@skyhook-io/radar-app 1.13.4 → 1.14.0

package/src/components/diagnose/investigationState.test.ts

@@ -16,11 +16,13 @@ import {
   investigationEvidenceInputsEqual,
   investigationEvidenceCoverageLimited,
   investigationEvidenceConflictsWithHealthy,
+  investigationHealthConflictExplainedBy,
   investigationEndedBeforeConclusion,
   investigationHistoryUnavailablePresentation,
   investigationInteractionsBlocked,
   investigationIsReadOnly,
   investigationPaneCenteredScrollTop,
+  investigationLiveCaseTurnIndex,
 } from "./investigationState";
 
 describe("investigation terminal presentation", () => {
@@ -289,6 +291,127 @@ describe("investigation evidence projection stability", () => {
       }),
     ).toBe(false);
   });
+  it("names the explained cards only when the agent addressed every conflict", () => {
+    const group = (id: string, title: string, tone = "warning") => ({
+      id,
+      identity: `issue:${id}`,
+      kind: "issue",
+      historical: false,
+      latest: {
+        tier: "supporting" as const,
+        relevance: "target" as const,
+        tone,
+        title,
+      },
+    });
+    const projection = {
+      groups: [group("g1", "CrashLoopBackOff"), group("g2", "OOMKilled")],
+    };
+    const note = (
+      groupId: string,
+      role: string,
+      placement: "card" | "revision" | "source" = "card",
+      claim = "the agent's reading of this card",
+    ) => ({ role, placement, claim, groupId });
+
+    expect(investigationHealthConflictExplainedBy(projection, undefined)).toBe(
+      null,
+    );
+    expect(
+      investigationHealthConflictExplainedBy(projection, [
+        note("g1", "benign"),
+      ]),
+    ).toBe(null);
+    expect(
+      investigationHealthConflictExplainedBy(projection, [
+        note("g1", "benign"),
+        note("g2", "cause"),
+      ]),
+    ).toBe(null);
+    expect(
+      investigationHealthConflictExplainedBy(projection, [
+        note("g1", "benign"),
+        note("g2", "benign", "source"),
+      ]),
+    ).toBe(null);
+    // A note pinned to a superseded read addressed the card as it was then,
+    // not the card the banner is qualifying now.
+    expect(
+      investigationHealthConflictExplainedBy(projection, [
+        note("g1", "benign"),
+        note("g2", "benign", "revision"),
+      ]),
+    ).toBe(null);
+    // An empty claim renders nothing, so the banner would be pointing at a
+    // note the reader cannot find.
+    expect(
+      investigationHealthConflictExplainedBy(projection, [
+        note("g1", "benign"),
+        note("g2", "benign", "card", "   "),
+      ]),
+    ).toBe(null);
+    // "Excludes some hypothesis" and "is peripheral here" are both true of a
+    // problem that is still live, so neither reconciles a healthy verdict.
+    expect(
+      investigationHealthConflictExplainedBy(projection, [
+        note("g1", "benign"),
+        note("g2", "rules_out"),
+      ]),
+    ).toBe(null);
+    // A note on a superseded revision of the card is not an explanation of
+    // the card as it now stands.
+    expect(
+      investigationHealthConflictExplainedBy(projection, [
+        note("g1", "benign"),
+        note("g2", "demoted"),
+      ]),
+    ).toBe(null);
+    expect(
+      investigationHealthConflictExplainedBy(projection, [
+        note("g1", "benign"),
+        note("g2", "benign"),
+      ]),
+    ).toEqual(["CrashLoopBackOff", "OOMKilled"]);
+    // The agent contradicting itself on the same card is not an explanation.
+    expect(
+      investigationHealthConflictExplainedBy(projection, [
+        note("g1", "benign"),
+        note("g2", "benign"),
+        note("g2", "cause"),
+      ]),
+    ).toBe(null);
+    expect(
+      investigationHealthConflictExplainedBy({ groups: [] }, [
+        note("g1", "benign"),
+      ]),
+    ).toBe(null);
+
+    // One log stream read through two calls lands in two groups sharing an
+    // identity, so the partition must not decide whether the agent addressed
+    // it: a note on either twin counts for the conflict recorded on the other.
+    const stream = (id: string) => ({
+      id,
+      identity: "logs:previous:api-abc:api",
+      kind: "logs",
+      historical: false,
+      latest: {
+        tier: "supporting" as const,
+        relevance: "target" as const,
+        tone: "warning",
+        title: "Previous logs · api-abc / api",
+      },
+    });
+    expect(
+      investigationHealthConflictExplainedBy(
+        { groups: [stream("scope-a"), stream("scope-b")] },
+        [note("scope-b", "benign")],
+      ),
+    ).toEqual([
+      "Previous logs · api-abc / api",
+      "Previous logs · api-abc / api",
+    ]);
+  });
+
   it("ignores reasoning-only transcript updates while retaining completed tool identity", () => {
     const completedTool = {
       kind: "tool" as const,
@@ -693,3 +816,202 @@ describe("investigation action gating", () => {
     ).toBe(true);
   });
 });
+
+describe("investigationLiveCaseTurnIndex", () => {
+  const linkedItem = {
+    status: "linked" as const,
+    ref: "ev_x",
+    role: "context" as const,
+    claim: "c",
+  };
+  const assessment = {
+    status: "done" as const,
+    diagnosis: { healthy: true, rootCause: "", report: "", remediation: [] },
+  };
+  it("keeps the assessment when no later turn cites evidence", () => {
+    const answer = {
+      status: "done" as const,
+      question: "why?",
+      diagnosis: { rootCause: "", report: "because", remediation: [] },
+    };
+    expect(investigationLiveCaseTurnIndex([assessment, answer], 0)).toBe(0);
+  });
+  it("moves to an answer turn that carries a bound case or linked root-cause refs", () => {
+    const cited = {
+      status: "done" as const,
+      question: "chart it and cite it",
+      diagnosis: {
+        rootCause: "",
+        report: "",
+        remediation: [],
+        evidence: [linkedItem],
+      },
+    };
+    expect(investigationLiveCaseTurnIndex([assessment, cited], 0)).toBe(1);
+    const legacy = {
+      status: "done" as const,
+      question: "what broke?",
+      diagnosis: {
+        rootCause: "x",
+        report: "",
+        remediation: [],
+        rootCauseEvidence: { status: "linked" as const, refs: ["ev_x"] },
+      },
+    };
+    expect(investigationLiveCaseTurnIndex([assessment, legacy], 0)).toBe(1);
+    const unlinkedOnly = {
+      ...cited,
+      diagnosis: {
+        ...cited.diagnosis,
+        evidence: [{ status: "unlinked" as const }],
+      },
+    };
+    expect(investigationLiveCaseTurnIndex([assessment, unlinkedOnly], 0)).toBe(
+      0,
+    );
+  });
+  it("ignores apply, explanation, running, and superseded turns", () => {
+    const cited = {
+      status: "done" as const,
+      question: "cite",
+      diagnosis: {
+        rootCause: "",
+        report: "",
+        remediation: [],
+        evidence: [linkedItem],
+      },
+    };
+    expect(
+      investigationLiveCaseTurnIndex(
+        [
+          assessment,
+          { ...cited, apply: true },
+          { ...cited, explainAssessment: 2 },
+          { ...cited, status: "running" as const },
+        ],
+        0,
+      ),
+    ).toBe(0);
+    // A newer assessment after the cited answer is the current one.
+    expect(
+      investigationLiveCaseTurnIndex([assessment, cited, assessment], 2),
+    ).toBe(2);
+  });
+});
+
+describe("adverse evidence and the healthy-conflict banner", () => {
+  const group = (kind: string, tone: string) => ({
+    id: `${kind}-1`,
+    kind,
+    historical: false,
+    latest: { tier: "supporting" as const, relevance: "target" as const, tone },
+  });
+
+  it("counts every kind Radar can capture a live problem in", () => {
+    // The round that added alerts and Helm cards forgot this rule, so a
+    // firing alert naming the workload sat under a green banner.
+    for (const kind of [
+      "issue",
+      "startup",
+      "crash",
+      "resource",
+      "logs",
+      "events",
+      "dns",
+      "network",
+      "alerts",
+      "helm",
+    ]) {
+      expect(
+        investigationEvidenceConflictsWithHealthy({
+          groups: [group(kind, "error")],
+        }),
+        kind,
+      ).toBe(true);
+    }
+    // A change, a receipt, a chart or a permission grant describe the world,
+    // not a problem in it.
+    for (const kind of [
+      "changes",
+      "receipt",
+      "metrics",
+      "permissions",
+      "relationships",
+      "topology",
+      "inventory",
+    ]) {
+      expect(
+        investigationEvidenceConflictsWithHealthy({
+          groups: [group(kind, "error")],
+        }),
+        kind,
+      ).toBe(false);
+    }
+  });
+
+  // `observe` splits one log stream read by two calls into two groups, so the
+  // explained check deliberately matches a note across groups sharing a kind
+  // and identity. That crossing must not reach forward in time: a later turn
+  // reading the same stream can report a different failure, and the
+  // assessment never saw it.
+  it("refuses a note as explaining a reading captured after the assessment", () => {
+    const logGroup = (id: string, turnIndex: number) => ({
+      id,
+      // Same stream, different calls: what the twin lookup exists for.
+      identity: "logs:current:api-7f6-a:api",
+      kind: "logs",
+      historical: false,
+      latest: {
+        tier: "supporting" as const,
+        relevance: "target" as const,
+        tone: "warning",
+        title: "Error logs",
+        source: { turnIndex },
+      },
+    });
+    const note = (groupId: string, turnIndex: number) => ({
+      role: "benign",
+      placement: "card" as const,
+      claim: "the warmup error clears once the cache fills",
+      groupId,
+      source: { turnIndex },
+    });
+
+    // Two calls in the assessment's own turn read the same stream. The note
+    // sits on one group and explains its twin as well.
+    expect(
+      investigationHealthConflictExplainedBy(
+        { groups: [logGroup("g-a", 0), logGroup("g-b", 0)] },
+        [note("g-a", 0)],
+      ),
+    ).toEqual(["Error logs", "Error logs"]);
+
+    // A later turn reads the same stream and reports a different failure.
+    // The turn-0 note was about something else and must not soften it.
+    expect(
+      investigationHealthConflictExplainedBy(
+        { groups: [logGroup("g-a", 0), logGroup("g-c", 1)] },
+        [note("g-a", 0)],
+      ),
+    ).toBe(null);
+  });
+
+  it("counts the intermediate alert tone, which carries every high severity", () => {
+    for (const tone of ["warning", "alert", "error"]) {
+      expect(
+        investigationEvidenceConflictsWithHealthy({
+          groups: [group("issue", tone)],
+        }),
+        tone,
+      ).toBe(true);
+    }
+    for (const tone of ["neutral", "info", "success"]) {
+      expect(
+        investigationEvidenceConflictsWithHealthy({
+          groups: [group("issue", tone)],
+        }),
+        tone,
+      ).toBe(false);
+    }
+  });
+});

package/src/components/diagnose/investigationState.ts

@@ -1,5 +1,6 @@
 // Pure presentation decisions over the durable transcript and evidence projection.
 // Keep React/DOM orchestration in InvestigationView; these rules have no UI runtime.
+import { evidenceKindIsAdverse } from "./investigationEvidenceKinds";
 import {
   DiagnoseError,
   type DiagnoseStreamEvent,
@@ -271,6 +272,35 @@ export function investigationEvidenceInputsEqual(
   return true;
 }
 
+/**
+ * The turn whose agent case annotates the Evidence pane. A follow-up answer
+ * that cites evidence ("chart this and cite it") must reach Findings, so the
+ * newest completed non-apply, non-explanation turn carrying a bound case or
+ * linked root-cause refs wins; earlier turns keep their case read-only.
+ */
+export function investigationLiveCaseTurnIndex(
+  turns: readonly Pick<
+    Turn,
+    "status" | "apply" | "explainAssessment" | "diagnosis"
+  >[],
+  currentAssessmentIdx: number,
+): number {
+  for (let index = turns.length - 1; index >= 0; index -= 1) {
+    const turn = turns[index];
+    if (turn.status !== "done" || turn.apply || turn.explainAssessment)
+      continue;
+    const diagnosis = turn.diagnosis;
+    if (!diagnosis) continue;
+    if (
+      diagnosis.evidence?.some((item) => item.status === "linked") ||
+      (diagnosis.rootCause && diagnosis.rootCauseEvidence?.status === "linked")
+    ) {
+      return Math.max(index, currentAssessmentIdx);
+    }
+  }
+  return currentAssessmentIdx;
+}
+
 export function investigationEvidenceCoverageLimited(
   projection: Pick<
     InvestigationEvidenceProjection,
@@ -306,44 +336,136 @@ export function investigationEvidenceCoverageLimited(
   );
 }
 
-const HEALTH_CONFLICT_EVIDENCE_KINDS = new Set([
-  "issue",
-  "startup",
-  "crash",
-  "resource",
-  "logs",
-  "events",
-  "dns",
-  "network",
-]);
-
 /**
  * A model-authored all-clear must not overrule active adverse Radar evidence.
  * Context-only warnings (for example a Helm ownership advisory) and ordinary
  * recent changes are deliberately excluded: they are useful context, not proof
  * that the investigated resource is unhealthy.
  */
-export function investigationEvidenceConflictsWithHealthy(projection: {
-  groups: readonly {
-    historical: boolean;
-    kind: string;
-    latest: {
-      relevance: "target" | "producer-related" | "broader";
-      tier: "key" | "supporting" | "context" | "checked";
-      tone: string;
-    };
-  }[];
-}): boolean {
-  return projection.groups.some(
+interface HealthConflictGroup {
+  id?: string;
+  /** Display identity; logs partition into several groups sharing one. */
+  identity?: string;
+  historical: boolean;
+  kind: string;
+  latest: {
+    relevance: "target" | "producer-related" | "broader";
+    tier: "key" | "supporting" | "context" | "checked";
+    tone: string;
+    title?: string;
+    /** Which turn captured this reading; a note cannot explain a later one. */
+    source?: { turnIndex: number };
+  };
+}
+
+export function investigationHealthConflictGroups<
+  G extends HealthConflictGroup,
+>(projection: { groups: readonly G[] }): G[] {
+  return projection.groups.filter(
     (group) =>
       !group.historical &&
       group.latest.relevance !== "broader" &&
       (group.latest.tier === "key" || group.latest.tier === "supporting") &&
-      (group.latest.tone === "warning" || group.latest.tone === "error") &&
-      HEALTH_CONFLICT_EVIDENCE_KINDS.has(group.kind),
+      // Radar's adverse tones run warning → alert → error; "high" severity
+      // from the Go side lands on alert, so leaving it out silently excused
+      // every high-severity finding.
+      (group.latest.tone === "warning" ||
+        group.latest.tone === "alert" ||
+        group.latest.tone === "error") &&
+      evidenceKindIsAdverse(group.kind),
   );
 }
 
+export function investigationEvidenceConflictsWithHealthy(projection: {
+  groups: readonly HealthConflictGroup[];
+}): boolean {
+  return investigationHealthConflictGroups(projection).length > 0;
+}
+
+/**
+ * The banner over a healthy verdict points at adverse Radar evidence. When the
+ * agent placed a "not a problem" note on every such card, the evidence is
+ * still shown but the reader has the agent's reason next to it, so the banner
+ * can say that instead of accusing evidence the agent addressed.
+ * Returns the titles of the explained cards, or null when any conflict is
+ * unexplained (or there is no conflict).
+ */
+export function investigationHealthConflictExplainedBy(
+  projection: { groups: readonly HealthConflictGroup[] },
+  caseItems:
+    | readonly {
+        role: string;
+        placement: "card" | "revision" | "source";
+        claim: string;
+        groupId?: string;
+        source?: { turnIndex: number };
+      }[]
+    | undefined,
+): string[] | null {
+  const conflicting = investigationHealthConflictGroups(projection);
+  if (conflicting.length === 0 || !caseItems) return null;
+  // `observe` keeps a log stream read through two different calls in separate
+  // groups, so a same-named pod from another workload's call cannot inherit
+  // the target's relevance. That partition must not also decide whether the
+  // agent addressed the stream: it explained one card, and the conflict is
+  // recorded on its twin. Group ids that share an identity are the same
+  // underlying observation for this question.
+  const twins = new Map<string, Set<string>>();
+  for (const group of projection.groups) {
+    if (!group.id || !group.identity) continue;
+    const key = `${group.kind}\u0000${group.identity}`;
+    const ids = twins.get(key) ?? new Set<string>();
+    ids.add(group.id);
+    twins.set(key, ids);
+  }
+  const titles: string[] = [];
+  for (const group of conflicting) {
+    const sameStream =
+      (group.identity && twins.get(`${group.kind}\u0000${group.identity}`)) ||
+      new Set<string>([group.id ?? ""]);
+    const onGroup = caseItems.filter(
+      (item) => item.groupId && sameStream.has(item.groupId),
+    );
+    // The agent contradicting itself is not an explanation. If it also called
+    // this card a cause or a symptom, it is asserting the problem, and the
+    // reader must see the unqualified warning.
+    if (
+      onGroup.some((item) => item.role === "cause" || item.role === "symptom")
+    )
+      return null;
+    const explained = onGroup.some(
+      (item) =>
+        // Only a note the reader can actually see on the card in front of
+        // them addresses it. A `source` item renders away from the card and a
+        // `revision` item addressed a superseded read of it, so neither
+        // speaks to the state the banner is qualifying; an empty claim shows
+        // nothing at all, and the banner would be citing a note that is not
+        // there. None of this judges whether the agent is right — that is why
+        // the banner stays a warning either way.
+        item.placement === "card" &&
+        item.claim.trim() !== "" &&
+        // Only `benign` says this evidence does not indicate a live problem.
+        // `rules_out` excludes some other hypothesis and `demoted` says the
+        // card is peripheral — both true of a still-active problem — so
+        // neither reconciles a healthy verdict with evidence contradicting it.
+        item.role === "benign" &&
+        // An assessment cannot have addressed a reading taken after it. The
+        // twin lookup above deliberately crosses calls, because one log
+        // stream read twice lands in two groups; without this, it would also
+        // let a note about an earlier failure explain a different one that
+        // the same stream reported in a later turn.
+        !(
+          group.latest.source !== undefined &&
+          item.source !== undefined &&
+          group.latest.source.turnIndex > item.source.turnIndex
+        ),
+    );
+    if (!explained) return null;
+    titles.push(group.latest.title ?? group.kind);
+  }
+  return titles;
+}
+
 export function investigationEndedBeforeConclusion(
   status: RunSummary["status"],
   lastTurn: Pick<Turn, "status" | "apply" | "explainAssessment"> | undefined,