# Daily optimizer candidate path policy

<!-- auto-oncall-optimization-record
{
  "schemaVersion": "auto-oncall-optimization-record-v1",
  "optimizationId": "daily-optimizer-candidate-path-policy-2026-07-21",
  "problems": [
    {
      "problemId": "daily-optimizer-rejects-required-optimization-record",
      "summary": "The Daily Recent Optimizer requires an optimization record but rejects docs/opts and new bounded source modules through a stale exact-file allowlist.",
      "status": "optimized_verified",
      "issueKeys": [],
      "sourceRefs": [],
      "signalTextIncludesAny": [],
      "observedThrough": "2026-07-20",
      "effectiveAt": "2026-07-21T10:11:42+08:00",
      "verifiedAt": "2026-07-21T10:41:23+08:00",
      "attemptedAction": "Replace the exact source-file allowlist with protected high-risk paths plus bounded source, test, skill, and optimization-record roots.",
      "evidenceUrl": "https://github.com/tidbcloud/aisupport/issues/375#issuecomment-5029582457"
    }
  ]
}
-->

## Bounded problem

The patch Agent must follow `AGENTS.md` and create a dedicated `docs/opts/`
record when optimization work starts. The controller's older exact-file
allowlist did not permit that directory or newly factored source modules, so a
valid bounded candidate failed during `candidate_policy` before tests or the
challenger evaluation ran.

## Implementation and effective status

- Implementation: PR `tidbcloud/aisupport#392` changes the policy to protect high-risk
  automation, evaluation, deployment, and external-write paths while allowing
  ordinary TypeScript source files, tests, skills, and correctly named
  `docs/opts/YYYY-MM-DD-<slug>.md` records.
- Effective/deployment: deployed to staging as image
  `90775e732d569ff95b2726ba7f88cc3986aa3b2c`. Both the Deployment and Recent
  Optimizer CronJob use that image and the Deployment is Ready `1/1`.

## Candidate problem signals

- Focus #375 attempt 1 changed the required optimization record, a reply-format
  source file, and its contract test.
- The controller rejected only the optimization-record path and stopped before
  creating a candidate branch or comparable challenger results.

## Validation evidence

- Status: `optimized_verified`.
- 2026-07-21: the current-main full repository suite passed, 341/341,
  including the focused path-policy cases and strict checked-in
  `auto-oncall-optimization-record-v1` parsing.
- 2026-07-21 10:41 UTC+8: the deployed validator accepted the exact three paths
  from the failed Focus #375 attempt: its `docs/opts` record, reply-format
  source, and contract test.
- The post-deployment rerun Job
  `auto-oncall-recent-optimizer-rerun-20260720-policy` completed successfully on
  base `90775e732d569ff95b2726ba7f88cc3986aa3b2c`; it produced fresh baseline
  checkpoints without the former forbidden-path error.
- The rerun itself ended `evaluation_inconclusive`: three of four targets and
  the control met all criteria, while APID-29174 could not be evaluated because
  the separate Manus read-only runtime credentials were unavailable.
- The resulting Recent Evaluation notification was delivered to Feishu as
  message `om_x100b6ad98e3690bcddaae9f41abfae7`.

## Unresolved gaps and next action

- The candidate-path policy gap is verified resolved.
- Restore the Manus read-only credentials and rerun APID-29174 so the active
  Focus can be conclusively evaluated; this is independent of path validation.