diff --git a/agents.md b/agents.md index 9e852756..6a37b9d6 100644 --- a/agents.md +++ b/agents.md @@ -72,19 +72,21 @@ This is a **migration, not a cleanup**, and it's a separate PR: 20 inbound links * Auth methods, categories, and integration names are catalog data. As of 2026-08 the catalog has **no OAuth integrations at all** (580 `apiKey`, 56 `basicAuth`, 6 keyless) — so don't document an auth method just because the UI has a code path for it. * **A count column can become a navigation surface.** The Integrations Management table's "Used by" cell went from a plain hover tooltip to a real button opening a modal with links onward (ORIONIQ-1585). The invocation drawer got the reverse links the same week (ORIONIQ-1613: Agent definition / Agent invocations from a run, View invocations from the agent form). When either the Integrations or Agents Hub surface changes, check whether it added or removed a cross-link to the other — these two features shipped independently but both close the same kind of "you can get there but not back" gap. * **A per-connector secret's required/optional-ness is catalog depth, not something this repo documents** — same bucket as per-connector operation coverage (2026-09-02 PagerDuty) and credential-field renames (2026-09-05 Salesforce). `oiq-resources`#94 made the Slack `slack_user_token` optional, then a same-day follow-up commit reverted just that part (connection saves broke — `type_to_required_secrets` in `ai_backend`'s loader isn't wired to `optional_secrets` yet, so a provided-but-optional secret is rejected as unexpected). Neither direction touched this repo: it doesn't document per-integration required-secret lists, only the top-level `auth` bucket shape, which never changed. +* **`alert-digest` (and now `alert-tuning-report`) keep landing on `oiq-resources` `main` and getting reverted same-day.** 2026-08-13→09-08: `alert-digest` alone, added then reverted. 2026-09-17: both templates added together (PR #97) and both reverted ~5 minutes after merge, no stated reason either time. As of 2026-09-17 neither has stayed merged, so `marketplace.md`'s 5-template list is still accurate — don't treat a same-day merge of either as live without checking `marketplace/templates/` on `main` afterward. `Artemis` has already pre-wired billing config for both agent types ahead of either shipping for real (`orioniq-be`'s `AlertDigest`/`AlertTuningReport` pricing, PR #290, 2026-09-17) — that config is inert, not evidence the templates are live. ## Shipped in code but NOT in the product — do not document An endpoint existing in `public.routes.ts` is not proof a feature is available to customers. Check for a UI before documenting it, and when in doubt ask the feature's owner. -* **Agent lessons** (`GET /v2/ai-agent/:agentId/lessons`, `PUT .../lessons/:lessonId/status`, ORIONIQ-1491 / ORIONIQ-1144). The endpoints are live and the backend learns from feedback, but there is **no lessons UI anywhere** in `Artemis` or `app-ui`, and rollout is gated per account. Documented in the first run and removed on review. Document it when the UI lands. -* The in-app API reference (`Artemis` `apps/orioniq/.../AgentEdit/api-endpoints.ts`) is a good signal here: it lists what the product actually exposes, and it did **not** list the lessons endpoints. +* ~~**Agent lessons**~~ — **closed 2026-09-22.** `Artemis`#333 (ORIONIQ-1670) shipped the Learning section in the agent edit form and flipped `learn_from_feedback` to on-by-default. Documented in `create-agent.md` (new "Learning" section) and cross-linked from `agents-hub.md`'s feedback paragraph. Left here as the worked example of the rule: an endpoint existing in `public.routes.ts`/`ai.routes.ts` is not proof of a customer-visible feature — check for a UI before documenting, and revisit once one lands, as happened here after ~4 weeks (first flagged 2026-08-27). +* The in-app API reference (`Artemis` `apps/orioniq/.../AgentEdit/api-endpoints.ts`) is a good signal here: it lists what the product actually exposes. ## Known gaps not yet documented * **OrionIQ chat** has no page in this repo. Chat renaming, the server-owned chat-mode registry (Fast / Advanced), conversation history, stopping an in-flight run, and legacy AI Assistant history all shipped in the 3 months to 2026-08-27. The blocker is scope, not evidence: the chat renders in two surfaces (the Open 360 drawer and the OrionIQ standalone app) and it isn't clear which nav path the docs should describe. Confirm with the team before writing it. ⚠️ **This got more urgent on 2026-09-09/10.** `gaia-hermes-ws`#17045 (ORIONIQ-1625, A7) deleted the legacy pre-OrionIQ "AI Copilot" bedrock chat from `app-ui` entirely — not superseded, gone. `docs/open360/observability/assistantiq.md` ("AI Agent") describes exactly that deleted UI: a History button, a pencil icon to start a new conversation, pre-built questions, chat history review. The entry points it documents (Explore / Kubernetes 360 / APM) still open a chat, but it's now unconditionally the OrionIQ chat drawer (`OrionIqButton` → `Open360OrionChat`, per `gaia-hermes-ws`#17041), whose actual UI/copy this repo has never described. This is no longer "a gap in what's covered" — it's a live page whose walkthrough no longer matches any UI a customer can reach. Still not fixed here: it's the exact page the AI docs refactor above is scoped to move/rewrite, and a narrow patch risks reintroducing the "invented content" class of error PR #960's reviewers already flagged (this bot doesn't have verified copy for the new drawer's History/new-conversation equivalents). Flagged in the PR description for a human to prioritize the refactor; do not patch piecemeal in a daily sync. ⚠️ **A second feature landed on the same undocumented surface, 2026-09-10.** `Artemis`#278 (ORIONIQ-1393/1480) shipped the composer's "next question" ghost-text suggestion — the UI/BFF half of the chain the 2026-09-10 run log entry said to recheck once it merged (`OIQ-AI-service`#476 backend → `gaia-hermes-ws`#17048 analytics registration → this). It's a real, user-visible chat-composer behavior (ghost text, a `Tab`-to-accept hint, four analytics events) and it still has nowhere to live: same blocker as the line above, not a new one. Not documented for the same reason — writing it up means either inventing a new OrionIQ-chat page ahead of the team's nav decision or patching `assistantiq.md`, which is the exact piecemeal mistake already flagged. Two shipped features now stacked on this one blocker; worth someone prioritizing the scope call soon. + ⚠️ **Escalated again, 2026-09-22→23.** `Artemis`#336 (ORIONIQ-1393: a shared `Pulse` DS primitive, a `⇥` Tab-hint on the suggestion, and the suggestion becoming persisted conversation data so it survives a remount) and `Artemis`#351 (ORIONIQ-1480 follow-up: the suggestion now takes up to two lines instead of one) shipped on the standalone chat. Then `gaia-hermes-ws`#17095 (same ticket) offered the SAME suggestion in the **Open 360 drawer** for the first time — previously standalone-chat only — bumping `app-ui` to `@logzio/artemis-orion-chat@3.0.0`. That drawer is exactly the surface `assistantiq.md` already (mis)describes, so the page is no longer just stale on deleted UI — it's now also silent about a real, shipped affordance on the one surface it claims to cover. Three shipped iterations now stacked on this single blocker, spanning two surfaces; still not patched piecemeal here for the same reason as the two entries above, but the scope call gets more overdue each cycle this stacks. * **Mobile push notifications** for finished agent runs (ORIONIQ-1463/1464) are undocumented. * **OrionIQ for SIEM** (ORIONIQ-622) is undocumented. * **Agent audit log** provenance columns (ORIONIQ-1531) are undocumented; unclear whether the audit log is customer-visible. @@ -96,6 +98,8 @@ The bot's instructions say to post the PR link immediately, then **edit that sam Until an edit-capable tool is added, the practical fallback is a threaded reply on the original notification with the preview link once it lands (clearly worse than an edit, but better than leaving the team without the link at all) — note this deviation explicitly when it happens rather than silently substituting it. Confirmed still the case on 2026-09-10 — same tool list, no edit method. +**Refinement, 2026-09-22:** this bot doesn't post a notification just because a PR exists — only when the PR carries a real doc-content change or a genuinely new blocker. #968 sat open five days (2026-09-17 through 2026-09-21) with zero Slack activity for exactly this reason; the first post went out only once real content landed. When the preview link is already live by the time that first post is due (as it was here — Netlify had commented days earlier), post it inline immediately; the "edit vs. reply" problem above only bites when the link lands *after* the first post. + ## Run log ### 2026-08-27 — initial run, 3 months of history (since 2026-05-27) @@ -308,7 +312,7 @@ No PR opened this run; folded into the still-open #967, which needed no content ### 2026-09-14 — daily scan (since 2026-09-13), no additional doc changes -Checked #967 first for unresolved reviewer feedback per the "address comments first" rule — still none (only the Netlify bot's deploy-preview comment, zero reviews); both check runs (`PR validation`, Netlify deploy preview) are green on the current head, `mergeable_state` still `blocked` on pending review, not on anything this bot can act on. +Checked #967 first for unresolved reviewer feedback per the "address comments first" rule — still none (only the Netlify bot's deploy-preview comment, zero reviews); both check runs (`PR validation`, Netlify deploy preview) are green on the current head, `mergeable_state` are green on the current head, `mergeable_state` is still `blocked` on pending review, not on anything this bot can act on. Scanned commits merged to each repo's default branch since the last run: @@ -347,7 +351,7 @@ Checked #967 first for unresolved reviewer feedback per the "address comments fi Scanned commits merged to each repo's default branch since the last run: * `Artemis` (`main`) — 5 commits: - * **#304** (galangel, "let agent-runs/search return only the fields a caller needs") — a payload/query-cost optimization on `POST /orioniq-be/agent-runs/search`. Checked `orion-iq.routes.ts`: this route is registered in the BFF route table, not `ai.routes.ts` (the customer-callable list this repo's `api.md` tracks) — confirmed by the PR's own "Not in this PR" section, which names Artemis web (unchanged, sends no `fields`) and OrionIQ Mobile (a separate repo, outside this scan) as the only callers. Additive `fields` allow-list, no response-shape change for an existing caller, no route added or removed. **No doc change.** + * **#304** (galangel, "let agent-runs/search return only the fields a caller needs") — a payload/query-cost optimization on `POST /orioniq-be/agent-runs/search`. Checked `orion-iq.routes.ts`: this route is registered in the BFF route table, not `ai.routes.ts` (the customer-callable table `api.md` tracks) — confirmed by the PR's own "Not in this PR" section, which names Artemis web (unchanged, sends no `fields`) and OrionIQ Mobile (a separate repo, outside this scan) as the only callers. Additive `fields` allow-list, no response-shape change for an existing caller, no route added or removed. **No doc change.** * **#288** (RoyiSitbon) — consolidates the three mesh services' vendored `@logz-pkg` tarballs into one shared, version-named root `vendor/` plus a weekly gaia-sync job. Build/deploy infra only, no product-surface change. RoyiSitbon is already an assignee from the 2026-09-15 entry above. * **#279** (amir-noyman) — replaces `MenuItem`'s inheritance from `Button` with a shared, unstyled `Pressable` primitive, so a future `Button` layout change can't re-centre every menu row again. A design-system component fix (no route, schema, or copy change, and no OrionIQ-specific behavior) — this repo doesn't document Artemis's internal component library. No doc change, no assignee action. * `#306`, `#305` — `chore: version packages`, no code. @@ -358,3 +362,352 @@ Scanned commits merged to each repo's default branch since the last run: Doc changes made: none — the one in-scope commit (#304) is an internal BFF optimization with no customer-visible surface change. PR #967 updated (not opened new): body left as-is — no content to add. Assignees updated to add galangel (author of #304, the one Artemis commit this cycle that touches `orioniq-be` and was reviewed for scope), alongside the existing RoyiSitbon, yotamloe, Gavriel-M. No new Slack notification sent — nothing here is new information for the team beyond what #967's thread already carries. + +### 2026-09-17 — daily scan (since 2026-09-16), no doc changes + +No agent PR was open at scan time — #967 merged 2026-09-16T08:45:50Z (merge commit `3b821d8`). This is a memory-only PR: nothing here needed a doc content change, so there is nothing to fold in and nothing new to open a content PR for. Recorded anyway per the "maintain agents.md every run" rule, so the recheck flags below survive to the next cycle. + +Scanned commits merged to each repo's default branch since the last run: + +* `Artemis` (`main`) — 18 commits, none needing a doc change: + * **#307** (galangel, ORIONIQ-1656) — moves the new-chat "For you" suggestion cards from a client-driven Bedrock call to a server-owned `POST /orioniq-be/generate/chat-suggestions`. Confirmed via `orion-iq-generate.routes.ts` and `ROUTES.md`: registered alongside `orion-iq-analytics/identify-*`, not in `ai.routes.ts` (the customer-callable table `api.md` tracks) — internal/BFF, same class as prior analytics-registration commits this log has already skipped. Also deprecates (does not remove) `POST /services/bedrock-ai`; removal is tracked on ORIONIQ-1657 — recheck then. **No doc change.** + * **#328** (Gavriel-M, ORIONIQ-1660) — the rail logo now opens a workspace flyout (Open 360 AI / Cloud SIEM / OrionIQ), fixing a one-way door out of OrionIQ, plus a dark-theme contrast fix and a drag-floor bump. Real, fully-shipped UI, but it's cross-product nav chrome — same category as the 2026-09-11 sidenav account-selector (#276) and 2026-09-09 sidenav scroll-fade (#215) calls, both "no doc change." Applied the same standard here. + * The rest: vendor-sync / weekly-job CI fixes (#319, #316, #314, #288), `chore: version packages` ×6, test-only changes (#325, #323), a `serve:mesh` script fix (#310), and a deploy gate on the onboarding survey (#308) — infra/tooling, no product surface. +* `OIQ-AI-service` (`main`) — 2 commits, both backend-only, neither reachable by a customer: + * **#472** (kevkle, ORIONIQ-1500) — adds the OIHV hypothesize stage; `spec.profile` enum gains `"oihv"` (contract 3.9.0 → 3.10.0, additive). Confirmed flag-gated (`RCA_OIHV_SUPERGRAPH_ENABLED`) and set only by this repo's own `oihv-escalation-snapshot` tooling (`request_models.py`: "'oihv' selects the OIHV supergraph (flag-gated)"). No caller in `Artemis` or `gaia-hermes-ws` sets it. **Not documented** — same "shipped in code, not in the product" shape as the 2026-08-31/09-07/09-09 entries. + * **#478** (augment770-dev, ORIONIQ-1620) — new `spec.knowledgeBase.accountDocs` field lets a request grant per-file read/read-write access to the account's knowledge-base documents (contract 3.8.0 → 3.9.0, additive). The PR's own "Agent builder" section says the grant is meant to be authored by the Agent Builder, but no `Artemis` commit in this or any prior scanned window adds a UI for it, and `api.md`'s documented `context.*` request fields don't include a `spec` object at all. **Not documented — recheck once an Artemis Agent Builder PR surfaces it.** +* `gaia-hermes-ws` (`master`) — 8 commits, 7 out of OrionIQ scope (APPZ-3369/3367/3368/3326/3361/3004/3356 — SIEM Summary, Data Hub Metrics, OSD deep links, Pendo removal). The 8th, **ORIONIQ-1625** (#17070, Gavriel-M), is further cleanup of already-dead legacy-chat leftovers (dead locals, stale e2e assertions) that the 2026-09-09/10 entries already logged as removed; it also fixes an unrelated pre-existing bug in the Explore exceptions-search dictionary join, which is not an OrionIQ surface. **No doc change.** +* `oiq-resources` (`main`) — zero commits since 2026-09-09. + +No PR opened for doc content — nothing here needs one. No new Slack notification sent — nothing here is new information for the team. + +### 2026-09-18 — daily scan (since 2026-09-17 06:15), no doc changes + +Checked #968 first for unresolved reviewer feedback per the "address comments first" rule — none (only the Netlify bot's deploy-preview comment, zero reviews); `mergeable_state` is `blocked` (pending required review/approval, not a check failure — nothing for this bot to fix). + +Scanned commits merged to each repo's default branch since the last run: + +* `Artemis` (`main`) — 7 commits: + * **#290** (ralongit, ORIONIQ-1304/1377) — `feat(orioniq-be): price the Alert Digest and Alert Tuning Report agents`. Adds billing/cap pricing (`AlertDigest`: $2, `AlertTuningReport`: $8, product id 100) to `apps/orioniq-be/src/config.js`. Backend-only pricing table — see the `oiq-resources` line below: both agent types' marketplace templates were merged *and* reverted the same morning, so there is nothing customer-visible to price yet. The config is now pre-wired for whenever (if) either template lands and stays merged. **No doc change.** + * **#334** (RoyiSitbon) — `fix(orioniq): the schedule dropdowns open where they can be seen` — a positioning/overflow fix on the scheduling UI. This repo doesn't describe dropdown placement at that level of detail. **No doc change.** + * **#327** (amir-noyman) — `fix(orioniq): the settings tabs read as one surface` — visual grouping fix on the Settings page tabs. **No doc change.** + * **#331** (RoyiSitbon) — `test(orioniq): live within the tenant's secret-version write budget` — test-only. **No doc change.** + * **#332** (amir-noyman) and **#326** (amir-noyman) — Artemis design-system fixes (`MenuItem` control-scale alignment; a progress-bar surface token). Not OrionIQ-scoped at all — this repo doesn't document Artemis's internal component library, same standard as the 2026-09-16 `#279`/MenuItem-Pressable entry. **No doc change, no assignee action.** + * `chore: version packages` — no code. +* `OIQ-AI-service` (`main`) — 1 commit, **#483** (kevkle) — `docs(skills): rewrite the oihv reasoning audit, resync the RCA status surfaces`. Rewrites this repo's own internal Claude-skill and RCA-operational-memory files (`.claude/`, `docs/design_decisions/`) — no route, schema, or runtime behavior change reachable by a customer. **No doc change.** +* `gaia-hermes-ws` (`master`) — 3 commits, all out of OrionIQ scope: `APPZ-3376` (Unified Dashboards / Perses router navigation bug), `APPZ-3363` (service worker reload behavior), `APPZ-3331` (AI Observability trace-waterfall summary header — AI Observability is the separate Jaeger/OpenSearch trace viewer, out of scope per the standing filter rule applied every prior cycle it's come up). +* `oiq-resources` (`main`) — 3 commits, net **zero** catalog change, but a pattern worth flagging: + * PR #97 (ralongit) merged both `alert-digest.json` and `alert-tuning-report.json` marketplace templates onto `main` at 09:06, then `ralongit` reverted the merge at 09:08 — five minutes later, no stated reason in either commit. Live catalog is unchanged from what `marketplace.md` already reflects (5 templates; confirmed against `marketplace/templates/` at the post-revert head — neither file is present). + * This is the **second** time `alert-digest` specifically has been merged to `main` and reverted same-day (first: PR #81 on 2026-09-08, already logged in the 2026-09-09 entry). `alert-tuning-report`'s own dedicated main-track PR (#83) has been open, unmerged, since 2026-08-13, separate from today's combined add/revert. + * **No doc change** (nothing live to document) — but see the new "Recurring documentation patterns" bullet below; this is now a repeating shape, not a one-off, and it's what produced the orphaned Artemis pricing config noted above. + +No PR opened for doc content — nothing here needs one. Assignee added to #968: **ralongit** (author of the one in-scope Artemis commit, #290, and of the oiq-resources add/revert audited above), joining no prior assignees (#968 had none). No new Slack notification sent, consistent with this bot's standing practice of only notifying the team when a doc-content change lands or a genuinely new blocker needs their attention — neither is true this cycle. + +### 2026-09-19 — daily scan (since 2026-09-18 06:21), no doc changes + +Checked #968 first for unresolved reviewer feedback per the "address comments first" rule — still none (only the Netlify bot's deploy-preview comment, zero reviews). The Netlify deploy preview is live: https://deploy-preview-968--deluxe-empanada-3ebf3b.netlify.app. + +Scanned commits merged to each repo's default branch since the last run: + +* `Artemis` (`main`) — zero commits. Confirmed by checking the latest commit on `main` directly (`chore: version packages` #329, 2026-09-17T12:35), not just an empty windowed query. +* `OIQ-AI-service` (`main`) — zero commits. +* `oiq-resources` (`main`) — zero commits. Latest commit on `main` is still the 2026-09-17 09:08 revert of PR #97 (the alert-digest/alert-tuning-report add-and-revert already logged in the 2026-09-18 entry) — nothing new. +* `gaia-hermes-ws` (`master`) — 5 commits, all out of OrionIQ scope: **APPZ-2883** (restores OSD asset uploads to NetStorage on master deploys — CDN/deploy plumbing for Unified Dashboards, not OrionIQ), **APPZ-3336** and **APPZ-3334** (AI Observability: export conversation to markdown, and alias-name translation in filters/smart search — AI Observability is the separate Jaeger/OpenSearch trace-tracing product, out of scope per the standing filter rule applied every prior cycle it's come up), **APPZ-3346** (SPIKE: cursor-movement stutter fix on Unified Dashboards/Perses panels), **APPZ-3374** (import-preview panel sizing on Unified Dashboards). None touch `app-ai` or any OrionIQ-facing surface. + +Doc changes made: none — nothing in scope merged anywhere in the window. + +No PR opened for doc content — nothing here needs one. No assignee change to #968 — no new in-scope commit, so no new author to add. No new Slack notification sent, consistent with this bot's standing practice of only notifying the team when a doc-content change lands or a genuinely new blocker needs their attention — neither is true this cycle. + +### 2026-09-20 — daily scan (since 2026-09-19), no doc changes + +Checked #968 first for unresolved reviewer feedback per the "address comments first" rule — still none (only the Netlify bot's deploy-preview comment, zero reviews); the Netlify deploy preview is still live: https://deploy-preview-968--deluxe-empanada-3ebf3b.netlify.app. + +Scanned commits merged to each repo's default branch since the last run: + +* `Artemis` (`main`) — zero commits. Latest commit on `main` is still `chore: version packages` #329, 2026-09-17T12:35 (unchanged since the 2026-09-19 entry). +* `OIQ-AI-service` (`main`) — zero commits. Latest commit on `main` is still #483 (kevkle), 2026-09-17T08:21 (already logged in the 2026-09-18 entry). +* `oiq-resources` (`main`) — zero commits. Latest commit on `main` is still the 2026-09-17 09:08 revert of PR #97 (already logged in the 2026-09-18 entry). +* `gaia-hermes-ws` (`master`) — zero commits. Latest commit on `master` is still `c80fa52` (APPZ-2883), 2026-09-18T13:26 — the same 5-commit batch already logged and dismissed as out-of-scope in the 2026-09-19 entry. + +Checked directly against each repo's raw (unwindowed) commit history, not just the windowed query, so an empty result here isn't a scan-window bug — three of the four repos simply haven't merged anything since 2026-09-17, and `gaia-hermes-ws` hasn't since 2026-09-18T13:26. + +Doc changes made: none — nothing merged anywhere in the window. + +No PR opened for doc content — nothing here needs one. No assignee change to #968 — no new in-scope commit, so no new author to add. No new Slack notification sent, consistent with this bot's standing practice of only notifying the team when a doc-content change lands or a genuinely new blocker needs their attention — neither is true this cycle. + +This is now a third straight quiet cycle across the whole scan surface (2026-09-18's flurry, then 2026-09-19 and 2026-09-20 both fully empty) — worth a human glance in case it reflects a real slowdown rather than coincidence, but nothing here indicates a bot/tooling problem. + +### 2026-09-21 — daily scan (since 2026-09-20), no doc changes + +Checked #968 first for unresolved reviewer feedback per the "address comments first" rule — still none (only the Netlify bot's deploy-preview comment, zero reviews); the Netlify deploy preview is still live: https://deploy-preview-968--deluxe-empanada-3ebf3b.netlify.app. + +Scanned commits merged to each repo's default branch since the last run: + +* `Artemis` (`main`), `OIQ-AI-service` (`main`), `gaia-hermes-ws` (`master`) — zero commits. +* `oiq-resources` (`main`) — one commit, PR #95 (ralongit, ORIONIQ-1584): adds a "Linking to the UI" section to both `integrations/skills/logzio_api.md` and `integrations/skills/logzio_security_api.md` — the api-host→app-host mapping per region and the `https:///360?switchToAccountId=` link shape for alerts, dashboards, SIEM rules, lookup lists, and more, so the agent stops inventing broken UI links (the triggering bug: a customer was handed SIEM-rule links that resolved to Alerts instead). Companion to `OIQ-AI-service`#477 (still open, unmerged — the account-visibility-gating half of the same ticket; #95's own description confirms it ships independently). Checked whether this needs a doc update: it's an edit to an `integrations/skills/*.md` file, which this repo has never mirrored into customer docs — the same class of change as the 2026-08-31 `rca`-flag guardrail (PR #89) and the 2026-09-09 `logzio_api.md` description/heading edits, both logged here as "internal agent-skill file this repo doesn't mirror into customer docs." It's not a public API route, request/response field, or catalog entry either — it's prompt content that shapes how OrionIQ formats a URL in its own chat/tool output, not something `api.md`'s documented endpoints or `integrations.md`'s catalog fields describe. Grepped this repo for `app.logz.io` deep-link documentation and any existing "invented link" caveat — none exists to correct. **No doc change**, consistent with the skill-file precedent. + +Doc changes made: none — the one in-scope commit is a skill-file edit this repo doesn't mirror. + +No PR opened for doc content — nothing here needs one. No assignee change to #968 — ralongit (the commit's author) is already an assignee from the 2026-09-18 cycle. No new Slack notification sent, consistent with this bot's standing practice of only notifying the team when a doc-content change lands or a genuinely new blocker needs their attention — neither is true this cycle. + +Fourth straight quiet cycle for doc *content* (2026-09-18's flurry was the last content-relevant activity), though today's `oiq-resources` commit is the first non-empty scan result since 2026-09-17 — the slowdown flagged in the 2026-09-20 entry looks like normal cadence, not a stall. + +### 2026-09-22 — daily scan (since 2026-09-21), doc changes made + +Checked #968 first for unresolved reviewer feedback per the "address comments first" rule — still none (only the Netlify bot's deploy-preview comment, zero reviews); the Netlify deploy preview is still live: https://deploy-preview-968--deluxe-empanada-3ebf3b.netlify.app. + +Scanned commits merged to each repo's default branch since the last run: + +* **`Artemis` (`main`) — #333 (yotamloe, ORIONIQ-1670): "learn from feedback is on by default."** `learn_from_feedback` flips from opt-in to opt-out — absence of the stored field now means enabled, both in the injection gate and in the agent edit form, so no backfill was needed and no agent silently lost lessons it already had. This is the UI-landing half of the gap flagged as "shipped in code but NOT in the product" since this bot's very first run (2026-08-27: `Artemis`#201 added a Learning toggle to the edit form on 2026-09-02, but the feature stayed opt-in and this repo never had cause to write it up as a customer-facing capability worth a section). With today's default flip making it something every agent now does unless explicitly turned off, it crossed the line into "needs documenting." + * Added a new **Learning** section to `create-agent.md`: on-by-default framing, the opt-out toggle's effect (pauses new lessons and stops applying existing ones; nothing is deleted), the 20-active-lesson cap and what happens as it's approached/reached, and the reflection billing note (20 free per account all-time, then $1 each — sourced from `gaia-hermes-ws`#16993's billing description, still accurate). + * Cross-linked from `agents-hub.md`'s feedback-note paragraph ("a note that teaches the agent something becomes a lesson"). + * Updated the "Shipped in code but NOT in the product" entry above to record the closure rather than deleting it — it's the clearest worked example in this file of that rule actually paying off. + * `chore: version packages` (#339) — no code. +* `OIQ-AI-service` (`main`) — zero commits. +* `gaia-hermes-ws` (`master`) — 5 commits, all out of OrionIQ scope: `APPZ-3379` (AI Observability error handling instead of a bare "no results"), `APPZ-1767` (Unified Dashboards keyboard-shortcut legend), `APPZ-3256` (public-API DAST scan tooling under `tools/`), `APPZ-3380` (stat-panel tooltip stutter fix), `APPZ-3330` (BETA badge on the AI Observability tab). AI Observability and Unified Dashboards are both out of OrionIQ scope per the standing filter rule applied every prior cycle; the DAST tooling scans the public API broadly but isn't OrionIQ-specific either. +* `oiq-resources` (`main`) — zero commits. + +PR #968 updated: title and description rewritten to lead with today's real doc content instead of the stale "no doc changes" framing from when the PR was first opened. Assignees updated to add **yotamloe** (author of #333), alongside the existing **ralongit**. + +**First Slack notification for this PR sent this cycle** — none had gone out before, since every prior cycle back to 2026-09-17 had nothing customer-facing to tell the team about (per the standing "only notify when a doc-content change lands or a genuinely new blocker needs attention" practice recorded in the 2026-09-18 through 2026-09-21 entries). Today's Learning-section addition is the first thing in this PR's life actually worth surfacing. Posted with the PR link, the (already-live) Netlify preview link, and the two assignees. No edit-in-place needed this time since the preview link was already available before the post went out — see "Slack notification mechanics" above for why an edit isn't possible with current tooling regardless. + +### 2026-09-23 — daily scan (since 2026-09-22 06:20), no doc changes + +Checked #968 first for unresolved reviewer feedback per the "address comments first" rule — still none (only the Netlify bot's deploy-preview comment, zero reviews); the Netlify deploy preview is still live: https://deploy-preview-968--deluxe-empanada-3ebf3b.netlify.app. `mergeable_state` still `blocked` on pending review, not on anything this bot can act on. + +Scanned commits merged to each repo's default branch since the last run: + +* `Artemis` (`main`) — 10 commits since 06:20: + * **#336 (Gavriel-M, ORIONIQ-1393)** — three changesets: a shared `Pulse` DS primitive (replacing four hand-rolled box-shadow pulses; `Badge`'s own pulse now correctly halos just the badge in wrapper mode, not whatever it wraps), a `⇥` Tab-hint riding that pulse on the next-step suggestion, and the suggestion becoming persisted conversation data whose visibility derives from the draft rather than being stored — which is what lets it survive a remount. Same undocumented chat surface as the 2026-09-09/11 entries. Escalated in "Known gaps" above, not documented here. + * **#351 (Gavriel-M, ORIONIQ-1480 follow-up)** — the suggestion now takes up to two lines (was clipped to one with an ellipsis) and the composer grows to hold it, only when the text actually wrapped. Same blocker, same treatment. + * **#349 (amir-noyman)** — every kebab menu (Agents hub, memory table, agent panel header, builder rail, chat history) now opens from the same horizontal glyph; two glyphs for one gesture, down to one. Pure icon-consistency fix, no behavior or copy change. No doc change. + * **#346 (amir-noyman)** — an uncontrolled `Input` now offers its clear button. Design-system component fix, not OrionIQ-scoped — same standard as the 2026-09-16 `MenuItem`/`Pressable` entry. No doc change, no assignee action. + * **#300 (Gavriel-M, ORIONIQ-1652)** — `orioniq-be` reads the consolidated `aiEnabled`, falling back to the two legacy flags. Internal plumbing behind the single AI gate this repo already documents (ORIONIQ-1625, `ai-settings.md`) — no customer-observable behavior change. No doc change. + * **#340, #344, #345** — a smoke-test failure-reporting fix and two agent-builder test hardenings. Test/CI-only. No doc change. + * `chore: version packages` ×2 (#348, #353) — no code. +* `gaia-hermes-ws` (`master`) — 3 commits: + * **#17095 (Gavriel-M, ORIONIQ-1393)** — offers the same next-step suggestion in the **Open 360 drawer** for the first time (previously standalone-chat only), persisted the same way, and bumps `app-ui` to the four Artemis packages this needs (`@logzio/artemis-orion-chat@3.0.0` among them). This is the escalation logged in "Known gaps" above. + * **#17098 (APPZ-3360)** — Span Compare adds AI-span-adapter field-label translations and excludes prompt/entity blobs from compare ranking. Span Compare / AI Observability is the separate Jaeger trace-tracing product, out of OrionIQ scope per the standing filter rule applied on every prior cycle it's come up. + * **#17072 (Gavriel-M, ORIONIQ-1652)** — the gaia-hermes-ws half of `Artemis`#300 above (same fallback logic, same internal-only scope). No doc change. +* `OIQ-AI-service` (`main`) — 1 commit, **#498 (augment770-dev, ORIONIQ-1684)** — publishes `oiq-service`/`oiq-backend` as multi-arch (amd64+arm64) images, and pins `pymysql<1.2` (a transitive `aiomysql` dependency was silently breaking the LangGraph MySQL checkpointer's write path on any fresh build — `escape_bytes_prefixed` had been replaced with a string). Build/deploy reliability fix, no route/schema/contract change reachable by a customer. No doc change. +* `oiq-resources` (`main`) — zero commits. + +Doc changes made: none. Updated the "Known gaps" OrionIQ-chat entry above — the next-step suggestion is now a third shipped iteration on the same blocker, and as of this cycle it also reaches the Open 360 drawer, the exact surface `assistantiq.md` already documents (badly). No PR content follows from that update, same reasoning as the 2026-09-11 entry. + +PR #968: description updated to record this cycle under "Audited, no doc change needed." Assignees unchanged — per the 2026-09-10/11 precedent, this bot doesn't add assignees for commits blocked on the standing chat-page gap, and no other in-scope commit this cycle needed scope review beyond what's logged above. No new Slack notification — nothing here is new information beyond what the thread and this file's "Known gaps" entry already carry. + +### 2026-09-24 — daily scan (since 2026-09-23 06:20), no doc changes + +Checked #968 first for unresolved reviewer feedback per the "address comments first" rule — still none (only the Netlify bot's deploy-preview comment, zero reviews); the Netlify deploy preview is still live: https://deploy-preview-968--deluxe-empanada-3ebf3b.netlify.app. `mergeable_state` still `blocked` on pending review, not on anything this bot can act on. + +Scanned commits merged to each repo's default branch since the last run: + +* `Artemis` (`main`) — 5 commits: + * **#359 (Gavriel-M, ORIONIQ-1480 follow-up)** — two bug fixes on the shipped next-step suggestion: the mode pill no longer resizes on the first keystroke (it was absorbing space `Send`'s mount claims instead of the text field doing so), and a conversation reloaded over the network now restores its newest run's suggestion instead of silently losing it — the endpoint reports `nextStepSuggestion` per run now, with a `restored` flag so a restored offer doesn't double-count as a fresh impression. Plus composer alignment polish (Tab-hint/Send centering, expand-button placement) found while reviewing the above. Same undocumented chat surface as the 2026-09-09/11/22/23 entries — this is a bug fix on already-shipped, already-escalated behavior, not a new capability, so it doesn't add anything to the "Known gaps" escalation. No doc change. No new assignee: this bot doesn't add assignees for commits blocked on the standing chat-page gap (2026-09-10/11 precedent), which is why Gavriel-M still isn't an assignee despite authoring #336/#351/#359, three cycles running. + * **#361 (RoyiSitbon, ORIONIQ-1693)** — test-only: adds a fifth `orioniq-be` smoke probe that hits `/v2/orioniq-be/incoming-webhooks/*` on the **PUBLIC_API** gateway listener specifically (a separate listener with a separate label matcher from the one the other four probes cover), proving the persisted webhook-notification path is actually routed rather than silently dead until an alert fires. Companion to `gaia-hermes-ws`#17106 below — same ticket, same underlying surface. No doc change (deploy gate, not a route/schema change) — but see #17106 below for why the ticket itself is in-scope. + * `#357` (already logged 2026-09-23), `chore: version packages` (#360), and a CI change removing the non-gating AI smoke pass from the deploy gate — infra-only. No doc change. +* `gaia-hermes-ws` (`master`) — 5 commits: + * **#17106 (RoyiSitbon, ORIONIQ-1693)** — fixes `app-ui`'s copy of `orioniq-agent-endpoint.service.ts` to build the OrionIQ agent notification webhook URL from `orioniqPublicApiBasePath()` instead of a hardcoded `/v2/incoming-webhooks/` prefix, which nothing has served since app-ai became a redirect shim. Confirmed against `Artemis`'s own copy of this service, which already did this correctly — gaia's had drifted. This is a real, in-scope fix to a customer-facing surface (the URL a flagged account pastes into Datadog/New Relic as an incoming-webhook target), reviewed for scope even though it produces no doc change: grepped this repo for any page documenting a literal webhook URL pattern and found none — `create-agent.md`'s Notification Endpoints section only says "custom API endpoints" generically (already checked, see the create-agent.md excerpt in prior cycles) — same as the already-flagged Q10 note in this file about the same endpoint's AI-entitlement gating. Nothing here for docs to be stale about, because docs never printed the literal path. **RoyiSitbon added as a new #968 assignee** — author of both halves of this fix (here and `Artemis`#361 above), matching the 2026-09-18 `ralongit`/#290 precedent: an in-scope OrionIQ backend/public-API fix gets an assignee even when it nets no doc change, as long as it isn't blocked on the standing chat-page gap. + * **#17100 (APPZ-3381, sergiimeleshko)** — account-scopes the internal Logz.io MCP server's metrics and logs tools to the caller's own authorized accounts via `account_id`. This is the general-purpose Logz.io MCP server (external AI-agent access to logs/metrics), a separate product from OrionIQ's own agent/tool system — no `Artemis` or `OIQ-AI-service` code path consumes it. Out of OrionIQ scope, same standard applied to other MCP-server-adjacent commits. + * **#17108, #17068, #17103** (APPZ-3396, APPZ-3239, APPZ-3385) — AI Observability span tagging, Restored-accounts filtering, and an internal `app-ui` README rewrite. AI Observability is the separate trace-tracing product (out of scope, standing rule); Restored accounts and the README are unrelated to OrionIQ. No doc change. + * **#17099** (APPZ-3382, drag-to-zoom fix) — Perses/Unified Dashboards, not OrionIQ. No doc change. +* `OIQ-AI-service` (`main`) — 1 commit, **#499 (augment770-dev)** — `ai_backend`'s scheduler was 500ing on every tick since 2026-09-14 because `AppAIClient`'s httpx client didn't follow the 307 App-AI now serves on its old `/app-ai/*` route prefix (renamed to `/orioniq-be`), so `raise_for_status()` turned the redirect into a hard failure before a single cron fired. Fixes `follow_redirects=True` and moves the client's default paths to `/orioniq-be`. This is `ai_backend` calling `app-ai` internally to trigger scheduled agent runs — an internal service-to-service path, not a customer-callable route or contract — same "build/deploy reliability fix, no route/schema/contract change reachable by a customer" bucket as `OIQ-AI-service`#498 (2026-09-23 entry) and #483 (2026-09-18 entry). No doc change, no new assignee, consistent with those two precedents. +* `oiq-resources` (`main`) — 5 commits (PRs #102 and #103/#104, ralongit): expands both Salesforce agent-skill guides. `salesforce` read ops go 4 → 15 (queryAll, pagination, SOSL, describe, org limits, Knowledge articles, and more) and write ops 4 → 9 (adds Case comments, Chatter posts, upsert-by-external-ID, close/transition, owner reassignment). `salesforce-service-cloud` goes from read-only to a gated 6-op Case write surface (`allow_write` + manifest `enableWrite`) for the first time — previously this integration only ever showed **Read** in the product's Agent-permissions picker (per `integrations.md`'s "Not every integration supports write actions — those show Read only, with no choice to make"). Also fixes a reversed fact in both guides (Salesforce's `Sforce-Auto-Assign` default: assignment rules fire on API-created/updated Cases unless explicitly turned off, not the other way around) and adds a "finding the right field" retry strategy to reduce false-negative INVALID_FIELD failures. Checked whether Service Cloud's read-only→write flip needs a doc update: `integrations.md` doesn't enumerate which specific integrations support write (only the general two-level toggle mechanism), so the sentence quoted above stays accurate as written — same "per-connector operation coverage is catalog depth" bucket as the 2026-09-02 PagerDuty and 2026-09-05 Salesforce credential-field entries already in this file. **No doc change.** `ralongit` is already a #968 assignee (since 2026-09-18) — no change needed. + +Doc changes made: none. PR #968: description rewritten to record this cycle under "Audited, no doc change needed." Assignees updated to add **RoyiSitbon** (see #17106 above) alongside the existing ralongit, yotamloe. No new Slack notification — nothing here is new information for the team beyond what the thread and this file's "Known gaps" / "Recurring documentation patterns" entries already carry, consistent with this bot's standing practice of only notifying when a doc-content change lands or a genuinely new blocker needs attention. + +### 2026-09-25 — daily scan (since 2026-09-24 06:09), no doc changes + +Checked #968 first for unresolved reviewer feedback per the "address comments first" rule — still none (one APPROVED review from RoyiSitbon, submitted 2026-09-24T06:16, zero comment threads); both checks (`PR validation`, Netlify deploy preview) are green on the current head, `mergeable_state` is `clean`. + +Scanned commits merged to each repo's default branch since the last run (`since=2026-09-24T06:09:55Z`): + +* `Artemis` (`main`) — 3 commits: + * **#367 (RoyiSitbon)** — "serve the invocations total cost from self-service (`budget-consumed`, product 100) instead of summing per-agent count × list price, matching how chat tokens already work." The derived figure had been pricing `started` and `failed` invocations and ignoring each agent type's `freeUsage` quota. `orioniq-be`'s `UsagePerformanceResponse` gains a new `totalInvocationCost` field (the old improvised `totals.totalCost` client math is gone); the dashboard header's "Total cost" line now reads it directly. Checked `usage-performance.md`'s "Total Cost ($)" description ("The total cost of the agent's invocations during the selected period") against this — it describes the figure, not its computation source, and stays accurate. Same "calculation-correctness fix isn't new documented behavior" bucket as the 2026-09-09 `ORIONIQ-1543` spend-cap entry. **No doc change.** + * **#338 (ralongit, co-authored Gavriel-M)** — two independent Agents Hub/Marketplace polish items in one PR: (1) `getAgentTypeDisplayLabel` now humanizes any unmapped PascalCase agent type instead of returning it raw, and the Usage & Performance table's Type column switches from plain text to the same colored `` the Agents Hub and Run History already use — closing a three-way inconsistency where the same agent type rendered differently on each page. `AlertDigest`/`AlertTuningReport` join the alert family's cyan tag hue. (2) Marketplace tiles drop the "Then $X per invocation" struck-through-price line, keeping only the free-invocations line (the preview modal still shows full pricing). Checked both `agents-hub.md` ("The agent type (for example, Custom)") and `marketplace.md` (no pricing/tile-layout description at all) — neither enumerates specific type labels or tile pricing copy, so nothing is stale. **No doc change**, but a real in-scope Agents Hub/Marketplace fix — assigned per the 2026-09-18 `ralongit`/#290 precedent (ralongit already assigned; added Gavriel-M as co-author of this one). + * **#363 (Gavriel-M, ORIONIQ-1480 follow-up)** — a further designer's pass on the composer's next-step-suggestion hint: it's now a real `tertiary` button (was a decorative `Tag`), reachable by touch as well as `Tab`, with an opaque backing behind its attention ring and a fixed (non-looping) 3-cycle pulse; the composer's bottom-row occupants (mode pill / hint / Send) now hold one edge instead of re-centering on wrap. Same undocumented OrionIQ-chat surface as every prior cycle on this ticket (2026-09-09/10/11/23/24) — an accessibility/polish fix, not a new capability, still blocked on the standing "OrionIQ chat has no page in this repo" gap. **Not documented.** +* `OIQ-AI-service` (`main`) — 2 commits: + * **#485 (ralongit, ORIONIQ-1692)** — every credentialed base-skill guide (`ai_backend/api/v1/kb/base_skills.py`) is now prefixed with an explicit note naming the account's connection(s) and an unconditional instruction to pass `connection`; `execute_api_read`/`execute_api_write`'s own docstrings (`ai_service/agents/shared/api/api_tools.py`) change from "pass `connection` when the tenant has multiple connections of the same integration type" to "pass it on every credentialed call, exactly as listed." This is prompt content injected into the agent's own context and its own tool docstrings — internal agent orchestration, not a customer-callable route, schema, or UI. Same "internal prompt content this repo has never mirrored into customer docs" bucket as the 2026-09-21 `oiq-resources`#95 skill-file entry. **No doc change, no new assignee** (ralongit already assigned from other work). + * **#445 (augment770-dev, ORIONIQ-1523)** — raises the DOD-eval judge's Bedrock output-token cap (1024 → 16384) so its `GRADE:` verdict isn't truncated away, which had been silently mis-scoring up to 14/64 graded eval samples as incorrect. Internal eval/research tooling (`research/`), explicitly out of this repo's scope — no route, schema, or customer-visible change. **Out of scope, no doc change.** +* `gaia-hermes-ws` (`master`) — 7 commits, all out of OrionIQ scope: `APPZ-3415`/`APPZ-3392`/`APPZ-3394`/`APPZ-3395` (AI Observability trace-waterfall "More fields", initial-detail-selection, color, and service-legend changes) and `APPZ-3255`/`APPZ-3408`/`APPZ-3353` (SIEM/Unified-Dashboards time-interval parsing, browser-tab title, and series-limit notice). AI Observability is the separate Jaeger/OpenSearch trace-tracing product; SIEM/Unified Dashboards is Open 360/SIEM — both out of OrionIQ scope per the standing filter rule applied on every prior cycle. +* `oiq-resources` (`main`) — 1 commit, **#83 (ralongit)**: merges `feat/ORIONIQ-1377-alert-tuning-report-main` — adds the **Alert Tuning Report** marketplace template (`marketplace/templates/alert-tuning-report.json`, `agentType: AlertTuningReport`, category `alerting`) plus its `index.json` entry. Checked `marketplace.md`'s category table — it lists categories with example descriptions only, never enumerates specific templates by name, and "Alerting" is already listed with a description a hygiene-recommendation report still fits. Same "marketplace.md doesn't enumerate templates by name" precedent as the 2026-09-18 Alert Digest/Alert Tuning Report add-then-revert entry — except this time the template stays merged, no revert observed in the window. **No doc change.** ralongit already assigned. + +Doc changes made: none. PR #968: description rewritten to record this cycle under "Audited, no doc change needed." Assignees updated to add **Gavriel-M** (co-author of #338, an in-scope Agents Hub/Marketplace fix, not the blocked chat-only work) alongside the existing RoyiSitbon, ralongit, yotamloe. No new Slack notification — nothing here is new information for the team beyond what the thread and this file's existing entries already carry, consistent with this bot's standing practice of only notifying when a doc-content change lands or a genuinely new blocker needs attention. + +### 2026-09-26 — daily scan (since 2026-09-25 06:24), no doc changes + +Checked #968 first for unresolved reviewer feedback per the "address comments first" rule — still none (one APPROVED review from RoyiSitbon, submitted 2026-09-24T06:16, zero comment/review threads); all 13 checks are green (success/neutral) on the current head, `mergeable_state` is `clean`. Netlify deploy preview is still live: https://deploy-preview-968--deluxe-empanada-3ebf3b.netlify.app. + +Scanned commits merged to each repo's default branch since the last run: + +* `Artemis` (`main`) — 1 commit: **#366, `chore: version packages`** (github-actions[bot], 2026-09-25T08:01:15Z) — the changesets bot consuming five changeset files (`invocations-cost-from-self-service`, `olive-otters-listen`, `orioniq-be-public-api-listener-smoke`, `smoke-drop-reported-ai-pass`, `suggestion-hint-button`) into version bumps and `CHANGELOG.md` entries for `apps/orioniq`, `apps/orioniq-be`, `apps/storybook`, `packages/app-core`, `packages/frontend-services`, `packages/opfs-client`, `packages/orion-chat`. Every one of these changesets traces back to a PR (#367, #363, and earlier work) already audited in the 2026-09-25 entry above — this commit carries no new source change, only version/changelog bookkeeping. **No doc change, no new assignee** (author is a bot). +* `OIQ-AI-service` (`main`) — zero commits. Latest commit on `main` is still #485 (ralongit), 2026-09-24T15:12:39Z (already logged in the 2026-09-25 entry). +* `gaia-hermes-ws` (`master`) — zero commits. Latest commit on `master` is still `e2aef69` (APPZ-3415), 2026-09-24T13:57:52Z — part of the 7-commit batch already logged and dismissed as out-of-scope in the 2026-09-25 entry. +* `oiq-resources` (`main`) — zero commits. Latest commit on `main` is still #83 (ralongit), 2026-09-24T15:17:20Z (already logged in the 2026-09-25 entry). + +Doc changes made: none. PR #968: description rewritten to record this cycle under "Audited, no doc change needed." No assignee change — the one new commit is bot-authored, no human author to add. No new Slack notification sent — nothing here is new information for the team beyond what the thread and this file's existing entries already carry, consistent with this bot's standing practice of only notifying when a doc-content change lands or a genuinely new blocker needs attention. + +### 2026-09-27 — daily scan (since 2026-09-26 06:15), no doc changes + +Checked #968 first for unresolved reviewer feedback per the "address comments first" rule — still none (one APPROVED review from RoyiSitbon, submitted 2026-09-24T06:16, zero comment/review threads); all 13 checks are green (success/neutral) on the current head, `mergeable_state` is `clean`. Netlify deploy preview is still live: https://deploy-preview-968--deluxe-empanada-3ebf3b.netlify.app. + +Scanned commits merged to each repo's default branch since the last run: + +* `Artemis` (`main`) — zero commits. Latest commit on `main` is still #366 (`chore: version packages`, github-actions[bot]), 2026-09-25T08:01:15Z (already logged in the 2026-09-26 entry). +* `OIQ-AI-service` (`main`) — zero commits. Latest commit on `main` is still #485 (ralongit), 2026-09-24T15:12:39Z (already logged in the 2026-09-25 entry). +* `gaia-hermes-ws` (`master`) — zero commits. Latest commit on `master` is still `e2aef69` (APPZ-3415), 2026-09-24T13:57:52Z — part of the 7-commit batch already logged and dismissed as out-of-scope in the 2026-09-25 entry. +* `oiq-resources` (`main`) — zero commits. Latest commit on `main` is still #83 (ralongit), 2026-09-24T15:17:20Z (already logged in the 2026-09-25 entry). + +Doc changes made: none. PR #968: description rewritten to record this cycle under "Audited, no doc change needed." No assignee change — no new commits, no new authors. No new Slack notification — nothing here is new information for the team beyond what the thread and this file's existing entries already carry, consistent with this bot's standing practice of only notifying when a doc-content change lands or a genuinely new blocker needs attention. + +### 2026-09-28 — daily scan (since 2026-09-27), no doc changes + +Checked #968 first for unresolved reviewer feedback per the "address comments first" rule — still none (one APPROVED review from RoyiSitbon, submitted 2026-09-24T06:16, zero comment/review threads); `mergeable_state` is `clean`. Netlify deploy preview is still live: https://deploy-preview-968--deluxe-empanada-3ebf3b.netlify.app. + +This cycle ran in a session assigned a different branch (`claude/gracious-thompson-asfc75`) than this PR's head — same situation the 2026-09-01 entry first flagged. Per the "habit to design around" note on that entry, this commit was pushed directly to `claude/gracious-thompson-11rvmo` (this PR's actual head ref) rather than stranded on the session's own branch. + +Scanned commits merged to each repo's default branch since the last run: + +* `oiq-resources` (`main`) — 11 commits: + * **Alert Digest recreated again** (`795ff31`, "Create alert-digest.json", ralongit, 06:12) — the same template this log has tracked being added then reverted same-day since 2026-08-13/09-08/09-18 (see "Recurring documentation patterns"). This time it stayed merged through the whole run window, alongside repeated edits to `alert-tuning-report.json` and `alert-digest.json` and the usual bot-generated `index.json` regenerations — none of which change the verdict. Per the standing precedent (`marketplace.md` is category-level only, "Alerting" already covers it, and no per-template page exists for `alert-tuning-report` either, per #83's 2026-09-25 entry above), **no doc change** — noted here in case it reverts again like its predecessors, or in case a future run is asked to break from the no-per-template-page convention now that it has stuck for a full day. + * **`filter.timeframe.from/.to` changed from Unix epoch milliseconds to seconds** (`08c3282`, "Change timeframe filter to Unix epoch seconds", ralongit, 16:31), on the `POST /v2/unified-alerts/events/search` request body documented in `integrations/skills/logzio_api.md`. Same file, same "internal agent-skill file this repo doesn't mirror into customer docs" verdict as the 2026-09-09 entry — `docs/user-guide/orioniq/api.md`'s own `context.timerange` field uses ISO 8601 strings, not epoch, and is unrelated to this internal skill. **No doc change.** +* `OIQ-AI-service` (`main`) — one commit, **ORIONIQ-1685** (#497, ralongit): the agent-builder validator is now shown the `execute_api_read`/`execute_api_write` integration tools whenever `spec.enableInternalIntegrations` and write-consent apply, instead of reasoning from a static per-agent-type list that omitted them entirely — unblocks installing Exception Analysis, Alert Digest, and Alert Tuning Report, which the validator was previously refusing outright as a `capability_gap`. Internal agent-builder reasoning, not a documented route/schema/UI surface — this repo has no page describing agent-builder validator behavior or "capability gap," consistent with the "Known gaps not yet documented" entry on agent-builder-authored grants not yet surfaced in the UI. **No doc change** — worth revisiting only if a future run is asked to document marketplace-agent install troubleshooting. +* `gaia-hermes-ws` (`master`) — 2 commits, both Gavriel-M: + * **ORIONIQ-1480** (#17104) — restores the chat composer's next-step suggestion when a conversation reloads from the network instead of the IndexedDB cache, and bumps `orion-chat`/`components`. Bug fix to the composer-suggestion feature, which this log has tracked as **not documented** since 2026-09-11 (OrionIQ chat still has no page in this repo). Fixing existing behavior doesn't change that verdict. **No doc change.** + * **ORIONIQ-1716** (#17125) — registers 7 marketplace-agent free-trial analytics event names to the allow-list (trial started/ended/converted, deleted-after-trial, notice-seen, keep-running, paid-activation) so they stop being silently dropped. Same "registers analytics events around a feature" shape as prior entries — internal telemetry, no customer-visible surface. **No doc change.** +* `Artemis` (`main`) — one commit, **ORIONIQ-1717** (#373, Gavriel-M): a selected link-menu-row border/token fix on the OrionIQ sidenav (a 1px content shift on selection). Design-system component styling, not OrionIQ product copy — same verdict as the 2026-09-16 entry on #279 (`MenuItem`/`Pressable`). **No doc change.** + +No screenshots found on any of today's PRs marked for documentation use. + +Doc changes made: none. PR #968: description rewritten to record this cycle under "Audited, no doc change needed." No assignee change — ralongit and Gavriel-M, today's two authors, are both already assignees. No new Slack notification sent — nothing here is new information for the team beyond what the thread and this file's existing entries already carry, consistent with this bot's standing practice of only notifying when a doc-content change lands or a genuinely new blocker needs attention. + +### 2026-09-29 — daily scan (since 2026-09-28 06:10), no doc changes + +* `Artemis` (`main`) — two commits, both Gavriel-M: + * **ORIONIQ-1713** (#371) — marketplace agents switch themselves off when their free runs are used up; `/marketplace/templates` returns `freeRuns`. Gated behind the `oiq-marketplace-free-trial` account flag, and `/marketplace/templates` is a BFF route, not the customer-callable `/v2` surface. `marketplace.md` has never described pricing or free runs. Not yet a general behavior, so **no doc change**. Recheck once the flag is removed or a trial UI lands (gaia-hermes-ws #17125 already registered its analytics events). + * **ORIONIQ-1717** (#374) — rail row leading-slot and collapsed-row shape in the OrionIQ sidenav. Design-system styling, same verdict as #373. **No doc change.** +* `OIQ-AI-service` (`main`) — two commits, both yotamloe: + * **#455 / ORIONIQ-1433** — agent persistent memory phase 1: new `spec.knowledgeBase.agentDocs` grant (single `scratchpad` document, `read`/`readWrite`), `/kb/agent-docs/...` routes on the internal AI Backend, contract 3.11.0. `AGENT_MEMORY_ENABLED` is a kill switch and App-AI does not send the grant yet, so no customer path exists. Same class as `accountDocs` (2026-09-17): flagged to recheck once an Agent Builder UI or App-AI setting exposes it. **No doc change.** + * **#501** — Traceloop hook unwrapping and an instrumentation allowlist. Internal observability plumbing. **No doc change.** +* `gaia-hermes-ws` — 11 commits, all AI Observability (trace waterfall, run status, monitoring dashboard), Span Explorer, K8s 360 dashboards, Finance console, Perses submodule or an ArgoCD URL. Out of OrionIQ scope, same standing filter rule. +* `oiq-resources` — zero commits. + +No screenshots found on any of today's PRs marked for documentation use. + +Doc changes made: none. PR #968: description rewritten to record this cycle. No assignee change: today's authors, Gavriel-M and yotamloe, are already assignees. No new Slack notification sent, per the standing practice of notifying only when a doc-content change lands or a new blocker appears. + +### 2026-10-01 — daily scan (since 2026-09-30 06:00), no doc changes + +PR #968 has no unresolved reviewer threads (one approval, zero review threads). Master merged into the branch to clear the `behind` state. + +* `Artemis` (`main`): + * **ORIONIQ-1700** (#368, ralongit) — Custom API integration (`custom-api`) gets its own connect form (host, No auth / Bearer / API key in header or query / Basic auth, health-check path). Shown only to accounts with the `oiq-custom-api` flag. **No doc change** while flag-gated. Recheck when the flag is removed: `integrations.md` auth methods table and catalog categories would need Custom API, its auth choices and the host rules. + * **ORIONIQ-1716** (#385) and **ORIONIQ-1714** (#377) — free-trial analytics events and trial notices in channel deliveries. Same `oiq-marketplace-free-trial` flag as #371 and #372. **No doc change.** + * #384 (list row animation), #389 (tables separator fix, amir-noyman), #386 (vendor refresh bot). Design system or internal. **No doc change.** +* `OIQ-AI-service` (`main`) — **#453** (ralongit, ORIONIQ-1700, ORIONIQ-1219, ORIONIQ-1547): customer hosts per account (`CUSTOMER_HOSTS_ACCOUNT_IDS`), configurable auth type, response caps, per-account connection test rate limit from the manifest (`rateLimit`), `none` auth. Account-gated backend work behind the same Custom API switch. **No doc change**, same recheck condition as #368. +* `oiq-resources` (`main`) — **#107** (ralongit): `custom-api` integration manifest and skill. Non-GET calls go through `execute_api_write`. Same flag. **No doc change.** +* `gaia-hermes-ws` (`master`) — 3 commits (restore UI, SIEM summary dashboard, Firefox chart performance). Out of OrionIQ scope. + +No screenshots marked for documentation use. No new assignees (ralongit and Gavriel-M are already assigned; amir-noyman's commit is out of scope). No Slack message: no doc content change landed. + +Pattern: an account-gated feature (flag or account list) is logged and rechecked, not documented, until it is generally available. Custom API now joins the free-trial and `agentDocs` recheck list. + +### 2026-10-02 — daily scan (since 2026-10-01 06:00) + +PR #968 has no unresolved reviewer threads (one approval, zero review threads). + +* `Artemis` (`main`): + * **ORIONIQ-436, ORIONIQ-1691** (#365, ralongit) — Data sources now shows for API, Alert and Deployment agents (optional there, still required for scheduled). v2 alert AI-analysis agents are seeded with the alert's accounts, editable, and fall back to the alert's own when cleared. **Documented** in `create-agent.md` > Data Sources. + * #392, #394, #399 (Gavriel-M, ORIONIQ-1737, 1740, 1744): rail animation, animated OrionIQ mark, relative times in chat. Visual polish. **No doc change.** + * #390 (Gavriel-M, ORIONIQ-1716): free-trial UI events. Behind `oiq-marketplace-free-trial`. **No doc change.** +* `OIQ-AI-service`, `oiq-resources` — no commits. +* `gaia-hermes-ws` — 2 commits (APPZ-3345, APPZ-3433, AI Observability run hydration and conversation parsing). Out of OrionIQ scope. + +No screenshots marked for documentation use. Assignees already include ralongit and Gavriel-M. + +### 2026-10-03 — daily scan (since 2026-10-02 06:00), no doc changes + +* `Artemis`, `OIQ-AI-service` — no commits. +* `oiq-resources` — #110 and #111 (ralongit): PostHog integration gets a gated write surface (`enableWrite`), more read operations, a new icon, and guide fixes for the insight query format. Catalog depth only, and PostHog is not named anywhere in this repo. **No doc change.** +* `gaia-hermes-ws` — #17152 (APPZ-3451): Unified Dashboards use the legacy searchable-accounts endpoint. Dashboards are not OrionIQ. Out of scope. + +No screenshots marked for documentation use. Assignees unchanged. + +### 2026-10-04 — daily scan (since 2026-10-03 06:00), no doc changes + +* `Artemis` — #397, #398, #400, #401 (Gavriel-M), plus the automated version PR #403. + * #397 (ORIONIQ-1742): marketplace free trial is stored on the agent (`freeTrialState`, `freeRunsLeftAfter`) instead of reading `oiq-marketplace-free-trial` per run. Still behind the flag, internal testing only. **No doc change.** Recheck the free-trial and run-history API fields when the flag is generally available. + * #398, #400, #401 (ORIONIQ-1745, 1746, 1747): greeting removed from the first chat message, new user message pinned to the top, `TravellingLayer` design system component. Visual polish. **No doc change.** +* `OIQ-AI-service`, `gaia-hermes-ws`, `oiq-resources` — no commits. + +No screenshots marked for documentation use. Assignees unchanged. + +### 2026-10-05 — daily scan (since 2026-10-04 06:00), no doc changes + +* `gaia-hermes-ws` — #17159 (RoyiSitbon, ORIONIQ-1756) deletes the `app-ai` service. gaia callers move to `/orioniq-be/*` directly and the rewrite shim is removed. The customer API (`/v2/ai-agent/...`) is unchanged and `api.md` uses `<>`, so **no doc change now.** The PR's own checklist says the `AI/LEGACY_REDIRECT` drain and the config repoints must finish first. **Recheck the 307 redirect note in `api.md` once the deletion is deployed**, and remove it if redirects no longer occur. + * #17140 (APPZ-3432) and #17139 (APPZ-3434): Unified Dashboards and K8s 360. Out of OrionIQ scope. +* `Artemis` — #412 (RoyiSitbon, ORIONIQ-1756) makes `orioniq-be` serve the legacy `/v2/incoming-webhooks/*` path used by existing Datadog and New Relic webhook URLs, and drops the `oiq-artemis-be` branching. Compatibility for existing URLs. Webhook triggers are not documented here. **No doc change.** + * #409 (RoyiSitbon): alerts list filter moves to the URL. UI behavior only. + * #404, #402 (Gavriel-M, ORIONIQ-1749, 1752): chat fade-in and thinking card fixes. Visual polish. + * #410 (CI smoke), #370 (tests), version PRs #417, #418, #423: internal. +* `OIQ-AI-service` — #509 (yotamloe, ORIONIQ-1741): Agent Builder prompt now allows read grants on `ACCOUNT.md`. Prompt wording fix. **No doc change.** +* `oiq-resources` — no commits. + +No screenshots marked for documentation use. Assignees unchanged (RoyiSitbon, yotamloe, Gavriel-M already assigned). + +### 2026-10-06 - daily scan (since 2026-10-05 06:00), no doc changes + +* `Artemis` - #388 (Gavriel-M, ORIONIQ-1730) moves public API auth to the gateway. Only API tokens are accepted on the public routes, and anything else returns `401` "Missing or invalid API token". This matches the `401` note already in `api.md`. **No doc change.** + * #421, #422 (galangel, ORIONIQ-1657): the server builds the run handoff, and the UI continues a run in chat from it. Internal UI and BFF flow, not a public route. No doc change. + * #356, #437 (RoyiSitbon, ORIONIQ-1687): the alert-triggered run names the group that tripped a group-by alert. Run input wording only. No doc change. + * #330 (galangel): models stop shipping the investigation strategy to clients. Internal. #408, #420, #391, #393, #352, #424, #425, #192: UI and design system polish. Version PRs: internal. +* `OIQ-AI-service` - #480, #486 (kevkle, ORIONIQ-1628, 1671, 1581): RCA/OIHV profile internals (log catalog, incident report in the hypothesize bundle, onset ladder removal) and Bedrock pricing rows. No customer-facing route or schema. No doc change. +* `gaia-hermes-ws` - #17085 (Gavriel-M, ORIONIQ-1661): admin AI settings write sends the consolidated `aiEnabled`. Already described in `ai-settings.md`. #17138, #17157: gateway fake and analytics event. Internal. #17149, #17150, #17161, #17162: out of OrionIQ scope. +* `oiq-resources` - no commits. + +No screenshots marked for documentation use. Assignees updated to add galangel and kevkle. + +### 2026-10-07 - daily scan (since 2026-10-06 06:09), doc changes made + +* `Artemis` - #335 (ralongit): **Allow Logz.io API access** now defaults to off for new agents and templates, is saved only when the checkbox was offered, and shows a notice when connections fail to load. A template's `spec.enableInternalIntegrations` reaches the agent form. Added to `create-agent.md` Data Sources. The checkbox was not documented before. + * #411 (Gavriel-M, ORIONIQ-1759): an integration added in the current edit must be connected before the agent saves. `unreachable` only warns, saved references never block, and Select all appends. Added to `create-agent.md` Integrations. The server does not enforce this yet (ORIONIQ-1762). + * #442 (RoyiSitbon, ORIONIQ-1687): group-by alert samples left out of the run message. Run input wording. No doc change. + * #413 (ralongit, ORIONIQ-1763): markdown links open in a new tab, empty runbook no longer shows "null". Polish. #450, #444, #415, #414, #405, #419, #434 and version PR #441: UI polish and tests. No doc change. +* `gaia-hermes-ws` - #17171 (Gavriel-M, ORIONIQ-1750): Open 360 drawer adopts the living mark. Visual only. Other commits (APPZ-3486, 3435, 3464, 3452, 3437) are out of OrionIQ scope. +* `OIQ-AI-service`, `oiq-resources` - no commits. + +No screenshots marked for documentation use. Assignees unchanged. + +### 2026-10-08 - daily scan (since 2026-10-07 06:09), no doc changes + +* `Artemis` - #451, #453 (RoyiSitbon, ORIONIQ-1782): `orioniq-be` serves a Swagger UI for every endpoint, and Swagger calls public routes with `X-API-TOKEN`. Developer tooling on the service, no route or schema change. No doc change. Recheck `api.md` if the Swagger UI is announced to customers. + * #447, #448 (galangel, ORIONIQ-1776): welcome survey served as typed questions from the memory feature and rendered by question type. Not covered in `memory.md` today. No doc change until the survey is described as a customer feature. + * #446 (Gavriel-M, ORIONIQ-1753): live thinking card starts collapsed. #455 (galangel, ORIONIQ-1791): RCA finding prefixes shown as chips. UI polish. No doc change. +* `OIQ-AI-service` - #514 (yotamloe, ORIONIQ-1772): `agentDocs` can grant `lessons` (contract 3.12.0, additive, App-AI facing) and Agent Builder keeps the grant across edit turns. Internal contract. #519 (kevkle, ORIONIQ-1785): runtime agents move to Sonnet 5.5. Model internals. No doc change. +* `oiq-resources` - #113 (Gavriel-M, ORIONIQ-1786): `spec.knowledgeBase.accountDocs.files` is now configurable on every active marketplace template, so account docs a user attaches are kept on save. Account docs are not documented in `create-agent.md` or `marketplace.md`. No doc change until the feature is described there. +* `gaia-hermes-ws` - APPZ-3375, 3313, 3457, 3397, 3472: consumption, load performance, internal dashboards and AI Observability. Out of OrionIQ scope. + +No unresolved reviewer comments on the PR. No screenshots marked for documentation use. Assignees unchanged. + +### 2026-10-09 - daily scan (since 2026-10-08 06:09), doc changes made + +* `Artemis` - #416 (Gavriel-M, ORIONIQ-1419): Marketplace agents are activated from a setup dialog in the template preview, replacing the chat builder path. The agent is created switched on with learning off, the card and preview show an active agent count linking to the Agents Hub, and `orioniq-be` skips free-trial enrollment for agents created off. Rewrote the install section of `marketplace.md` as **Activate an agent template**. The old text still said **Install**, which no longer exists. Source of wording: `Marketplace/constants.ts` (`ACTIVATION_MESSAGES`). + * #457 (Gavriel-M, ORIONIQ-1796): **Open in Agents Hub** after activation filters the hub by the agent type. Covered in the same section. + * #462 (ralongit, ORIONIQ-1798): saving an RCA system agent now keeps nested configurable paths such as the account docs file. Account docs are still not documented. No doc change. + * Version PRs #459, #445 and vendor refresh #443: internal. +* `gaia-hermes-ws` - ORIONIQ-1794 (Gavriel-M): analytics event registration. Internal. #17182, #17164, #17172, #17178: out of OrionIQ scope. +* `OIQ-AI-service`, `oiq-resources` - no commits. + +Open question for the owner: `marketplace.md` still says **+ Create New Agent**, while the vocabulary table says **Build an Agent**. Not changed, since the Marketplace page copy was not verified this run. + +No unresolved reviewer comments on the PR. No screenshots marked for documentation use. Assignees unchanged. + +### 2026-10-12 - daily scan (since 2026-10-11 06:09), no doc changes + +* `Artemis` - #460, #461 (Gavriel-M, ORIONIQ-1794): a **Keep running after the free runs** checkbox on marketplace agents, so an agent moves from its free trial to paid instead of switching off. Gated by the `oiqMarketplaceFreeTrial` flag and visible only to users who can see pricing. The free-trial feature is not documented anywhere in `docs/user-guide/orioniq/`, so there is nothing to extend. Add it with the free-trial feature when that is described. + * #466 (Gavriel-M, ORIONIQ-1809): the Agents Hub opens every agent on its **Agent details** form instead of the chat builder. `agents-hub.md` says "open the agent's details" and "configuration", which already matches. No doc change. + * #458 (Gavriel-M, ORIONIQ-1795): a partial agent update keeps the marketplace agent's spec. Bug fix. #467: page-header layout fix. +* `gaia-hermes-ws` - #17195, #17185, #17192: finance console, SIEM Lucene editor, date picker colors. Out of OrionIQ scope. +* `OIQ-AI-service`, `oiq-resources` - no commits. + +No unresolved reviewer comments on the PR. No screenshots marked for documentation use. Assignees unchanged. diff --git a/docs/user-guide/orioniq/agents-hub.md b/docs/user-guide/orioniq/agents-hub.md index aa513b36..ff5a0eb0 100644 --- a/docs/user-guide/orioniq/agents-hub.md +++ b/docs/user-guide/orioniq/agents-hub.md @@ -132,7 +132,7 @@ Once a run finishes, a **Was this useful?** rating sits in the panel's footer, v Clicking a thumb registers immediately and opens a note composer. Add a free-text note explaining the rating — a rating alone doesn't teach the agent anything, only a written note does — or click **Skip** to leave just the rating. You can return to a rated run at any time to add, view, or edit its note. -Feedback helps improve AI performance over time and gives you a way to track agent reliability. +Feedback helps improve AI performance over time and gives you a way to track agent reliability. A note that teaches the agent something becomes a lesson, applied to that agent's future runs — see [Learning](/docs/user-guide/orioniq/create-agent/#learning) in the agent's configuration for the on/off toggle and how lessons are billed. You can monitor feedback scores and coverage across all your agents from the [Usage & Performance Dashboard](/docs/user-guide/orioniq/usage-performance/), and submit or read feedback programmatically with the [OrionIQ API](/docs/user-guide/orioniq/api/). diff --git a/docs/user-guide/orioniq/create-agent.md b/docs/user-guide/orioniq/create-agent.md index 2280e100..a4304ed3 100644 --- a/docs/user-guide/orioniq/create-agent.md +++ b/docs/user-guide/orioniq/create-agent.md @@ -91,12 +91,18 @@ Account-wide limits are set separately — see [Settings → Capping](/docs/user Pick the observability platform and accounts this agent can query. Toggle the scope chips to choose Logs, Metrics, or both — each scope has its own accounts list. -Which scopes you have to fill in follows the **Agent tools** you chose above: an agent declaring a logs tool set needs a logs data source, and the agent won't save until every declared scope has one. +Data Sources is available for every trigger type. Which scopes you have to fill in follows the **Agent tools** you chose above: a scheduled agent declaring a logs tool set needs a logs data source, and it won't save until every declared scope has one. For API, Alert, and Deployment agents, picking a data source is optional. + +When you create an alert-linked AI analysis agent, it starts with the accounts named in the alert, and you can edit them here. If the alert queries all accounts, the agent follows the alert instead and picks up new sub-accounts. Later changes to the alert don't overwrite the accounts you saved. If you remove every account, the agent falls back to the alert's accounts. + +**Allow Logz.io API access** lets the agent read from your Logz.io accounts through the Logz.io public API, using a token OrionIQ provisions. It is off by default, for new agents and for templates that don't turn it on. The checkbox appears for agents that use a logs tool set and stays disabled until at least one selected Logz.io account has API Read enabled in **Integrations > Management**. If your connections fail to load, it is disabled with a note asking you to refresh. An agent without a logs data source always saves with API access off. For the scopes, see [Logz.io API access](/docs/user-guide/orioniq/integrations/#logzio-api-access). ### Integrations Connect third-party tools — Slack, Jira, Confluence, and the rest — that this agent can use as context. Only integrations your account has already connected are available here; connect new ones from the [Integrations](/docs/user-guide/orioniq/integrations/) page. +An integration you add to an agent must be connected before you can save. If its connection needs reauthentication or has expired, the save is blocked until you reconnect it or remove it. An integration that is only unreachable shows a warning and doesn't block the save. Integrations the agent already had never block it. **Select all** adds every available integration to your current selection instead of replacing it. + ### Notification recipients Configure where agent results are sent after each invocation. You can select from: @@ -104,6 +110,18 @@ Configure where agent results are sent after each invocation. You can select fro - **Email addresses** of team members. - **Pre-configured notification endpoints** such as Slack channels, Microsoft Teams webhooks, or custom API endpoints. +### Learning + +Agents can learn from the feedback you leave on their invocations (see [Provide feedback](/docs/user-guide/orioniq/agents-hub/#provide-feedback)) — a written note that teaches the agent something becomes a lesson, applied to its future runs. Lessons are advisory: they never override the agent's runbook or your account instructions. + +**Learn from feedback** is on by default for every agent. Use the toggle to pause it: the agent keeps the lessons it already has, but stops accepting new ones and stops applying any of them to its runs until you turn learning back on. Nothing is deleted. + +An agent can hold up to 20 active lessons at a time. As that limit gets close, a warning appears here; once it's reached, new feedback is acknowledged but produces no further lessons until you disable an existing one to make room. + +:::note +Writing a note is billed once it's accepted for review, whether or not it ends up teaching the agent anything: the first 20 reflections per account are free (all-time), then $1 each. +::: + ## Finalize and create Once you've reviewed the agent definition and configured the settings, click **Create Agent**. The agent becomes available in the [Agents Hub](/docs/user-guide/orioniq/agents-hub/) where you can monitor its invocations and manage its settings. diff --git a/docs/user-guide/orioniq/marketplace.md b/docs/user-guide/orioniq/marketplace.md index 6d78faa2..209e86c8 100644 --- a/docs/user-guide/orioniq/marketplace.md +++ b/docs/user-guide/orioniq/marketplace.md @@ -27,9 +27,32 @@ Agent templates are organized into the following categories: Use the search bar at the top of the page to find specific agent templates, or click a category tab to filter the list. -## Install an agent template +## Activate an agent template -To install an agent template, find the template you want and click **Install**. The agent is added to your [Agents Hub](/docs/user-guide/orioniq/agents-hub/) where you can configure its trigger, notification recipients, and other settings before activating it. +To activate an agent template, click **View details** on its card, then click **Activate**. The preview turns into a short setup dialog, and the agent is created switched on. + +The template decides which sections the dialog shows. A section appears only when the template lets you change it. Anything hidden keeps the template's value. + +| Section | What you set | +|---|---| +| **Trigger** | The trigger type and, for a scheduled agent, the schedule. | +| **Runbook** | The instructions for agents triggered by an API call, an alert, or a deployment. A scheduled agent shows its context message and run frequency instead. | +| **Output detail** | **Summary** by default, unless the template sets a level. | +| **Data sources** | The accounts the agent reads from. For an agent that reads logs, the account you are on is selected by default. | +| **Integrations** | The integrations the agent can use. | +| **Notification recipients** | Who gets notified of the agent's results. | + +Data sources, Integrations, and Notification recipients appear as one-line summaries that expand in place. If something required is missing, such as a data source or a reconnected integration, the row opens so you can fix it. + +Learning is off for agents activated from the Marketplace, because it is billed separately. You can turn it on later in the agent's **Agent details** form. See [Learning](/docs/user-guide/orioniq/create-agent/). + +Click **All settings** to move your draft into the full agent form in the side panel, with everything you entered so far. Click **Show details** or **Hide details** to switch between the template description and the setup form. + +If you close the dialog after changing the setup, OrionIQ asks before it discards your changes. + +After you click **Activate agent**, a confirmation shows how the agent runs. Click **Open in Agents Hub** to see the new agent in the [Agents Hub](/docs/user-guide/orioniq/agents-hub/), filtered to the template's agent type. + +You can activate a template more than once. Once agents exist for a template, its card and preview show the number of active agents. Click it to open the Agents Hub filtered to those agents. To switch an agent off, use the Agents Hub. If a template you're interested in is not yet available, click **Add to Wish List** to signal your interest. This helps Logz.io prioritize which templates to build next.