feat(timeline): one record of what happened to the infrastructure, newest first (#6348)

A stored log, timeline_entries, with one row per thing that happened. Each
source writes its row in the same transaction as its own record, so the
history outlives the 30/90/365-day retention of the tables it points to:

- alert events (core/alerts._add_event): fired, resolved, acknowledged,
  went silent, readings back;
- finished Ansible runs (executor, and the startup sweep of interrupted
  runs): changed something, changed nothing, failed, dry run;
- audit rows (core/audit.log_audit): Steward's settings, users and access,
  sign-ins, backups. Actions another writer records are left to it.

Entries carry a kind (fixed) and an area (Service, Host OS, Hardware,
Storage, Network, Security, Monitoring). Settings → Timeline edits the
areas and each type's area and visibility; both are applied when the
timeline is read, so a change re-sorts past entries and a hidden type
comes back when shown. Kept forever unless a retention is set.

The first start fills the timeline from the last 90 days of records once,
skipping any already covered. A host rename carries its entries.

UI: Timeline in the sidebar (filter by host, area, kind; scrolls on), a
History card on each host page. MCP: get_timeline.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/models/__init__.py

@@ -14,6 +14,7 @@ from .ansible_schedule import AnsibleSchedule
 from .settings import AppSetting
 from .dashboard import Dashboard, DashboardWidget, DashboardShareToken
 from .outbox import EmailOutbox, email_outbox_events
+from .timeline import TimelineEntry
 
 __all__ = [
     "Base", "User", "ApiToken", "UserInvite", "PasswordReset",
@@ -27,4 +28,5 @@ __all__ = [
     "AppSetting",
     "Dashboard", "DashboardWidget", "DashboardShareToken",
     "EmailOutbox", "email_outbox_events",
+    "TimelineEntry",
 ]

steward/models/timeline.py

@@ -0,0 +1,47 @@
+from __future__ import annotations
+from datetime import datetime
+from sqlalchemy import JSON, DateTime, Index, String, Text, text
+from sqlalchemy.dialects.postgresql import ARRAY
+from sqlalchemy.orm import Mapped, mapped_column
+from .base import Base
+from steward.core.ids import time_ordered_id
+
+
+class TimelineEntry(Base):
+    """One thing that happened to the infrastructure: an alert firing, a
+    playbook run, a change to Steward's settings. Each row stands on its own,
+    so it outlives the record it points to (`ref_type` / `ref_id`) once that
+    record's retention removes it.
+
+    `type` is a key of steward.timeline.catalog. Whether a type is shown, and
+    which area it sorts under, are settings applied when the timeline is read;
+    `area` is the area the event itself named when it was written, used unless
+    Settings → Timeline gives its type one."""
+    __tablename__ = "timeline_entries"
+
+    id: Mapped[str] = mapped_column(String(36), primary_key=True, default=time_ordered_id)
+    at: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)
+    # When something that lasted (a run) ended.
+    until: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
+    type: Mapped[str] = mapped_column(String(64), nullable=False)
+    area: Mapped[str] = mapped_column(String(32), nullable=False)
+    # The hosts it happened on, by name, as every other record keyed by host.
+    hosts: Mapped[list[str]] = mapped_column(ARRAY(String(128)), nullable=False, default=list)
+    # What it happened to, when that is not a host: a container, a rule's resource.
+    subject: Mapped[str | None] = mapped_column(String(255), nullable=True)
+    summary: Mapped[str] = mapped_column(Text, nullable=False)
+    detail: Mapped[dict | None] = mapped_column(JSON, nullable=True)
+    # A username, "<user> via MCP", or "system".
+    actor: Mapped[str] = mapped_column(String(64), nullable=False, default="system")
+    ref_type: Mapped[str | None] = mapped_column(String(32), nullable=True)
+    ref_id: Mapped[str | None] = mapped_column(String(64), nullable=True)
+
+    __table_args__ = (
+        Index("ix_timeline_entries_at", "at", "id"),
+        Index("ix_timeline_entries_hosts", "hosts", postgresql_using="gin"),
+        Index("ix_timeline_entries_type", "type"),
+        # One entry per source record, so a backfill can run over rows the
+        # live writers already covered.
+        Index("uq_timeline_entries_ref", "ref_type", "ref_id", unique=True,
+              postgresql_where=text("ref_id IS NOT NULL")),
+    )