[jzhu13]

Problem

• An insight alert the alerts platform owns shows no investigation results in its check history: no verdict, summary, notebook link or "Notification suppressed".
• Legacy alerts read these from AlertCheck, which the platform never writes. This blocks cutting over alerts with the investigation agent on.
• Investigation rows (from feat(alerts): record insight alert investigations for platform evaluations #123622) also have no retention yet.

Changes

• The history of a moved alert now shows each check's investigation status, verdict, summary and notebook link, the same as a legacy alert.
• A check now shows "Notification suppressed" when the agent's verdict suppressed its held delivery, or when the episode's earlier verdict muted it.
• The API keeps the legacy check shape, so the frontend and the MCP tool need no change.
• Under that, moved_alert_check_page joins InsightAlertInvestigation and released delivery holds onto the platform's history page by evaluation key.
• A new facade read, source_suppressed_holds_by_legacy_id, returns the evaluations whose hold the source released with a suppress. A safety-net suppress (an alert turned off) does not count.
• A verdict that would send, on an alert turned off during its investigation, now records its suppress as the safety net's, so history does not show it as the agent's.
• The carried-verdict mute writes a new source detail key, SUPPRESSED_BY_AGENT_KEY, on the firing it mutes, and the history reads it.
• The daily cleanup_alert_checks activity now also deletes investigation rows older than 90 days, the platform's history TTL.
• Migration 0016 adds an index on created_at for that prune, built concurrently.

Before (moved alert, platform history without the join) and after, rendered in Storybook with invented data:

How did you test this code?

• Ran the alerts API, investigation and delivery-hold tests locally, plus repo-wide mypy and tach.
• Rendered AlertHistorySection in a scratch Storybook story (not committed) against the old and new response shapes.
• Not run: the full app against a real moved alert, because the I5 adapter that writes investigation rows for moved alerts is not merged.

Test rationale:

• test_a_moved_alert_shows_each_checks_investigation_and_what_the_agent_suppressed catches a dropped or mismatched join, and a safety-net suppress counted as the agent's. The nearest existing test covers detector output only.
• test_the_daily_prune_drops_only_investigations_past_retention catches a prune that deletes recent rows or never runs. No prune test existed for this table.

Release status

• No feature flag controls this change

Docs update

• None.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Agent: Claude Code, Claude Opus 5.5 (claude-opus-5-5)

Skills: /improving-drf-endpoints, /django-migrations, /writing-tests, /writing-pr-descriptions, /reviewing-with-coderabbit, /simplify, /code-review

More context for AI agents

• Session: I7 of the insight investigations cutover, started from the cutover owner session. Claude Code desktop, Storybook, Playwright.
• Decisions: the hold read returns a key set, so the platform stays free of agent wording beyond "source vs safety net".
• Decisions: the notebook link uses an unsaved notebook built through the check's FK, so alerts imports no notebooks models.
• Follow-ups: the list endpoint's chart-dot checks for moved alerts carry no investigation fields. The chart does not read them.
• Follow-ups: the "Notification suppressed" tag shows only for a finished investigation, on both stacks, so a carried-verdict mute shows a dash.
• CI report, comment density: the remaining comments state a reason (retention source, mute vs snooze, the cross-product model) or a required nosemgrep.
• Read closely: products/alerts/backend/platform_alert_reads.py and products/alerts_platform/backend/logic/delivery_holds.py.
• CodeRabbit: local CLI run skipped, rate limited three times (no usage-based seat linked). The bot reviews on open.
• No duplicate: an open-PR search for investigation history PRs found nothing.

🤖 Generated with Claude Code

[trunk-io]

😎 This pull request was merged.

[posthog]

PostHog Review · Standard · reviewed 8f4d3e5: 2 Should fix.

This is the only automatic review while this pull request is a draft. Comment @posthog review to review new changes sooner. Otherwise, a review of the new changes runs when you mark it ready for review.

See this review and its findings in PostHog Review. Comment @posthog review --deep for a Deep review. A Deep review takes longer and looks deeper than a Standard review.

[github-actions]

🤖 CI report

⚠️ Trunk lane — backend Python lane

This PR is assigned to the backend Python lane. It runs backend Python tests and may merge in parallel with PRs in other lanes.

✅ Duplication (Python) — clean

New Python code duplication introduced by this branch. Fails at 70+ tokens in app code, or 150+ tokens when both copies live in test files. Advisory while the gate proves itself: extract a shared helper instead of copying.

✅ Duplication (TypeScript) — clean

New TypeScript code duplication introduced by this branch. Fails at 70+ tokens in app code, or 150+ tokens when both copies live in test files. Advisory while the gate proves itself: extract a shared helper instead of copying.

⚠️ Comment density — 3% of added code lines are comments (7 of 225)

This section warns when comments are more than 3% of the code lines a PR adds, and alerts above 6%. Before agent-assisted PRs, the typical share was about 2%. Only full-line comments count. Docstrings, generated files, snapshots, migrations, and workflow files are left out.

Comments that restate the code, record how the change came about, or narrate the next line add noise for the next reader. Keep the comments that explain a reason the code cannot show, and remove the rest. See .agents/skills/writing-code-comments/SKILL.md for the house rules.

Files with the most added comment lines:

File	Comment lines	Added lines
products/alerts/backend/investigation_release.py	2	5
products/alerts/backend/models/investigation.py	2	12
products/alerts/backend/platform_investigation_detail.py	1	2
products/alerts/backend/presentation/views/alert.py	1	9
products/alerts_platform/backend/facade/contracts.py	1	2

This check does not block merging. It updates on every push and clears when the share drops.

⚠️ Django migration SQL — 1 new migration to review

We've detected new migrations on this PR. Review the SQL output for each migration:

products/alerts/backend/migrations/0016_insight_alert_investigation_age_index.py

/home/runner/work/tmp/tool_cache/Python/3.14.7/x64/lib/python3.14/site-packages/anyio/from_thread.py:119: SyntaxWarning: 'return' in a 'finally' block
  return result
2026-11-04T00:47:06.565231Z [error    ] Path must be a valid database or directory containing databases. [posthog.exceptions_capture] pid=5618 tid=140445337254784
Traceback (most recent call last):
  File "/home/runner/work/posthog/posthog/posthog/geoip.py", line 15, in <module>
    geoip: Optional[GeoIP2] = GeoIP2(cache=8)
                              ~~~~~~^^^^^^^^^
  File "/home/runner/work/tmp/tool_cache/Python/3.14.7/x64/lib/python3.14/site-packages/django/contrib/gis/geoip2.py", line 114, in __init__
    raise GeoIP2Exception(
        "Path must be a valid database or directory containing databases."
    )
django.contrib.gis.geoip2.GeoIP2Exception: Path must be a valid database or directory containing databases.
/home/runner/work/tmp/tool_cache/Python/3.14.7/x64/lib/python3.14/site-packages/sshtunnel.py:1040: SyntaxWarning: 'return' in a 'finally' block
  return (ssh_host,
System check identified some issues:

WARNINGS:
?: (axes.W001) You are using the django-axes cache handler for login attempt tracking. Your cache configuration is however invalid and will not work correctly with django-axes. This can leave security holes in your login systems as attempts are not tracked correctly. Reconfigure settings.AXES_CACHE and settings.CACHES per django-axes configuration documentation.
?: (staticfiles.W004) The directory '/home/runner/work/posthog/posthog/frontend/dist' in the STATICFILES_DIRS setting does not exist.
--
-- Concurrently create index insight_alert_inv_age_idx on field(s) created_at of model insightalertinvestigation
--
SET lock_timeout = 0;
SET statement_timeout = 0;
CREATE INDEX CONCURRENTLY "insight_alert_inv_age_idx" ON "alerts_insightalertinvestigation" ("created_at");

Last updated: 2026-11-04 00:47 UTC (1366c62)

✅ Django migration risk — migration analysis complete

We've analyzed your migrations for potential risks.

Summary: 1 Safe | 0 Needs Review | 0 Blocked

✅ Safe

Brief or no lock, backwards compatible

alerts.0016_insight_alert_investigation_age_index
  └─ #1 ✅ SafeAddIndexConcurrently
     PostHog concurrent-index helper: idempotent (timeout disabling + invalid-leftover recovery)
     model: insightalertinvestigation, index: insight_alert_inv_age_idx

Last updated: 2026-11-04 00:48 UTC (1366c62)

[parameterai]

Risk: No findings

This increment adds a platform "verdict change" follow-up: a new record_verdict_change facade that writes a verdict_changed history row and returns a delivery request, a CHECKS_ONLY filter that keeps follow-ups out of every checks read, delivered_as mapping so a follow-up reaches the firing's destinations, and a switch from PermissionDenied to InsufficientScope (same 403) in the alerts API scope guards. I found no new security issues: the new facade is team-scoped, blocks held/suppressed firings, has no HTTP surface, and repeated calls are deduped by the delivery thread store.

_{Sentinel reviewed 1366c62 · Review settings}

[stamphog]

Not approved yet — waiting on the conditions below.

The Migration risk check has not finished for this commit, so stamphog cannot tell a safe migration from a risky one yet. The review runs again on the next push, or you can re-request it once the check reports.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✗	matches: migrations
size	✓	167L, 11F substantive, 242L/14F incl. docs/generated/snapshots — within ceiling
tier	✗	classified as T2-never: T2-never (242L, 14F, two-areas, feat)
stamphog 2.7.0		.stamphog/policy.yml @ unknown · reviewed head 0432822

[pr-assigner-resolver-posthog]

👀 Auto-assigned reviewers

These soft owners were skipped because they only have minor changes here. Nothing blocks merge, so self-assign if you'd like a look:

• @PostHog/team-product-analytics (posthog/temporal/owners.yaml)

Soft owners come from each directory's owners.yaml and each product's product.yaml (resolved nearest-file-wins). For a skipped owner, the locator is the file that decided it. Generated files and lockfiles are ignored when deciding ownership.

[posthog]

PostHog Review · Standard · reviewed 0432822: 1 Should fix.

[stamphog]

Not approved yet — waiting on the conditions below.

The Migration risk check has not finished for this commit, so stamphog cannot tell a safe migration from a risky one yet. The review runs again on the next push, or you can re-request it once the check reports.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✗	matches: migrations
size	✓	170L, 13F substantive, 245L/16F incl. docs/generated/snapshots — within ceiling
tier	✗	classified as T2-never: T2-never (245L, 16F, two-areas, feat)
stamphog 2.7.0		.stamphog/policy.yml @ unknown · reviewed head 0100a47

[stamphog]

Not approved yet — waiting on the conditions below.

The Migration risk check has not finished for this commit, so stamphog cannot tell a safe migration from a risky one yet. The review runs again on the next push, or you can re-request it once the check reports.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✗	matches: migrations
size	✓	170L, 13F substantive, 249L/17F incl. docs/generated/snapshots — within ceiling
tier	✗	classified as T2-never: T2-never (249L, 17F, two-areas, feat)
stamphog 2.7.0		.stamphog/policy.yml @ unknown · reviewed head 90679d2

[posthog]

PostHog Review

Found 5 should fix.

This is review round 3 on this pull request. When findings keep coming back in the same code, the approach is usually the problem. Before the next fix, check whether a different design would remove the whole class of findings.

Findings on the changed lines

products/alerts/backend/platform_investigation.py:208

P2 · Record the carried-verdict suppression in source detail

When an episode exhausts its investigation budget after a false-positive verdict, this branch suppresses delivery without setting SUPPRESSED_BY_AGENT_KEY. No investigation or hold exists for that check, so moved_alert_check_page reports notification_suppressed_by_agent=False. Persist the suppression marker in the group's source_detail.

products/alerts_platform/backend/facade/api.py:108

P2 · Implement delivery of changed-verdict announcements

When a later investigation contradicts an earlier delivered verdict, _announce_verdict_change calls this facade, but it always returns None. The new workflow therefore sends no correction, unlike the legacy path; the added test mocks this function and misses the failure. Record a follow-up announcement and return its delivery request.

products/alerts/backend/temporal/platform_evaluate.py:822

P2 · Complete metrics investigations before starting their deliveries

For a metrics firing, _record_chunk starts delivery before claiming or running its investigation. A delivery that executes immediately finds no summary in firing_investigation, so its Slack notification loses the explanation that the legacy path computes before notifying. Complete the metrics investigation before starting that firing's delivery.

products/alerts/backend/investigation_release.py:141

P2 · Distinguish disabled-alert suppression from agent suppression

When an alert is disabled during an investigation that returns true_positive, this release suppresses its hold with released_by=VERDICT. source_suppressed_holds_by_legacy_id then marks it as agent-suppressed, and history claims the agent deemed it unworthy of notification. Preserve a distinct reason for suppression caused by disabling the alert.

products/alerts/backend/temporal/platform_evaluate.py:397

P2 · Enforce the metrics deadline during slot acquisition and queries

When ClickHouse slots are saturated, ClickHouseQuerySlot waits up to 45 seconds, exhausting this activity's entire timeout before queries start. The loop checks its deadline only before each run, and synchronous work continues after Temporal times out, occupying evaluation workers and ClickHouse slots. Propagate the remaining budget into slot acquisition and queries.

[stamphog]

Not approved yet — waiting on the conditions below.

The Migration risk check has not finished for this commit, so stamphog cannot tell a safe migration from a risky one yet. The review runs again on the next push, or you can re-request it once the check reports.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✗	matches: migrations
size	✓	187L, 15F substantive, 286L/20F incl. docs/generated/snapshots — within ceiling
tier	✗	classified as T2-never: T2-never (286L, 20F, two-areas, feat)
stamphog 2.7.0		.stamphog/policy.yml @ unknown · reviewed head 5d98720

[stamphog]

Not approved yet — waiting on the conditions below.

The Migration risk check has not finished for this commit, so stamphog cannot tell a safe migration from a risky one yet. The review runs again on the next push, or you can re-request it once the check reports.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✗	matches: migrations
size	✓	187L, 15F substantive, 286L/20F incl. docs/generated/snapshots — within ceiling
tier	✗	classified as T2-never: T2-never (286L, 20F, two-areas, feat)
stamphog 2.7.0		.stamphog/policy.yml @ unknown · reviewed head 2209262

[stamphog]

Not approved yet — waiting on the conditions below.

The Migration risk check has not finished for this commit, so stamphog cannot tell a safe migration from a risky one yet. The review runs again on the next push, or you can re-request it once the check reports.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✗	matches: migrations
size	✓	187L, 15F substantive, 286L/20F incl. docs/generated/snapshots — within ceiling
tier	✗	classified as T2-never: T2-never (286L, 20F, two-areas, feat)
stamphog 2.7.0		.stamphog/policy.yml @ unknown · reviewed head 8c531b2

[stamphog]

Not approved yet — waiting on the conditions below.

The Migration risk check has not finished for this commit, so stamphog cannot tell a safe migration from a risky one yet. The review runs again on the next push, or you can re-request it once the check reports.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✗	matches: migrations
size	✓	187L, 15F substantive, 286L/20F incl. docs/generated/snapshots — within ceiling
tier	✗	classified as T2-never: T2-never (286L, 20F, two-areas, feat)
stamphog 2.7.0		.stamphog/policy.yml @ unknown · reviewed head 019989a

[stamphog]

Not approved yet — waiting on the conditions below.

The Migration risk check has not finished for this commit, so stamphog cannot tell a safe migration from a risky one yet. The review runs again on the next push, or you can re-request it once the check reports.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✗	matches: migrations
size	✓	187L, 15F substantive, 286L/20F incl. docs/generated/snapshots — within ceiling
tier	✗	classified as T2-never: T2-never (286L, 20F, two-areas, feat)
stamphog 2.7.0		.stamphog/policy.yml @ unknown · reviewed head a26fc01

[stamphog]

Not approved yet — waiting on the conditions below.

Re-add the stamphog label to request another review once you have addressed this.

stamphog declined to auto-review this pull request because it failed the size gate. It has 1467 substantive lines in the global category, over the 1200-line ceiling. Including docs, generated files and snapshots, it touches 43 files and 2194 lines. The other gates (prerequisites, deny-list, tier) passed, but they don't override the size refusal.

To move forward, ask a human reviewer to take it. Alternatively, split it into smaller pull requests, for example the investigation workflow and EvaluatedCheck refactor, the delivery-hold facade read and release logic, and the moved-alert history join with the retention prune and migration 0016. Each piece would then need to come in under the size ceiling.

• DanielVisca reviewed the current head.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✓	no deny categories matched
size	✗	too large for auto-review (1467L substantive in global — ceiling is 1200L; 1467L, 29F total, 2194L/43F incl. docs/generated/snapshots)
tier	✓	T1-agent / T1d-complex (2194L, 43F, cross-cutting, feat)
stamphog 2.7.0		.stamphog/policy.yml @ unknown · reviewed head a26fc01

[trunk-io]

This pull request is queued for merge as part of 127926, which will merge 127913, 127926.

[trunk-io]

Stacked PR 127926 failed testing in the merge queue. Please investigate the failure and re-submit the stack.

[trunk-io]

This pull request is queued for merge as part of 127926, which will merge 127913, 127926.

[trunk-io]

This pull request was merged into master as part of stacked PR 127926.

[deployment-status-posthog]

Deploy status

Environment	Status	Deployed At	Workflow
dev	✅ Deployed	2026-11-04 02:29 UTC	Run
prod-us	✅ Deployed	2026-11-04 02:40 UTC	Run
prod-eu	✅ Deployed	2026-11-04 02:42 UTC	Run