feat(ops): auto-resolve PagerDuty incidents once ops anomalies clear

[bitfathers94]

feat(ops): auto-resolve PagerDuty incidents once ops anomalies clear

runOpsAlerts now tracks previous-tick anomaly state per repo via the
pagerduty audit-event row the trigger already writes: on a tick where a
repo is healthy but its newest completed external_notification.pagerduty
event for the ops_anomaly dedup key was a trigger (not yet a resolve),
it sends a matching PagerDuty resolve so the incident auto-closes.

• add resolvePagerDutyIncident (Events API resolve action; no severity
  floor or cooldown, best-effort/never-throws like the trigger path)
• add latestCompletedAuditEventDetail repository helper as the durable,
  isolate-surviving previous-tick state (no bespoke table needed)
• cover the two-tick clear-and-resolve path plus resolve HTTP delivery

Closes #8903

Validation

Verified locally on this branch before opening:

• npm run typecheck
• npx turbo run build:tsc build:verify
• npm run test:coverage — patch coverage 100.0% of changed lines

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.09%. Comparing base (469e8e6) to head (38c307e).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8942      +/-   ##
==========================================
+ Coverage   90.56%   91.09%   +0.53%     
==========================================
  Files          96       99       +3     
  Lines       22490    24535    +2045     
  Branches     3884     4548     +664     
==========================================
+ Hits        20367    22350    +1983     
- Misses       1945     1954       +9     
- Partials      178      231      +53     

Flag	Coverage Δ
backend	96.96% <100.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/db/repositories.ts	96.75% <100.00%> (ø)
src/review/ops-wire.ts	98.88% <100.00%> (ø)
src/services/notify-pagerduty.ts	100.00% <100.00%> (ø)

[loopover-orb]

Tip

✅ LoopOver review result - approve/merge recommended

_{Review updated: 2026-07-26 14:15:12 UTC}

5 files · 1 AI reviewer · no blockers · readiness 93/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This closes #8903 by adding a matching PagerDuty resolve event when a repo's ops anomalies clear, using the audit_events row the existing trigger path already writes as durable previous-tick state (no new table/migration needed). The logic is correct: latestCompletedAuditEventDetail filters to outcome="completed" rows only, so denied/error trigger attempts (no real incident opened) are correctly ignored, and a repeat healthy tick sees detail="resolved" and skips re-resolving. Test coverage is solid, including a full two-tick trigger→resolve lifecycle test and the resolve-path unit tests (flag off, no key, HTTP failure, network failure, cooldown-immunity).

Nits — 4 non-blocking

• notify-pagerduty.ts:223 latestCompletedAuditEventDetail lookup filters actor="loopover" only, so an incident triggered under the pre-rebrand "gittensory" actor (still consulted for cooldown counting) won't be recognized as open by the new auto-resolve branch — narrow, rebrand-boundary-only edge case worth a one-line note or the same dual-actor check used in triggerPagerDutyIncident's cooldown lookup.
• repositories.ts:2883 the new latestCompletedAuditEventDetail helper has no test file shown in this diff for db/repositories.ts itself, though it's exercised indirectly via the ops-wire integration tests.
• The magic numbers (5000ms timeout, 200/280 char slices) in resolvePagerDutyIncident just mirror the existing triggerPagerDutyIncident constants inline rather than introducing new unexplained values — consistent with the file's existing style, not a new smell.
• Consider extracting the shared dual-actor (`loopover`/`gittensory`) lookup pattern used in triggerPagerDutyIncident's cooldown check into a small helper that latestCompletedAuditEventDetail-based resolve logic could also use, closing the rebrand-boundary gap noted above.

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ✅ Gate result — Passing (No configured blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#8903
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 41 registered-repo PR(s), 32 merged, 0 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	bitfathers94; Gittensor profile; 41 PR(s), 0 issue(s).
Improvement	✅ Minor	risk: clean · value: minor · LLM: moderate

Linked issue satisfaction

Addressed
The PR persists previous-tick state via the existing pagerduty audit_events row (latestCompletedAuditEventDetail), adds resolvePagerDutyIncident and wires it into runOpsAlerts so a repo whose anomalies clear triggers a PagerDuty resolve, and includes a two-tick test asserting trigger then resolve dedup_key events plus HTTP delivery/edge-case coverage.

Review context

• Author: bitfathers94
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: TypeScript
• Official Gittensor activity: 41 PR(s), 0 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Start here: Triage stale or unlinked PRs.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

LoopOver approves — the gate is satisfied and CI is green.