Remove Needle; stop paging on nginx 4xx

Needle scored ~chance on the golden set and never gated alerts, so drop the
sidecar, proxy handlers, UI buttons, k8s container and build step. The labelled
eval sets move to cmd/triage-eval/data.

nginx 4xx (registry 401 challenges, /oauth2/auth, scanner 405s) is now dropped
in FilterActionable instead of only being discounted, so it cannot ride along
with a real 5xx. nginx 5xx still alerts.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/alerts/filter.go

@@ -11,6 +11,13 @@ func TriageOf(e features.Event) triage.Result {
 		IsTimeout: e.IsTimeout, IsCancellation: e.IsCancellation, IsRetry: e.IsRetry})
 }
 
+// edgeClientError reports a 4xx seen at the nginx edge: registry auth
+// challenges, /oauth2/auth subrequests, 405s from scanners. These are the
+// caller's problem and never page, even next to a real 5xx.
+func edgeClientError(e features.Event) bool {
+	return e.Service == "nginx" && e.StatusCode >= 400 && e.StatusCode < 500
+}
+
 // FilterActionable keeps only patterns whose category should page a human
 // (unless keepMuted), recomputing each spike's excess so a probe storm cannot
 // alert by itself. muted, when non-nil, counts what was dropped per category.
@@ -21,7 +28,7 @@ func FilterActionable(spikes []features.Spike, keepMuted bool, muted map[triage.
 		sp.Excess = 0
 		for _, p := range sp.Patterns {
 			c := TriageOf(p.Example).Category
-			if !keepMuted && !c.Actionable() {
+			if !keepMuted && (!c.Actionable() || edgeClientError(p.Example)) {
 				if muted != nil {
 					muted[c]++
 				}

internal/collector/handlers.go

@@ -13,7 +13,6 @@ import (
 	"io"
 	"log"
 	"net/http"
-	"os"
 	"strconv"
 	"strings"
 	"time"
@@ -1007,110 +1006,6 @@ func (c *Collector) HandleStatsEndpoints(w http.ResponseWriter, r *http.Request)
 	})
 }
 
-// needleAddr returns the configured or default address for the Needle 3 sidecar.
-func needleAddr() string {
-	addr := os.Getenv("OTEL_NEEDLE_ADDR")
-	if addr == "" {
-		addr = "http://127.0.0.1:5005"
-	}
-	return strings.TrimRight(addr, "/")
-}
-
-// HandleNeedleStatus checks if the Needle 3 sidecar is reachable and reports its health.
-func (c *Collector) HandleNeedleStatus(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
-		return
-	}
-
-	target := needleAddr() + "/health"
-	client := &http.Client{Timeout: 2 * time.Second}
-	resp, err := client.Get(target)
-	w.Header().Set("Content-Type", "application/json")
-	if err != nil {
-		w.WriteHeader(http.StatusServiceUnavailable)
-		_ = json.NewEncoder(w).Encode(map[string]interface{}{
-			"available": false,
-			"error":     fmt.Sprintf("Needle sidecar unreachable at %s: %v", target, err),
-		})
-		return
-	}
-	defer resp.Body.Close()
-	w.WriteHeader(resp.StatusCode)
-	_, _ = io.Copy(w, resp.Body)
-}
-
-// HandleNeedleClassify proxies telemetry triage requests to the Needle 3 sidecar.
-func (c *Collector) HandleNeedleClassify(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
-		return
-	}
-
-	body, err := io.ReadAll(r.Body)
-	if err != nil {
-		http.Error(w, "failed to read request body", http.StatusBadRequest)
-		return
-	}
-
-	// If the payload specifies an issue_id and no text, look up the issue
-	var reqMap map[string]interface{}
-	if err := json.Unmarshal(body, &reqMap); err == nil {
-		if issueID, ok := reqMap["issue_id"].(string); ok && issueID != "" {
-			if issue, ok := c.GetIssue(issueID); ok {
-				var promptParts []string
-				promptParts = append(promptParts, fmt.Sprintf("Service: %s", issue.Service))
-				promptParts = append(promptParts, fmt.Sprintf("Title: %s", issue.Title))
-				promptParts = append(promptParts, fmt.Sprintf("Kind: %s", issue.Kind))
-				if len(issue.Samples) > 0 {
-					latest := issue.Samples[len(issue.Samples)-1]
-					if latest.Message != "" {
-						promptParts = append(promptParts, fmt.Sprintf("Message: %s", latest.Message))
-					}
-					if latest.URL != "" {
-						promptParts = append(promptParts, fmt.Sprintf("URL: %s", latest.URL))
-					}
-					if latest.HTTPStatus > 0 {
-						promptParts = append(promptParts, fmt.Sprintf("Status: %d", latest.HTTPStatus))
-					}
-					if latest.HTTPRoute != "" {
-						promptParts = append(promptParts, fmt.Sprintf("Route: %s", latest.HTTPRoute))
-					}
-				}
-				reqMap["text"] = strings.Join(promptParts, " | ")
-				reqMap["service"] = issue.Service
-				reqMap["title"] = issue.Title
-				body, _ = json.Marshal(reqMap)
-			}
-		}
-	}
-
-	target := needleAddr() + "/classify"
-	client := &http.Client{Timeout: 60 * time.Second}
-	proxyReq, err := http.NewRequestWithContext(r.Context(), http.MethodPost, target, strings.NewReader(string(body)))
-	if err != nil {
-		http.Error(w, "failed to create proxy request", http.StatusInternalServerError)
-		return
-	}
-	proxyReq.Header.Set("Content-Type", "application/json")
-
-	resp, err := client.Do(proxyReq)
-	if err != nil {
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusServiceUnavailable)
-		_ = json.NewEncoder(w).Encode(map[string]interface{}{
-			"success": false,
-			"error":   fmt.Sprintf("Needle sidecar unreachable at %s: %v", target, err),
-		})
-		return
-	}
-	defer resp.Body.Close()
-
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(resp.StatusCode)
-	_, _ = io.Copy(w, resp.Body)
-}
-
 // stampFrontendClient fills in client.address and user_agent.original on
 // browser-originated log records (source=frontend) from the ingest request,
 // since the browser cannot know its own public IP. Values the SDK already