feat(tickets): open, comment and resolve tickets from the UI and MCP; known issues on alerts and anomalies (#6351, #6352)

A ticket records a known problem: title, area, hosts, subject, description,
links to alert rules and anomalies, and a log of comments, edits, resolving
and reopening. Opening, resolving (with the resolution as the note) and
reopening go on the timeline; every step is audited, and the audit rows stay
off the timeline.

An alert or anomaly an open ticket covers (by link, by subject, or a
host-wide ticket on the host itself) shows a Known issue badge, and offers
"Open a ticket" prefilled from its rule or anomaly when none does. Hosts,
monitors and containers get a Known issues card.

MCP: list_tickets, get_ticket (viewer); open_ticket, update_ticket,
comment_ticket, resolve_ticket, reopen_ticket (operator). list_alerts and
list_anomalies carry known_issue; get_overview, get_host, get_monitor and
get_container carry open_tickets. Also update_change and delete_change for
changes recorded by hand (author or admin).

Tickets are left out of backups, like the timeline (2026-10-15 ruling).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/mcp/tools/overview.py

@@ -18,12 +18,16 @@ from steward.models.hosts import Host
 from steward.models.monitors import Monitor
 from steward.models.users import UserRole
 from steward.monitors import service as monitor_svc
+from steward.tickets import service as tk
 
 from ._shape import age_s, db_session, iso, now_utc, rnd
+from .tickets import brief
 
 logger = logging.getLogger(__name__)
 
 FINDINGS_CAP = 50
+# Open tickets get_overview lists; list_tickets has the rest.
+TICKETS_CAP = 10
 # A scheduled backup this long past its slot with none made is overdue: one
 # 15-minute tick and the hour a failed try waits, with room to spare.
 BACKUP_OVERDUE_AFTER = timedelta(hours=2)
@@ -291,6 +295,10 @@ async def get_overview() -> dict:
 
     `counts` sizes the fleet; `counts.anomalies_to_review` is how many metric
     anomalies wait for someone to mark them normal or real (list_anomalies).
+    `open_tickets` are known problems someone recorded and is working, most
+    recently worked first (up to 10; `counts.tickets_open` counts them all,
+    list_tickets lists them). A finding an open ticket covers is already
+    known: read the ticket (get_ticket) before treating it as new.
     `active_maintenance` names windows currently silencing alerts.
     `all_clear` is true when nothing is wrong.
     """
@@ -322,6 +330,8 @@ async def get_overview() -> dict:
         open_anomalies = await anom.open_anomalies(db)
         to_review = await anom.to_review_count(db)
         settings = await get_all_settings(db)
+        open_tickets = list((await db.execute(tk.query(status=tk.OPEN).limit(TICKETS_CAP + 1))).scalars())
+        tickets_open = await tk.open_count(db)
 
     thresholds = app.config.get("THRESHOLDS") or {}
     listed, silent, speaking = fold_agent_silence(active, agent)
@@ -347,7 +357,10 @@ async def get_overview() -> dict:
             "critical": sum(1 for f in findings if f["severity"] == "critical"),
             "warning": sum(1 for f in findings if f["severity"] == "warning"),
             "anomalies_to_review": to_review,
+            "tickets_open": tickets_open,
         },
+        # Known problems someone is working: what is wrong that is already known.
+        "open_tickets": [brief(t) for t in open_tickets[:TICKETS_CAP]],
         "active_maintenance": [
             {"window_id": w.id, "name": w.name, "end_at": iso(w.end_at),
              "scope": {"source_module": w.scope_source, "resource": w.scope_resource}}