fix(dx_evidence_graph): node identity = pod→service→IP, so empty-pod peers don't collapse

Edges whose peer is not a pod (k8s API server, external/IP endpoints, consulted
sockets) carry an empty requestor_pod/responder_pod. The Graph widget keyed on
*_pod alone, so EVERY such edge collapsed into one bogus "" node — visually
merging unrelated peers (the API server, every distinct remote IP) into one.

Coalesce node identity to pod, else service, else IP (the same idiom
net_flow_graph uses: px.select(src=='', src_ip, src)) and point the adjacencyList
from/to at the coalesced columns. Now each distinct peer is its own node.

Validated live (px run, forensic_db): control-plane → k8s-apiserver; the 5
consulted sockets → 5 distinct IPs (10.43.143.34, 10.42.0.1, ::1, 127.0.0.1,
10.42.0.43) instead of one merged node.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Entlein

src/pxl_scripts/px/dx_evidence_graph/dx_evidence_graph.pxl

@@ -19,7 +19,19 @@ import px
 
 def dx_attack_graph(start_time: str, clickhouse_dsn: str, table: str):
     df = px.DataFrame(table, clickhouse_dsn=clickhouse_dsn, start_time=start_time)
-    return df[['requestor_pod', 'responder_pod',
+    # Node identity: pod, else service, else IP. Edges whose peer is an IP or a
+    # non-pod entity (the k8s API server, an external endpoint, a consulted
+    # socket) have an empty *_pod; keying the graph on *_pod alone collapses ALL
+    # of them into one bogus "" node. Coalesce so each distinct peer is its own
+    # node — same idiom Pixie's net_flow_graph uses (px.select(src=='', src_ip, src)).
+    df.requestor = px.select(df.requestor_pod == '',
+                             px.select(df.requestor_service == '', df.requestor_ip, df.requestor_service),
+                             df.requestor_pod)
+    df.responder = px.select(df.responder_pod == '',
+                             px.select(df.responder_service == '', df.responder_ip, df.responder_service),
+                             df.responder_pod)
+    return df[['requestor', 'responder',
+               'requestor_pod', 'responder_pod',
                'requestor_service', 'responder_service',
                'requestor_ip', 'responder_ip',
                'weight', 'max_severity', 'confidence',

src/pxl_scripts/px/dx_evidence_graph/vis.json

@@ -40,8 +40,8 @@
       "displaySpec": {
         "@type": "types.px.dev/px.vispb.Graph",
         "adjacencyList": {
-          "fromColumn": "requestor_pod",
-          "toColumn": "responder_pod"
+          "fromColumn": "requestor",
+          "toColumn": "responder"
         },
         "edgeWeightColumn": "weight",
         "edgeColorColumn": "max_severity",