# Report SQL token preservation

<!-- auto-oncall-optimization-record
{
  "schemaVersion": "auto-oncall-optimization-record-v1",
  "optimizationId": "report-sql-token-preservation-2026-07-20",
  "problems": [
    {
      "problemId": "report-sql-token-corruption",
      "summary": "Report sanitization corrupts SQL comparison operators and qualified identifiers before evaluation.",
      "status": "optimized_verified",
      "issueKeys": ["APID-29196"],
      "sourceRefs": [],
      "signalTextIncludesAny": ["alias scope", "comparison operator", "correlated alias", "d.state", "qualified identifier", "sql 被截断", "sql 内容被破坏"],
      "observedThrough": "2026-07-20",
      "effectiveAt": "2026-07-20T18:51:00+08:00",
      "verifiedAt": "2026-07-20T18:51:00+08:00",
      "attemptedAction": "Preserve SQL angle-bracket comparisons and restrict bare-domain redaction.",
      "evidenceUrl": "https://github.com/tidbcloud/aisupport/pull/381"
    }
  ]
}
-->

- Optimization ID: `report-sql-token-preservation-2026-07-20`
- Owner: auto-oncall-services
- Source type: weekly report audit
- Source reference: `APID-29196`; weekly report `2026-07-13 00:00 ~ 2026-07-20 00:00`

## Bounded problem

The report-input sanitizer interpreted SQL comparison text between `<` and `>` as an HTML tag and interpreted qualified identifiers such as `d.state` as domains. This corrupted the AI answer supplied to weekly evaluation, causing APID-29196 to be reported as having missing predicates and an invalid alias scope even though the AI and human replies used the same rewrite.

## Implementation and effective status

- Implementation: remove generic angle-bracket stripping and restrict bare-domain redaction to recognized public or reserved suffixes.
- Implementation status: merged in `tidbcloud/aisupport#381` and deployed as staging image `689606d74276437d96e3b91475305969a664113b` through `tidbcloud/app-delivery#74985`.
- Effective status: available and verified in the staging report runtime. The required Secret injection was merged in `tidbcloud/aisupport#383` and `tidbcloud/app-delivery#74986`.

## Problem signals

| Problem signal | Ticket | Status |
| --- | --- | --- |
| SQL containing `<`, `>`, and qualified column names is corrupted before report evaluation | APID-29196 | `optimized_verified` |

## Validation evidence

- Added a case-specific regression that preserves the APID-29196 comparison predicates, correlated `EXISTS`, and `d.*` identifiers in both sanitized text and the generated report prompt.
- Focused report-generator tests: 11 passed.
- Full test suite: 334 passed.
- Staging Deployment reached image `689606d74276437d96e3b91475305969a664113b` and Ready `1/1`.
- First bounded replay attempt at 2026-07-20 18:42 Asia/Shanghai failed before generation because the main Deployment did not receive the existing `AUTO_ONCALL_GITHUB_TOKEN` Secret key required by weekly optimization-status lookup. No replacement Feishu message was sent.
- The main Deployment was updated through `tidbcloud/aisupport#383` and `tidbcloud/app-delivery#74986`; the live Pod had `AUTO_ONCALL_GITHUB_TOKEN` present and remained Ready `1/1` on the fixed image.
- Post-change weekly replay completed at 2026-07-20 18:51 Asia/Shanghai using report artifact `427`. APID-29196 changed from `human_better` with an alias-scope SQL gap to `equivalent` with no AI gaps; evaluation row `run_db_id=60035` was refreshed accordingly.
- Feishu delivery `25` reached `sent` on attempt 2, and message `om_x100b6aeb97147ca8c379c944a514e18` was read back from the target chat with the corrected APID-29196 verdict.

## Unresolved gaps and next action

- This optimization verifies report-input and evaluation correctness only. The customer's later observation that the shared AI/human query recommendation did not improve runtime remains a separate, unresolved ticket-quality signal and must not be promoted by this record.