Issues: symptom classification + owner-grouping (engine)

[nadaverell]

Builds the Radar Issues engine: every operational issue is classified by symptom category, gets a stable identity, and is grouped under its owning workload — so /api/issues and the MCP issues tool emit a triage queue, not a per-object feed. Pure/deterministic, table-tested, MCP-first.

What changed (3 commits)

1. Classify — a pure (Source, Kind, Reason) → category classifier (~25 categories → 11 groups, unknown first-class), wired into Compose. Every row carries category + category_group, both server-emitted labels and CEL filter bindings. Grounded in radar's actual reason vocabulary.
2. Identity — resolve each Pod problem's topmost stable controller (Pod→Deployment, not the intermediate ReplicaSet) at detection time; derive a grouping_scope and a deterministic cluster-local id = hash(scope, subject key, category). resourceKey reuses pkg/audit.ResourceKey so issues and audit deep-links share one key format.
3. Group — GroupIssues folds the flat evidence rows into the public model: one row per id with affected counts + bounded member refs. Grouped by default on /api/issues + MCP; the cap now counts issue groups, not replica fan-out.

Notes for review

• ?view=flat on /api/issues returns the raw pre-fold rows for debugging ("what folded into this group?"). MCP stays grouped-only — agents use get_resource/get_events for raw state.
• Compose() stays flat internally, so summarycontext's per-resource index is unchanged; a Filters.Grouped flag gates the fold.
• Representative rules are deterministic: severity = max member, subject = topmost owner, reason/message/crash-context from the worst member, age = oldest onset, last_seen = newest, members sorted + capped at 10 with members_truncated.
• Taxonomy gaps fall through to unknown deliberately (CronJob/Job/CAPI/PVC-Lost/Node-Cordoned, and categories whose detectors don't exist yet).

Pairs with skyhook-dev/radar-hub#52 (forwards the new fields through the fleet pivot). SPA grouped IssuesView is a follow-up.

🤖 Generated with Claude Code

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4b11cd6. Configure here.}

[cursor]

Unused GroupApplication constant is dead code

Low Severity

GroupApplication is declared as a Group constant but no category in the categoryGroup map maps to it, and it's not referenced anywhere else in the codebase. Unlike the forward-declared categories (e.g. CategoryDNSFailure) which at least have entries in categoryGroup, this group constant has zero consumers — making it truly dead code rather than a planned placeholder.

 

^{Reviewed by Cursor Bugbot for commit 4b11cd6. Configure here.}

[nadaverell]

Subsumed into #811 — the classification engine (the three issues: commits) is now the bottom of that stack, which also adds the unified pkg/subject resolver, the GA-blockers, and the grouped triage UI. Consolidating to one PR per review request. Reopen if we want the engine reviewed separately.