeps one identity however many pods share it. Keying a
+      // merged card differently from a single-pod one made a re-diagnose that
+      // crossed one pod look like a new fact, so the same reason appeared
+      // twice; a Pod blocker is the same finding whether it holds one pod or
+      // nine.
       const grouped = blocker.kind === "Pod" && pods.length > 1;
       builder.observe(
-        grouped
+        blocker.kind === "Pod"
           ? `startup:Pod:${blocker.reason}:${fnv1a32(blocker.message).toString(36)}`
           : `startup:${blocker.kind}:${blocker.name}:${blocker.reason}`,
         "startup",
@@ -2428,7 +2520,11 @@ function adaptDiagnose(
           data: {
             type: "startup",
             blocker,
-            ...(grouped ? { pods } : {}),
+            // Always carry the pods, whether one or nine: they are what puts
+            // this workload's pods into the set a later Prometheus query is
+            // proved against, and a merged card that dropped them quietly
+            // weakened attribution elsewhere.
+            pods,
             subject: grouped
               ? undefined
               : (() => {
@@ -2502,7 +2598,7 @@ function adaptDiagnose(
     builder.limit(
       source,
       "Crash evidence",
-      "Additional crash-cause candidates were omitted.",
+      "Radar returned part of the crash-cause candidates.",
       "truncated",
     );
   }
@@ -2553,7 +2649,7 @@ function adaptDiagnose(
           tier: evidenceTierForRelevance("checked", logRelevance),
           relevance: logRelevance,
           tone: "neutral",
-          title: "No previous container instance expected",
+          title: "No previous logs expected",
           summary: `${item.pod} / ${item.container}`,
           data: {
             type: "receipt",
@@ -2785,6 +2881,21 @@ function adaptDiagnose(
   if (nonEmptyString(value.recentChangesError)) {
     builder.limit(source, "Recent changes", value.recentChangesError, "error");
   }
+
+  addDiagnoseMetrics(
+    builder,
+    source,
+    value.metrics,
+    {
+      kind: resource.kind,
+      ...(apiVersionToGroup(resource.apiVersion)
+        ? { group: apiVersionToGroup(resource.apiVersion) }
+        : {}),
+      namespace: resource.metadata.namespace,
+      name: resource.metadata.name,
+    },
+    bundleRelevance,
+  );
   if (value.recentChangesSaturated === true) {
     builder.limit(
       source,
@@ -2973,14 +3084,12 @@ function adaptIssues(
       tier: evidenceTierForRelevance("checked", relevance),
       relevance,
       tone: "neutral",
-      title: "No matching live issues",
+      title: "No live issues matched this search",
       summary: scope,
       data: {
         type: "receipt",
         checked: "issues",
         scope,
-        message:
-          "Radar's live-issue query completed and returned no matching issues.",
       },
     });
   } else {
@@ -3190,7 +3299,7 @@ function adaptListResources(
     builder.limit(
       source,
       "Resource inventory",
-      `Radar found no matching resources for ${scope}, but access restrictions may have hidden some results.`,
+      `Radar found no matching resources for ${scope}. Anything you do not have permission to read was not searched.`,
       "unknown",
     );
     return;
@@ -3248,6 +3357,18 @@ function adaptEvents(
     );
     return;
   }
+  // A cluster-wide read the producer narrowed to the caller's namespaces
+  // answers for those alone, so neither its empty receipt nor its card may
+  // stand for the cluster.
+  const narrowedTo = narrowedEventScope(value);
+  if (narrowedTo && events.length > 0) {
+    builder.limit(
+      source,
+      "Events",
+      `This cluster-wide events read covered only the namespaces you can read (${narrowedTo}).`,
+      "unknown",
+    );
+  }
   addEvents(
     builder,
     source,
@@ -3256,12 +3377,33 @@ function adaptEvents(
     !nonEmptyString(value.narrowHint),
     true,
     sourceArgsRelevance(builder, source),
-    {
-      title: "No events matched",
-      message:
-        "The events query completed and returned nothing for this scope. Events outside its window or filters are not covered; a namespace you cannot read also returns nothing.",
-    },
+    narrowedTo
+      ? {
+          title: "No events in the namespaces you can read",
+          message: `Read ${narrowedTo}. Namespaces outside your permissions were not read, so this does not clear the cluster.`,
+        }
+      : {
+          title: "No events in this window",
+          message:
+            "Events outside this window or its filters are not covered, and a namespace you cannot read also returns nothing.",
+        },
+  );
+}
+
+/**
+ * Names the namespaces a cluster-wide events read was actually narrowed to,
+ * or undefined when the read covered everything the query asked for.
+ */
+function narrowedEventScope(
+  value: Record<string, unknown>,
+): string | undefined {
+  if (value.partialScope !== true) return undefined;
+  const namespaces = (stringArray(value.scopeNamespaces) ?? []).filter(
+    nonEmptyString,
   );
+  return namespaces.length > 0
+    ? namespaces.join(", ")
+    : "the namespaces you can read";
 }
 
 function adaptPodLogs(
@@ -3586,11 +3728,13 @@ function adaptWorkloadLogs(
       return;
     }
     if (!source.confirmedSuccess) return;
+    // The producer's own sentence when it gave one; otherwise nothing, because
+    // "no pods to read logs from" is already the whole answer.
     const message = nonEmptyString(value.emptyMessage)
       ? value.emptyMessage
       : nonEmptyString(value.logs)
         ? value.logs
-        : "The workload resolved no pods, so there were no log streams to read.";
+        : undefined;
     builder.observe(
       `workload-logs:${previous ? "previous" : "current"}:${scope}`,
       "receipt",
@@ -3607,7 +3751,7 @@ function adaptWorkloadLogs(
     return;
   }
   const logsRaw = value.logs;
-  const noStreams = `No log streams were returned for the ${value.pods} resolved pod${value.pods === 1 ? "" : "s"}, so Radar could not evaluate them.`;
+  const noStreams = `Radar found ${value.pods} pod${value.pods === 1 ? "" : "s"} but got no logs from ${value.pods === 1 ? "it" : "them"}, so the logs were not checked.`;
   if (!Array.isArray(logsRaw)) {
     if (logsRaw === undefined || logsRaw === null) {
       builder.limit(source, "Workload logs", noStreams, "unknown");
@@ -3675,7 +3819,7 @@ function stringRecord(value: unknown): Record<string, string> | undefined {
 function producerEstablishedTargetPods(
   builder: ProjectionBuilder,
 ): Set<string> {
-  const pods = new Set<string>();
+  const pods = new Set<string>(builder.establishedTargetPods);
   const namespace = builder.target.namespace;
   if (!namespace) return pods;
   for (const group of builder.groups) {
@@ -3686,12 +3830,11 @@ function producerEstablishedTargetPods(
         pods.add(data.pod);
       } else if (data.type === "crash" && data.namespace === namespace) {
         for (const pod of data.crash.pods) pods.add(pod);
-      } else if (
-        data.type === "startup" &&
-        data.subject?.kind === "Pod" &&
-        data.subject.namespace === namespace
-      ) {
-        pods.add(data.subject.name);
+      } else if (data.type === "startup" && data.blocker.kind === "Pod") {
+        // The blocker names the pods it holds whether the card merged them or
+        // not; the subject is only set when there is exactly one, so reading
+        // it alone lost the whole set the moment a second pod appeared.
+        for (const pod of data.pods ?? []) pods.add(pod);
       }
     }
   }
@@ -4002,7 +4145,7 @@ function adaptPrometheusRules(
       tier: "checked",
       relevance: "target",
       tone: "neutral",
-      title: `No ${stateFilter} alert rules name this ${displayKind(builder.target.kind)}`,
+      title: `No ${stateFilter} alerts matched this ${displayKind(builder.target.kind)}`,
       summary: identity,
       data: {
         type: "receipt",
@@ -4486,6 +4629,578 @@ function adaptSubjectPermissions(
   }
 }
 
+function timeSeries(value: unknown): TimeSeries | undefined {
+  const item = record(value);
+  if (!item || !Array.isArray(item.dataPoints)) return undefined;
+  const labels = record(item.labels) ?? {};
+  if (Object.values(labels).some((label) => typeof label !== "string")) {
+    return undefined;
+  }
+  const dataPoints: TimeSeries["dataPoints"] = [];
+  for (const raw of item.dataPoints) {
+    const point = record(raw);
+    if (!point || typeof point.timestamp !== "number") return undefined;
+    if (
+      point.value !== undefined &&
+      point.value !== null &&
+      typeof point.value !== "number"
+    ) {
+      return undefined;
+    }
+    dataPoints.push({
+      timestamp: point.timestamp,
+      value: typeof point.value === "number" ? point.value : null,
+    });
+  }
+  return { labels: labels as Record<string, string>, dataPoints };
+}
+
+function metricsSelector(
+  value: unknown,
+): InvestigationMetricsSelector | undefined {
+  const item = record(value);
+  if (!item || typeof item.metric !== "string" || !Array.isArray(item.matchers))
+    return undefined;
+  const matchers: InvestigationMetricsSelector["matchers"] = [];
+  for (const raw of item.matchers) {
+    const matcher = record(raw);
+    if (
+      !matcher ||
+      typeof matcher.label !== "string" ||
+      typeof matcher.op !== "string" ||
+      typeof matcher.value !== "string"
+    ) {
+      return undefined;
+    }
+    matchers.push({
+      label: matcher.label,
+      op: matcher.op,
+      value: matcher.value,
+    });
+  }
+  return { metric: item.metric, matchers };
+}
+
+/**
+ * How one selector relates to the investigated resource. "target": it names
+ * the target itself (an identity label, or pods a producer established as
+ * the target's own). "related": it mentions the target's namespace and
+ * something in it the target cannot be proved to own (a pod named by prefix,
+ * a sibling workload, an owner series). "namespace": only the namespace.
+ * "foreign": another namespace or none.
+ */
+type SelectorVerdict = "target" | "related" | "namespace" | "foreign";
+
+const VERDICT_RANK: Record<SelectorVerdict, number> = {
+  foreign: 3,
+  target: 2,
+  related: 1,
+  namespace: 0,
+};
+
+/**
+ * A regex matcher names the target only in the exact forms the plan admits,
+ * with the name's regex metacharacters (a dot in a Kubernetes name) escaped
+ * or absent. "api-?.*" also selects "apiworker-…" and an unescaped "api.v2"
+ * also selects "api-v2", so neither may claim the target.
+ */
+function regexNamesExactly(
+  value: string,
+  name: string,
+  suffix: string,
+): boolean {
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return value === `${escaped}${suffix}`;
+}
+
+/**
+ * The pod names an exact-set regex `^(a|b)$` (or the unanchored `a|b`, which
+ * Prometheus anchors) lists. A dot must be escaped to count: `^(api.v2-0)$`
+ * also selects `api-v2-0`, so it names more than the pod it appears to and
+ * cannot prove membership. Undefined for any other shape.
+ */
+function exactPodSet(value: string): string[] | undefined {
+  const body =
+    value.startsWith("^(") && value.endsWith(")$") ? value.slice(2, -2) : value;
+  if (body === "" || /[^A-Za-z0-9\-|\\.]/.test(body)) return undefined;
+  // Every dot has to arrive escaped; an unescaped one is a wildcard.
+  if (/(^|[^\\])\./.test(body.replace(/\\\\/g, ""))) return undefined;
+  const names = body.split("|").map((name) => name.replace(/\\\./g, "."));
+  return names.every((name) => /^[a-z0-9]([-a-z0-9.]*[a-z0-9])?$/.test(name))
+    ? names
+    : undefined;
+}
+
+/**
+ * Whether a workload identity label names the target: the label
+ * kube-state-metrics uses for the kind (`deployment`, `job_name`, …) or a
+ * generic `workload` label, with the exact name.
+ */
+function identityLabelNamesTarget(
+  target: InvestigationEvidenceTarget,
+  label: string,
+  value: string,
+  exact: boolean,
+): boolean {
+  const kind = target.kind.toLowerCase();
+  const workloadLabel = WORKLOAD_LABEL_BY_KIND[kind];
+  // `deployment=api` states the kind in the label itself; `workload=api` does
+  // not, so a `workload_type` naming another kind vetoes it in
+  // classifySelector, which is the only place that sees the whole selector.
+  if (label !== workloadLabel && label !== "workload") return false;
+  return exact
+    ? value === target.name
+    : regexNamesExactly(value, target.name, "");
+}
+
+function classifyMatcher(
+  target: InvestigationEvidenceTarget,
+  matcher: InvestigationMetricsSelector["matchers"][number],
+  establishedPods: ReadonlySet<string>,
+): SelectorVerdict {
+  const { label, op, value } = matcher;
+  const kind = target.kind.toLowerCase();
+  if (label === "pod") {
+    if (kind === "pod") {
+      if (op === "=") return value === target.name ? "target" : "related";
+      if (op === "=~") {
+        if (regexNamesExactly(value, target.name, "")) return "target";
+        // `^(name)$` is the form the diagnose prompt asks the agent to write,
+        // so a Pod target has to recognise its own name in it. The set must
+        // name nothing else: a query covering the target and a neighbour is
+        // not evidence about the target alone.
+        const names = exactPodSet(value);
+        return names && names.every((name) => name === target.name)
+          ? "target"
+          : "related";
+      }
+      return "related";
+    }
+    if (op === "=") return establishedPods.has(value) ? "target" : "related";
+    if (op === "=~") {
+      const names = exactPodSet(value);
+      if (names && names.every((name) => establishedPods.has(name))) {
+        return "target";
+      }
+      return "related";
+    }
+    return "related";
+  }
+  if (label === "namespace" || label === "container") return "namespace";
+  if (op === "=" && identityLabelNamesTarget(target, label, value, true)) {
+    return "target";
+  }
+  if (op === "=~" && identityLabelNamesTarget(target, label, value, false)) {
+    return "target";
+  }
+  // Owner series (kube_pod_owner, kube_replicaset_owner) and every other
+  // label in the namespace: about the namespace's things, not proved to be
+  // the target's.
+  return "related";
+}
+
+function classifySelector(
+  target: InvestigationEvidenceTarget,
+  selector: InvestigationMetricsSelector,
+  establishedPods: ReadonlySet<string>,
+): SelectorVerdict {
+  // `workload` is generic, so a `workload_type` naming another kind means
+  // the series is about a different workload that happens to share a name.
+  // A regex counts when it names an exact set, the same way the namespace
+  // matcher below does: `workload_type=~"statefulset"` excludes a Deployment
+  // as plainly as `=` does, and reading only `=` let a sibling's chart take
+  // the target's identity. A set that includes the target kind is no conflict,
+  // and an inexact regex says nothing either way.
+  const workloadType = selector.matchers.find(
+    (matcher) =>
+      matcher.label === "workload_type" &&
+      (matcher.op === "=" || matcher.op === "=~"),
+  );
+  const workloadTypeNames =
+    workloadType === undefined
+      ? undefined
+      : workloadType.op === "="
+        ? [workloadType.value]
+        : exactPodSet(workloadType.value);
+  const workloadTypeConflicts =
+    workloadTypeNames !== undefined &&
+    workloadTypeNames.length > 0 &&
+    !workloadTypeNames.some(
+      (name) => name.toLowerCase() === target.kind.toLowerCase(),
+    );
+  // Prometheus anchors regex matchers, so namespace=~"shop" is exact too.
+  const inNamespace = selector.matchers.some(
+    (matcher) =>
+      matcher.label === "namespace" &&
+      ((matcher.op === "=" && matcher.value === target.namespace) ||
+        (matcher.op === "=~" &&
+          regexNamesExactly(matcher.value, target.namespace ?? "", ""))),
+  );
+  if (!inNamespace) return "foreign";
+  let verdict: SelectorVerdict = "namespace";
+  for (const matcher of selector.matchers) {
+    if (workloadTypeConflicts && matcher.label === "workload") continue;
+    const candidate = classifyMatcher(target, matcher, establishedPods);
+    if (candidate === "foreign") return "foreign";
+    if (VERDICT_RANK[candidate] > VERDICT_RANK[verdict]) verdict = candidate;
+  }
+  return verdict;
+}
+
+/**
+ * A metrics result is about the target only when every selector names it:
+ * the target namespace plus pods a producer established as the target's own
+ * or an identity label with its exact name. A selector that only mentions
+ * something in the namespace the target cannot be proved to own (a pod
+ * prefix, a sibling, an owner join) makes the result producer-related: kept,
+ * not promoted, no change markers. A namespace-only query, a bare or foreign
+ * selector, or an inventory the producer could not extract is broader.
+ */
+export function metricsScope(
+  target: InvestigationEvidenceTarget,
+  selectors: readonly InvestigationMetricsSelector[],
+  selectorsUnknown: boolean,
+  establishedPods: ReadonlySet<string> = new Set(),
+): InvestigationEvidenceRelevance {
+  if (selectorsUnknown || selectors.length === 0 || !target.namespace) {
+    return "broader";
+  }
+  let allTarget = true;
+  let anyRelated = false;
+  for (const selector of selectors) {
+    const verdict = classifySelector(target, selector, establishedPods);
+    if (verdict === "foreign") return "broader";
+    if (verdict !== "target") allTarget = false;
+    if (verdict === "related") anyRelated = true;
+  }
+  if (allTarget) return "target";
+  return anyRelated ? "producer-related" : "broader";
+}
+
+function metricsWindowLabel(data: {
+  mode: "range" | "instant";
+  start?: string;
+  end?: string;
+  step?: string;
+}): string | undefined {
+  if (data.mode !== "range" || !data.start || !data.end) return undefined;
+  const startMs = Date.parse(data.start);
+  const endMs = Date.parse(data.end);
+  if (!Number.isFinite(startMs) || !Number.isFinite(endMs) || endMs <= startMs)
+    return undefined;
+  const minutes = Math.round((endMs - startMs) / 60_000);
+  const window =
+    minutes >= 60 * 24 * 2
+      ? `${Math.round(minutes / (60 * 24))}d`
+      : minutes >= 120
+        ? `${Math.round(minutes / 60)}h`
+        : `${minutes}m`;
+  return data.step
+    ? `${window} window · ${data.step} step`
+    : `${window} window`;
+}
+
+/**
+ * One half of a Go↔TS contract: `diagnoseMetricsCategories` in
+ * internal/mcp/tools_diagnose_metrics.go decides which categories the producer
+ * captures, and a series whose category is missing here is discarded. Change
+ * both together.
+ */
+const DIAGNOSE_METRICS_LABELS: Record<string, string> = {
+  cpu: "CPU usage",
+  memory: "Memory working set",
+  restarts: "Restarts",
+};
+
+/**
+ * The vitals `diagnose` captured inside the same call: one chart per category
+ * over the exact pods the bundle covers. They take the bundle's relevance, so a
+ * neighbour's diagnose never charts as evidence for the target, and they carry
+ * the diagnosed resource as their subject so recorded changes can be marked
+ * on them. An absent field means Prometheus was not available or the read was
+ * not permitted, which is not a collection failure the producer reported.
+ */
+function addDiagnoseMetrics(
+  builder: ProjectionBuilder,
+  source: InvestigationEvidenceSource,
+  raw: unknown,
+  subject: DiagnosisResourceRef,
+  relevance: InvestigationEvidenceRelevance,
+): void {
+  if (raw === undefined) return;
+  const value = record(raw);
+  const window = record(value?.window);
+  if (
+    !value ||
+    !window ||
+    !nonEmptyString(window.start) ||
+    !nonEmptyString(window.end) ||
+    !nonEmptyString(window.step) ||
+    !(Date.parse(window.end) > Date.parse(window.start)) ||
+    !nonNegativeInteger(value.pods) ||
+    (value.partial !== undefined && typeof value.partial !== "boolean") ||
+    (value.omittedPods !== undefined &&
+      !nonNegativeInteger(value.omittedPods)) ||
+    (value.error !== undefined && typeof value.error !== "string") ||
+    !Array.isArray(value.series)
+  ) {
+    invalidPayload(builder, source, "Workload metrics");
+    return;
+  }
+  const scope = scopeFromArgs(source);
+  const partial = value.partial === true;
+  // The pods the chart covers: the ones the workload controlled when the
+  // bundle was captured, which a rollout during the window can miss.
+  const podsLabel = partial
+    ? `first ${value.pods} of ${typeof value.omittedPods === "number" ? value.pods + value.omittedPods : "the"} current pods`
+    : `${value.pods} current pod${value.pods === 1 ? "" : "s"}`;
+  const windowLabel = metricsWindowLabel({
+    mode: "range",
+    start: window.start,
+    end: window.end,
+    step: window.step,
+  });
+  for (const rawEntry of value.series) {
+    const entry = record(rawEntry);
+    const rawSeries = entry?.series;
+    const series = Array.isArray(rawSeries)
+      ? rawSeries
+          .map(timeSeries)
+          .filter((item): item is TimeSeries => Boolean(item))
+      : undefined;
+    if (
+      !entry ||
+      !nonEmptyString(entry.category) ||
+      !Object.hasOwn(DIAGNOSE_METRICS_LABELS, entry.category) ||
+      !nonEmptyString(entry.query) ||
+      !nonEmptyString(entry.unit) ||
+      !Array.isArray(rawSeries) ||
+      !series ||
+      series.length !== rawSeries.length
+    ) {
+      invalidPayload(builder, source, "Workload metrics");
+      continue;
+    }
+    const label = DIAGNOSE_METRICS_LABELS[entry.category];
+    const data: InvestigationMetricsEvidence = {
+      type: "metrics",
+      origin: "diagnose",
+      query: entry.query,
+      mode: "range",
+      start: window.start,
+      end: window.end,
+      step: window.step,
+      unit: entry.unit,
+      label,
+      series,
+      truncated: false,
+      subject,
+      pods: value.pods,
+      partial,
+    };
+    builder.observe(
+      `metrics:diagnose:${subject.group ?? ""}:${subject.kind}:${subject.namespace ?? ""}:${subject.name}:${entry.category}`,
+      "metrics",
+      source,
+      {
+        tier: evidenceTierForRelevance("supporting", relevance),
+        relevance,
+        tone: "neutral",
+        title: `${label} · ${scope}`,
+        summary: [
+          series.length === 0 ? "No samples in the window" : podsLabel,
+          windowLabel,
+          partial ? "partial pod set" : undefined,
+        ]
+          .filter((part): part is string => Boolean(part))
+          .join(" · "),
+        data,
+      },
+    );
+  }
+  if (nonEmptyString(value.error)) {
+    builder.limit(source, "Workload metrics", value.error, "error");
+  }
+}
+
+// Radar's reading of a metric name, so an agent-written query gets a title a
+// reader can scan instead of the raw series name. Deliberately small and exact:
+// an unrecognised metric keeps its own name rather than being handed a meaning
+// Radar cannot derive from it.
+const METRIC_FAMILY_LABELS: Record<string, string> = {
+  container_cpu_usage_seconds_total: "CPU usage",
+  container_cpu_cfs_throttled_seconds_total: "CPU throttling",
+  container_memory_working_set_bytes: "Memory working set",
+  container_memory_usage_bytes: "Memory usage",
+  container_memory_rss: "Memory RSS",
+  kube_pod_container_status_restarts_total: "Restarts",
+  container_network_receive_bytes_total: "Network received",
+  container_network_transmit_bytes_total: "Network transmitted",
+  container_fs_usage_bytes: "Filesystem usage",
+  up: "Scrape target up",
+};
+
+function adaptQueryPrometheus(
+  builder: ProjectionBuilder,
+  source: InvestigationEvidenceSource,
+  payload: unknown,
+): void {
+  const value = record(payload);
+  const mode = value?.type;
+  if (
+    !value ||
+    !nonEmptyString(value.query) ||
+    (mode !== "range" && mode !== "instant") ||
+    !Array.isArray(value.series) ||
+    !Array.isArray(value.selectors) ||
+    (value.selectorsUnknown !== undefined &&
+      typeof value.selectorsUnknown !== "boolean") ||
+    (value.truncated !== undefined && typeof value.truncated !== "boolean")
+  ) {
+    invalidPayload(builder, source, "Prometheus query");
+    return;
+  }
+  const series = value.series
+    .map(timeSeries)
+    .filter((item): item is TimeSeries => Boolean(item));
+  const selectors = value.selectors
+    .map(metricsSelector)
+    .filter((item): item is InvestigationMetricsSelector => Boolean(item));
+  if (
+    series.length !== value.series.length ||
+    selectors.length !== value.selectors.length
+  ) {
+    invalidPayload(builder, source, "Prometheus query");
+    return;
+  }
+  const selectorsUnknown = value.selectorsUnknown === true;
+  const relevance = metricsScope(
+    builder.target,
+    selectors,
+    selectorsUnknown,
+    producerEstablishedTargetPods(builder),
+  );
+  const start = nonEmptyString(value.start) ? value.start : undefined;
+  const end = nonEmptyString(value.end) ? value.end : undefined;
+  const step = nonEmptyString(value.step) ? value.step : undefined;
+  const note = nonEmptyString(value.note) ? value.note : undefined;
+  if (value.truncated === true) {
+    const summary = record(value.summary);
+    const cardinality = record(summary?.labelCardinality);
+    const widest = cardinality
+      ? Object.entries(cardinality).find(
+          ([, count]) => typeof count === "number",
+        )
+      : undefined;
+    const parts = [
+      typeof summary?.seriesCount === "number"
+        ? `${summary.seriesCount} series`
+        : undefined,
+      typeof summary?.totalDataPoints === "number"
+        ? `${summary.totalDataPoints} samples`
+        : undefined,
+      widest ? `${widest[1]} distinct ${widest[0]} values` : undefined,
+    ].filter((part): part is string => Boolean(part));
+    builder.limit(
+      source,
+      "Prometheus query",
+      `The result of \`${value.query}\` was too large to keep${parts.length ? ` (${parts.join(", ")})` : ""}, so Radar cannot chart it.${note ? ` ${note}` : ""}`,
+      "truncated",
+    );
+    return;
+  }
+  const windowLabel = metricsWindowLabel({ mode, start, end, step });
+  // One metric names the card; the title is Radar's reading of the query,
+  // never the agent's, so a wrong claim cannot become the card's identity.
+  // A bare matcher block such as `{namespace="shop"}` names no metric.
+  const metricNames = [
+    ...new Set(
+      selectors.flatMap((selector) =>
+        selector.metric.trim() ? [selector.metric.trim()] : [],
+      ),
+    ),
+  ];
+  // A recognised family names the card; the scope is added only when Radar
+  // already decided the query is about the target, so the title never widens
+  // or narrows what the relevance check concluded.
+  const family =
+    metricNames.length === 1 ? METRIC_FAMILY_LABELS[metricNames[0]] : undefined;
+  const scope =
+    relevance === "target"
+      ? `${displayKind(builder.target.kind)} ${builder.target.namespace ? `${builder.target.namespace}/` : ""}${builder.target.name}`
+      : undefined;
+  const title = family
+    ? scope
+      ? `${family} · ${scope}`
+      : family
+    : metricNames.length === 1
+      ? metricNames[0]
+      : mode === "range"
+        ? "Prometheus metrics"
+        : "Prometheus values";
+  const data: InvestigationMetricsEvidence = {
+    type: "metrics",
+    origin: "query",
+    query: value.query,
+    mode,
+    start,
+    end,
+    step,
+    unit: metricsUnitForExpression(value.query, selectors),
+    series,
+    truncated: false,
+    note,
+    selectors,
+    selectorsUnknown,
+    subject:
+      relevance === "target"
+        ? {
+            kind: builder.target.kind,
+            ...(builder.target.group ? { group: builder.target.group } : {}),
+            namespace: builder.target.namespace,
+            name: builder.target.name,
+          }
+        : undefined,
+  };
+  builder.observe(
+    `metrics:${mode}:${value.query}:${start ?? ""}:${end ?? ""}:${step ?? ""}`,
+    "metrics",
+    source,
+    {
+      tier: evidenceTierForRelevance("supporting", relevance),
+      relevance,
+      tone: "neutral",
+      title,
+      summary: [
+        // When a family named the card, the metric name moves here so it stays
+        // visible; otherwise it is already the title.
+        family
+          ? metricNames[0]
+          : metricNames.length === 1
+            ? "Prometheus"
+            : undefined,
+        series.length === 0 ? "No series matched" : `${series.length} series`,
+        windowLabel,
+      ]
+        .filter((part): part is string => Boolean(part))
+        .join(" · "),
+      data,
+    },
+  );
+}
+
+/**
+ * Adapters whose verdict depends on which pods a producer established as the
+ * target's. They run after every other tool in the transcript, so the answer
+ * does not depend on whether the agent happened to query Prometheus before or
+ * after the read that named the pods. Their source order is captured before
+ * they are queued, so deferring the classification does not reorder evidence.
+ */
+const MEMBERSHIP_DEPENDENT_ADAPTERS = new Set([
+  "query_prometheus",
+  "get_prometheus_rules",
+]);
+
 const ADAPTERS: Record<
   string,
   (
@@ -4507,15 +5222,72 @@ const ADAPTERS: Record<
   get_prometheus_rules: adaptPrometheusRules,
   get_helm_release: adaptHelmRelease,
   get_subject_permissions: adaptSubjectPermissions,
+  query_prometheus: adaptQueryPrometheus,
 };
 
+/**
+ * The pods every diagnose of the target listed as its own, gathered before
+ * anything is classified. A metrics query is target evidence when it names
+ * pods a producer established, and that must not depend on whether the agent
+ * happened to run diagnose before or after the query: the same investigation
+ * would otherwise read differently for the same facts.
+ */
+function collectEstablishedTargetPods(
+  builder: ProjectionBuilder,
+  turns: readonly InvestigationEvidenceTurn[],
+): void {
+  for (const turn of turns) {
+    for (const item of turn.timeline) {
+      if (
+        item.kind !== "tool" ||
+        item.tool !== "diagnose" ||
+        item.radarEvidence !== true ||
+        item.status !== "done" ||
+        // Confirmed success, the same test the sources use. This set is what
+        // proves a Prometheus selector is about the target, so a result that
+        // never said it succeeded must not put pods into it.
+        item.isError !== false ||
+        !nonEmptyString(item.result)
+      ) {
+        continue;
+      }
+      const value = record(parseJSON(item.result));
+      const resource = kubernetesResource(value?.resource);
+      if (!value || !resource || !Array.isArray(value.podNames)) continue;
+      if (
+        relevanceForResource(builder, {
+          kind: resource.kind,
+          group: apiVersionToGroup(resource.apiVersion),
+          namespace: resource.metadata.namespace,
+          name: resource.metadata.name,
+        }) !== "target"
+      ) {
+        continue;
+      }
+      for (const pod of value.podNames) {
+        if (nonEmptyString(pod)) builder.establishedTargetPods.add(pod);
+      }
+    }
+  }
+}
+
 export function projectInvestigationEvidence(
   turns: readonly InvestigationEvidenceTurn[],
   target: InvestigationEvidenceTarget,
 ): InvestigationEvidenceProjection {
   const builder = new ProjectionBuilder(target);
+  collectEstablishedTargetPods(builder, turns);
   const evidenceRefSources: InvestigationEvidenceSource[] = [];
   const citableSources: InvestigationEvidenceSource[] = [];
+  const deferred: {
+    adapt: (
+      builder: ProjectionBuilder,
+      source: InvestigationEvidenceSource,
+      payload: unknown,
+    ) => void;
+    source: InvestigationEvidenceSource;
+    payload: unknown;
+  }[] = [];
   let order = 0;
   for (const [turnIndex, turn] of turns.entries()) {
     for (const [timelineIndex, item] of turn.timeline.entries()) {
@@ -4590,7 +5362,11 @@ export function projectInvestigationEvidence(
         invalidPayload(builder, source);
         continue;
       }
-      adapt(builder, source, payload);
+      if (MEMBERSHIP_DEPENDENT_ADAPTERS.has(item.tool)) {
+        deferred.push({ adapt, source, payload });
+      } else {
+        adapt(builder, source, payload);
+      }
       if (item.isError !== false) {
         builder.limit(
           source,
@@ -4602,6 +5378,13 @@ export function projectInvestigationEvidence(
     }
   }
 
+  // Membership is settled now: every read that could name one of the target's
+  // pods has been adapted, so these see the same set whatever order the agent
+  // worked in.
+  for (const { adapt, source, payload } of deferred) {
+    adapt(builder, source, payload);
+  }
+
   const tierRank: Record<InvestigationEvidenceTier, number> = {
     key: 0,
     supporting: 1,
@@ -4770,7 +5553,12 @@ export function projectInvestigationEvidence(
 
   return {
     groups: builder.groups,
-    limitations: builder.limitations,
+    // Qualifications read in the order the investigation produced them, which
+    // is the transcript's order and not the order the adapters happened to
+    // run in: the membership-dependent ones are adapted last.
+    limitations: [...builder.limitations].sort(
+      (a, b) => a.firstOrder - b.firstOrder,
+    ),
     sources: builder.sources,
     evidenceRefSources,
     citableSources,