Skip to content

feat(alerts): word platform insight firings with their investigation - #127907

Merged
trunk-io[bot] merged 2 commits into
masterfrom
claude/insight-investigation-describer-d2156f
Nov 3, 2026
Merged

feat(alerts): word platform insight firings with their investigation#127907
trunk-io[bot] merged 2 commits into
masterfrom
claude/insight-investigation-describer-d2156f

Conversation

@jzhu13

@jzhu13 jzhu13 commented Nov 3, 2026

Copy link
Copy Markdown
Contributor

Problem

  • Insight alerts with the investigation agent on cannot move to the alerts platform, because a platform-sent firing says nothing about the investigation.
  • Legacy firings state the verdict, a summary teaser and a notebook link, or a fallback line when the agent did not finish in time.

Changes

  • Platform-owned insight firings now carry the same lines in native Slack, native email and other native transports, and in the $insight_alert_firing event for HogFunction destinations.
  • The insight describer, Slack renderer and legacy-event emitter read the evaluation's InsightAlertInvestigation row by (configuration_id, evaluation_key), and the platform delivery hold's released_by.
Hold released by Breach lines
verdict Verdict, summary teaser, notebook link (and the "verdict changed" line when it differs from the episode's previous verdict)
safety_net Anomaly line plus legacy's fallback line
no hold, claim_refused, no row, skipped The firing's own breaches, as today
  • The Slack card shows the investigation status ("In progress", the verdict), and its primary button opens the notebook once a verdict is in.
  • A transition of kind verdict_changed is worded as legacy's follow-up. That kind does not exist yet: the platform half (F1) is built separately, so this branch is inert until it lands.
  • Legacy's verdict and fallback lines move into posthog/tasks/alerts/investigation_wording.py, so both stacks send the same text. That move is mechanical.
  • AnnouncedTransition gains configuration_id, because evaluation keys repeat across configurations.
  • The SourceDescriber contract now allows a point read of the source's own state.

How did you test this code?

Test rationale: test_platform_investigation_message.py covers each row of the table above through the emitter and the describer, the follow-up wording and Slack button, and the episode boundary of the previous verdict. No existing test read investigation state on the platform path. Existing legacy agent and safety-net tests cover the moved wording unchanged.

Not checked: a real delivery on a running stack, and native email rendering. Native email shows the summary teaser where legacy email rendered the full Markdown.

Release status

  • No feature flag controls this change

Docs update

  • None.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Agent: Claude Code, Claude Opus 5.5 (claude-opus-5-5)

Skills: /writing-code-comments, /writing-tests, /simplify, /code-review, /reviewing-with-coderabbit, /writing-pr-descriptions

More context for AI agents
  • Decisions: the describer reads Postgres at send time, as the investigations design chose, rather than stamping the verdict on the delivery request.
  • Decisions: the follow-up's investigation row is found by stripping #verdict from its evaluation key; verdict_change_evaluation_key is the producer for the agent PR to use.
  • CodeRabbit CLI: not run. Three attempts hit the shared rate limit, so the PR bot review stands in.
  • Code review (high): squashed a non-conventional commit; skipped the native-email Markdown gap, the double read on the Slack path, and adding the platform enum member (owned by F1).
  • Follow-ups: swap VERDICT_CHANGED_KIND for the platform enum member once F1 merges.
  • Read closely: products/alerts/backend/platform_investigation_message.py.

🤖 Generated with Claude Code

@jzhu13 @claude
feat(alerts): word platform insight firings with their investigation
96df83e 
The insight describer, Slack renderer and legacy-event emitter read the
evaluation's InsightAlertInvestigation row and the platform's delivery
hold, so a platform-owned firing states the verdict, summary, notebook
link or safety-net line that the insight stack sends. The verdict-change
follow-up is worded for the verdict_changed kind.

Legacy's verdict and safety-net lines move to one shared module so both
stacks send the same text.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@jzhu13 jzhu13 self-assigned this Nov 3, 2026
@trunk-io

trunk-io Bot commented Nov 3, 2026 •
edited
Loading

Copy link
Copy Markdown

😎 Merged successfully - details.

@github-actions

github-actions Bot commented Nov 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🤖 CI report

⚠️ Trunk lane — backend Python lane

This PR is assigned to the backend Python lane. It runs backend Python tests and may merge in parallel with PRs in other lanes.

✅ Duplication (Python) — clean

New Python code duplication introduced by this branch. Fails at 70+ tokens in app code, or 150+ tokens when both copies live in test files. Advisory while the gate proves itself: extract a shared helper instead of copying.

✅ Duplication (TypeScript) — clean

New TypeScript code duplication introduced by this branch. Fails at 70+ tokens in app code, or 150+ tokens when both copies live in test files. Advisory while the gate proves itself: extract a shared helper instead of copying.

⚠️ Playwright — 1 flaky

🎭 Playwright report · View test results →

⚠️ 1 flaky test:

  • create experiment via wizard, add metrics, and launch (chromium)

These issues are not necessarily caused by your changes.
Annoyed by this section? Help fix flakies and failures and it will go green!

posthog[bot]
posthog Bot reviewed Nov 3, 2026
View reviewed changes

@posthog posthog Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PostHog Review · Standard · reviewed 96df83e: 1 Should fix.

This is the only automatic review while this pull request is a draft. Comment @posthog review to review new changes sooner. Otherwise, a review of the new changes runs when you mark it ready for review.

See this review and its findings in PostHog Review. Comment @posthog review --deep for a Deep review. A Deep review takes longer and looks deeper than a Standard review.

Comment thread products/alerts/backend/platform_alert_slack.py Resolved
@jzhu13
jzhu13 marked this pull request as ready for review November 3, 2026 01:06
@jzhu13 jzhu13 added the stamphog Request AI approval (no full review) label Nov 3, 2026
@parameterai

parameterai Bot commented Nov 3, 2026 •
edited
Loading

Copy link
Copy Markdown

Risk: No findings

This delta adds incident opened/closed internal events for platform-owned insight alerts on the HogFunction delivery path, plus the routing and destination-eligibility plumbing that decides when those events are emitted (the rest arrived via a master merge and is upstream). I traced every new read and write: all queries are team-scoped, the incident enum is exhaustive, and event UUIDs are deterministic so retries dedup — no new vulnerability.

Sentinel reviewed 6a29620 · Review settings

@pr-assigner-resolver-posthog
pr-assigner-resolver-posthog Bot requested review from a team November 3, 2026 01:06
stamphog[bot]

This comment was marked as outdated.

Sign in to view

@jzhu13
Merge remote-tracking branch 'origin/master' into claude/insight-inve…
6a29620 
…stigation-describer-d2156f

# Conflicts:
#	products/alerts/backend/platform_alert_legacy_events.py
@stamphog
stamphog Bot dismissed their stale review November 3, 2026 01:34

A new stamphog review started for this PR — the fresh verdict replaces this approval.

stamphog[bot]
stamphog Bot approved these changes Nov 3, 2026
View reviewed changes

@stamphog stamphog Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved.

The disclosed risky behavior has current-head independent assurance, and the author belongs to an owning team. No concrete unresolved review concern or policy refusal ground is present.

  • Author wrote 5% of the modified lines and has 38 merged PRs in these paths (familiarity MODERATE).
  • PostHog Review (Standard) reviewed the current head: no findings.
Gate mechanics and policy version
Gate Result
prerequisites ✓ all clear
deny-list ✓ no deny categories matched
size ✓ 440L, 13F substantive, 686L/14F incl. docs/generated/snapshots — within ceiling
tier ✓ T1-agent / T1d-complex (686L, 14F, two-areas, feat)
stamphog 2.7.0 .stamphog/policy.yml @ 6a29620 · reviewed head 6a29620

@jzhu13

jzhu13 commented Nov 3, 2026

Copy link
Copy Markdown
Contributor Author

/trunk merge

@trunk-io
trunk-io Bot merged commit d4e885c into master Nov 3, 2026
261 checks passed
@trunk-io
trunk-io Bot deleted the claude/insight-investigation-describer-d2156f branch November 3, 2026 02:34
@deployment-status-posthog

deployment-status-posthog Bot commented Nov 3, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploy status

Environment Status Deployed At Workflow
dev ✅ Deployed 2026-11-03 03:00 UTC Run
prod-us ✅ Deployed 2026-11-03 03:19 UTC Run
prod-eu ✅ Deployed 2026-11-03 03:12 UTC Run

@fuziontech fuziontech mentioned this pull request Nov 3, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@posthog posthog[bot] posthog[bot] left review comments
@stamphog stamphog[bot] stamphog[bot] approved these changes

Assignees

@jzhu13 jzhu13

Labels

stamphog Request AI approval (no full review)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jzhu13