### Problem to Solve Orbit in DAP is opt-in per user: `UserPreference#orbit_settings` starts as `{}`, which resolves the killswitch to `false`, so nobody gets Orbit tools in Agentic Chat, the Orbit agent, or other foundational agents until they find the Preferences checkbox. A Self-Managed admin who has already configured Orbit and enrolled namespaces has no way to turn it on for everyone, the same way `/admin/orbit` now offers "Index root namespaces automatically" (gitlab-org/gitlab!253942). ### Proposed Solution - One boolean instance setting, `orbit_dap_enabled_by_default`, shown as a checkbox on `/admin/orbit` next to the auto-index setting. Default off. - When on, users who never saved an Orbit preference (`enabled` key absent) resolve the killswitch to `true`. The four subsettings (gitlab-org/gitlab!234806) already default to `true` when the killswitch is on, so all checkboxes flip on. - Explicit user choices (`enabled: false` or `true`) always win over the instance default. - Store it as a second key in the existing `ApplicationSetting#orbit_settings` JSONB; no migration. - Keep the setting off on GitLab.com until the default-on exit criteria in gitlab-org/gitlab#607084 are met. Related: gitlab-org/gitlab#607084, #598704, #598726, #598922. <details> <summary><b>Agent context</b>: extended analysis, alternatives considered, related-code dumps</summary> Findings from a research leg run against GDK master (`bb396f12`), independently reproduced by a second agent. **Resolution path.** `EE::UserPreference#orbit_enabled` is `orbit_settings.fetch('enabled', false)` and is the single backend read point: `Ai::Orbit::Settings#killswitch_on?` and `#subsetting_enabled?` (hence `agent_enabled?`, `chat_enabled?`, `foundational_enabled?`, `custom_agents_enabled?`), `McpConfigService#orbit_enabled_for_flow?`, `FoundationalChatAgentsFinder`, the dashboard helper, and `Gitlab::DuoWorkflow::OrbitLocalSetup` all reach it. The preferences HAML binds via `User` delegates to the same accessor, so an unset checkbox renders checked once the getter returns the instance default. Changing the getter to `orbit_settings.key?('enabled') ? orbit_settings['enabled'] : Gitlab::CurrentSettings.orbit_dap_enabled_by_default` is sufficient for the backend and HAML. **Two surfaces bypass or destroy the unset state and must also change:** 1. `OrbitToggle` (`ee/app/assets/javascripts/ai/duo_agentic_chat/components/orbit_toggle.vue`) reads raw `UserPreferencesType#orbitSettings` JSON and computes `enabled === true` / `subsetting === true` client-side. `{}` renders and emits off regardless of the instance default. Fix: expose an *effective* projection (main flag plus four effective subsettings) from the EE `Types::UserPreferencesType`; keep raw JSON for persistence/merge. 2. The `/preferences` form emits a hidden `0` plus checkbox `1` for the main checkbox and all four subsettings. Reproduced with a controller spec: saving an unrelated preference converts `{}` into five explicit `false` keys, which would permanently opt the user out of the instance default. Fix: in the EE preferences-controller extension, permit the five Orbit params only when at least one submitted value differs from the current effective value. Alternatives (JS dirty marker, separate Orbit form, tri-state column) are broader; JSON key absence already models "inherit". **Historical rows.** Existing `enabled: false` rows may come from a real opt-out, the earlier single-checkbox form, or an unrelated whole-form save; intent cannot be reconstructed. Treat them as explicit off; count by JSON shape in production before rollout. Self-Managed upper-bound query: ```sql SELECT count(*) FROM users LEFT JOIN user_preferences ON user_preferences.user_id = users.id WHERE users.state = 'active' AND (user_preferences.id IS NULL OR NOT (user_preferences.orbit_settings ? 'enabled')); ``` **Storage / admin / API.** Add `orbit_dap_enabled_by_default: [:boolean, { default: false }]` to `jsonb_accessor :orbit_settings` in `ee/app/models/ee/application_setting.rb`; add the property to `ee/app/validators/json_schemas/application_setting_orbit_settings.json` (`additionalProperties: false`); register it in `ee/app/models/analytics/knowledge_graph/settings.rb`, which fans out to `Admin::OrbitController` params, `visible_attributes`, the admin checkbox helper, `InfoService` / `gitlab:orbit:info`, and `/application/settings`. Update both OpenAPI application-setting schema occurrences, `doc/integration/orbit.md`, `locale/gitlab.pot`, changelog trailer. No migration, `structure.sql`, or database review. **Gating.** `Ai::Orbit::Settings.platform_available?` checks `Analytics::KnowledgeGraph.enabled_for?` plus the `orbit_foundational_agent` FF, not license or SaaS enrollment; `user_preference_section_visible?` adds those. Keep runtime gates unchanged — the setting is a fallback preference, not an availability bypass. Reuse the `/admin/orbit` SM/Dedicated + `:orbit` license gate for the checkbox. Scope note: `OrbitLocalSetup` uses the killswitch without `platform_available?`, so the instance default also enables the DAP local-index path when `duo_developer_orbit` is on; consistent with "Orbit in DAP by default", separate that caller only if remote MCP is the intended scope. **Spec list.** `ee/spec/models/user_preference_spec.rb` (unset × default off/on, explicit precedence), `ee/spec/models/ai/orbit/settings_spec.rb` (four predicates under both defaults, team-member shortcut, platform gates), `ee/spec/controllers/ee/profiles/preferences_controller_spec.rb` (untouched-save preserves unset under both defaults; toggling persists explicit), `ee/spec/views/profiles/preferences/show.html.haml_spec.rb`, GraphQL `UserPreferencesType` effective projection, `orbit_toggle_spec.js`, `ee/spec/requests/admin/orbit_controller_spec.rb`, plus registry/helper/info-service specs. </details>