Enable Orbit and Knowledge Graph feature flags by default
What does this MR do and why?
Enables the Orbit / Knowledge Graph feature flags by default so Orbit can reach GA on GitLab Dedicated, which does not support non-default-enabled flags.
Defaulting knowledge_graph on would surface the Orbit UI on instances where the Knowledge Graph service isn't wired up. To avoid that, this MR also gates user-facing Orbit availability on the existing instance config knowledge_graph.enabled (gitlab.yml / Helm global.appConfig.knowledgeGraph.enabled) through a new module-level predicate Analytics::KnowledgeGraph.enabled_for?, mirroring Search::Zoekt.search_enabled?.
Feature flag changes
| Flag | Type | Change |
|---|---|---|
knowledge_graph |
wip -> beta |
default_enabled: true |
orbit_mcp_command_tools |
gitlab_com_derisk -> beta |
default_enabled: true |
orbit_foundational_agent |
gitlab_com_derisk -> beta |
default_enabled: true |
orbit_user_preference |
beta |
default_enabled: true |
knowledge_graph_infra |
ops |
default_enabled: true |
orbit_use_legacy_tools |
ops |
default_enabled: false |
wip and gitlab_com_derisk flags cannot be default_enabled: true (can_be_default_enabled: false in Feature::Shared::TYPES), so the three affected flags are graduated to beta and moved to ee/config/feature_flags/beta/.
Gating Orbit on instance configuration
Analytics::KnowledgeGraph.enabled_for?(user) is the single place that composes service_configured? (reads knowledge_graph.enabled) with the knowledge_graph flag; accessible_for? layers the :orbit license on top. The user-facing surfaces (nav menu, dashboard controller, Orbit data + MCP APIs, the orbit_update mutation, the admin global_policy condition, Ai::Orbit::Settings#platform_available?, and the frontend feature-flag gon push) all route through it. On an instance with the service unconfigured, Orbit stays hidden even with the flags on and an :orbit license present.
The backend indexing paths (branch_push_service, api/internal/orbit, api/admin/knowledge_graph, search_subscriptions) intentionally keep gating on knowledge_graph_infra directly - they are the service itself, not the user-facing layer.
The upsell empty state is preserved: /dashboard/orbit renders for signed-in users without an :orbit license (the license gate applies to data, not to the onboarding entry point).
MR acceptance checklist
This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.
- I have evaluated the MR acceptance checklist for this MR.
References
Related to #600633 Related to #583676 Related to #598922 Related to #602095