[jzhu13]

Problem

• Insight alerts with the investigation agent on cannot move to the alerts platform, because a platform-sent firing says nothing about the investigation.
• Legacy firings state the verdict, a summary teaser and a notebook link, or a fallback line when the agent did not finish in time.

Changes

• Platform-owned insight firings now carry the same lines in native Slack, native email and other native transports, and in the $insight_alert_firing event for HogFunction destinations.
• The insight describer, Slack renderer and legacy-event emitter read the evaluation's InsightAlertInvestigation row by (configuration_id, evaluation_key), and the platform delivery hold's released_by.

Hold released by	Breach lines
verdict	Verdict, summary teaser, notebook link (and the "verdict changed" line when it differs from the episode's previous verdict)
safety_net	Anomaly line plus legacy's fallback line
no hold, claim_refused, no row, skipped	The firing's own breaches, as today

• The Slack card shows the investigation status ("In progress", the verdict), and its primary button opens the notebook once a verdict is in.
• A transition of kind verdict_changed is worded as legacy's follow-up. That kind does not exist yet: the platform half (F1) is built separately, so this branch is inert until it lands.
• Legacy's verdict and fallback lines move into posthog/tasks/alerts/investigation_wording.py, so both stacks send the same text. That move is mechanical.
• AnnouncedTransition gains configuration_id, because evaluation keys repeat across configurations.
• The SourceDescriber contract now allows a point read of the source's own state.

How did you test this code?

Test rationale: test_platform_investigation_message.py covers each row of the table above through the emitter and the describer, the follow-up wording and Slack button, and the episode boundary of the previous verdict. No existing test read investigation state on the platform path. Existing legacy agent and safety-net tests cover the moved wording unchanged.

Not checked: a real delivery on a running stack, and native email rendering. Native email shows the summary teaser where legacy email rendered the full Markdown.

Release status

• No feature flag controls this change

Docs update

• None.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Agent: Claude Code, Claude Opus 5.5 (claude-opus-5-5)

Skills: /writing-code-comments, /writing-tests, /simplify, /code-review, /reviewing-with-coderabbit, /writing-pr-descriptions

More context for AI agents

• Decisions: the describer reads Postgres at send time, as the investigations design chose, rather than stamping the verdict on the delivery request.
• Decisions: the follow-up's investigation row is found by stripping #verdict from its evaluation key; verdict_change_evaluation_key is the producer for the agent PR to use.
• CodeRabbit CLI: not run. Three attempts hit the shared rate limit, so the PR bot review stands in.
• Code review (high): squashed a non-conventional commit; skipped the native-email Markdown gap, the double read on the Slack path, and adding the platform enum member (owned by F1).
• Follow-ups: swap VERDICT_CHANGED_KIND for the platform enum member once F1 merges.
• Read closely: products/alerts/backend/platform_investigation_message.py.

🤖 Generated with Claude Code

[trunk-io]

😎 Merged successfully - details.

[github-actions]

🤖 CI report

⚠️ Trunk lane — backend Python lane

This PR is assigned to the backend Python lane. It runs backend Python tests and may merge in parallel with PRs in other lanes.

✅ Duplication (Python) — clean

New Python code duplication introduced by this branch. Fails at 70+ tokens in app code, or 150+ tokens when both copies live in test files. Advisory while the gate proves itself: extract a shared helper instead of copying.

✅ Duplication (TypeScript) — clean

New TypeScript code duplication introduced by this branch. Fails at 70+ tokens in app code, or 150+ tokens when both copies live in test files. Advisory while the gate proves itself: extract a shared helper instead of copying.

⚠️ Playwright — 1 flaky

🎭 Playwright report · View test results →

⚠️ 1 flaky test:

• create experiment via wizard, add metrics, and launch (chromium)

These issues are not necessarily caused by your changes.
Annoyed by this section? Help fix flakies and failures and it will go green!

[posthog]

PostHog Review · Standard · reviewed 96df83e: 1 Should fix.

This is the only automatic review while this pull request is a draft. Comment @posthog review to review new changes sooner. Otherwise, a review of the new changes runs when you mark it ready for review.

See this review and its findings in PostHog Review. Comment @posthog review --deep for a Deep review. A Deep review takes longer and looks deeper than a Standard review.

[parameterai]

Risk: No findings

This delta adds incident opened/closed internal events for platform-owned insight alerts on the HogFunction delivery path, plus the routing and destination-eligibility plumbing that decides when those events are emitted (the rest arrived via a master merge and is upstream). I traced every new read and write: all queries are team-scoped, the incident enum is exhaustive, and event UUIDs are deterministic so retries dedup — no new vulnerability.

_{Sentinel reviewed 6a29620 · Review settings}

A new stamphog review started for this PR — the fresh verdict replaces this approval.

[stamphog]

Approved.

The disclosed risky behavior has current-head independent assurance, and the author belongs to an owning team. No concrete unresolved review concern or policy refusal ground is present.

• Author wrote 5% of the modified lines and has 38 merged PRs in these paths (familiarity MODERATE).
• PostHog Review (Standard) reviewed the current head: no findings.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✓	no deny categories matched
size	✓	440L, 13F substantive, 686L/14F incl. docs/generated/snapshots — within ceiling
tier	✓	T1-agent / T1d-complex (686L, 14F, two-areas, feat)
stamphog 2.7.0		.stamphog/policy.yml @ 6a29620 · reviewed head 6a29620

[jzhu13]

/trunk merge

[deployment-status-posthog]

Deploy status

Environment	Status	Deployed At	Workflow
dev	✅ Deployed	2026-11-03 03:00 UTC	Run
prod-us	✅ Deployed	2026-11-03 03:19 UTC	Run
prod-eu	✅ Deployed	2026-11-03 03:12 UTC	Run