feat(investigations): Improve breached metric analysis

Rewrite the breached metric template into evidence-backed sections and expose resolved source context to Code Mode. Persist fenced completion metadata and expose its generation status to list consumers.

Author: arslnb

src/sentry/investigations/agent.py

@@ -86,6 +86,9 @@ class TitleGenerationStatus(StrEnum):
 import type helpers. Time-axis
 x values must be offset-bearing ISO 8601 timestamps. If the question cannot be answered with telemetry, ask the user an
 inline clarification. Finish by returning exactly one raw JSON object in your final response.
+The source object in investigation_context is authoritative resolved source context, not a
+template parameter. Use source.snapshot for supplied monitor, project, threshold, condition,
+dataset, and analysis-window facts; do not report them missing merely because parameters is empty.
 When notebookContext contains an item with currentBlock=true, it is the last successful result for
 the block being refined. Reuse its table and chart data for presentation-only requests such as
 changing line, area, or bar visualization; do not claim the data is unavailable or query it again.
@@ -119,6 +122,8 @@ def build_agent_prompt(execution: InvestigationBlockExecution) -> str:
     )
     context = {
         "request": snapshot.get("prompt"),
+        "organizationSlug": snapshot.get("organizationSlug"),
+        "source": snapshot.get("source", {}),
         "projectSlugs": snapshot.get("projectSlugs", []),
         "filters": snapshot.get("filters", {}),
         "parameters": snapshot.get("parameters", {}),
@@ -889,6 +894,7 @@ def _completion_block_context(block: InvestigationBlock) -> str:
 
 
 def _parse_completion_metadata(content: str) -> dict[str, str] | None:
+    content = _strip_json_code_fence(content)
     try:
         payload = json.loads(content)
     except ValueError:
@@ -924,6 +930,18 @@ def _parse_completion_metadata(content: str) -> dict[str, str] | None:
     }
 
 
+def _strip_json_code_fence(content: str) -> str:
+    stripped = content.strip()
+    lines = stripped.splitlines()
+    if (
+        len(lines) >= 3
+        and lines[0].strip().lower() in {"```", "```json"}
+        and lines[-1].strip() == "```"
+    ):
+        return "\n".join(lines[1:-1]).strip()
+    return stripped
+
+
 def title_generation_preview(content: str | None) -> str | None:
     if not content:
         return None

src/sentry/investigations/endpoints/serializers/investigation.py

@@ -59,6 +59,7 @@ class InvestigationSerializerResponse(TypedDict):
     version: int
     blockCount: int
     isFavorited: bool
+    titleGeneration: InvestigationTitleGenerationSerializerResponse
 
 
 class InvestigationDetailsSerializerResponse(InvestigationSerializerResponse):
@@ -68,7 +69,6 @@ class InvestigationDetailsSerializerResponse(InvestigationSerializerResponse):
     projectIds: list[int]
     parameters: list[InvestigationParameterSerializerResponse]
     blocks: list[InvestigationBlockSerializerResponse]
-    titleGeneration: InvestigationTitleGenerationSerializerResponse
 
 
 @register(Investigation)
@@ -124,6 +124,7 @@ def serialize(
             "version": obj.version,
             "blockCount": attrs["block_count"],
             "isFavorited": attrs["is_favorited"],
+            "titleGeneration": {"status": obj.title_generation_status},
         }
 
 

src/sentry/investigations/services/executions.py

@@ -321,6 +321,8 @@ def build_block_execution_snapshot(
                 )
     snapshot: dict[str, Any] = {
         "prompt": prompt,
+        "organizationSlug": block.investigation.organization.slug,
+        "source": block.investigation.source,
         "filters": block.investigation.filters,
         "parameters": parameters,
         "dependencies": dependencies,

src/sentry/investigations/templates/breached_metric.py

@@ -1,66 +1,177 @@
 from sentry.investigations.models import InvestigationBlockKind, InvestigationSourceType
 from sentry.investigations.templates.types import InvestigationTemplateSpec, TemplateBlockSpec
 
+SHORT_LINKED_SUMMARY_INSTRUCTIONS = (
+    "Use at most three short sentences or three compact bullets total. Preserve useful Markdown "
+    "links from the evidence. Link concrete Sentry issues, releases, transactions, or other pages "
+    "when the evidence contains a valid URL or identifier; never invent a URL or identifier."
+)
+LINKED_EVIDENCE_INSTRUCTIONS = (
+    "Include concise Markdown links to relevant Sentry issues, releases, transactions, or other "
+    "pages when telemetry returns a concrete URL or identifier. Use organizationSlug from the "
+    "investigation context for relative Sentry paths when needed; never guess a URL or identifier."
+)
+
 BREACHED_METRIC_TEMPLATE = InvestigationTemplateSpec(
     key="breached_metric",
     version=1,
     source_type=InvestigationSourceType.METRIC_OPEN_PERIOD,
     parameters=(),
     blocks=(
         TemplateBlockSpec(
-            key="metric_chart",
+            key="monitor_summary",
+            kind=InvestigationBlockKind.TEXT,
+            title="Monitor context",
+            generation_prompt=(
+                "Summarize only the Monitor details evidence for a human responder. State the "
+                "monitor name and query, affected project and environment when known, threshold "
+                "and breach direction, and supplied open-period time range. Do not speculate about "
+                "the cause. " + SHORT_LINKED_SUMMARY_INSTRUCTIONS
+            ),
+            config={"autoRun": True},
+            display={"type": "markdown"},
+            dependencies=("monitor_evidence",),
+        ),
+        TemplateBlockSpec(
+            key="monitor_evidence",
             kind=InvestigationBlockKind.QUERY,
-            title="Breached metric",
+            title="Monitor details",
+            generation_prompt=(
+                "Use the supplied metric issue, monitor definition, project, open-period window, "
+                "threshold, and direction. Query the exact supplied monitor definition over the "
+                "open period and an equal pre-breach baseline. Return a compact table of the "
+                "monitor facts and the most useful baseline and open-period values. Preserve the "
+                "exact query and time range; do not infer missing monitor configuration. "
+                + LINKED_EVIDENCE_INSTRUCTIONS
+            ),
+            config={"autoRun": True},
+            display={"version": 1, "type": "table", "defaultView": "table"},
+        ),
+        TemplateBlockSpec(
+            key="spike_summary",
+            kind=InvestigationBlockKind.TEXT,
+            title="What happened",
             generation_prompt=(
-                "Query the exact supplied monitor definition over the supplied analysis window. "
-                "Make the breach immediately visible in a time-series chart spanning the equal "
-                "pre-breach baseline and open-period portions. Plot the observed metric and the "
-                "supplied threshold or comparison as separate series so the crossing is clear. "
-                "Use the monitor time window for the chart interval when supported."
+                "Summarize only the Metric spike evidence. Describe when the ramp-up began, the "
+                "peak value and time, how long the breach lasted, and whether the signal recovered "
+                "or remained elevated. State uncertainty when sparse telemetry does not establish "
+                "one of those facts. " + SHORT_LINKED_SUMMARY_INSTRUCTIONS
+            ),
+            config={"autoRun": True},
+            display={"type": "markdown"},
+            dependencies=("spike_evidence",),
+        ),
+        TemplateBlockSpec(
+            key="spike_evidence",
+            kind=InvestigationBlockKind.QUERY,
+            title="Metric spike",
+            generation_prompt=(
+                "Query the exact supplied monitor definition over the supplied open period and an "
+                "equal pre-breach baseline. Make the ramp-up, peak, and ramp-down or recovery "
+                "visible in a time-series chart. Plot the observed metric and supplied threshold "
+                "or comparison as separate series so the crossing is clear. Use the monitor time "
+                "window for the chart interval when supported, and do not invent missing points. "
+                + LINKED_EVIDENCE_INSTRUCTIONS
             ),
             config={"autoRun": True, "preferChart": True},
             display={"version": 1, "type": "table", "defaultView": "chart"},
+            dependencies=("monitor_evidence",),
         ),
         TemplateBlockSpec(
-            key="overview",
+            key="issues_summary",
             kind=InvestigationBlockKind.TEXT,
-            title="Overview",
+            title="What caused the spike",
             generation_prompt=(
-                "Give the reader a useful overview of this breached metric using the supplied "
-                "monitor, open-period, project, threshold, direction, and analysis-window facts. "
-                "Accurately describe whether this is an upward or downward breach. Do not claim a "
-                "cause before examining the telemetry. Keep the overview to two short paragraphs."
+                "Summarize only the Contributing issues evidence. Identify the issue groups that "
+                "best account for the spike, including their counts, change from baseline, and "
+                "relative contribution when available. If no issue groups convincingly explain "
+                "the metric change, say that clearly. " + SHORT_LINKED_SUMMARY_INSTRUCTIONS
             ),
             config={"autoRun": True},
             display={"type": "markdown"},
+            dependencies=("issues_evidence",),
         ),
         TemplateBlockSpec(
-            key="synthesis",
+            key="issues_evidence",
+            kind=InvestigationBlockKind.QUERY,
+            title="Contributing issues",
+            generation_prompt=(
+                "Using the Metric spike evidence to preserve the spike window, compare issue-group "
+                "telemetry during the open period with the equal pre-breach baseline. Rank issue "
+                "groups by the strongest supported contribution using absolute counts, change "
+                "from baseline, and share of the spike. Prefer a bar chart with a compact table "
+                "when useful, and include issue links only when the telemetry provides valid ones. "
+                "Treat no supporting issue groups as a valid result; never fabricate attribution. "
+                + LINKED_EVIDENCE_INSTRUCTIONS
+            ),
+            config={"autoRun": True, "preferChart": True},
+            display={"version": 1, "type": "table", "defaultView": "chart"},
+            dependencies=("spike_evidence",),
+        ),
+        TemplateBlockSpec(
+            key="tags_summary",
             kind=InvestigationBlockKind.TEXT,
-            title="What explains the change",
+            title="Why those issues spiked",
             generation_prompt=(
-                "Explain what the breached-metric result above and contributor result below show "
-                "together. Focus on evidence, distinguish correlation from causation, and state "
-                "uncertainty when the telemetry does not establish a convincing explanation. Keep "
-                "the answer to two or three short paragraphs unless a tiny table is essential."
+                "Summarize only the Issue tag changes evidence. Explain which dimensions changed "
+                "most during the spike and what explanation, if any, those distribution changes "
+                "support. Distinguish evidence from hypotheses and say when the slices do not "
+                "establish a convincing explanation. " + SHORT_LINKED_SUMMARY_INSTRUCTIONS
             ),
             config={"autoRun": True},
             display={"type": "markdown"},
-            dependencies=("metric_chart", "contributors"),
+            dependencies=("tags_evidence",),
         ),
         TemplateBlockSpec(
-            key="contributors",
+            key="tags_evidence",
             kind=InvestigationBlockKind.QUERY,
-            title="Likely contributors",
+            title="Issue tag changes",
             generation_prompt=(
-                "Compare telemetry during the supplied open-period window with its equal baseline. "
-                "Use as many supported telemetry calls and local transformations as useful. Let "
-                "the evidence determine whether issue groups, tags, or other metadata best explain "
-                "the change, then chart the strongest available evidence. If no convincing "
-                "contributor exists, show the most useful evidence and say so in the result."
+                "Slice the contributing issue groups by supported dimensions that can explain the "
+                "change, such as release, transaction, environment, region, browser, device, or "
+                "other useful tags. Compare each distribution during the open period with the "
+                "equal pre-breach baseline; do not rank raw spike volume without that comparison. "
+                "Chart the strongest supported distribution changes and retain a compact table "
+                "when useful. Do not invent unavailable tags or claim causation from correlation. "
+                + LINKED_EVIDENCE_INSTRUCTIONS
             ),
             config={"autoRun": True, "preferChart": True},
             display={"version": 1, "type": "table", "defaultView": "chart"},
+            dependencies=("issues_evidence",),
+        ),
+        TemplateBlockSpec(
+            key="trigger_summary",
+            kind=InvestigationBlockKind.TEXT,
+            title="Likely trigger and next steps",
+            generation_prompt=(
+                "Summarize only the Release and infrastructure signals evidence. Classify the "
+                "result as code-related, infrastructure-related, mixed, or insufficient evidence. "
+                "Distinguish correlation from causation, name the strongest supported finding, and "
+                "give concrete next steps a human can take. Present external observability checks "
+                "as suggestions rather than findings. " + SHORT_LINKED_SUMMARY_INSTRUCTIONS
+            ),
+            config={"autoRun": True},
+            display={"type": "markdown"},
+            dependencies=("trigger_evidence",),
+        ),
+        TemplateBlockSpec(
+            key="trigger_evidence",
+            kind=InvestigationBlockKind.QUERY,
+            title="Release and infrastructure signals",
+            generation_prompt=(
+                "Use the supplied spike window together with the contributing issue and tag "
+                "evidence. Check supported Sentry telemetry for releases, deployments, affected "
+                "services or transactions, and infrastructure-like patterns correlated with the "
+                "change. Return a compact evidence table containing only observed signals and "
+                "their timing. If Sentry cannot inspect relevant infrastructure directly, include "
+                "specific suggested external checks such as affected pods or services in Datadog, "
+                "clearly labeled as follow-up checks rather than findings. Never fabricate release, "
+                "deployment, infrastructure, or external-observability data. "
+                + LINKED_EVIDENCE_INSTRUCTIONS
+            ),
+            config={"autoRun": True},
+            display={"version": 1, "type": "table", "defaultView": "table"},
+            dependencies=("spike_evidence", "issues_evidence", "tags_evidence"),
         ),
     ),
 )

tests/sentry/investigations/endpoints/serializers/test_investigation.py

@@ -38,6 +38,7 @@ def test_serializes_the_list_representation(self) -> None:
             "version": 1,
             "blockCount": 0,
             "isFavorited": False,
+            "titleGeneration": {"status": None},
         }
 
     def test_counts_only_active_blocks(self) -> None:

tests/sentry/investigations/services/test_executions.py

@@ -202,6 +202,33 @@ def test_canonicalizes_project_scope(self) -> None:
         assert execution.input_snapshot["projectIds"] == [project.id for project in expected]
         assert execution.input_snapshot["projectSlugs"] == [project.slug for project in expected]
 
+    def test_snapshots_the_resolved_investigation_source(self) -> None:
+        source = {
+            "type": "metric_open_period",
+            "ref": {"groupId": "30", "openPeriodId": "85"},
+            "snapshot": {
+                "analysisWindow": {
+                    "baselineStart": "2026-08-11T01:21:15+00:00",
+                    "breachStart": "2026-08-14T23:56:02+00:00",
+                    "end": "2026-08-18T22:30:49+00:00",
+                },
+                "monitor": {
+                    "name": "Mobile API error volume",
+                    "query": "fixture_metric:mobile-api-errors",
+                    "aggregate": "count()",
+                    "direction": "above",
+                },
+            },
+        }
+        self.investigation.update(source=source)
+        block = self.create_block()
+
+        execution, created = self.run_block(block)
+
+        assert created
+        assert execution.input_snapshot["organizationSlug"] == self.organization.slug
+        assert execution.input_snapshot["source"] == source
+
     def test_revalidates_project_parameter_access(self) -> None:
         cases: list[tuple[InvestigationParameterType, Callable[[int], Any]]] = [
             (InvestigationParameterType.PROJECT, lambda project_id: project_id),