@oneuptime/common 14.0.9 → 14.0.11

package/Server/Utils/AI/SRE/AIInvestigationEngine.ts

@@ -10,10 +10,20 @@ import AIRunStatus from "../../../../Types/AI/AIRunStatus";
 import AIRunCodeFixRecommendation from "../../../../Types/AI/AIRunCodeFixRecommendation";
 import AIRunEventType from "../../../../Types/AI/AIRunEventType";
 import AIRunEvent from "../../../../Models/DatabaseModels/AIRunEvent";
+import AIAgentRunLimitsHelper, {
+  AI_AGENT_RUNAWAY_MAX_LLM_CALLS,
+  AI_AGENT_RUNAWAY_MAX_TOOL_CALLS,
+  AIAgentRunLimits,
+} from "../../../../Types/AI/AIAgentRunLimits";
 import {
   LIST_CLUSTER_ACCESS_TOOL_NAME,
   RUN_KUBECTL_TOOL_NAME,
 } from "../../../../Types/Kubernetes/KubernetesClusterAiAccessToolNames";
+import {
+  LIST_INFRASTRUCTURE_ACCESS_TOOL_NAME,
+  RUN_INFRASTRUCTURE_COMMAND_TOOL_NAME,
+  isInfrastructureToolName,
+} from "../ResourceAccess/ResourceAccessToolNames";
 import Project from "../../../../Models/DatabaseModels/Project";
 import LlmProvider from "../../../../Models/DatabaseModels/LlmProvider";
 import AIRunService from "../../../Services/AIRunService";
@@ -51,17 +61,20 @@ import CaptureSpan from "../../Telemetry/CaptureSpan";
  * Enablement + provider gating is shared via isEnabledForProject().
  */
 
-// Budgets — larger than an interactive chat-ops answer, small enough to stay cheap.
-const MAX_LLM_CALLS: number = 8;
-const MAX_TOOL_CALLS: number = 12;
 /*
- * The wall clock an investigation run gets by default. Exported because the
- * kubectl read toolkit plans every command's wait against this same budget
- * (the runners hand it to the engine AND to the toolkit as an absolute
- * deadline), and one definition is how the two can never disagree.
+ * Budgets. An investigation runs until it is done: no wall clock, and step
+ * counts that only guard against a runaway loop (see AIAgentRunLimits). A
+ * project that wants a hard time limit configures one per lane, and the
+ * runners pass it in as maxWallClockMs — and to the command toolkits as a
+ * deadline — so the loop and every command wait agree on one number.
+ */
+const MAX_LLM_CALLS: number = AI_AGENT_RUNAWAY_MAX_LLM_CALLS;
+const MAX_TOOL_CALLS: number = AI_AGENT_RUNAWAY_MAX_TOOL_CALLS;
+/*
+ * Room for a full report. An answer that still reaches the limit is
+ * finished with continuation calls, never published half-written.
  */
-export const MAX_WALL_CLOCK_MS: number = 150 * 1000;
-const MAX_OUTPUT_TOKENS: number = 2000;
+const MAX_OUTPUT_TOKENS: number = 4096;
 
 /*
  * Conditional recommendation persistence is idempotent, so transient
@@ -200,6 +213,7 @@ export interface InvestigationRequest {
   extraTools?: Array<ObservabilityAssistantExtraTool> | undefined;
   maxLlmCalls?: number | undefined;
   maxToolCalls?: number | undefined;
+  // Undefined means no time limit.
   maxWallClockMs?: number | undefined;
   maxOutputTokens?: number | undefined;
 }
@@ -253,6 +267,39 @@ export default class AIInvestigationEngine {
     return this.getProviderOrBalanceReason(projectId);
   }
 
+  /*
+   * How far an investigation of this lane may run: no time limit unless the
+   * project configured one in its Incident / Alert AI settings. Fails open —
+   * a project that cannot be read runs unbounded rather than being cut
+   * short, since the time limit is an opt-in.
+   */
+  public static async getRunLimitsForProject(
+    projectId: ObjectID,
+    subjectType: AISubjectType,
+  ): Promise<AIAgentRunLimits> {
+    try {
+      const project: Project | null = await ProjectService.findOneById({
+        id: projectId,
+        select: {
+          incidentAiInvestigationTimeLimitInMinutes: true,
+          alertAiInvestigationTimeLimitInMinutes: true,
+        },
+        props: { isRoot: true },
+      });
+
+      return AIAgentRunLimitsHelper.fromTimeLimitInMinutes(
+        subjectType === "Alert"
+          ? project?.alertAiInvestigationTimeLimitInMinutes
+          : project?.incidentAiInvestigationTimeLimitInMinutes,
+      );
+    } catch (error) {
+      logger.error(
+        `AI: could not read the investigation time limit for project ${projectId.toString()}; running without one: ${error}`,
+      );
+      return AIAgentRunLimitsHelper.getDefault();
+    }
+  }
+
   /*
    * The half of the gate that is not a switch: a model to call, and AI
    * credits to pay for it. Shared with the other autonomous AI work that
@@ -352,6 +399,14 @@ export default class AIInvestigationEngine {
      */
     let clusterToolCallCount: number = 0;
 
+    /*
+     * The same for the tools that reach an infrastructure resource through
+     * its AI agent (run_infrastructure_command, list_infrastructure_access):
+     * commands on a host, a container engine, a hypervisor, a storage
+     * cluster or a database — never telemetry queries either.
+     */
+    let infrastructureToolCallCount: number = 0;
+
     /*
      * Live narration: persist each LLM/tool step as an AIRunEvent so the UI can
      * "watch it think" by polling the run's events. Best-effort, ordered.
@@ -366,6 +421,13 @@ export default class AIInvestigationEngine {
         clusterToolCallCount++;
       }
 
+      if (
+        step.type === "tool_started" &&
+        isInfrastructureToolName(step.toolName)
+      ) {
+        infrastructureToolCallCount++;
+      }
+
       /*
        * A completed tool call also records the citation it minted (label +
        * deep-link target) and — via toolArguments below — the arguments it
@@ -439,7 +501,8 @@ export default class AIInvestigationEngine {
           }\n\n${request.contextSummary}`,
           maxLlmCalls: request.maxLlmCalls ?? MAX_LLM_CALLS,
           maxToolCalls: request.maxToolCalls ?? MAX_TOOL_CALLS,
-          maxWallClockMs: request.maxWallClockMs ?? MAX_WALL_CLOCK_MS,
+          // Null tells the loop "no time limit" (undefined = its chat default).
+          maxWallClockMs: request.maxWallClockMs ?? null,
           maxOutputTokens: request.maxOutputTokens ?? MAX_OUTPUT_TOKENS,
           onStep,
           extraTools: request.extraTools,
@@ -599,6 +662,7 @@ export default class AIInvestigationEngine {
         result,
         analysis,
         clusterToolCallCount,
+        infrastructureToolCallCount,
       );
 
       await request.postAnalysis({
@@ -863,11 +927,17 @@ export default class AIInvestigationEngine {
    * model's). So a run that made no cluster call posts exactly what it
    * always has, and a run that did writes its telemetry count only when it
    * is not zero.
+   *
+   * Commands on infrastructure resources (run_infrastructure_command) are
+   * counted the same way, as their own "N infrastructure commands run"
+   * part appended only when a run used those tools — so every footer of a
+   * run that did not stays byte-for-byte what it was.
    */
   public static buildBrandedMarkdown(
     result: ObservabilityAssistantResult,
     analysisMarkdown: string,
     clusterToolCallCount: number = 0,
+    infrastructureToolCallCount: number = 0,
   ): string {
     let markdown: string = `## 🧠 AI — Automated Root Cause Analysis\n\n${analysisMarkdown}`;
 
@@ -888,7 +958,7 @@ export default class AIInvestigationEngine {
       }
     }
 
-    if (clusterToolCallCount <= 0) {
+    if (clusterToolCallCount <= 0 && infrastructureToolCallCount <= 0) {
       markdown += `\n\n---\n*Investigated automatically by OneUptime AI — read-only, ${result.toolCallCount} quer${
         result.toolCallCount === 1 ? "y" : "ies"
       } run across your own telemetry${
@@ -900,7 +970,9 @@ export default class AIInvestigationEngine {
 
     const telemetryQueryCount: number = Math.max(
       0,
-      result.toolCallCount - clusterToolCallCount,
+      result.toolCallCount -
+        Math.max(0, clusterToolCallCount) -
+        Math.max(0, infrastructureToolCallCount),
     );
     // Only commands that reached kubectl are cited, so only they are "run".
     const kubectlCommandCount: number = citations.filter(
@@ -926,10 +998,38 @@ export default class AIInvestigationEngine {
       );
     }
 
+    // Only commands that reached a resource are cited, so only they are "run".
+    const infrastructureCommandCount: number = citations.filter(
+      (citation: AIChatCitation): boolean => {
+        return citation.toolName === RUN_INFRASTRUCTURE_COMMAND_TOOL_NAME;
+      },
+    ).length;
+
+    if (infrastructureCommandCount > 0) {
+      counts.push(
+        `${infrastructureCommandCount} infrastructure ${
+          infrastructureCommandCount === 1 ? "command" : "commands"
+        } run on your infrastructure`,
+      );
+    }
+
+    if (counts.length === 0 && infrastructureToolCallCount > 0) {
+      counts.push(
+        clusterToolCallCount > 0
+          ? "no telemetry queries, kubectl commands or infrastructure commands run"
+          : "no telemetry queries or infrastructure commands run",
+      );
+    }
+
     if (counts.length === 0) {
       counts.push("no telemetry queries or kubectl commands run");
     }
 
+    // Three parts read "A, B and C"; one or two read exactly as they always have.
+    if (counts.length > 2) {
+      counts.splice(0, counts.length - 1, counts.slice(0, -1).join(", "));
+    }
+
     markdown += `\n\n---\n*Investigated automatically by OneUptime AI — read-only, ${counts.join(
       " and ",
     )}${
@@ -956,6 +1056,19 @@ export default class AIInvestigationEngine {
       return `${citation.rowCount} cluster(s)`;
     }
 
+    /*
+     * A command on an infrastructure resource: 1 when it completed, 0 when
+     * it ran and the program returned an error; a listing of resources is
+     * the number it listed.
+     */
+    if (citation.toolName === RUN_INFRASTRUCTURE_COMMAND_TOOL_NAME) {
+      return citation.rowCount > 0 ? "succeeded" : "command returned an error";
+    }
+
+    if (citation.toolName === LIST_INFRASTRUCTURE_ACCESS_TOOL_NAME) {
+      return `${citation.rowCount} resource(s)`;
+    }
+
     return null;
   }
 

package/Server/Utils/AI/SRE/AlertInvestigationRunner.ts

@@ -38,9 +38,15 @@ import {
 import { KubernetesClusterAiAccessStatus } from "../../../../Types/Kubernetes/KubernetesClusterAiAccess";
 import KubernetesClusterAiAccessService from "../../../Services/KubernetesClusterAiAccessService";
 import ClusterAccessContext from "../ClusterAccess/ClusterAccessContext";
-import KubectlInvestigationToolkit, {
-  INVESTIGATION_MAX_WALL_CLOCK_MS,
-} from "../ClusterAccess/KubectlInvestigationToolkit";
+import KubectlInvestigationToolkit from "../ClusterAccess/KubectlInvestigationToolkit";
+import ToolOutputPager from "../Chat/ToolOutputPager";
+import AIAgentRunLimitsHelper, {
+  AIAgentRunLimits,
+} from "../../../../Types/AI/AIAgentRunLimits";
+import { ResourceAiAccessStatus } from "../../../../Types/ResourceAiAgent/ResourceAiAccess";
+import ResourceAiAccessService from "../../../Services/ResourceAiAccessService";
+import ResourceAccessContext from "../ResourceAccess/ResourceAccessContext";
+import InfrastructureInvestigationToolkit from "../ResourceAccess/InfrastructureInvestigationToolkit";
 import logger from "../../Logger";
 import CaptureSpan from "../../Telemetry/CaptureSpan";
 
@@ -165,6 +171,7 @@ export default class AIAlertInvestigationRunner {
 
     let contextSummary: string;
     let clusterStatuses: Array<KubernetesClusterAiAccessStatus> = [];
+    let resourceStatuses: Array<ResourceAiAccessStatus> = [];
     try {
       const contextData: AlertContextData =
         await AlertAIContextBuilder.buildAlertContext({
@@ -192,6 +199,29 @@ export default class AIAlertInvestigationRunner {
 
       contextSummary +=
         ClusterAccessContext.buildContextSection(clusterStatuses);
+
+      /*
+       * Direct infrastructure access (Docker, Podman, Swarm, Proxmox,
+       * VMware, Ceph, databases, hosts) through their resource AI agents.
+       * Enrichment only, like cluster access, and on its own: losing it
+       * never fails the investigation nor takes the cluster access away.
+       */
+      try {
+        const statuses: Array<ResourceAiAccessStatus> =
+          await ResourceAiAccessService.getStatusesForSubject({
+            projectId,
+            alertId,
+          });
+        const section: string =
+          ResourceAccessContext.buildContextSection(statuses);
+
+        resourceStatuses = statuses;
+        contextSummary += section;
+      } catch (error) {
+        logger.error(
+          `AI: could not resolve infrastructure access for alert ${alertId.toString()}; investigating it with OneUptime data only: ${error}`,
+        );
+      }
     } catch (error) {
       /*
        * Context assembly failed — the run is claimed, so hand it to the
@@ -220,13 +250,19 @@ export default class AIAlertInvestigationRunner {
     }
 
     /*
-     * The run's wall clock, stated once: the engine enforces it between
-     * tool calls and the kubectl toolkit plans every command's wait to end
-     * before it, so a run_kubectl issued late in the run cannot outlive the
-     * budget (the loop cannot interrupt a tool once it is running).
+     * How far the run may go, stated once: no time limit unless the project
+     * configured one. When it did, the engine enforces it between tool
+     * calls and the command toolkits plan every command's wait to end
+     * before it, so a command issued late in the run cannot outlive it (the
+     * loop cannot interrupt a tool once it is running).
      */
-    const runDeadlineAtMs: number =
-      Date.now() + INVESTIGATION_MAX_WALL_CLOCK_MS;
+    const runLimits: AIAgentRunLimits =
+      await AIInvestigationEngine.getRunLimitsForProject(projectId, "Alert");
+    const runDeadlineAtMs: number | undefined =
+      AIAgentRunLimitsHelper.getDeadlineAtMs(runLimits, Date.now());
+
+    // One pager for the run, so read_tool_output reads every toolkit's output.
+    const outputPager: ToolOutputPager = new ToolOutputPager();
 
     const kubectlToolkit: KubectlInvestigationToolkit =
       new KubectlInvestigationToolkit({
@@ -234,10 +270,59 @@ export default class AIAlertInvestigationRunner {
         aiRunId,
         clusters: clusterStatuses,
         runDeadlineAtMs,
+        outputPager,
       });
     const extraTools: Array<ObservabilityAssistantExtraTool> =
       kubectlToolkit.buildTools();
 
+    /*
+     * The infrastructure tools, bound to the same run and deadline. Built
+     * on their own so a failure here leaves the kubectl tools (and the
+     * run) as they are.
+     */
+    let resourceAddendum: string = "";
+
+    try {
+      const infrastructureToolkit: InfrastructureInvestigationToolkit =
+        new InfrastructureInvestigationToolkit({
+          projectId,
+          aiRunId,
+          resources: resourceStatuses,
+          runDeadlineAtMs,
+          outputPager,
+        });
+      const infrastructureTools: Array<ObservabilityAssistantExtraTool> =
+        infrastructureToolkit.buildTools();
+
+      resourceAddendum =
+        resourceStatuses.length > 0
+          ? ResourceAccessContext.buildPersonaAddendum(resourceStatuses)
+          : "";
+      extraTools.push(...infrastructureTools);
+    } catch (error) {
+      logger.error(
+        `AI: could not offer infrastructure access for alert ${alertId.toString()}; investigating it with OneUptime data only: ${error}`,
+      );
+    }
+
+    // Long command output is paged, never cut: offer the reader with the commands.
+    if (extraTools.length > 0) {
+      extraTools.push(outputPager.buildReadTool());
+    }
+
+    // The cluster rules first, exactly as before; the infrastructure rules after.
+    const additionalInstructions: Array<string> = [];
+
+    if (clusterStatuses.length > 0) {
+      additionalInstructions.push(
+        ClusterAccessContext.buildPersonaAddendum(clusterStatuses),
+      );
+    }
+
+    if (resourceAddendum) {
+      additionalInstructions.push(resourceAddendum);
+    }
+
     await AIInvestigationEngine.executeRun({
       aiRunId,
       projectId,
@@ -247,12 +332,11 @@ export default class AIAlertInvestigationRunner {
         feature: AI_ALERT_INVESTIGATION_FEATURE,
         alertId,
         contextSummary,
-        maxWallClockMs: INVESTIGATION_MAX_WALL_CLOCK_MS,
-        ...(clusterStatuses.length > 0
-          ? {
-              additionalInstructions:
-                ClusterAccessContext.buildPersonaAddendum(clusterStatuses),
-            }
+        maxLlmCalls: runLimits.maxLlmCalls,
+        maxToolCalls: runLimits.maxToolCalls,
+        maxWallClockMs: runLimits.maxWallClockMs,
+        ...(additionalInstructions.length > 0
+          ? { additionalInstructions: additionalInstructions.join("\n\n") }
           : {}),
         ...(extraTools.length > 0 ? { extraTools } : {}),
         persistCodeFixRecommendation: true,

package/Server/Utils/AI/SRE/IncidentInvestigationRunner.ts

@@ -40,9 +40,15 @@ import {
 import { KubernetesClusterAiAccessStatus } from "../../../../Types/Kubernetes/KubernetesClusterAiAccess";
 import KubernetesClusterAiAccessService from "../../../Services/KubernetesClusterAiAccessService";
 import ClusterAccessContext from "../ClusterAccess/ClusterAccessContext";
-import KubectlInvestigationToolkit, {
-  INVESTIGATION_MAX_WALL_CLOCK_MS,
-} from "../ClusterAccess/KubectlInvestigationToolkit";
+import KubectlInvestigationToolkit from "../ClusterAccess/KubectlInvestigationToolkit";
+import ToolOutputPager from "../Chat/ToolOutputPager";
+import AIAgentRunLimitsHelper, {
+  AIAgentRunLimits,
+} from "../../../../Types/AI/AIAgentRunLimits";
+import { ResourceAiAccessStatus } from "../../../../Types/ResourceAiAgent/ResourceAiAccess";
+import ResourceAiAccessService from "../../../Services/ResourceAiAccessService";
+import ResourceAccessContext from "../ResourceAccess/ResourceAccessContext";
+import InfrastructureInvestigationToolkit from "../ResourceAccess/InfrastructureInvestigationToolkit";
 import logger from "../../Logger";
 import CaptureSpan from "../../Telemetry/CaptureSpan";
 
@@ -334,6 +340,7 @@ export default class AIIncidentInvestigationRunner {
 
     let contextSummary: string;
     let clusterStatuses: Array<KubernetesClusterAiAccessStatus> = [];
+    let resourceStatuses: Array<ResourceAiAccessStatus> = [];
     try {
       const contextData: IncidentContextData =
         await IncidentAIContextBuilder.buildIncidentContext({
@@ -380,6 +387,29 @@ export default class AIIncidentInvestigationRunner {
 
       contextSummary +=
         ClusterAccessContext.buildContextSection(clusterStatuses);
+
+      /*
+       * Direct infrastructure access (Docker, Podman, Swarm, Proxmox,
+       * VMware, Ceph, databases, hosts) through their resource AI agents.
+       * Enrichment only, like cluster access, and on its own: losing it
+       * never fails the investigation nor takes the cluster access away.
+       */
+      try {
+        const statuses: Array<ResourceAiAccessStatus> =
+          await ResourceAiAccessService.getStatusesForSubject({
+            projectId,
+            incidentId,
+          });
+        const section: string =
+          ResourceAccessContext.buildContextSection(statuses);
+
+        resourceStatuses = statuses;
+        contextSummary += section;
+      } catch (error) {
+        logger.error(
+          `AI: could not resolve infrastructure access for incident ${incidentId.toString()}; investigating it with OneUptime data only: ${error}`,
+        );
+      }
     } catch (error) {
       /*
        * Context assembly failed — the run is claimed, so hand it to the
@@ -408,13 +438,19 @@ export default class AIIncidentInvestigationRunner {
     }
 
     /*
-     * The run's wall clock, stated once: the engine enforces it between
-     * tool calls and the kubectl toolkit plans every command's wait to end
-     * before it, so a run_kubectl issued late in the run cannot outlive the
-     * budget (the loop cannot interrupt a tool once it is running).
+     * How far the run may go, stated once: no time limit unless the project
+     * configured one. When it did, the engine enforces it between tool
+     * calls and the command toolkits plan every command's wait to end
+     * before it, so a command issued late in the run cannot outlive it (the
+     * loop cannot interrupt a tool once it is running).
      */
-    const runDeadlineAtMs: number =
-      Date.now() + INVESTIGATION_MAX_WALL_CLOCK_MS;
+    const runLimits: AIAgentRunLimits =
+      await AIInvestigationEngine.getRunLimitsForProject(projectId, "Incident");
+    const runDeadlineAtMs: number | undefined =
+      AIAgentRunLimitsHelper.getDeadlineAtMs(runLimits, Date.now());
+
+    // One pager for the run, so read_tool_output reads every toolkit's output.
+    const outputPager: ToolOutputPager = new ToolOutputPager();
 
     const kubectlToolkit: KubectlInvestigationToolkit =
       new KubectlInvestigationToolkit({
@@ -422,10 +458,59 @@ export default class AIIncidentInvestigationRunner {
         aiRunId,
         clusters: clusterStatuses,
         runDeadlineAtMs,
+        outputPager,
       });
     const extraTools: Array<ObservabilityAssistantExtraTool> =
       kubectlToolkit.buildTools();
 
+    /*
+     * The infrastructure tools, bound to the same run and deadline. Built
+     * on their own so a failure here leaves the kubectl tools (and the
+     * run) as they are.
+     */
+    let resourceAddendum: string = "";
+
+    try {
+      const infrastructureToolkit: InfrastructureInvestigationToolkit =
+        new InfrastructureInvestigationToolkit({
+          projectId,
+          aiRunId,
+          resources: resourceStatuses,
+          runDeadlineAtMs,
+          outputPager,
+        });
+      const infrastructureTools: Array<ObservabilityAssistantExtraTool> =
+        infrastructureToolkit.buildTools();
+
+      resourceAddendum =
+        resourceStatuses.length > 0
+          ? ResourceAccessContext.buildPersonaAddendum(resourceStatuses)
+          : "";
+      extraTools.push(...infrastructureTools);
+    } catch (error) {
+      logger.error(
+        `AI: could not offer infrastructure access for incident ${incidentId.toString()}; investigating it with OneUptime data only: ${error}`,
+      );
+    }
+
+    // Long command output is paged, never cut: offer the reader with the commands.
+    if (extraTools.length > 0) {
+      extraTools.push(outputPager.buildReadTool());
+    }
+
+    // The cluster rules first, exactly as before; the infrastructure rules after.
+    const additionalInstructions: Array<string> = [];
+
+    if (clusterStatuses.length > 0) {
+      additionalInstructions.push(
+        ClusterAccessContext.buildPersonaAddendum(clusterStatuses),
+      );
+    }
+
+    if (resourceAddendum) {
+      additionalInstructions.push(resourceAddendum);
+    }
+
     await AIInvestigationEngine.executeRun({
       aiRunId,
       projectId,
@@ -435,12 +520,11 @@ export default class AIIncidentInvestigationRunner {
         feature: AI_INCIDENT_INVESTIGATION_FEATURE,
         incidentId,
         contextSummary,
-        maxWallClockMs: INVESTIGATION_MAX_WALL_CLOCK_MS,
-        ...(clusterStatuses.length > 0
-          ? {
-              additionalInstructions:
-                ClusterAccessContext.buildPersonaAddendum(clusterStatuses),
-            }
+        maxLlmCalls: runLimits.maxLlmCalls,
+        maxToolCalls: runLimits.maxToolCalls,
+        maxWallClockMs: runLimits.maxWallClockMs,
+        ...(additionalInstructions.length > 0
+          ? { additionalInstructions: additionalInstructions.join("\n\n") }
           : {}),
         ...(extraTools.length > 0 ? { extraTools } : {}),
         persistCodeFixRecommendation: true,

package/Server/Utils/AI/SRE/InvestigationQueue.ts

@@ -52,8 +52,8 @@ export const MAX_INVESTIGATION_ATTEMPTS: number = 2;
 
 /*
  * G4 cost guardrail: at most this many investigations may be Running in an
- * incident, alert or subjectless lane at once. Each lane has its own project
- * override; subjectless work keeps Project.aiMaxConcurrentInvestigations.
+ * incident, alert or subjectless lane at once. The incident and alert lanes
+ * have their own project override; subjectless work always uses the default.
  * Enforced at CLAIM time, so a storm queues (bounded by dedupe + severity
  * gates + this TTL) and drains at cap rate instead of being dropped.
  */
@@ -633,25 +633,22 @@ export default class AIInvestigationQueue {
 
     /*
      * Each subject lane owns its own concurrency pool. Insight triage and any
-     * future subjectless queue work retain the legacy project-wide fallback.
+     * future subjectless queue work use the default cap.
      */
-    const project: Project | null = await ProjectService.findOneById({
-      id: run.projectId,
-      select: {
-        aiMaxConcurrentInvestigations: true,
-        incidentAiMaxConcurrentInvestigations: true,
-        alertAiMaxConcurrentInvestigations: true,
-      },
-      props: { isRoot: true },
-    });
-
-    let configuredConcurrencyCap: number | undefined =
-      project?.aiMaxConcurrentInvestigations;
+    let configuredConcurrencyCap: number | undefined = undefined;
+
+    if (run.triggeredByIncidentId || run.triggeredByAlertId) {
+      const project: Project | null = await ProjectService.findOneById({
+        id: run.projectId,
+        select: run.triggeredByIncidentId
+          ? { incidentAiMaxConcurrentInvestigations: true }
+          : { alertAiMaxConcurrentInvestigations: true },
+        props: { isRoot: true },
+      });
 
-    if (run.triggeredByIncidentId) {
-      configuredConcurrencyCap = project?.incidentAiMaxConcurrentInvestigations;
-    } else if (run.triggeredByAlertId) {
-      configuredConcurrencyCap = project?.alertAiMaxConcurrentInvestigations;
+      configuredConcurrencyCap = run.triggeredByIncidentId
+        ? project?.incidentAiMaxConcurrentInvestigations
+        : project?.alertAiMaxConcurrentInvestigations;
     }
 
     const concurrencyCap: number = Math.min(