feat(ui): audit, alert rules and the rule form say things in words (#5212)

#5212 "Plain labels: no raw ids, scopes, metric keys or unexplained jargon",
batch 1:

- Audit log: each action reads as a sentence ("paused monitor"), with the
  code as its tooltip. Detail shows flags as yes/no, lists joined, a run's
  scope by name, spans as spans, and no ids the entity column already gives.
  The filter is now a picker of areas.
- Alert rules, history and Status say the condition in words: "is down",
  "Fullest disk >= 85%". Readings use metric_value, and history times use
  |ago.
- Rule form: sources and metrics by name, the threshold's unit, "fires
  when it is down/up" for an up/down metric instead of 0.5, and a metric
  reference built from the catalog.
- Schedules and Maintenance: viewers no longer see Run now, Pause, Edit,
  Delete or New. Intervals and next runs read as "every 2h" and "in 3h";
  a scope reads "Every alert on Host agent".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/alerts/routes.py

@@ -15,6 +15,16 @@ alerts_bp = Blueprint("alerts", __name__, url_prefix="/alerts")
 
 _OPERATORS = [(op.value, op.value) for op in AlertOperator]
 
+def _form_condition(form) -> dict:
+    """The operator and threshold the form asks for. An up/down metric's form
+    sends the word it fires on (binary_when) instead: down is < 0.5, up is
+    >= 0.5, the midpoint of the 1.0 / 0.0 such a metric records."""
+    when = form.get("binary_when")
+    if when in ("down", "up") and form.get("metric_name") in ("is_up", "is_healthy"):
+        return {"operator": "<" if when == "down" else ">=", "threshold": "0.5"}
+    return {"operator": form.get("operator", ""), "threshold": form.get("threshold")}
+
+
 def _rule_form(form) -> dict:
     """The rule form's fields, as alert_svc.rule_fields takes them."""
     return {
@@ -22,8 +32,7 @@ def _rule_form(form) -> dict:
         "source_module": form.get("source_module", ""),
         "resource_name": form.get("resource_name", ""),
         "metric_name": form.get("metric_name", ""),
-        "operator": form.get("operator", ""),
-        "threshold": form.get("threshold"),
+        **_form_condition(form),
         "consecutive_failures_required": form.get("consecutive_failures_required"),
         "consecutive_ok_required": form.get("consecutive_ok_required"),
         "notify_no_data": "notify_no_data" in form,
@@ -121,6 +130,7 @@ async def active_fragment():
 def _history_row(event, rule) -> dict:
     """One transition as the history page shows it."""
     from steward.core.alerts import MUTED, RELEASED
+    from steward.core.formatting import metric_label, metric_value
     notes, muted_by, released = [], None, False
     for part in (event.note or "").split("; "):
         if part.startswith(MUTED):
@@ -129,11 +139,17 @@ def _history_row(event, rule) -> dict:
             released = True
         elif part:
             notes.append(part)
-    value = "no data" if event.metric_value is None else f"{event.metric_value:g}"
+    metric = rule.metric_name
+    if event.metric_value is None:
+        value = f"No {metric_label(metric)} reading"
+    elif metric in ("is_up", "is_healthy"):
+        value = metric_value(metric, event.metric_value).capitalize()
+    else:
+        value = f"{metric_label(metric)} {metric_value(metric, event.metric_value)}"
     return {
         "at": event.transitioned_at, "rule": rule,
         "from_state": event.from_state, "to_state": event.to_state,
-        "value": value, "condition": f"{rule.operator.value} {rule.threshold:g}",
+        "value": value, "condition": alert_svc.rule_condition(rule),
         "notes": notes, "muted_by": muted_by, "released": released,
         "deliveries": [(label, sent, error) for label, sent, error in (
             ("email", event.email_sent, event.email_error),
@@ -197,6 +213,7 @@ async def new_rule():
         initial_source=first_source,
         resources=resources,
         metrics=alert_svc.metric_catalog().get(first_source, []),
+        catalog=alert_svc.metric_catalog(),
         ansible_sources=_ansible_source_names(),
     )
 
@@ -218,6 +235,7 @@ async def edit_rule(rule_id: str):
         initial_source=rule.source_module,
         resources=resources,
         metrics=alert_svc.metric_catalog().get(rule.source_module, []),
+        catalog=alert_svc.metric_catalog(),
         ansible_sources=_ansible_source_names(),
     )
 

steward/alerts/service.py

@@ -131,17 +131,32 @@ async def resource_url(db, rule: AlertRule) -> str | None:
 _BINARY = ("is_up", "is_healthy")
 
 
+def rule_condition(rule: AlertRule) -> str:
+    """What a rule fires on, in words: "CPU > 90%", "Fullest disk >= 85%",
+    or "is down" for an up/down metric rather than "is_up < 0.5"."""
+    from steward.core.alerts import _is_breached
+    from steward.core.formatting import metric_label, metric_value
+    metric = rule.metric_name
+    if metric in _BINARY:
+        fires_on = [metric_value(metric, v) for v in (1.0, 0.0)
+                    if _is_breached(v, rule.operator, rule.threshold)]
+        if len(fires_on) == 1:
+            return f"is {fires_on[0]}"
+    return f"{metric_label(metric)} {rule.operator.value} {metric_value(metric, rule.threshold)}"
+
+
 def alert_sentence(rule: AlertRule, label: str, value: float | None,
              since: datetime | None, now: datetime) -> dict:
     """An alert as one sentence around its resource: {"lead", "resource",
-    "tail"}, read lead + resource + tail, e.g. "cpu_pct on " + "web-1" +
+    "tail"}, read lead + resource + tail, e.g. "CPU on " + "web-1" +
     " is 94% (> 90%), firing for 12m". label is alert_label(state); since is
     when that label began (no_data_since for no_data)."""
-    from steward.core.formatting import human_duration, metric_value
+    from steward.core.formatting import human_duration, metric_label, metric_value
     metric = rule.metric_name
+    said = metric_label(metric)
     held = human_duration((now - since).total_seconds()) if since else None
     if label == "no_data":
-        return {"lead": f"No {metric} from ", "resource": rule.resource_name,
+        return {"lead": f"No {said} reading from ", "resource": rule.resource_name,
                 "tail": f" for {held}" if held else ""}
     # An acknowledged alert is still breaching: say for how long it has been,
     # not how long ago someone acknowledged it (the page says that apart).
@@ -155,7 +170,7 @@ def alert_sentence(rule: AlertRule, label: str, value: float | None,
     else:
         reading = f" is {metric_value(metric, value)}"
     condition = f" ({rule.operator.value} {metric_value(metric, rule.threshold)})"
-    return {"lead": f"{metric} on ", "resource": rule.resource_name,
+    return {"lead": f"{said} on ", "resource": rule.resource_name,
             "tail": f"{reading}{condition}{for_how_long}"}