From 7a1b46c37f25db099a3403f904cfbcba5d741f9e Mon Sep 17 00:00:00 2001 From: ConstanzeTU Date: Sat, 12 Sep 2026 10:48:21 +0200 Subject: [PATCH 1/2] pxl_scripts/dx: freshness reports over retention, not the picker Asked over the picker's window, freshness returned an empty table whenever the window held no rows, which is the reading it exists to rule out. It now looks back over the retention period, so an empty result means the store holds nothing rather than nothing recently. --- src/pxl_scripts/dx/evidence_graph/evidence_graph.pxl | 10 ++++++---- src/pxl_scripts/dx/shadow_trace/shadow_trace.pxl | 8 ++++++-- 2 files changed, 12 insertions(+), 6 deletions(-) diff --git a/src/pxl_scripts/dx/evidence_graph/evidence_graph.pxl b/src/pxl_scripts/dx/evidence_graph/evidence_graph.pxl index 2bcc85edbb0..586aa8c43c6 100644 --- a/src/pxl_scripts/dx/evidence_graph/evidence_graph.pxl +++ b/src/pxl_scripts/dx/evidence_graph/evidence_graph.pxl @@ -204,10 +204,12 @@ def stack_diff(start_time: str, clickhouse_dsn: str, order_id: str): def freshness(start_time: str, clickhouse_dsn: str): - # Seconds since the newest order. Distinguishes "quiet" from "dead": an empty - # panel with a small age means nothing happened; a large age means nothing is - # arriving. Without it both render as an empty table. - df = px.DataFrame('dx_src__orders', clickhouse_dsn=clickhouse_dsn, start_time=start_time) + # Deliberately ignores start_time. Freshness is a property of the store, not + # of the picker: asked over the picker's window this returned an empty table + # whenever the window held nothing, which is the exact reading it exists to + # rule out. The lookback is the retention period, so an empty result here + # means the store holds nothing at all rather than nothing recently. + df = px.DataFrame('dx_src__orders', clickhouse_dsn=clickhouse_dsn, start_time='-720h') df.one = 1 agg = df.groupby(['one']).agg(newest=('row_time', px.max), orders=('order_id', px.count)) agg.age_seconds = (px.now() - agg.newest) / 1000000000 diff --git a/src/pxl_scripts/dx/shadow_trace/shadow_trace.pxl b/src/pxl_scripts/dx/shadow_trace/shadow_trace.pxl index 2ee233d04cd..165e8129e5b 100644 --- a/src/pxl_scripts/dx/shadow_trace/shadow_trace.pxl +++ b/src/pxl_scripts/dx/shadow_trace/shadow_trace.pxl @@ -203,8 +203,12 @@ def creds(start_time: str, clickhouse_dsn: str, shadow_id: str): def freshness(start_time: str, clickhouse_dsn: str): - # Seconds since the newest trace update. Quiet and dead read differently here. - df = px.DataFrame('dx_shadow__trace', clickhouse_dsn=clickhouse_dsn, start_time=start_time) + # Deliberately ignores start_time. Freshness is a property of the store, not + # of the picker: asked over the picker's window this returned an empty table + # whenever the window held nothing, which is the exact reading it exists to + # rule out. The lookback is the retention period, so an empty result here + # means the store holds nothing at all rather than nothing recently. + df = px.DataFrame('dx_shadow__trace', clickhouse_dsn=clickhouse_dsn, start_time='-720h') df.one = 1 agg = df.groupby(['one']).agg(newest=('updated_at', px.max), traces=('shadow_id', px.count)) agg.age_seconds = (px.now() - agg.newest) / 1000000000 From 7e2b8d2efc01f06b8a5920e37e9aa1a4de09cd68 Mon Sep 17 00:00:00 2001 From: ConstanzeTU Date: Sat, 12 Sep 2026 10:49:57 +0200 Subject: [PATCH 2/2] pxl_scripts/dx/profile_coverage: governed is not signed Signature verification is off on these clusters, so an unsigned authored profile is adopted and governs. Counting signed == 1 reported zero for containers that are governed. The panel now counts authored profiles and reports verified and unsigned beside that count. --- .../dx/profile_coverage/profile_coverage.pxl | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/src/pxl_scripts/dx/profile_coverage/profile_coverage.pxl b/src/pxl_scripts/dx/profile_coverage/profile_coverage.pxl index 5cda03c964a..7e7ec5f3847 100644 --- a/src/pxl_scripts/dx/profile_coverage/profile_coverage.pxl +++ b/src/pxl_scripts/dx/profile_coverage/profile_coverage.pxl @@ -18,10 +18,19 @@ import px def governed(start_time: str, clickhouse_dsn: str): + # Governed means an authored profile governs the container. It does NOT mean + # signed: signature verification is off on these clusters, so an unsigned + # authored profile is adopted and governs exactly as a signed one would. + # This counted signed == 1 and so reported zero for containers that are + # governed today. signed stays a column beside kind, never the definition. df = px.DataFrame('dx_profiles__latest', clickhouse_dsn=clickhouse_dsn, start_time=start_time) - df = df[df.signed == 1] - agg = df.groupby(['namespace']).agg(signed_profiles=('name', px.count)) - return agg[['namespace', 'signed_profiles']] + df = df[df.kind == 'user'] + df.verified = px.select(df.signed == 1, 1, 0) + df.unsigned = px.select(df.signed == 1, 0, 1) + agg = df.groupby(['namespace']).agg(governed=('name', px.count), + verified=('verified', px.sum), + unsigned=('unsigned', px.sum)) + return agg[['namespace', 'governed', 'verified', 'unsigned']] def ungoverned(start_time: str, clickhouse_dsn: str):