@oneuptime/common 14.0.11 → 14.0.12

package/Server/Utils/AI/CodeFix/FixRunBudget.ts

@@ -9,12 +9,13 @@ import QueryHelper from "../../../Types/Database/QueryHelper";
 import CaptureSpan from "../../Telemetry/CaptureSpan";
 
 /*
- * Per-project daily fix-run budget (Preventive-lane X guardrail, G11).
+ * Per-project daily fix-run limit (Preventive-lane X guardrail, G11), opt-in.
  *
- * Every CodeFix AIRun counts against the daily cap for its lane: incident,
+ * Every CodeFix AIRun counts against the daily limit for its lane: incident,
  * alert, or subjectless. Incident and alert runs use their independent
- * settings; recipes with neither subject always use the default below.
- * Null/unset means the default and 0 pauses that lane.
+ * settings; recipes with neither subject have no setting and no limit.
+ * Null/unset means no limit and 0 pauses that lane (see AIWorkloadLimits for
+ * why every AI limit is off until a project sets it).
  *
  * Enforced centrally at BOTH creation paths:
  *   - TelemetryExceptionService.createCodeFixRunForException (the
@@ -27,16 +28,16 @@ import CaptureSpan from "../../Telemetry/CaptureSpan";
  * over-budget as a logged skip (it must never throw into an investigation).
  */
 
-// Fix runs allowed per project per UTC day when no explicit limit is set.
-export const DEFAULT_DAILY_FIX_RUN_LIMIT: number = 25;
-
 export interface FixRunBudgetDecision {
   allowed: boolean;
-  // The effective limit after defaulting (<= 0 means paused).
-  limit: number;
+  // The configured limit: null means no limit, <= 0 means paused.
+  limit: number | null;
   // True when the configured limit pauses fix tasks outright (0 or less).
   paused: boolean;
-  // CodeFix runs created since UTC midnight (0 when paused short-circuits).
+  /*
+   * CodeFix runs created since UTC midnight (0 when the count is skipped
+   * because the lane is paused or has no limit).
+   */
   runsToday: number;
 }
 
@@ -50,19 +51,24 @@ type FixRunBudgetLane = "incident" | "alert" | "other";
 export default class FixRunBudget {
   /*
    * The pure budget decision, separated from IO so it can be tested
-   * directly. Null/undefined means "use the default cap" — unlike the
-   * token budget, an unset fix-task limit is NOT unlimited: fix runs fan
-   * out into pull requests on customer repositories, so they always ship
-   * with a ceiling. 0 (or negative) pauses fix tasks entirely.
+   * directly. Null/undefined means no limit, like the token budget: AI fix
+   * tasks are opened as often as the work calls for until a project sets a
+   * ceiling. 0 (or negative) pauses fix tasks entirely.
    */
   public static evaluate(data: {
     configuredLimit: number | null | undefined;
     runsToday: number;
   }): FixRunBudgetDecision {
-    const limit: number =
-      data.configuredLimit === null || data.configuredLimit === undefined
-        ? DEFAULT_DAILY_FIX_RUN_LIMIT
-        : data.configuredLimit;
+    if (data.configuredLimit === null || data.configuredLimit === undefined) {
+      return {
+        allowed: true,
+        limit: null,
+        paused: false,
+        runsToday: data.runsToday,
+      };
+    }
+
+    const limit: number = data.configuredLimit;
 
     if (limit <= 0) {
       return {
@@ -93,32 +99,36 @@ export default class FixRunBudget {
   ): Promise<FixRunBudgetDecision> {
     const lane: FixRunBudgetLane = this.getLane(subject);
 
-    let configuredLimit: number | null = null;
-
-    if (lane !== "other") {
-      const project: Project | null = await ProjectService.findOneById({
-        id: projectId,
-        select:
-          lane === "incident"
-            ? { incidentAiDailyFixTaskLimit: true }
-            : { alertAiDailyFixTaskLimit: true },
-        props: { isRoot: true },
-      });
+    // Subjectless fix tasks have no setting, so no limit and nothing to read.
+    if (lane === "other") {
+      return this.evaluate({ configuredLimit: null, runsToday: 0 });
+    }
 
-      configuredLimit =
+    const project: Project | null = await ProjectService.findOneById({
+      id: projectId,
+      select:
         lane === "incident"
-          ? project?.incidentAiDailyFixTaskLimit ?? null
-          : project?.alertAiDailyFixTaskLimit ?? null;
-    }
+          ? { incidentAiDailyFixTaskLimit: true }
+          : { alertAiDailyFixTaskLimit: true },
+      props: { isRoot: true },
+    });
 
-    // Paused short-circuits the count query (mirrors the token budget).
-    const pausedCheck: FixRunBudgetDecision = this.evaluate({
+    const configuredLimit: number | null =
+      lane === "incident"
+        ? project?.incidentAiDailyFixTaskLimit ?? null
+        : project?.alertAiDailyFixTaskLimit ?? null;
+
+    /*
+     * Paused and unlimited both short-circuit the count query (mirrors the
+     * token budget): neither decision depends on today's count.
+     */
+    const uncountedCheck: FixRunBudgetDecision = this.evaluate({
       configuredLimit,
       runsToday: 0,
     });
 
-    if (pausedCheck.paused) {
-      return pausedCheck;
+    if (uncountedCheck.paused || uncountedCheck.limit === null) {
+      return uncountedCheck;
     }
 
     const runsToday: number = (
@@ -131,15 +141,10 @@ export default class FixRunBudget {
                 triggeredByIncidentId: QueryHelper.notNull(),
                 triggeredByAlertId: QueryHelper.isNull(),
               }
-            : lane === "alert"
-              ? {
-                  triggeredByIncidentId: QueryHelper.isNull(),
-                  triggeredByAlertId: QueryHelper.notNull(),
-                }
-              : {
-                  triggeredByIncidentId: QueryHelper.isNull(),
-                  triggeredByAlertId: QueryHelper.isNull(),
-                }),
+            : {
+                triggeredByIncidentId: QueryHelper.isNull(),
+                triggeredByAlertId: QueryHelper.notNull(),
+              }),
           createdAt: QueryHelper.greaterThanEqualTo(
             OneUptimeDate.getStartOfDay(OneUptimeDate.getCurrentDate(), "UTC"),
           ),
@@ -178,7 +183,10 @@ export default class FixRunBudget {
   ): string {
     const lane: FixRunBudgetLane = this.getLane(subject);
 
-    // Subjectless fix tasks have a fixed daily cap with no setting.
+    /*
+     * getBudgetStatus never rejects a subjectless fix task (that lane has no
+     * limit), so a decision for it has no setting to point at.
+     */
     if (lane === "other") {
       return `The project's daily fix task limit for AI work outside incidents and alerts has been reached (${decision.runsToday} of ${decision.limit} fix tasks created today, UTC). New fix tasks can be created tomorrow.`;
     }
@@ -189,15 +197,15 @@ export default class FixRunBudget {
         : "Daily Alert AI Fix Task Limit";
     const settingsLocation: string =
       lane === "incident"
-        ? "Incidents > AI > Investigation"
-        : "Alerts > AI > Investigation";
+        ? "Incidents > Settings > AI"
+        : "Alerts > Settings > AI";
     const laneLabel: string = `${lane} AI`;
 
     if (decision.paused) {
       return `${laneLabel} fix tasks are paused for this project — the "${settingTitle}" is set to 0. Raise or unset it under ${settingsLocation} to resume.`;
     }
 
-    return `The project's ${laneLabel} fix task limit has been reached (${decision.runsToday} of ${decision.limit} fix tasks created today, UTC). New fix tasks can be created tomorrow — or raise the "${settingTitle}" under ${settingsLocation} (unset means the default of ${DEFAULT_DAILY_FIX_RUN_LIMIT}/day).`;
+    return `The project's ${laneLabel} fix task limit has been reached (${decision.runsToday} of ${decision.limit} fix tasks created today, UTC). New fix tasks can be created tomorrow — or raise the "${settingTitle}" under ${settingsLocation}, or clear it for no limit.`;
   }
 
   /*

package/Server/Utils/AI/CodeFix/OpenPullRequestCap.ts

@@ -4,11 +4,12 @@ import AIAgentTaskPullRequestService from "../../../Services/AIAgentTaskPullRequ
 import CaptureSpan from "../../Telemetry/CaptureSpan";
 
 /*
- * Per-repository open-PR cap (Preventive-lane X guardrail, G11).
+ * Per-repository open-PR cap (Preventive-lane X guardrail, G11), opt-in.
  *
  * A repository may have at most `CodeRepository.maxOpenFixPullRequests`
- * OPEN AI-authored fix pull requests at a time (null/unset = the default
- * below, 0 = no AI fix PRs for this repository). Open-PR counts come from
+ * OPEN AI-authored fix pull requests at a time (null/unset = no cap, 0 = no
+ * AI fix PRs for this repository; see AIWorkloadLimits for why every AI
+ * limit is off until someone sets it). Open-PR counts come from
  * AIAgentTaskPullRequest rows, whose states the AIAgent:SyncPullRequestStates
  * worker keeps current — merging or closing an AI PR frees a slot within
  * its 30-minute sync window.
@@ -20,32 +21,37 @@ import CaptureSpan from "../../Telemetry/CaptureSpan";
  * worker surfaces the rejection message as the run's failure guidance.
  */
 
-// Open AI fix PRs allowed per repository when no explicit cap is set.
-export const DEFAULT_MAX_OPEN_FIX_PULL_REQUESTS: number = 5;
-
 export interface OpenPullRequestCapDecision {
   allowed: boolean;
-  // The effective cap after defaulting (<= 0 means AI fix PRs are blocked).
-  limit: number;
+  // The configured cap: null means no cap, <= 0 means AI fix PRs are blocked.
+  limit: number | null;
   // True when the configured cap blocks AI fix PRs outright (0 or less).
   paused: boolean;
+  // Open AI fix PRs on the repository (0 when the count is skipped).
   openCount: number;
 }
 
 export default class OpenPullRequestCap {
   /*
    * The pure cap decision, separated from IO so it can be tested directly.
-   * At/over the cap rejects: `openCount >= limit` means the repository
-   * already carries a full review queue of unreviewed AI PRs.
+   * Unset means no cap. At/over a set cap rejects: `openCount >= limit`
+   * means the repository already carries a full review queue of unreviewed
+   * AI PRs.
    */
   public static evaluate(data: {
     configuredLimit: number | null | undefined;
     openCount: number;
   }): OpenPullRequestCapDecision {
-    const limit: number =
-      data.configuredLimit === null || data.configuredLimit === undefined
-        ? DEFAULT_MAX_OPEN_FIX_PULL_REQUESTS
-        : data.configuredLimit;
+    if (data.configuredLimit === null || data.configuredLimit === undefined) {
+      return {
+        allowed: true,
+        limit: null,
+        paused: false,
+        openCount: data.openCount,
+      };
+    }
+
+    const limit: number = data.configuredLimit;
 
     if (limit <= 0) {
       return {
@@ -74,14 +80,14 @@ export default class OpenPullRequestCap {
     codeRepositoryId: ObjectID;
     configuredLimit: number | null | undefined;
   }): Promise<OpenPullRequestCapDecision> {
-    // A blocked repo (cap 0) never needs the count query.
-    const pausedCheck: OpenPullRequestCapDecision = this.evaluate({
+    // A blocked repo (cap 0) or one with no cap never needs the count query.
+    const uncountedCheck: OpenPullRequestCapDecision = this.evaluate({
       configuredLimit: data.configuredLimit,
       openCount: 0,
     });
 
-    if (pausedCheck.paused) {
-      return pausedCheck;
+    if (uncountedCheck.paused || uncountedCheck.limit === null) {
+      return uncountedCheck;
     }
 
     const openCount: number = (
@@ -112,6 +118,6 @@ export default class OpenPullRequestCap {
       return `AI fix pull requests are blocked for repository ${data.repositoryName} — its "Max Open Fix Pull Requests" setting is 0. Raise or unset the setting on the repository's Settings page to allow AI fix pull requests again.`;
     }
 
-    return `Repository ${data.repositoryName} is at its open AI fix pull request cap (${data.decision.openCount} open of a maximum ${data.decision.limit}). Review and merge or close the open AI pull requests to free a slot, or raise the "Max Open Fix Pull Requests" setting on the repository's Settings page (unset means the default of ${DEFAULT_MAX_OPEN_FIX_PULL_REQUESTS}).`;
+    return `Repository ${data.repositoryName} is at its open AI fix pull request cap (${data.decision.openCount} open of a maximum ${data.decision.limit}). Review and merge or close the open AI pull requests to free a slot, or raise the "Max Open Fix Pull Requests" setting on the repository's Settings page, or clear it for no cap.`;
   }
 }

package/Server/Utils/AI/Remediation/RemediationExecutionRunner.ts

@@ -141,35 +141,14 @@ import CaptureSpan from "../../Telemetry/CaptureSpan";
  * suggestion settles what happened instead of re-executing anything.
  */
 
-/*
- * A cluster round: remediation a cluster's AI agent page asked for (its
- * Fixes mode), not an auto-remediation rule — it names a cluster and no
- * rule. The project's "Enable AI command execution" opt-in gates rule
- * rounds only; a cluster round's consent lives on the cluster (see
- * RemediationExecutionRunner.checkProjectGates). Keyed on the suggestion
- * row, never on the plan's step types: a rule can compose an all-kubectl
- * plan, and it was composed under the opt-in, so it stays under it. Shared
- * with the approve route so execution and approval can never disagree about
- * which rounds need the opt-in.
- */
-export function isClusterRemediationRound(suggestion: {
-  kubernetesClusterId?: ObjectID | undefined;
-  autoRemediationRuleId?: ObjectID | undefined;
-}): boolean {
-  return (
-    Boolean(suggestion.kubernetesClusterId) && !suggestion.autoRemediationRuleId
-  );
-}
-
 /*
  * A resource round: remediation an infrastructure resource's AI agent page
  * asked for (its Fixes mode) — a Docker or Podman host, a Docker Swarm,
  * Proxmox, VMware or Ceph cluster, a database server or a host — not a
  * rule. It names a resource (type and id) and no rule. Like a cluster
  * round, its consent lives on the resource (its Fixes mode, and the agent's
- * own ONEUPTIME_AI_ALLOW_WRITES), so the project's "Enable AI command
- * execution" opt-in does not gate it. Keyed on the suggestion row, never on
- * the plan's step types, and shared with the approve route.
+ * own ONEUPTIME_AI_ALLOW_WRITES). Keyed on the suggestion row, never on the
+ * plan's step types.
  */
 export function isResourceRemediationRound(suggestion: {
   resourceType?: AiResourceType | string | undefined;
@@ -820,9 +799,8 @@ export default class RemediationExecutionRunner {
        * would fall into the rule lane below and be closed as "the rule
        * behind this suggestion was deleted", naming a rule that never
        * existed. Its server-written name is what is left to tell. Checked
-       * before the project gates: nothing is left to run, and with no
-       * cluster on the row it no longer reads as a cluster round, so the
-       * gates would otherwise blame an opt-in it never needed.
+       * before the project gate: nothing is left to run, so the deletion,
+       * not a project switch, is what the round's record should say.
        */
       const deletedClusterRound: { clusterName: string } | null =
         !suggestion.kubernetesClusterId && !suggestion.autoRemediationRuleId
@@ -841,10 +819,6 @@ export default class RemediationExecutionRunner {
       // Gates that must still hold at execution time, not just at rule match.
       const gateFailure: string | null = await this.checkProjectGates({
         projectId,
-        isClusterRound: isClusterRemediationRound(suggestion),
-        ...(isResourceRemediationRound(suggestion)
-          ? { isResourceRound: true }
-          : {}),
       });
       if (gateFailure) {
         await this.settleNoneApplicable({
@@ -2001,57 +1975,30 @@ export default class RemediationExecutionRunner {
   }
 
   /*
-   * The project switches a round must still pass when it runs. Null when
-   * they do; otherwise the rationale for settling quietly.
+   * The project switch a round must still pass when it runs. Null when it
+   * does; otherwise the rationale for settling quietly.
    *
-   * Enable AI and Enable auto-remediation are kill switches for every
-   * round. The "Enable AI command execution" opt-in gates rule rounds
-   * (Bash/SSH on Runners, and kubectl a rule composes) but not a cluster
-   * round (isClusterRemediationRound): its consent is the cluster's own
-   * Fixes mode plus, for the in-cluster Kubernetes AI agent, the chart's
-   * write RBAC. A cluster reached through an advanced Runner with a
-   * Kubernetes credential has no chart RBAC behind it, so its status keeps
-   * the project_ai_command_execution_disabled gap while the opt-in is off —
-   * and the cluster round stops at isRemediationReady instead.
+   * Enable AI is the project's only AI switch and the kill switch for
+   * every round: rule rounds (Bash/SSH on Runners, and kubectl a rule
+   * composes), cluster rounds and resource rounds alike. Past it, a
+   * round's consent is its own: the rule's mode and allowlist and a
+   * Runner's Runs AI Remediation Commands, or the cluster's or resource's
+   * Fixes mode and its agent's write access.
    */
   public static async checkProjectGates(data: {
     projectId: ObjectID;
-    isClusterRound: boolean;
-    /*
-     * A resource round (isResourceRemediationRound): like a cluster round,
-     * its consent is the resource's own Fixes mode plus the agent's
-     * ONEUPTIME_AI_ALLOW_WRITES, so the opt-in does not gate it.
-     */
-    isResourceRound?: boolean | undefined;
   }): Promise<string | null> {
     const project: Project | null = await ProjectService.findOneById({
       id: data.projectId,
       select: {
         enableAi: true,
-        enableAutoRemediation: true,
-        enableAiCommandExecution: true,
       },
       props: { isRoot: true },
     });
 
-    if (
-      !project ||
-      project.enableAi === false ||
-      project.enableAutoRemediation === false
-    ) {
-      return "AI or auto-remediation was disabled for this project before the run started (Project Settings → AI Features) — nothing was run or proposed.";
-    }
-
-    if (data.isClusterRound || data.isResourceRound === true) {
-      return null;
-    }
-
-    /*
-     * Opt-in semantics (=== true): a rule's AI command execution never runs
-     * in a project that has not explicitly turned it on.
-     */
-    if (project.enableAiCommandExecution !== true) {
-      return "AI command execution is not enabled for this project (Project Settings → AI Features) — nothing was run or proposed.";
+    // === false: the column is NOT NULL DEFAULT true (see Project.enableAi).
+    if (!project || project.enableAi === false) {
+      return "AI was disabled for this project before the run started (Project Settings → AI Features) — nothing was run or proposed.";
     }
 
     return null;

package/Server/Utils/AI/SRE/AlertInvestigationRunner.ts

@@ -5,8 +5,8 @@ import {
 import InvestigationEligibility from "./InvestigationEligibility";
 import ObjectID from "../../../../Types/ObjectID";
 import OneUptimeDate from "../../../../Types/Date";
-import SortOrder from "../../../../Types/BaseDatabase/SortOrder";
 import AIRunType from "../../../../Types/AI/AIRunType";
+import AIWorkloadLimits from "../../../../Types/AI/AIWorkloadLimits";
 import { Blue500 } from "../../../../Types/BrandColors";
 import Alert from "../../../../Models/DatabaseModels/Alert";
 import AlertSeverity from "../../../../Models/DatabaseModels/AlertSeverity";
@@ -58,20 +58,17 @@ import CaptureSpan from "../../Telemetry/CaptureSpan";
  * the alert timeline + Slack/Teams. Symmetric to incident investigation and
  * built on the same shared AIInvestigationEngine.
  *
- * Gated by the same per-project opt-in as incidents, PLUS alert-specific cost
- * gates (alert volume can be far higher than incidents):
+ * Gated by the same per-project opt-in as incidents, PLUS two cost gates a
+ * project may set for alerts (alert volume can be far higher than
+ * incidents). Both are off until a project sets them, so by default every
+ * alert is investigated:
  *   - severity floor: only alerts at or above the project's configured minimum
- *     severity are investigated; when unset, the top two severity tiers
- *     (lowest two `order` values) are the default.
- *   - per-monitor dedupe window: a monitor that already triggered an
- *     investigation recently is not re-investigated — the first RCA stands.
+ *     severity are investigated; unset means every severity.
+ *   - per-monitor cooldown: a monitor that already triggered an investigation
+ *     within the window is not re-investigated — the first RCA stands; unset
+ *     means no cooldown.
  */
 
-// Per-project override lives in Project.alertInvestigationDedupeWindowMinutes.
-export const DEFAULT_DEDUPE_WINDOW_MINUTES: number = 30;
-// Clamp: an RCA older than a day is a new episode by any reading.
-const MAX_DEDUPE_WINDOW_MINUTES: number = 24 * 60;
-
 export interface AlertGateDecision {
   investigate: boolean;
   notStartedCode?: InvestigationNotStartedCode | undefined;
@@ -369,8 +366,8 @@ export default class AIAlertInvestigationRunner {
 
           /*
            * Inconclusive means the telemetry was insufficient — for
-           * opted-in projects (the alert instrumentation-fix setting,
-           * default false), queue an ImproveInstrumentation fix task that
+           * projects with the alert instrumentation-fix setting on (on
+           * for new projects), queue an ImproveInstrumentation fix task that
            * opens a PR adding the missing observability. Runs strictly
            * AFTER the analysis is posted, and the trigger never throws, so
            * the investigation can neither be blocked nor failed by it.
@@ -468,9 +465,12 @@ export default class AIAlertInvestigationRunner {
       props: { isRoot: true },
     });
 
-    // Severity floor.
+    /*
+     * Severity floor. Only filters KNOWN-low-severity alerts: an alert whose
+     * severity order cannot be determined passes, as does every alert when
+     * no floor is configured.
+     */
     const floorSeverity: AlertSeverity | null = await this.getSeverityFloor(
-      projectId,
       project?.alertInvestigationMinimumSeverityId,
     );
     const floorOrder: number | undefined = floorSeverity?.order;
@@ -494,17 +494,12 @@ export default class AIAlertInvestigationRunner {
     }
 
     /*
-     * Per-monitor dedupe window: per-project override, defaulting to 30
-     * minutes, clamped to at most a day; 0 disables the cooldown. Alerts
-     * without a monitor have no dedupe key.
+     * Per-monitor cooldown: off unless the project sets one, clamped to at
+     * most a day (see AIWorkloadLimits). Alerts without a monitor have no
+     * dedupe key.
      */
-    const dedupeWindowMinutes: number = Math.min(
-      MAX_DEDUPE_WINDOW_MINUTES,
-      Math.max(
-        0,
-        project?.alertInvestigationDedupeWindowMinutes ??
-          DEFAULT_DEDUPE_WINDOW_MINUTES,
-      ),
+    const dedupeWindowMinutes: number = AIWorkloadLimits.getCooldownInMinutes(
+      project?.alertInvestigationDedupeWindowMinutes,
     );
 
     if (alert.monitorId && dedupeWindowMinutes > 0) {
@@ -546,43 +541,32 @@ export default class AIAlertInvestigationRunner {
   /*
    * The severity `order` value that still qualifies for investigation (lower
    * order = higher severity; an alert qualifies when its order <= floor).
-   * An explicitly configured minimum severity wins; when unset — or when the
-   * configured severity has been deleted — the default is the project's top
-   * two tiers. Returns null when no floor applies (no severities configured).
+   * Returns null when no floor applies — the default: no configured minimum
+   * means every alert is investigated, whatever its severity.
    */
   private static async getSeverityFloor(
-    projectId: ObjectID,
     minimumSeverityId: ObjectID | undefined,
   ): Promise<AlertSeverity | null> {
-    if (minimumSeverityId) {
-      const floorSeverity: AlertSeverity | null =
-        await AlertSeverityService.findOneById({
-          id: minimumSeverityId,
-          select: { order: true, name: true },
-          props: { isRoot: true },
-        });
-
-      if (floorSeverity && floorSeverity.order !== undefined) {
-        return floorSeverity;
-      }
+    if (!minimumSeverityId) {
+      return null;
     }
 
-    // Default: the top two severity tiers (the two lowest order values).
-    const topTiers: Array<AlertSeverity> = await AlertSeverityService.findBy({
-      query: { projectId },
-      select: { order: true, name: true },
-      sort: { order: SortOrder.Ascending },
-      limit: 2,
-      skip: 0,
-      props: { isRoot: true },
-    });
+    const floorSeverity: AlertSeverity | null =
+      await AlertSeverityService.findOneById({
+        id: minimumSeverityId,
+        select: { order: true, name: true },
+        props: { isRoot: true },
+      });
 
-    if (topTiers.length === 0) {
+    /*
+     * A configured severity that has since been deleted must not silently
+     * become "investigate nothing" — fall back to no floor.
+     */
+    if (!floorSeverity || floorSeverity.order === undefined) {
       return null;
     }
 
-    const lastTier: AlertSeverity = topTiers[topTiers.length - 1]!;
-    return lastTier.order !== undefined ? lastTier : null;
+    return floorSeverity;
   }
 
   // Build a compact alert record to seed the investigation.

package/Server/Utils/AI/SRE/FixFromIncidentTaskTrigger.ts

@@ -31,16 +31,16 @@ import CaptureSpan from "../../Telemetry/CaptureSpan";
  * this form, but the durable recommendation remains a server-side gate so a
  * stale or forged client cannot turn a non-code investigation into a PR.
  *
- * AUTOMATIC: for projects that opted in through the subject lane's incident
- * or alert automatic-code-fix setting (default FALSE — G11 posture:
- * autonomous PR creation is opt-in only), an
+ * AUTOMATIC: for projects with the subject lane's incident or alert
+ * automatic-code-fix setting on (on for new projects; a project that
+ * existed before keeps its own value, and unset reads as off), an
  * investigation that ends with a POSITIVE code-fix classification (per the
  * structured G6 signal, never a regex over the analysis prose) enqueues the
  * same FixFromIncident task with no human click. Confidence alone is not
  * sufficient: operational and other non-code causes do not open PRs. Like its
  * InstrumentationTaskTrigger sibling it runs only after the Recommended
  * decision and snapshot are durable, and it never throws. The PR opens ready
- * for review and is always human-reviewed — the opt-in moves the human gate
+ * for review and is always human-reviewed — the setting moves the human gate
  * from PR creation to PR review, never past it.
  */
 
@@ -218,7 +218,7 @@ export default class FixFromIncidentTaskTrigger {
 
     if (!hasConnectedRepository) {
       throw new BadDataException(
-        "No GitHub-App-connected repository exists for this project, so the agent has nowhere to open the fix pull request. Connect one under AI > Code Repositories.",
+        "No GitHub-App-connected repository exists for this project, so the agent has nowhere to open the fix pull request. Connect one under Tasks > Code Repositories.",
       );
     }
 
@@ -255,7 +255,7 @@ export default class FixFromIncidentTaskTrigger {
 
   /*
    * The pure trigger decision for the AUTOMATIC form, separated from IO so
-   * it can be tested directly: strict opt-in (default FALSE), a repository
+   * it can be tested directly: the project's setting (=== true), a repository
    * the agent can actually open a PR against, and the per-subject dedupe
    * guard. The caller has already established and durably persisted the
    * code-fix-recommended investigation prerequisite.
@@ -272,8 +272,8 @@ export default class FixFromIncidentTaskTrigger {
     }
 
     /*
-     * Strict opt-in — the column defaults to false, so unset/legacy rows
-     * never enqueue. Autonomous PR creation must never be default-on.
+     * Strictly === true — the column defaults to false, so unset/legacy
+     * rows never enqueue. New projects get it on from ProjectService.
      */
     if (Boolean(input.incidentId) === Boolean(input.alertId)) {
       return {

package/Server/Utils/AI/SRE/FixPerformanceTaskTrigger.ts

@@ -186,7 +186,7 @@ export default class FixPerformanceTaskTrigger {
 
     if (!hasConnectedRepository) {
       throw new BadDataException(
-        "No GitHub-App-connected repository exists for this project, so the agent has nowhere to open the performance-fix pull request. Connect one under AI > Code Repositories.",
+        "No GitHub-App-connected repository exists for this project, so the agent has nowhere to open the performance-fix pull request. Connect one under Tasks > Code Repositories.",
       );
     }