# Diagnostic Scenario Child Handoff - Optimization ID: `diagnostic-scenario-child-handoff-2026-07-31` - Owner: auto-oncall-services - Source references: `APID-29231` runs `672c232d-4147-4d71-9178-587ef7bcce47`, `3a6b5117-a3b3-4546-8244-fe54f122e80b`, `1d75c382-9db7-46e4-80a5-f88386af6cb1`, and `96dba232-7dd8-47fc-8b8e-3754f7478620` - Implementation status: thin-transport redesign deployed to staging in image `a17c8dfacbc7728aba808a610908c6309a43395a`; canonical artifact-ref and checkpoint gate-reason boundary fixes implemented locally and not deployed - Effective status: original thin-handoff problem `optimized_unverified`; newly observed artifact-ref and checkpoint gate-reason boundaries `candidate` ## Bounded problem The scenario thread intentionally delegates provider querying to one isolated evidence child. In the source run, the child completed provider work but continued searching repository schema and validator files instead of returning its compact handoff. The deployed reserve fixed that timeout shape, but the next replay showed that the handoff still mixed evidence with typed diagnostic classification. The parent copied those classifications and emitted an invalid final packet. Staging replay `1d75c382-9db7-46e4-80a5-f88386af6cb1` then showed a separate transport mismatch: the child emitted two valid canonical compact-report paths together with two `attachment:` refs and one provider bootstrap `summary:` ref. The child parser accepted all five, but the strict parent artifact contract rejected the opaque refs as `diagnostic_artifactrefs_invalid`, discarding the usable compact evidence. Run `96dba232-7dd8-47fc-8b8e-3754f7478620` crossed that boundary and produced a valid strict parent packet with two explicit bounded-failure gates. The runner then copied each gate's natural-language evidence into the checkpoint reason field, whose strict parser accepts only canonical reason codes. Readback failed with `diagnostic_objective_gate_reason_code_invalid`, and downstream synthesis received `diagnostic_scenario_progress_missing_or_invalid` instead of the bounded observations, counter-evidence, and provider limitations. ## Implementation - Give the child one thin, run-scoped v2 transport envelope containing only the route-supplied `timeWindow`, lifecycle, neutral summary, factual statements with provenance refs, gaps, query coverage, acquisition errors, and compact artifact refs. It has no identity, causality, risk, transaction-shape, monitoring-semantics, gate, scenario execution, or final-packet fields. - Keep all classification and final-packet ownership in the scenario parent. The child receives only its delimited transport contract and evidence query objective; it never receives or searches for the scenario output schema, parser, validator, progress contract, or final-packet examples. - The parent consumes the thin facts, refs, and gaps and independently emits the existing strict `DiagnosticScenarioEvidencePacket`. The runner checks time-window/lifecycle binding and cited provenance, without normalizing or copying evidence-layer classifications. - Compute the child evidence deadline from the stage timeout actually allocated by the shared pipeline budget, leaving up to 60 seconds for finalization. At that boundary the parent requests the current handoff once, waits at most ten seconds, interrupts a still-running child, and continues with fresh compact evidence instead of waiting to the outer timeout. - At the reserve boundary, the runner stops the original turn and reads only a current-attempt, size-bounded handoff. It deterministically maps that handoff to a partial bounded-failure packet without starting another LLM finalizer; observations and canonical refs survive, but semantic classification does not. - The runner atomically writes the progress checkpoint only after validating the scenario parent's final packet against the current handoff. - At that explicit packet-to-checkpoint boundary, derive one existing canonical gate reason code from the validated gate status and typed identity facts. Parent prose remains in the parent packet, while the checkpoint keeps only `identity_proof_admitted`, `identity_correlation_only`, `identity_evidence_unavailable`, `transaction_shape_admitted`, or `transaction_shape_unavailable`; the progress parser remains strict. - Restrict the child handoff schema to the same canonical compact scenario paths already admitted by the parent. At the runtime boundary, remove only recognized attachment/bootstrap pseudo refs, preserve canonical refs and their facts plus acquisition errors, and keep a complete handoff fail-closed when a required fact has no canonical ref. Supplied attachment provenance remains inside the materialized compact report; provider bootstrap state is represented through gaps, query coverage, and errors instead of artifact refs. ## Local verification - TypeScript typecheck passes. - Diagnostic contract and runner tests cover the thin schema/prompt boundary, required route-supplied time window, factual refs and gaps reaching backend reserve conversion, strict parent packet validation, complete and partial no-terminal fail-close, oversized and stale handoff rejection, and the normal packet path. - The APID-29231 replay-shaped contract fixture uses the exact two canonical refs, two attachment refs, and provider-bootstrap summary ref from run `1d75c382-9db7-46e4-80a5-f88386af6cb1`. It verifies that only the canonical refs reach a legal handoff and deterministic reserve packet while the factual compact evidence and `provider_auth_bounded_failure` error remain available. - The run `96dba232-7dd8-47fc-8b8e-3754f7478620` packet regression writes and reads back the two natural-language bounded-failure gates as canonical unavailable reason codes without mutating or discarding the bounded packet. Separate admitted and correlation-only fixtures cover the remaining normal gate mappings. - Source PR `tidbcloud/aisupport#585`, deploy run `30634839847`, and app-delivery PR `tidbcloud/app-delivery#75989` delivered the implementation to staging. The Deployment and Recent Optimizer CronJob both rendered image `a17c8dfacbc7728aba808a610908c6309a43395a`; the new Pod was Ready with zero restarts, `/healthz` and `/readyz` returned 200, and DB queued/running counts were both zero. - This proves staging availability only. It does not prove APID-29231 runtime effectiveness. ## Unresolved gaps - Post-deployment run `1d75c382-9db7-46e4-80a5-f88386af6cb1` did not verify the optimization because the newly observed opaque artifact refs caused `diagnostic_artifactrefs_invalid` before parent finalization. - The canonical artifact-ref boundary fix is local only and has not been deployed or replayed. - The checkpoint gate-reason mapping is local only and remains a `candidate`; its exact packet regression is contract evidence, not runtime effectiveness. - The evidence-child cooperative deadline is prompt-controlled. The backend reserve path can recover only when a valid current-attempt handoff was already written before the reserve boundary. ## Next validation action After an authorized rollout of the canonical artifact-ref boundary fix, replay APID-29231 at its historical cutoff and verify that only the two canonical compact refs cross the handoff, acquisition errors remain explicit, and the parent independently emits a valid strict packet. Jira internal-comment refresh and readback remain a separate completion step.