feat(web): SIEM-informed focus screens — Simple+ KPIs/pipeline, SOC triage table, NOC path health

[01rabbit]

Summary

Implements the three screens designed from commercial SIEM/SOC/NOC dashboard references (Splunk ES Security Posture key indicators, analyst-queue consoles, QRadar network summaries, Grafana SOC standup boards), adapted to the deterministic edge doctrine. The adopt/reject rationale — including what was deliberately not copied (radial time charts, geo maps, donut charts, threshold-less raw count tiles) — is recorded in docs/architecture/socnoc-workspace-design.md. Two commits:

Commit 1 — SIEM-informed focus screens

Simple+ (default landing view additions)

• KPI strip (Splunk Key Indicators style): Risk / Now queue / Direct critical / Impacted clients / Uplink / Services, each with tone coloring and ~1-min client-side trend arrows (▲/▼).
• Activity strip: last 60 min of alert activity as band-colored bars (amber = watch band, red = critical band).
• Deterministic pipeline funnel: events → signals → now/watch → action for the last hour, ending in the arbiter's current action.

SOC Focus panel (SOC workspace, directly under the Command Strip)

• KPIs: NOW / WATCH / BACKLOG / critical-warn / visibility / oldest unhandled NOW age (MTTA-style pressure signal, amber ≥10 min, red ≥30 min).
• Triage table over the deterministic queue bands — time / band / src→dst / sid·type / risk — with band filter chips and a keyword filter. Explicitly a banded queue view, not a raw event stream.
• 6-hour alerts-over-time strip.

NOC Focus panel (NOC workspace)

• KPIs: uplink / internet / capacity (with delta) / clients / impacted / services.
• Five-hop path health strip: clients → edge → uplink → gateway → internet with per-hop deterministic states — the edge-local replacement for a geo map.
• Top talkers table: state.noc_capacity.top_sources joined with the client identity view (hostname + trust state), share bars.
• Runtime meters (same math as the resource guard) and service chips.

Backend

• The dashboard bundle gains an activity key: time-bucketed alert counts (1h/2-min and 6h/20-min windows), banded through the same _normalize_alert_event normalizer and NOW/WATCH thresholds as the alert queues — activity coloring can never disagree with queue bands. Event-log tail widened to 400 rows for the bundle only.
• Alert-queue items caps raised 5 → 12 per band (8 for escalation candidates) so the triage table can render them; count fields unchanged.

Commit 2 — BHUSA 2026 decision rationale per jurisdiction

Surfaces the v2 decision-explanation fields from the Arsenal audit walkthrough (selected action, why chosen, why_not_others, release condition, trace / policy profile / config hash / evidence ids) inside each domain's focus screen:

• Booth-focus payload gains a domains key: domains.noc / domains.soc, each {status, reasons[]} from the explanation record's machine.noc_summary / soc_summary evaluator reasons — a read-only projection of the same artifacts the audit-review CLI reads.
• The bundle carries the whole projection as decision_focus.
• SOC decision card: arbiter's pick + reason, SOC jurisdiction rationale ("why this state"), why-not-stronger, release condition, and the audit line (trace · policy · cfg · evidence · DRY RUN/ENFORCED).
• NOC focus panel: mirrored "Decision rationale — NOC" card with the NOC jurisdiction's reasons and the same audit line.
• Graceful fallback to the live actions payload when no explanation record exists yet.

Type of change

• feat — new feature
• fix — bug fix
• refactor — no behavior change
• docs — documentation only
• test — tests only
• chore — build/CI/config
• security — security fix

Checklist

• PYTHONPATH=. pytest -q passes — 527 passed, identical to the pre-change baseline (only the known bhusa sandbox-only failures); booth-focus tests unaffected (additive key)
• Related documentation updated in this PR (docs/API_REFERENCE.md activity + decision_focus sections, docs/CHANGELOG.md, docs/architecture/socnoc-workspace-design.md)
• Deterministic First principle not violated (verdict/band logic reuses existing summarize* helpers and thresholds; the rationale cards are read-only projections of the arbiter's own explanation records)
• Raspberry Pi constraints not broken (no new dependencies; single-pass aggregation; plain DOM bars, no chart library)
• No changes to installer/, systemd/, security/

Notes for reviewers

• Verified in a real browser against fixture data including a synthetic v2 explanation record: KPI values and deltas, pipeline numbers, band chips and keyword filter, five path hops, top-talkers join, and the THROTTLE decision rendered with per-domain reasons, why-not-stronger, release condition, and the trace/policy/cfg/evidence audit line on both screens — zero JS console errors.
• activity and decision_focus are documented in API_REFERENCE.md; the bundle contract test asserts the window/bucket shapes and key presence.
• KPI trend deltas are client-side session memory (~1 min reference) — a display affordance, not persisted state.
• Focus panels render only in their own workspace via CSS (body[data-workspace]) at order 3, directly under the Command Strip.

Related issues

Refs #283, follow-up to #334 / #335

🤖 Generated with Claude Code

https://claude.ai/code/session_01Sd147KuF5sUu6UNM4t5H8x