Phase 7: AI-assisted query authoring (autocomplete, explain, fix, optimize, NL translation)

Adds a self-hosted (Ollama, qwen2.5-coder) model provider abstraction
with a pluggable opt-in cloud adapter, schema grounding, and a shared
cost/safety guard every AI-suggested query is assessed against --
compiling to and executing through the same unchanged Phase 2 IR/
compiler and Phase 4 tenant scoping as a hand-written query, no
parallel execution path.

Track A (built into the query bar): inline ghost-text autocomplete,
"Explain this query", "Fix this query" with a diff view, and a
rule-based "Optimize" suggestion. Track B: natural-language-to-query
translation, always a separate review step from execution, with
`sentryctl query --nl` requiring explicit confirmation to run.
Every accepted/dismissed translate-fix-optimize interaction is logged
into the same append-only audit_log table Phase 4 built.

Two real product bugs were found and fixed via live browser
verification (a Svelte effect re-running on every keystroke that
silently cancelled the ghost-text debounce; a ghost-text widget
positioned at document offset 0 instead of the cursor), and a real
costguard logic bug (unbounded-aggregation vs. raw-row) was caught by
its own test suite. New integration tests wire a real Ollama client
through the real HTTP handler against a mock server matching Ollama's
wire contract (hack/mock-ollama), keeping model-quality verification
out of CI as a disclosed, periodic human-run check instead.

See /docs/phase-7-ai-design.md and /docs/phase-7-runbook.md.

enterprise/cmd/enterprise-api/main.go

@@ -42,6 +42,9 @@ import (
 	chdriver "github.com/ClickHouse/clickhouse-go/v2"
 	"github.com/jackc/pgx/v5/pgxpool"
 
+	"github.com/sentry/sentry/api/ai/aiapi"
+	"github.com/sentry/sentry/api/ai/provider/ollama"
+	"github.com/sentry/sentry/api/ai/router"
 	"github.com/sentry/sentry/api/authz"
 	"github.com/sentry/sentry/api/dashboards"
 	"github.com/sentry/sentry/api/httpserver"
@@ -50,12 +53,17 @@ import (
 	"github.com/sentry/sentry/enterprise/internal/apiconfig"
 	"github.com/sentry/sentry/enterprise/internal/audit"
 	"github.com/sentry/sentry/enterprise/internal/chrunner"
+	"github.com/sentry/sentry/enterprise/internal/groundingregistry"
 	"github.com/sentry/sentry/enterprise/internal/rbacstore"
 	"github.com/sentry/sentry/enterprise/internal/searchclient"
 	"github.com/sentry/sentry/enterprise/internal/tenantcrd"
 	"github.com/sentry/sentry/enterprise/internal/tenantprovision"
 )
 
+// groundingRefreshInterval matches api/cmd/api's own constant of the
+// same name and reasoning -- see that file's doc comment.
+const groundingRefreshInterval = time.Minute
+
 func main() {
 	logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
 
@@ -161,6 +169,27 @@ func main() {
 	queryHandler.RegisterRoutes(mux) // also registers GET /healthz
 	dashboardsHandler.RegisterRoutes(mux)
 
+	// Same "off unless OLLAMA_BASE_URL is set" gate as api/cmd/api --
+	// see that file's doc comment.
+	if cfg.AI.OllamaBaseURL != "" {
+		groundingReg := groundingregistry.New(registry)
+		groundingReg.StartRefreshing(ctx, rbac.ListActiveTenantIDs, groundingRefreshInterval, logger)
+
+		defaultProvider := ollama.New(cfg.AI.OllamaBaseURL, cfg.AI.OllamaModel)
+		aiRouter := router.New(defaultProvider)
+		if cfg.AI.OllamaFastModel != "" && cfg.AI.OllamaFastModel != cfg.AI.OllamaModel {
+			aiRouter.SetOperation(router.OpComplete, ollama.New(cfg.AI.OllamaBaseURL, cfg.AI.OllamaFastModel))
+		}
+
+		// Reuses the same audit_writer-role pool/store auditLogger above
+		// writes through -- same append-only audit_log table, new
+		// event_type (see metadata/migrations/0036).
+		interactionLogger := audit.NewAIInteractionLogger(audit.NewStore(auditPool), audit.SourceAPI)
+		aiHandler := aiapi.NewHandler(logger, aiRouter, groundingReg, authorizer, interactionLogger)
+		aiHandler.RegisterRoutes(mux)
+		logger.Info("ai routes enabled", "ollama_base_url", cfg.AI.OllamaBaseURL, "model", cfg.AI.OllamaModel)
+	}
+
 	srv := &http.Server{
 		Addr:    cfg.HTTPListenAddr,
 		Handler: httpserver.WithCORS(mux, cfg.CORSAllowedOrigin),

enterprise/cmd/enterprise-auth/main.go

@@ -1,5 +1,6 @@
 // Command enterprise-auth is Sentry's SSO/tenant-provisioning/RBAC
-// service (commercial license, not AGPL) -- see
+// service (AGPLv3, same as core -- see
+// /docs/compliance/license-audit-report.md) -- see
 // /docs/phase-4-isolation-design.md and /docs/phase-4-rbac-design.md.
 //
 // Wires session issuance/validation (internal/session), the