# Reported-signal Provider Admission - Optimization ID: `reported-signal-provider-admission-2026-07-30` - Owner: auto-oncall-services - Source reference: `TCID-12973` - Implementation status: deployed to staging in revision `3efeb556` - Effective status: `optimized_unverified` ## Bounded problem The TCID-12973 historical description contains a reported alert image, but the replay path hid description media when a target support comment existed. The attachment manifest therefore recorded zero candidates. Investibook received only `context.md`, inferred an incident anchor from the image filename, and returned a non-empty RCA. The diagnostic manifest treated that non-empty summary as primary evidence even though it did not cover the original alert, its metric semantics, or a directly supported incident anchor. ## Candidate implementation - Keep description media visible in historical replay. Continue to enforce uploader and cutoff safety through attachment eligibility. - Recognize normalized `[image: filename]` description locators. Materialize the matching safe Jira attachment, or record an explicit skipped manifest item instead of silently producing zero candidates. - Include available and unavailable artifact state plus a structured reported-signal coverage contract in the Investibook request. State that a filename is only a locator and cannot establish time, units, query or recording-rule meaning, aggregation, or causal alignment. - Parse the provider coverage record and validate it against explicit ticket anchors and actual uploaded artifacts. Provider prose or a self-asserted status alone does not make coverage verified. - Preserve an unverified summary as an audit artifact, but keep `primaryEvidence=false` and `summaryPaths=[]` so synthesis fails closed. ## Local verification evidence - Attachment tests cover historical description images that materialize and unresolved description image locators that become explicit skipped entries. - Investibook tests cover the request contract, a verified coverage result, and rejection of a timestamp inferred from an unavailable image filename. - Diagnostic-context tests prove that a non-empty unverified summary remains auditable but is not exposed to synthesis. - Same-cutoff local replay `file:///tmp/auto-oncall-services/runs/7597ee13-bdd4-462e-b446-04524b641b55` moved the evidence-chain earliest failure from `attachment_materialization` to `provider_output_coverage`: one load-bearing description image was materialized and uploaded, the provider request was complete, coverage remained unverified, and synthesis did not admit the provider summary. - That replay passed `case-discriminator-routing` and `bounded-alternatives` but retained an attribution wording gap. The separate `customer-cause-attribution-boundary-2026-07-30` candidate owns that residual problem. - Final shared analysis-service replay `file:///tmp/auto-oncall-services/runs/7a17389d-3cbb-4892-bc08-b95fa65103a0` materialized and uploaded the load-bearing image, kept provider output coverage unverified, and retained the summary only in `auditSummaryPaths`. `primaryEvidence=false`, `summaryPaths=[]`, and the evidence-chain trace recorded `synthesisAdmission=not_admitted`; all three TCID Focus criteria passed. - APID-29231 non-trigger control `file:///tmp/auto-oncall-services/runs/04069e4c-2a1d-496f-bac8-4a0375733b24` remained on its Wetech/agent-provider path and did not inherit the Investibook monitoring-semantics boundary. - Local tests are implementation evidence only. The optimization remains unverified until the deployed synthesis path is proven not to consume the audit-only summary. - Deployed same-cutoff replay `a3c75380-d46e-46fd-82d5-7eaa72e7cf47` materialized the same attachment bytes, preserved `primaryEvidence=false`, left `summaryPaths=[]`, and kept reported-signal, incident-anchor, and metric-semantics coverage unverified. Those parts of the attempted action are effective. - The same deployed run exposed a remaining admission bypass: independent scenario thread `write-path-contention` read `input/diagnostics/investibook-summary.md` from the shared workspace even though it was listed only in `auditSummaryPaths`. It then carried the summary's approximately 99% NVMe utilization claim into the compact packet and final replay context as an unverified alternative. The manifest-based evidence-chain trace still reported `synthesisAdmission=not_admitted`, so that trace alone is insufficient verification. ## Unresolved gaps - No Jira internal comment has been refreshed. - Provider-free execution-state accounting is a separate concern and is not part of this bounded optimization. - Scenario evidence agents currently receive read-only access to the full run workspace. Prompt wording and `summaryPaths=[]` do not hard-isolate `auditSummaryPaths` or raw diagnostic artifacts. ## Next validation action Give each supplied-evidence scenario a sanitized workspace or equivalent hard allowlist containing only replay-frozen ticket inputs, explicitly admitted diagnostic summaries, and required attachments. Reject evidence packets whose artifact references are outside that allowlist, then rerun TCID-12973 at the same cutoff. Do not refresh Jira or promote this problem until the audit-only summary is absent from scenario packets and final synthesis. Keep ST-2846 inconclusive until an observable control answer is available.