# Write Identity Evidence Provenance

<!-- auto-oncall-optimization-record
{
  "schemaVersion": "auto-oncall-optimization-record-v1",
  "optimizationId": "write-identity-evidence-provenance-2026-07-31",
  "problems": [
    {
      "problemId": "apid-prev-stmt-typed-identity-admission-missing",
      "summary": "A diagnostic packet cannot distinguish an aggregate COMMIT summary or adjacent prev_stmt from a same-record identity-preserving workload mapping.",
      "status": "candidate",
      "issueKeys": ["APID-29259"],
      "sourceRefs": [
        "auto-oncall-report:staging:daily:2026-07-27:case:APID-29259#problem:ai_gap:787eca70bc0a8052"
      ],
      "signalTextIncludesAny": [
        "prev_stmt used as transaction identity",
        "aggregate commit summary used as identity",
        "adjacent statement treated as the causing write",
        "transaction identity provenance missing"
      ],
      "observedThrough": "2026-07-31",
      "effectiveAt": null,
      "verifiedAt": null,
      "attemptedAction": "Add typed workload-identity provenance and deterministic admission invariants to scenario packets: aggregate COMMIT and adjacent or co-window prev_stmt remain correlation-only, while prev_stmt can prove identity only from the provider API on the same Slow Query COMMIT record with stable record, session, transaction, or request linkage and aligned entity/event. Keep that identity proof as a high-risk candidate whose causal attribution remains unverified unless single-statement/autocommit or a complete transaction/write/request-to-latency mechanism mapping is observed. Require synthesis and the publication guard to state every applicable rejected identity boundary in both internal context and the Jira draft.",
      "evidenceUrl": "https://github.com/tidbcloud/aisupport/issues/531"
    }
  ]
}
-->

- Optimization ID: `write-identity-evidence-provenance-2026-07-31`
- Owner: auto-oncall-services
- Source reference: Focus `#531`, `APID-29259`
- Implementation status: candidate
- Effective status: `candidate`

## Bounded problem

The scenario packet currently represents workload identity only through free
text. It cannot prove whether `prev_stmt` came from the same Slow Query COMMIT
record or a neighboring row, and cannot deterministically prevent an aggregate
COMMIT summary from being used as transaction identity.

## Candidate implementation

- Add typed source, provenance, evidence kind, linkage, identity resolution,
  applicability, completeness, and opaque evidence references.
- Require objective gates to cite typed evidence.
- Enforce aggregate COMMIT and adjacent/co-window `prev_stmt` as
  correlation-only.
- Permit identity proof only for an aligned same-record Slow Query COMMIT
  `prev_stmt` with stable record, session, transaction, or request linkage.
- Keep valid identity proof as a high-risk candidate. Do not confirm it as the
  cause of high load or Commit latency without single-statement/autocommit
  evidence or a complete transaction/write/request-to-latency mechanism mapping.
- Run one deterministic publication correction when the reply omits an
  applicable identity boundary; fail closed if correction still omits it.
- Keep raw SQL, `prev_stmt` content, full Digests, target/session identifiers,
  and credentials outside the packet.

## Verification evidence

No effective runtime verification exists yet. Contract, runner, and deployed
same-cutoff replay evidence will be appended after implementation.

## Unresolved gaps

- The candidate is not deployed.
- The APID-29259 existing Jira internal comment has not been refreshed.

## Next validation action

Complete tests and deploy the candidate to staging. Replay APID-29259 at the
same historical cutoff and require all three applicable Focus criteria to pass
before updating this problem to `optimized_verified`.