Syspeek 0.11.0

Syspeek 0.11.0 — one event stream, correlated incidents, and cost that means something

What this release adds

Timeline — one event stream, and "why did this spike"
Every change the console observes (monitor fired/recovered, process/container/unit
action, file integrity change, Kubernetes change, service restart, synthetic check
transition) lands in one bounded ring. The Timeline page lists it with a kind
picker and a filter; every chart carries annotation ticks, so a spike and the
change that caused it sit on the same axis. Hover for the label, click to open the
Timeline narrowed to that instant.

Alert correlation, ownership and flap suppression
Rules now have a grouping key and an owner ([alerts] <id>_group= / _owner=):
app_cpu, host_cpu and host_steal fold into one "compute" incident instead of three
pages, the row names who owns it, and group_wait/repeat_interval follow
Alertmanager's notification cadence. A monitor that flips faster than you can act
on it is marked [FLAPPING] and its outbound notifications are held while the
breach stays visible. Webhook payloads carry group/owner labels and a real
groupKey. New: /metrics exposes incidents open/flapping/unowned.

Cloud cost that means something

• Burn rate: current $/hour against the account's own trailing baseline, with
  1.5x/3x bands, a cloud_burn monitor, and syspeek_cloud_burn_usd_hour.
• Idle containers: a container that stays under 1% CPU and 1 KB/s for 15
  minutes is reported in a new IDLE column and on the DOCKER card.
• Per-pod right-sizing: the Cost page now lists a recommendation per pod —
  request → usage × 1.2, priced at the cluster's own rates. Suggestions are
  floored at 25m CPU / 32Mi memory, because a zero request is BestEffort, not a
  right-size.
• IaC drift: point [cloud] terraform_state= at terraform show -json output
  (or a raw .tfstate) and the Cloud page diffs it against the account listing —
  MISSING (deleted out of band) and UNMANAGED (created out of band).
• [cloud] identity=<provider>/<region>[/<account>]: for hosts behind a
  network policy that blocks the instance metadata service. IMDS always wins; the
  override is only a fallback, and the page says which one it used.

Kubernetes contexts
The kubeconfig's contexts are listed on the Kubernetes page and [k8s] context=
targets one — every kubectl call follows it.

Logs page fix
The Logs page had never been wrapped in a scroll area (since well before 0.10.0),
so it rendered as a narrow strip of cards. Fixed, and journalctl failures now
say why instead of just "failed".

Classic palette
The purple/neon look is gone: steel blue accent, azure/muted-green series, navy
banners. Dropdowns are readable on a dark theme (they had no palette at all, so a
combo popup fell back to the light platform theme).

What is proven, and how

Proven by CI on every push (ubuntu, macOS, Windows, plus clean-room
ubuntu:22.04 and ubuntu:24.04 containers for the .deb): 14 test targets, the
--dump headless JSON with its self-test blocks, the probe with a worstMs
budget gate, the recorder, and 32 rendered console pages as an artifact.

Proven against a live endpoint (this cut): the AWS fleet inventory and the
billed-spend query were driven end to end against a local AWS emulator on :4566 —
not fixtures. That is where three defects came from:

1. a refused forecast (an IAM policy without ce:GetCostForecast, or a provider
   that does not implement it) used to discard the whole billed month-to-date;
2. billing day keys were not normalised, so the cost burn baseline reported a
   249x spike on a flat account;
3. right-sizing recommended a zero request for an idle pod — a QoS downgrade
   that would have been worse than the over-request.

Proven against a live cluster: per-pod right-sizing ran on minikube with
metrics-server (15 pods): 11 of 15 pod(s) measured — $221.91/month of request headroom, including both a shrink and a raise.

Never run on real hardware (unchanged from 0.10.0): a real cloud account
(--cloud-prices, the billed-spend card against a provider console), real NVIDIA
silicon, a real Mac battery, and X11 click-through on a real desktop. Azure/GCP/OCI
cost paths remain gated — AWS is the only provider whose spend query is
implemented.

Upgrading

Same one-liners; syspeek update, and the AppImage's zsync channel resolves
(Syspeek-0.11.0-x86_64.AppImage.zsync is published).