@oneuptime/common 14.0.10 → 14.0.11

package/Server/Utils/AI/ResourceAccess/InfrastructureInvestigationToolkit.ts

@@ -27,7 +27,6 @@ import { ToolArgs } from "../Toolbox/ToolTypes";
 import { ObservabilityAssistantExtraTool } from "../Chat/ObservabilityAssistant";
 import ResourceCommandJobRunner, {
   RESOURCE_COMMAND_CLAIM_TIMEOUT_MS,
-  RESOURCE_COMMAND_OUTPUT_TRUNCATED_SUFFIX,
   ResourceCommandJobOutcome,
   ResourceCommandRunState,
 } from "./ResourceCommandJobRunner";
@@ -39,6 +38,11 @@ import {
 import ResourceAccessContext, {
   describeResource,
 } from "./ResourceAccessContext";
+import ToolOutputPager, {
+  hasAgentTruncationMarker,
+  PagedToolOutput,
+  READ_TOOL_OUTPUT_TOOL_NAME,
+} from "../Chat/ToolOutputPager";
 
 /*
  * The run-scoped, READ-ONLY infrastructure command toolkit for an
@@ -56,12 +60,14 @@ import ResourceAccessContext, {
  * literally true.
  *
  * What else the toolkit owns, exactly as the kubectl one does:
- *  - the run's wall clock: every command's claim window and timeout are
- *    planned against the run's deadline (KubectlWaitBudget, which is
- *    generic in all but name) and a command the budget can no longer hold
- *    is refused before anything is enqueued;
+ *  - the run's time limit, when its project configured one (by default a
+ *    run has none): every command's claim window and timeout are planned
+ *    against the run's deadline (KubectlWaitBudget, which is generic in
+ *    all but name) and a command the time left can no longer hold is
+ *    refused before anything is enqueued;
  *  - what the model sees: output reaches it only through the shared
- *    ResourceCommandJobRunner redaction;
+ *    ResourceCommandJobRunner redaction, and is never cut — the whole
+ *    redacted output is kept and a long one is paged (ToolOutputPager);
  *  - what counts as evidence: a command that never ran is a failed call
  *    that mints no citation, one whose result never came back is "result
  *    unknown" (never "did not run"), and one that ran and exited non-zero
@@ -74,7 +80,17 @@ export interface InfrastructureInvestigationToolkitOptions {
   projectId: ObjectID;
   aiRunId: ObjectID;
   resources: Array<ResourceAiAccessStatus>;
+  /*
+   * Commands one run may send. Defaults to the runaway guard: an
+   * investigation runs as many commands as it needs.
+   */
   maxCommands?: number | undefined;
+  /*
+   * Where long outputs are kept so the model can page through them
+   * (read_tool_output). Shared with the run's other toolkits so one tool
+   * reads them all; the toolkit makes its own when none is given.
+   */
+  outputPager?: ToolOutputPager | undefined;
   /*
    * Which readiness admits a resource. Investigations require the
    * investigation switch; a remediation run may read a resource it is
@@ -82,9 +98,9 @@ export interface InfrastructureInvestigationToolkitOptions {
    */
   readinessCheck?: "investigation" | "remediation" | undefined;
   /*
-   * When the run's wall-clock budget ends (epoch milliseconds). Every
-   * command's wait is planned to end before it; absent, commands are only
-   * bounded by their own timeouts.
+   * When the run's configured time limit ends (epoch milliseconds). Every
+   * command's wait is planned to end before it; absent (the default — no
+   * time limit), commands are only bounded by their own timeouts.
    */
   runDeadlineAtMs?: number | undefined;
 }
@@ -107,7 +123,14 @@ export default class InfrastructureInvestigationToolkit {
     UnreachableAgent
   >();
 
+  private outputPager: ToolOutputPager;
+
+  public getOutputPager(): ToolOutputPager {
+    return this.outputPager;
+  }
+
   public constructor(options: InfrastructureInvestigationToolkitOptions) {
+    this.outputPager = options.outputPager ?? new ToolOutputPager();
     this.options = options;
   }
 
@@ -267,7 +290,11 @@ export default class InfrastructureInvestigationToolkit {
     return {
       definition: {
         name: RUN_INFRASTRUCTURE_COMMAND_TOOL_NAME,
-        description: `Run ONE read-only command on a linked infrastructure resource through its AI agent and get its output. The resources you may inspect:\n${this.describeReadyResources()}\n\nWhat each kind of resource accepts:\n\n${this.describeReadCommandGuides()}\n\nOne command per call, written as the program followed by its arguments — never a shell line: pipes, redirects, ;, &&, $( ) and sudo are refused. Anything that changes a resource is refused here — this is an investigation — and so is anything that would read credentials; credential-looking values (passwords, tokens, keys, connection strings) are redacted from every output before you see it, so do not spend commands on them. Keep output small (limit lines and tails). At most ${maxCommands} commands per investigation.`,
+        description: `Run ONE read-only command on a linked infrastructure resource through its AI agent and get its output. The resources you may inspect:\n${this.describeReadyResources()}\n\nWhat each kind of resource accepts:\n\n${this.describeReadCommandGuides()}\n\nOne command per call, written as the program followed by its arguments — never a shell line: pipes, redirects, ;, &&, $( ) and sudo are refused. Anything that changes a resource is refused here — this is an investigation — and so is anything that would read credentials; credential-looking values (passwords, tokens, keys, connection strings) are redacted from every output before you see it, so do not spend commands on them. Output is never cut off: a long output shows its first page and tells you how to read the rest with ${READ_TOOL_OUTPUT_TOOL_NAME}. Run as many commands as the investigation needs.${
+          maxCommands < MAX_RESOURCE_COMMANDS_PER_INVESTIGATION
+            ? ` At most ${maxCommands} commands in this run.`
+            : ""
+        }`,
         inputSchema: {
           type: "object",
           properties: {
@@ -287,7 +314,11 @@ export default class InfrastructureInvestigationToolkit {
             },
             timeoutInMs: {
               type: "number",
-              description: `Timeout in milliseconds (default ${DEFAULT_RESOURCE_COMMAND_TIMEOUT_MS}, max ${MAX_RESOURCE_COMMAND_TIMEOUT_MS}). Shortened automatically when the investigation's time budget is nearly spent.`,
+              description: `Timeout in milliseconds (default ${DEFAULT_RESOURCE_COMMAND_TIMEOUT_MS}, max ${MAX_RESOURCE_COMMAND_TIMEOUT_MS}).${
+                this.options.runDeadlineAtMs !== undefined
+                  ? " Shortened automatically when the investigation's configured time limit is close."
+                  : ""
+              }`,
             },
           },
           required: ["resourceId", "command", "rationale"],
@@ -305,7 +336,7 @@ export default class InfrastructureInvestigationToolkit {
   ): Promise<ToolCallOutcome> {
     if (this.commandsRun >= maxCommands) {
       return this.failure(
-        `The per-investigation infrastructure command budget (${maxCommands} commands) is spent. Finish your analysis with what you have.`,
+        `This run has already sent ${maxCommands} infrastructure commands, the most one run may send. Finish your analysis with what you have.`,
       );
     }
 
@@ -404,7 +435,7 @@ export default class InfrastructureInvestigationToolkit {
 
     if (!budget.ok) {
       return this.failure(
-        `Not enough time is left in this investigation's budget to run another infrastructure command (about ${InfrastructureInvestigationToolkit.describeSeconds(
+        `Not enough time is left before this investigation's configured time limit to run another infrastructure command (about ${InfrastructureInvestigationToolkit.describeSeconds(
           budget.refusal.remainingBudgetMs,
         )} remain; a command needs at least ${InfrastructureInvestigationToolkit.describeSeconds(
           budget.refusal.minimumBudgetMs,
@@ -437,6 +468,8 @@ export default class InfrastructureInvestigationToolkit {
         stepId: `ai-investigation-resource-${this.commandsRun}`,
         timeoutInMs: budget.plan.timeoutInMs,
         claimTimeoutInMs: budget.plan.claimTimeoutInMs,
+        // Everything the agent returned; long output is paged below.
+        maxOutputChars: Number.MAX_SAFE_INTEGER,
       });
     } catch (error) {
       const message: string = redactResourceCommandOutput({
@@ -510,27 +543,39 @@ export default class InfrastructureInvestigationToolkit {
       );
     }
 
-    const text: string = ResourceCommandJobRunner.describeForLlm({
-      outcome,
-      resourceType: resource.resourceType,
+    const citationLabel: string =
+      InfrastructureInvestigationToolkit.getCitationLabel({
+        displayCommand: outcome.displayCommand,
+        resource,
+      });
+
+    /*
+     * The whole output came back (see maxOutputChars above). A long one is
+     * shown a page at a time: the first page now, the rest through
+     * read_tool_output — nothing is cut away.
+     */
+    const paged: PagedToolOutput = this.outputPager.paginate({
+      label: citationLabel,
+      text: outcome.output,
     });
 
+    const text: string = `${ResourceCommandJobRunner.describeForLlm({
+      outcome: { ...outcome, output: paged.firstPage },
+      resourceType: resource.resourceType,
+    })}${paged.continuationNote ? `\n${paged.continuationNote}` : ""}`;
+
     return {
       success: true,
       textForLlm: text,
       result: {
         dataForLlm: text,
         rowCount: outcome.succeeded ? 1 : 0,
-        citationLabel: InfrastructureInvestigationToolkit.getCitationLabel({
-          displayCommand: outcome.displayCommand,
-          resource,
-        }),
+        citationLabel,
         redactionCount: outcome.redactionCount ?? 0,
+        // Paged output is complete; only an output the agent cut is not.
         isTruncated:
-          outcome.isTruncated ??
-          outcome.output.endsWith(
-            RESOURCE_COMMAND_OUTPUT_TRUNCATED_SUFFIX.trim(),
-          ),
+          outcome.isTruncated === true ||
+          hasAgentTruncationMarker(outcome.output),
       },
     };
   }

package/Server/Utils/AI/ResourceAccess/ResourceCommandJobRunner.ts

@@ -250,6 +250,11 @@ export default class ResourceCommandJobRunner {
     claimTimeoutInMs?: number | undefined;
     // The resource AI page's "Test connection" check (no aiRunId).
     isAccessTest?: boolean | undefined;
+    /*
+     * How much of the redacted output to keep. Defaults to the shared cap;
+     * a caller that pages long output itself asks for all of it.
+     */
+    maxOutputChars?: number | undefined;
   }): Promise<ResourceCommandJobOutcome> {
     const claimTimeoutInMs: number =
       data.claimTimeoutInMs ?? RESOURCE_COMMAND_CLAIM_TIMEOUT_MS;
@@ -284,6 +289,7 @@ export default class ResourceCommandJobRunner {
         resourceType: data.resourceType,
         claimTimeoutInMs,
         executionTimeoutInMs: data.timeoutInMs,
+        maxOutputChars: data.maxOutputChars,
       });
 
     await ResourceCommandJobRunner.recordOutcomeOnResource({
@@ -313,6 +319,8 @@ export default class ResourceCommandJobRunner {
     resourceType: AiResourceType;
     claimTimeoutInMs: number;
     executionTimeoutInMs: number;
+    // How much of the redacted output to keep (default: the shared cap).
+    maxOutputChars?: number | undefined;
   }): Promise<ResourceCommandJobOutcome> {
     const { job, terminalJob } = data;
 
@@ -357,6 +365,7 @@ export default class ResourceCommandJobRunner {
       output: terminalJob.output || "",
       resourceType: data.resourceType,
       program,
+      maxChars: data.maxOutputChars,
     });
 
     return {

package/Server/Utils/AI/SRE/AIInvestigationEngine.ts

@@ -10,6 +10,11 @@ import AIRunStatus from "../../../../Types/AI/AIRunStatus";
 import AIRunCodeFixRecommendation from "../../../../Types/AI/AIRunCodeFixRecommendation";
 import AIRunEventType from "../../../../Types/AI/AIRunEventType";
 import AIRunEvent from "../../../../Models/DatabaseModels/AIRunEvent";
+import AIAgentRunLimitsHelper, {
+  AI_AGENT_RUNAWAY_MAX_LLM_CALLS,
+  AI_AGENT_RUNAWAY_MAX_TOOL_CALLS,
+  AIAgentRunLimits,
+} from "../../../../Types/AI/AIAgentRunLimits";
 import {
   LIST_CLUSTER_ACCESS_TOOL_NAME,
   RUN_KUBECTL_TOOL_NAME,
@@ -56,17 +61,20 @@ import CaptureSpan from "../../Telemetry/CaptureSpan";
  * Enablement + provider gating is shared via isEnabledForProject().
  */
 
-// Budgets — larger than an interactive chat-ops answer, small enough to stay cheap.
-const MAX_LLM_CALLS: number = 8;
-const MAX_TOOL_CALLS: number = 12;
 /*
- * The wall clock an investigation run gets by default. Exported because the
- * kubectl read toolkit plans every command's wait against this same budget
- * (the runners hand it to the engine AND to the toolkit as an absolute
- * deadline), and one definition is how the two can never disagree.
+ * Budgets. An investigation runs until it is done: no wall clock, and step
+ * counts that only guard against a runaway loop (see AIAgentRunLimits). A
+ * project that wants a hard time limit configures one per lane, and the
+ * runners pass it in as maxWallClockMs — and to the command toolkits as a
+ * deadline — so the loop and every command wait agree on one number.
  */
-export const MAX_WALL_CLOCK_MS: number = 150 * 1000;
-const MAX_OUTPUT_TOKENS: number = 2000;
+const MAX_LLM_CALLS: number = AI_AGENT_RUNAWAY_MAX_LLM_CALLS;
+const MAX_TOOL_CALLS: number = AI_AGENT_RUNAWAY_MAX_TOOL_CALLS;
+/*
+ * Room for a full report. An answer that still reaches the limit is
+ * finished with continuation calls, never published half-written.
+ */
+const MAX_OUTPUT_TOKENS: number = 4096;
 
 /*
  * Conditional recommendation persistence is idempotent, so transient
@@ -205,6 +213,7 @@ export interface InvestigationRequest {
   extraTools?: Array<ObservabilityAssistantExtraTool> | undefined;
   maxLlmCalls?: number | undefined;
   maxToolCalls?: number | undefined;
+  // Undefined means no time limit.
   maxWallClockMs?: number | undefined;
   maxOutputTokens?: number | undefined;
 }
@@ -258,6 +267,39 @@ export default class AIInvestigationEngine {
     return this.getProviderOrBalanceReason(projectId);
   }
 
+  /*
+   * How far an investigation of this lane may run: no time limit unless the
+   * project configured one in its Incident / Alert AI settings. Fails open —
+   * a project that cannot be read runs unbounded rather than being cut
+   * short, since the time limit is an opt-in.
+   */
+  public static async getRunLimitsForProject(
+    projectId: ObjectID,
+    subjectType: AISubjectType,
+  ): Promise<AIAgentRunLimits> {
+    try {
+      const project: Project | null = await ProjectService.findOneById({
+        id: projectId,
+        select: {
+          incidentAiInvestigationTimeLimitInMinutes: true,
+          alertAiInvestigationTimeLimitInMinutes: true,
+        },
+        props: { isRoot: true },
+      });
+
+      return AIAgentRunLimitsHelper.fromTimeLimitInMinutes(
+        subjectType === "Alert"
+          ? project?.alertAiInvestigationTimeLimitInMinutes
+          : project?.incidentAiInvestigationTimeLimitInMinutes,
+      );
+    } catch (error) {
+      logger.error(
+        `AI: could not read the investigation time limit for project ${projectId.toString()}; running without one: ${error}`,
+      );
+      return AIAgentRunLimitsHelper.getDefault();
+    }
+  }
+
   /*
    * The half of the gate that is not a switch: a model to call, and AI
    * credits to pay for it. Shared with the other autonomous AI work that
@@ -459,7 +501,8 @@ export default class AIInvestigationEngine {
           }\n\n${request.contextSummary}`,
           maxLlmCalls: request.maxLlmCalls ?? MAX_LLM_CALLS,
           maxToolCalls: request.maxToolCalls ?? MAX_TOOL_CALLS,
-          maxWallClockMs: request.maxWallClockMs ?? MAX_WALL_CLOCK_MS,
+          // Null tells the loop "no time limit" (undefined = its chat default).
+          maxWallClockMs: request.maxWallClockMs ?? null,
           maxOutputTokens: request.maxOutputTokens ?? MAX_OUTPUT_TOKENS,
           onStep,
           extraTools: request.extraTools,

package/Server/Utils/AI/SRE/AlertInvestigationRunner.ts

@@ -38,9 +38,11 @@ import {
 import { KubernetesClusterAiAccessStatus } from "../../../../Types/Kubernetes/KubernetesClusterAiAccess";
 import KubernetesClusterAiAccessService from "../../../Services/KubernetesClusterAiAccessService";
 import ClusterAccessContext from "../ClusterAccess/ClusterAccessContext";
-import KubectlInvestigationToolkit, {
-  INVESTIGATION_MAX_WALL_CLOCK_MS,
-} from "../ClusterAccess/KubectlInvestigationToolkit";
+import KubectlInvestigationToolkit from "../ClusterAccess/KubectlInvestigationToolkit";
+import ToolOutputPager from "../Chat/ToolOutputPager";
+import AIAgentRunLimitsHelper, {
+  AIAgentRunLimits,
+} from "../../../../Types/AI/AIAgentRunLimits";
 import { ResourceAiAccessStatus } from "../../../../Types/ResourceAiAgent/ResourceAiAccess";
 import ResourceAiAccessService from "../../../Services/ResourceAiAccessService";
 import ResourceAccessContext from "../ResourceAccess/ResourceAccessContext";
@@ -248,13 +250,19 @@ export default class AIAlertInvestigationRunner {
     }
 
     /*
-     * The run's wall clock, stated once: the engine enforces it between
-     * tool calls and the kubectl toolkit plans every command's wait to end
-     * before it, so a run_kubectl issued late in the run cannot outlive the
-     * budget (the loop cannot interrupt a tool once it is running).
+     * How far the run may go, stated once: no time limit unless the project
+     * configured one. When it did, the engine enforces it between tool
+     * calls and the command toolkits plan every command's wait to end
+     * before it, so a command issued late in the run cannot outlive it (the
+     * loop cannot interrupt a tool once it is running).
      */
-    const runDeadlineAtMs: number =
-      Date.now() + INVESTIGATION_MAX_WALL_CLOCK_MS;
+    const runLimits: AIAgentRunLimits =
+      await AIInvestigationEngine.getRunLimitsForProject(projectId, "Alert");
+    const runDeadlineAtMs: number | undefined =
+      AIAgentRunLimitsHelper.getDeadlineAtMs(runLimits, Date.now());
+
+    // One pager for the run, so read_tool_output reads every toolkit's output.
+    const outputPager: ToolOutputPager = new ToolOutputPager();
 
     const kubectlToolkit: KubectlInvestigationToolkit =
       new KubectlInvestigationToolkit({
@@ -262,6 +270,7 @@ export default class AIAlertInvestigationRunner {
         aiRunId,
         clusters: clusterStatuses,
         runDeadlineAtMs,
+        outputPager,
       });
     const extraTools: Array<ObservabilityAssistantExtraTool> =
       kubectlToolkit.buildTools();
@@ -280,6 +289,7 @@ export default class AIAlertInvestigationRunner {
           aiRunId,
           resources: resourceStatuses,
           runDeadlineAtMs,
+          outputPager,
         });
       const infrastructureTools: Array<ObservabilityAssistantExtraTool> =
         infrastructureToolkit.buildTools();
@@ -295,6 +305,11 @@ export default class AIAlertInvestigationRunner {
       );
     }
 
+    // Long command output is paged, never cut: offer the reader with the commands.
+    if (extraTools.length > 0) {
+      extraTools.push(outputPager.buildReadTool());
+    }
+
     // The cluster rules first, exactly as before; the infrastructure rules after.
     const additionalInstructions: Array<string> = [];
 
@@ -317,7 +332,9 @@ export default class AIAlertInvestigationRunner {
         feature: AI_ALERT_INVESTIGATION_FEATURE,
         alertId,
         contextSummary,
-        maxWallClockMs: INVESTIGATION_MAX_WALL_CLOCK_MS,
+        maxLlmCalls: runLimits.maxLlmCalls,
+        maxToolCalls: runLimits.maxToolCalls,
+        maxWallClockMs: runLimits.maxWallClockMs,
         ...(additionalInstructions.length > 0
           ? { additionalInstructions: additionalInstructions.join("\n\n") }
           : {}),

package/Server/Utils/AI/SRE/IncidentInvestigationRunner.ts

@@ -40,9 +40,11 @@ import {
 import { KubernetesClusterAiAccessStatus } from "../../../../Types/Kubernetes/KubernetesClusterAiAccess";
 import KubernetesClusterAiAccessService from "../../../Services/KubernetesClusterAiAccessService";
 import ClusterAccessContext from "../ClusterAccess/ClusterAccessContext";
-import KubectlInvestigationToolkit, {
-  INVESTIGATION_MAX_WALL_CLOCK_MS,
-} from "../ClusterAccess/KubectlInvestigationToolkit";
+import KubectlInvestigationToolkit from "../ClusterAccess/KubectlInvestigationToolkit";
+import ToolOutputPager from "../Chat/ToolOutputPager";
+import AIAgentRunLimitsHelper, {
+  AIAgentRunLimits,
+} from "../../../../Types/AI/AIAgentRunLimits";
 import { ResourceAiAccessStatus } from "../../../../Types/ResourceAiAgent/ResourceAiAccess";
 import ResourceAiAccessService from "../../../Services/ResourceAiAccessService";
 import ResourceAccessContext from "../ResourceAccess/ResourceAccessContext";
@@ -436,13 +438,19 @@ export default class AIIncidentInvestigationRunner {
     }
 
     /*
-     * The run's wall clock, stated once: the engine enforces it between
-     * tool calls and the kubectl toolkit plans every command's wait to end
-     * before it, so a run_kubectl issued late in the run cannot outlive the
-     * budget (the loop cannot interrupt a tool once it is running).
+     * How far the run may go, stated once: no time limit unless the project
+     * configured one. When it did, the engine enforces it between tool
+     * calls and the command toolkits plan every command's wait to end
+     * before it, so a command issued late in the run cannot outlive it (the
+     * loop cannot interrupt a tool once it is running).
      */
-    const runDeadlineAtMs: number =
-      Date.now() + INVESTIGATION_MAX_WALL_CLOCK_MS;
+    const runLimits: AIAgentRunLimits =
+      await AIInvestigationEngine.getRunLimitsForProject(projectId, "Incident");
+    const runDeadlineAtMs: number | undefined =
+      AIAgentRunLimitsHelper.getDeadlineAtMs(runLimits, Date.now());
+
+    // One pager for the run, so read_tool_output reads every toolkit's output.
+    const outputPager: ToolOutputPager = new ToolOutputPager();
 
     const kubectlToolkit: KubectlInvestigationToolkit =
       new KubectlInvestigationToolkit({
@@ -450,6 +458,7 @@ export default class AIIncidentInvestigationRunner {
         aiRunId,
         clusters: clusterStatuses,
         runDeadlineAtMs,
+        outputPager,
       });
     const extraTools: Array<ObservabilityAssistantExtraTool> =
       kubectlToolkit.buildTools();
@@ -468,6 +477,7 @@ export default class AIIncidentInvestigationRunner {
           aiRunId,
           resources: resourceStatuses,
           runDeadlineAtMs,
+          outputPager,
         });
       const infrastructureTools: Array<ObservabilityAssistantExtraTool> =
         infrastructureToolkit.buildTools();
@@ -483,6 +493,11 @@ export default class AIIncidentInvestigationRunner {
       );
     }
 
+    // Long command output is paged, never cut: offer the reader with the commands.
+    if (extraTools.length > 0) {
+      extraTools.push(outputPager.buildReadTool());
+    }
+
     // The cluster rules first, exactly as before; the infrastructure rules after.
     const additionalInstructions: Array<string> = [];
 
@@ -505,7 +520,9 @@ export default class AIIncidentInvestigationRunner {
         feature: AI_INCIDENT_INVESTIGATION_FEATURE,
         incidentId,
         contextSummary,
-        maxWallClockMs: INVESTIGATION_MAX_WALL_CLOCK_MS,
+        maxLlmCalls: runLimits.maxLlmCalls,
+        maxToolCalls: runLimits.maxToolCalls,
+        maxWallClockMs: runLimits.maxWallClockMs,
         ...(additionalInstructions.length > 0
           ? { additionalInstructions: additionalInstructions.join("\n\n") }
           : {}),

package/Server/Utils/AI/SRE/InvestigationQueue.ts

@@ -52,8 +52,8 @@ export const MAX_INVESTIGATION_ATTEMPTS: number = 2;
 
 /*
  * G4 cost guardrail: at most this many investigations may be Running in an
- * incident, alert or subjectless lane at once. Each lane has its own project
- * override; subjectless work keeps Project.aiMaxConcurrentInvestigations.
+ * incident, alert or subjectless lane at once. The incident and alert lanes
+ * have their own project override; subjectless work always uses the default.
  * Enforced at CLAIM time, so a storm queues (bounded by dedupe + severity
  * gates + this TTL) and drains at cap rate instead of being dropped.
  */
@@ -633,25 +633,22 @@ export default class AIInvestigationQueue {
 
     /*
      * Each subject lane owns its own concurrency pool. Insight triage and any
-     * future subjectless queue work retain the legacy project-wide fallback.
+     * future subjectless queue work use the default cap.
      */
-    const project: Project | null = await ProjectService.findOneById({
-      id: run.projectId,
-      select: {
-        aiMaxConcurrentInvestigations: true,
-        incidentAiMaxConcurrentInvestigations: true,
-        alertAiMaxConcurrentInvestigations: true,
-      },
-      props: { isRoot: true },
-    });
-
-    let configuredConcurrencyCap: number | undefined =
-      project?.aiMaxConcurrentInvestigations;
+    let configuredConcurrencyCap: number | undefined = undefined;
+
+    if (run.triggeredByIncidentId || run.triggeredByAlertId) {
+      const project: Project | null = await ProjectService.findOneById({
+        id: run.projectId,
+        select: run.triggeredByIncidentId
+          ? { incidentAiMaxConcurrentInvestigations: true }
+          : { alertAiMaxConcurrentInvestigations: true },
+        props: { isRoot: true },
+      });
 
-    if (run.triggeredByIncidentId) {
-      configuredConcurrencyCap = project?.incidentAiMaxConcurrentInvestigations;
-    } else if (run.triggeredByAlertId) {
-      configuredConcurrencyCap = project?.alertAiMaxConcurrentInvestigations;
+      configuredConcurrencyCap = run.triggeredByIncidentId
+        ? project?.incidentAiMaxConcurrentInvestigations
+        : project?.alertAiMaxConcurrentInvestigations;
     }
 
     const concurrencyCap: number = Math.min(