detectkit 0.39.2__tar.gz → 0.41.0__tar.gz

{detectkit-0.39.2/detectkit.egg-info → detectkit-0.41.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: detectkit
-Version: 0.39.2
+Version: 0.41.0
 Summary: Metric monitoring with automatic anomaly detection
 Author: detectkit team
 License: MIT

{detectkit-0.39.2 → detectkit-0.41.0}/detectkit/__init__.py

@@ -4,7 +4,7 @@ detectk - Anomaly Detection for Time-Series Metrics
 A Python library for data analysts and engineers to monitor metrics with automatic anomaly detection.
 """
 
-__version__ = "0.39.2"
+__version__ = "0.41.0"
 
 from detectkit.core.interval import Interval
 from detectkit.core.models import ColumnDefinition, TableModel

{detectkit-0.39.2 → detectkit-0.41.0}/detectkit/alerting/channels/webhook.py

@@ -25,16 +25,22 @@ class WebhookChannel(BaseAlertChannel):
     - Slack incoming webhooks
     - Custom webhook endpoints
 
-    Rendering: the default (no custom ``template``) payload is a single
-    **Slack/Mattermost message attachment** — a colored accent bar, a title,
-    a short markdown lead (how long the anomaly has been running) with the
-    **Rule** chip beneath it, and a compact **fields grid** (Value / Expected /
-    Quorum / Severity / Started / Latest — Started / Cleared on recovery — then
-    full-width Detectors / Parameters), branded with a ``footer`` +
-    ``footer_icon``. This renders richly on both
-    Slack and Mattermost from one payload. A custom ``template`` degrades to a
-    plain text-only attachment (the template is one opaque string that can't be
-    sliced into fields), keeping the color, title and branding.
+    Rendering: the default (no custom ``template``) anomaly/recovery payload is
+    **two stacked Slack/Mattermost attachments** — a colored **base card** that
+    is always visible (the title, a short markdown lead with the **Rule** chip,
+    the Value / Expected fields and an always-visible compact **Links** field)
+    and a neutral **detail card** carrying the verbose tail (Quorum / Severity /
+    the anomalous span / Detectors / Parameters) as one markdown ``text`` block.
+    Slack and Mattermost natively collapse only an attachment's ``text`` (Slack
+    above 700 characters / 5 line breaks, Mattermost above ~200px of rendered
+    height) and **never** collapse the ``fields`` grid — so routing the bulk
+    into the detail card's ``text`` lets the platform fold it behind a
+    "Show more" toggle while the base (value, expected and links) stays in view.
+    Short kinds (no-data / error) render as a single base card. A custom
+    ``template`` degrades to a plain text-only attachment (one opaque string
+    that can't be sliced into fields), keeping the color, title and branding.
+    Branding (``footer`` + ``footer_icon``) rides on the **last** attachment so
+    it sits at the bottom of the whole message, below the folded detail card.
 
     Mentions ride in the **top-level** ``text`` (mentions inside attachments do
     not reliably notify on Slack). A ``dashboard_url`` makes the attachment
@@ -48,7 +54,12 @@ class WebhookChannel(BaseAlertChannel):
             "icon_url": "https://.../bot-icon.png",   # or "icon_emoji"
             "text": "<!here> ...",                      # mentions (top level)
             "channel": "#channel",                      # optional (Slack)
-            "attachments": [{"color": ..., "title": ..., "fields": [...], ...}]
+            "attachments": [
+                # base card — always visible (never folds; fields don't collapse)
+                {"color": ..., "title": ..., "fields": [Value, Expected, Links], ...},
+                # detail card — neutral, foldable text (anomaly/recovery only)
+                {"text": "<verbose tail>", "mrkdwn_in": ["text"]},
+            ]
         }
 
     Branding: the bot defaults to the **detectkit brand avatar** (``icon_url``)
@@ -177,39 +188,42 @@ class WebhookChannel(BaseAlertChannel):
         if template is not None:
             # Custom template → opaque text-only attachment (can't be sliced
             # into fields), but keep the color, title, branding and mrkdwn.
-            attachment: dict[str, Any] = {
-                "color": color,
-                "title": title,
-                "text": self.format_message(alert_data, template),
-                "mrkdwn_in": ["text"],
-            }
+            attachments: list[dict[str, Any]] = [
+                {
+                    "color": color,
+                    "title": title,
+                    "text": self.format_message(alert_data, template),
+                    "mrkdwn_in": ["text"],
+                }
+            ]
         else:
-            attachment = self._build_rich_attachment(alert_data, ctx, color, title)
+            attachments = self._build_rich_attachments(alert_data, ctx, color, title)
 
-        # Dashboard link → clickable attachment title (native on both platforms).
+        # Dashboard link → clickable title on the base (first) attachment.
         if alert_data.dashboard_url:
-            attachment["title_link"] = alert_data.dashboard_url
-
-        # Brand the attachment footer (reliable on Slack even when top-level
-        # username/icon are locked to the app install). Pair the brand name with
-        # the project name when set ("detectkit · my_project") so two projects
-        # posting to the same channel stay distinguishable even past the title.
+            attachments[0]["title_link"] = alert_data.dashboard_url
+
+        # Brand the LAST attachment's footer (reliable on Slack even when
+        # top-level username/icon are locked to the app install) so the brand
+        # line sits at the bottom of the whole message — below the folded detail
+        # card when one is present. Pair the brand name with the project name
+        # when set ("detectkit · my_project") so two projects posting to the same
+        # channel stay distinguishable even past the title.
         footer = self.username or BRAND_USERNAME
         if alert_data.project_name:
             footer = f"{footer} · {alert_data.project_name}"
-        attachment["footer"] = footer
+        attachments[-1]["footer"] = footer
         if self.icon_url:
-            attachment["footer_icon"] = self.icon_url
+            attachments[-1]["footer_icon"] = self.icon_url
         # Slack-only sugar: a real timestamp under the footer. Mattermost
-        # ignores it; the human-readable "Detected at" field carries the time
-        # on both.
+        # ignores it; the human-readable timestamp rides in the cards on both.
         ts_unix = self._unix_ts(alert_data.timestamp)
         if ts_unix is not None:
-            attachment["ts"] = ts_unix
+            attachments[-1]["ts"] = ts_unix
 
         payload: dict[str, Any] = {
             "username": self.username,
-            "attachments": [attachment],
+            "attachments": attachments,
         }
 
         # Mentions ride in TOP-LEVEL text — placed inside an attachment they
@@ -231,29 +245,43 @@ class WebhookChannel(BaseAlertChannel):
 
         return payload
 
-    def _build_rich_attachment(
+    def _build_rich_attachments(
         self,
         alert_data: AlertData,
         ctx: dict[str, Any],
         color: str,
         title: str,
-    ) -> dict[str, Any]:
-        """Build the default fields-based attachment for *alert_data*.
-
-        The lead text and which fields render depend on the alert kind
-        (anomaly / recovery / no-data / error); long values (params, detectors,
-        error message) use full-width fields, short stats use the 2-col grid.
+    ) -> list[dict[str, Any]]:
+        """Build the default attachment(s) for *alert_data*.
+
+        Returns a **base card** (always visible) and, for anomaly/recovery, a
+        neutral **detail card** whose long ``text`` block the chat client folds
+        behind "Show more". Slack and Mattermost collapse only an attachment's
+        ``text`` (never the ``fields`` grid), so the base keeps the value, the
+        expected band and the links permanently in view while the verbose tail
+        (quorum, severity, the anomalous span, detectors, parameters) rides in
+        the foldable detail card. No-data / error are short, so they render as a
+        single base card. Both cards render from one payload on Slack and
+        Mattermost.
         """
         kind = self.status_kind(alert_data)
-        fields: list[dict[str, Any]] = []
+        base_fields: list[dict[str, Any]] = []
+        detail_lines: list[str] = []
 
         def short(name: str, value: str) -> None:
+            """Add a 2-col field to the always-visible base card."""
             if value:
-                fields.append({"title": name, "value": value, "short": True})
+                base_fields.append({"title": name, "value": value, "short": True})
 
         def full(name: str, value: str) -> None:
+            """Add a full-width field to the always-visible base card."""
             if value:
-                fields.append({"title": name, "value": value, "short": False})
+                base_fields.append({"title": name, "value": value, "short": False})
+
+        def detail(name: str, value: str) -> None:
+            """Add one line to the foldable detail card: bold label + value."""
+            if value:
+                detail_lines.append(f"{self._bold(name)} {value}")
 
         def code(s: str) -> str:
             return f"`{s}`" if s else ""
@@ -261,7 +289,8 @@ class WebhookChannel(BaseAlertChannel):
         # The configured firing rule, set apart as a bold "Rule" label + an
         # inline-code chip so it reads as "this is the config that fired" at a
         # glance. Backticks render identically on Slack and Mattermost; the bold
-        # label is platform-aware (see ``_bold``).
+        # label is platform-aware (see ``_bold``). Stays in the always-visible
+        # base lead.
         rule_chip = f"{self._bold('Rule')} " + code(
             f"min_detectors={ctx['min_detectors']} · "
             f"direction={ctx['direction_policy']} · "
@@ -269,35 +298,42 @@ class WebhookChannel(BaseAlertChannel):
         )
 
         if kind == "anomaly":
-            # Description (how long it's been going on) leads; the Rule chip sits
-            # right above the value/expected fields it explains.
+            # Base (always visible): the lead (how long it's been going on), the
+            # Rule chip, and the value vs the expected band.
             lead = f"{ctx['anomaly_lead']}\n{rule_chip}"
             short("Value", code(ctx["value_display"]))
             short("Expected", code(ctx["expected_range"]))
-            short("Quorum", f"{ctx['detector_count']}/{ctx['min_detectors']} · {ctx['direction']}")
-            short("Severity", f"{alert_data.severity:.2f}")
-            # The problematic span: when the anomaly began and its latest point.
+            # Detail (folds): quorum, severity, the span, detectors + params.
+            detail(
+                "Quorum",
+                f"{ctx['detector_count']}/{ctx['min_detectors']} · {ctx['direction']}",
+            )
+            detail("Severity", f"{alert_data.severity:.2f}")
             if ctx["started_display"]:
-                short("Anomaly began", ctx["started_display"])
-                short("Latest reading", ctx["timestamp"])
+                detail("Anomaly began", ctx["started_display"])
+                detail("Latest reading", ctx["timestamp"])
             else:
-                full("Detected at", ctx["timestamp"])
-            full("Detectors", code(ctx["detector_name"]))
+                detail("Detected at", ctx["timestamp"])
+            detail("Detectors", code(ctx["detector_name"]))
             if ctx["detector_params"]:
-                full("Parameters", f"```{ctx['detector_params']}```")
+                # Fenced block on its own lines so it renders as a code block (and
+                # adds line breaks that help trip the platform's fold).
+                detail_lines.append(
+                    f"{self._bold('Parameters')}\n```\n{ctx['detector_params']}\n```"
+                )
         elif kind == "recovery":
             lead = f"{ctx['recovery_lead']}\n{rule_chip}"
             short("Value", code(ctx["value_display"]))
             short("Expected", code(ctx["expected_range"]))
-            # The incident timeline: anomaly onset → when the alert fired →
-            # when it recovered. ``short`` skips the fired field when unknown.
+            # Detail (folds): the incident timeline (onset → fired → recovered)
+            # and the detectors. ``detail`` skips the fired line when unknown.
             if ctx["started_display"]:
-                short("Anomaly began", ctx["started_display"])
-                short("Alert fired", ctx["fired_display"])
-                short("Recovered", ctx["timestamp"])
+                detail("Anomaly began", ctx["started_display"])
+                detail("Alert fired", ctx["fired_display"])
+                detail("Recovered", ctx["timestamp"])
             else:
-                full("Cleared at", ctx["timestamp"])
-            full("Detectors", code(ctx["detector_name"]))
+                detail("Cleared at", ctx["timestamp"])
+            detail("Detectors", code(ctx["detector_name"]))
         elif kind == "no_data":
             lead = "Query returned no datapoint for the latest expected interval."
             full("Expected at", ctx["timestamp"])
@@ -308,12 +344,13 @@ class WebhookChannel(BaseAlertChannel):
             err = f"{ctx['error_type']}: {ctx['error_message']}".strip(": ")
             full("Error", code(err))
 
-        # Links block — kept as its own flexible field, but every entry is a
-        # compact clickable label, never a raw URL string. A Grafana dashboard
-        # URL can be a paragraph long once it carries variables; nobody should
-        # read that in an alert, so we hide it behind the label and render in the
-        # platform's link syntax. Holds dashboard + any extra links + the "how to
-        # read this alert" guide, joined by " · ".
+        # Links — always visible in the base card. The dashboard / "how to read
+        # this alert" links are actionable, so they never fold. Every entry is a
+        # compact clickable label, never a raw URL string (a Grafana URL can be a
+        # paragraph long once it carries variables; nobody should read that in an
+        # alert), rendered in the platform's link syntax and joined by " · " on a
+        # single line to stay compact. (The title is also a clickable dashboard
+        # link.)
         link_parts = []
         if alert_data.dashboard_url:
             link_parts.append(self._link_markup(alert_data.dashboard_url, "Dashboard"))
@@ -335,14 +372,26 @@ class WebhookChannel(BaseAlertChannel):
                 f"(expected {ctx['expected_range']}) at {ctx['timestamp']}"
             )
 
-        return {
+        base: dict[str, Any] = {
             "fallback": fallback,
             "color": color,
             "title": title,
             "text": lead,
-            "fields": fields,
+            "fields": base_fields,
             "mrkdwn_in": ["text", "fields"],
         }
+        attachments: list[dict[str, Any]] = [base]
+        # Detail card: neutral (no color bar) so it reads as a continuation of
+        # the base rather than a second alert, with the verbose tail in one
+        # foldable ``text`` block.
+        if detail_lines:
+            attachments.append(
+                {
+                    "text": "\n".join(detail_lines),
+                    "mrkdwn_in": ["text"],
+                }
+            )
+        return attachments
 
     def _bold(self, text: str) -> str:
         """Render *text* bold in the target platform's markdown.

{detectkit-0.39.2 → detectkit-0.41.0}/detectkit/cli/assets/claude/rules/alerting.md

@@ -192,15 +192,25 @@ leads with a colored **status circle** — 🔴 anomaly, 🟢 recovery, 🟡 no-
 **project name** as a `[name] ` prefix (from `detectkit_project.yml`) — see
 [Project label](#project-label-multi-project-channels) below.
 
-- **Slack / Mattermost / generic webhook** — one message *attachment* with a
-  status-colored accent bar, a clickable title (the metric; links to
-  `dashboard_url` when set), a short markdown lead (the duration sentence — see
-  "Incident timing" below) with the **Rule** chip beneath it, and a compact
-  fields grid: short fields Value / Expected / Quorum / Severity / Anomaly began /
-  Latest reading (Anomaly began / Alert fired / Recovered on recovery), then full-width Detectors / Parameters,
-  plus a branded footer + footer icon. @mentions ride in the **top-level**
-  message text so they notify. A custom `template` instead renders as a plain
-  text-only attachment (color/title/ branding kept, no fields grid).
+- **Slack / Mattermost / generic webhook** — an anomaly/recovery renders as
+  **two stacked attachments** so long alerts fold in the channel. Both platforms
+  collapse only an attachment's `text` block behind a "Show more" toggle (Slack
+  above 700 chars / 5 line breaks; Mattermost above ~200px) and never collapse
+  the `fields` grid, so the message splits into:
+  - an always-visible **base card** — status-colored accent bar, a clickable
+    title (the metric; links to `dashboard_url` when set), a short markdown lead
+    (the duration sentence — see "Incident timing" below) with the **Rule** chip
+    beneath it, and a compact fields grid kept to **Value / Expected** plus an
+    always-visible compact **Links** field (dashboard + extra links + the "how to
+    read this alert" guide as clickable labels);
+  - a neutral, foldable **detail card** — the verbose tail as one markdown
+    `text` block: Quorum / Severity / the anomalous span (Anomaly began → Latest
+    reading; began → fired → recovered on recovery) / Detectors / Parameters.
+
+  No-data / error stay a single base card. The branded footer + footer icon ride
+  on the **last** attachment. @mentions ride in the **top-level** message text so
+  they notify. A custom `template` instead renders as a single plain text-only
+  attachment (color/title/branding kept, no fields grid, no fold split).
 - **Telegram** — default `parse_mode` is now **HTML**. The default message is
   structured and HTML-escaped: a colored status dot (red anomaly / green
   recovery / yellow no-data / blue error), a bold headline, the lead + rule, then

{detectkit-0.39.2 → detectkit-0.41.0}/detectkit/cli/assets/claude/rules/cli.md

@@ -104,17 +104,23 @@ the lot), and **Label** (band hides; **mark the real incidents** by drag, **Lass
 anomalies** — loop a cloud of anomaly dots, each consecutive run, gaps bridged up to
 `consecutive_anomalies`, becomes one span — or **Threshold capture** every span past
 a horizontal line, each widened to a full interval so the alert lands inside; the
-painted window saves as `capture_windows`). A confirmed (valid) alert is the user
-asserting a real incident happened there — it folds in as a virtual incident (counts
-toward recall + correct) so a clean metric whose alerts are all good is validated in
-a few clicks **without hand-drawing spans**, and is written as an incident on Save.
+painted window saves as `capture_windows`). **Confirming an alert valid IS marking an
+incident**: the confirmed streak becomes a first-class **ground-truth incident** that
+shows in the Marked-incidents list (a read-only "✓ confirmed alert" row; its ✕
+un-confirms the alert), counts toward recall + correct, and is written on Save — so a
+clean metric whose alerts are all good is validated in a few clicks **without
+hand-drawing spans**. The list, the live metrics and Save share **one** ground-truth
+set (hand-marked spans **plus** confirmed-valid alerts, deduped by overlap).
 As you tune, a metrics bar shows **incident catch rate (recall)** — how many
-ground-truth incidents (marked + validated) your config catches (an incident is
+ground-truth incidents (marked + confirmed) your config catches (an incident is
 caught when an alert's anomaly **streak overlaps** it, not just the fire instant) —
 **false-alert rate** (what share of alerts fall outside any incident and aren't
 confirmed valid; "≈1 in N false", a decimal so a mostly-false rate doesn't round to
 a misleading "1 in 1") — and **reviewed N/M**; only incidents within the loaded
-window are scored. **Save incidents** writes a
+window are scored. An optional **false-alert budget** (`false_alert_budget`, a
+fraction in `(0, 1]`, on the **metric** then **project**, default `0.5`) gently flags
+the false-alert chip when the rate exceeds it (tuning-only; labeling stays optional).
+**Save incidents** writes a
 versioned `incidents/<metric>/*.yml` — the same store `dtk autotune` reads, so the
 same labels feed the next supervised tune (it seeds from the newest file on open,
 **anchoring the budget-sized loaded window on the seeded incidents** — ending just

{detectkit-0.39.2 → detectkit-0.41.0}/detectkit/cli/assets/claude/rules/metrics.md

@@ -54,8 +54,15 @@ alerting:                      # optional — see alerting.md
 tables:                        # optional — per-metric internal table overrides
   datapoints: _dtk_datapoints_api
   detections: _dtk_detections_api
+
+false_alert_budget: 0.3        # optional — `dtk tune` target false-alert rate (0,1]; overrides project
 ```
 
+`false_alert_budget` is a per-metric **target false-alert rate** (a fraction in
+`(0, 1]`) the `dtk tune` cockpit gently flags when exceeded. It overrides the
+project-wide default; unset → project, then a built-in `0.5`. Tuning-only — it never
+affects the load/detect/alert pipeline.
+
 ## `interval` (required)
 
 Point spacing. String (`"30s"`, `"1min"`, `"5min"`, `"10min"`, `"1hour"`,

{detectkit-0.39.2 → detectkit-0.41.0}/detectkit/cli/assets/claude/rules/project.md

@@ -31,11 +31,17 @@ timeouts:                      # per-step, seconds
   alert: 300                   # alert step (default 300)
 
 alert_help_url: null           # optional, see below — "How to read this alert" link
+false_alert_budget: null       # optional — `dtk tune` target FDR (0,1]; per-metric override wins
 
 error_alerting:                # optional, see below
   enabled: false
 ```
 
+`false_alert_budget` is a project-wide **target false-alert rate** (a fraction in
+`(0, 1]`, e.g. `0.3` = 30%) for manual tuning: the `dtk tune` cockpit gently flags a
+metric when its false-alert rate exceeds it. A per-metric `false_alert_budget`
+overrides it; unset → a built-in `0.5`. Tuning-only — it never touches the pipeline.
+
 ### `alert_help_url` — "How to read this alert" link
 
 Every default-rendered alert on every channel carries a `How to read this alert`

{detectkit-0.39.2 → detectkit-0.41.0}/detectkit/cli/commands/tune.py

@@ -93,6 +93,11 @@ def run_tune(
 
     from_dt = parse_date(from_date) if from_date else None
     to_dt = parse_date(to_date) if to_date else None
+    # False-alert-rate budget for the cockpit's quality bar: metric overrides
+    # project; the builder falls back to a built-in default when both are unset.
+    budget = config.false_alert_budget
+    if budget is None:
+        budget = getattr(project_config, "false_alert_budget", None)
     # The builder resolves the window itself (recent ~TUNE_DEFAULT_POINTS by
     # default, or the explicit --from/--to span) and reads only that slice — no
     # need to pull the whole history just to find the bounds.
@@ -105,6 +110,7 @@ def run_tune(
         incidents=preload_incidents,
         capture_windows=preload_capture,
         alert_reviews=preload_reviews,
+        false_alert_budget=budget,
     )
     n_points = len(payload["points"])
     if n_points == 0:

{detectkit-0.39.2 → detectkit-0.41.0}/detectkit/config/metric_config.py

@@ -612,8 +612,31 @@ class MetricConfig(BaseModel):
     autotune: AutoTuneConfig | None = Field(
         default=None, description="Optional auto-tuning constraints (for `dtk autotune`)"
     )
+    # Per-metric false-alert-rate (FDR) budget for manual tuning, overriding the
+    # project-wide `false_alert_budget`. The `dtk tune` cockpit flags — non
+    # intrusively — when the share of fired alerts that don't overlap a real
+    # incident exceeds this fraction. Tuning-only: it never affects load/detect/
+    # alert and labeling stays optional.
+    false_alert_budget: float | None = Field(
+        default=None,
+        description=(
+            "False-alert-rate budget (a fraction in (0, 1], e.g. 0.3 = 30%) the "
+            "`dtk tune` cockpit flags when exceeded. Overrides the project-wide "
+            "default; unset → fall back to project, then a built-in default."
+        ),
+    )
     enabled: bool = Field(default=True, description="Whether metric is enabled")
 
+    @field_validator("false_alert_budget")
+    @classmethod
+    def validate_false_alert_budget(cls, v: float | None) -> float | None:
+        """A budget, if set, is a false-alert-rate fraction in ``(0, 1]``."""
+        if v is None:
+            return v
+        if not 0.0 < v <= 1.0:
+            raise ValueError("false_alert_budget must be a fraction in (0, 1] (e.g. 0.3 = 30%)")
+        return v
+
     # Parsed interval (computed from string/int)
     _interval: Interval | None = None
 

{detectkit-0.39.2 → detectkit-0.41.0}/detectkit/config/project_config.py

@@ -196,6 +196,30 @@ class ProjectConfig(BaseModel):
             "or false to hide it."
         ),
     )
+    # Project-wide default false-alert-rate (FDR) budget for manual tuning. The
+    # `dtk tune` cockpit flags — non-intrusively — when the share of fired alerts
+    # that don't overlap a real incident exceeds this fraction, so you have a
+    # target to tune against. A per-metric `false_alert_budget` overrides it.
+    # Labeling stays optional: the budget only colours an already-computed number,
+    # it never blocks anything or affects the load/detect/alert pipeline.
+    false_alert_budget: float | None = Field(
+        default=None,
+        description=(
+            "Default false-alert-rate budget (a fraction in (0, 1], e.g. 0.3 = "
+            "30%) the `dtk tune` cockpit flags when exceeded. Per-metric "
+            "`false_alert_budget` takes priority; unset → a built-in default."
+        ),
+    )
+
+    @field_validator("false_alert_budget")
+    @classmethod
+    def validate_false_alert_budget(cls, v: float | None) -> float | None:
+        """A budget, if set, is a false-alert-rate fraction in ``(0, 1]``."""
+        if v is None:
+            return v
+        if not 0.0 < v <= 1.0:
+            raise ValueError("false_alert_budget must be a fraction in (0, 1] (e.g. 0.3 = 30%)")
+        return v
 
     @field_validator("alert_help_url")
     @classmethod