# Cloud Clinic provider fallback

<!-- auto-oncall-optimization-record
{
  "schemaVersion": "auto-oncall-optimization-record-v1",
  "optimizationId": "cloud-clinic-provider-fallback-2026-08-04",
  "problems": [
    {
      "problemId": "cloud-diagnosis-stops-when-investibook-is-unavailable",
      "summary": "An ST or TCID Cloud SQL-performance or cluster-runtime diagnostic with an exact cluster ID stops before Codex analysis when Investibook is unavailable even though Clinic can provide bounded read-only evidence for the same cluster.",
      "status": "optimized_verified",
      "issueKeys": ["ST-2863"],
      "sourceRefs": [
        "https://tidb.atlassian.net/browse/ST-2863#problem:clinic_fallback:investibook_unavailable"
      ],
      "signalTextIncludesAny": [
        "investibook_disabled",
        "clinic is supplemental and was not used as a fallback",
        "cloud diagnosis stopped before codex analysis"
      ],
      "observedThrough": "2026-08-04",
      "effectiveAt": "2026-08-04T14:02:54.000Z",
      "verifiedAt": "2026-08-04T14:32:44.748Z",
      "attemptedAction": "When an Investibook-selected ST or TCID SQL-performance or cluster-runtime diagnostic has an exact cluster ID but Investibook is disabled, failed, or not found, persist a Clinic agent_read_only fallback route and continue bounded read-only analysis; retain fail-closed behavior when no exact Clinic target exists or Clinic evidence also fails.",
      "evidenceUrl": "https://tidb.atlassian.net/rest/servicedeskapi/request/7937860/comment/23422952"
    }
  ]
}
-->

- Optimization ID: `cloud-clinic-provider-fallback-2026-08-04`
- Owner: auto-oncall-services
- Source reference: `ST-2863`, job `120012`, run
  `1a72ff29-c6dc-4458-b4f0-8fad87fce763`
- Implementation status: merged in aisupport PR `#608`; the effective record
  from PR `#609` is deployed to staging as image
  `d349fb2407f105cef6daf1bd855de4cf1248ef42`
- Effective status: `optimized_verified`

## Bounded problem

ST-2863 was correctly classified as a Cloud cluster-runtime diagnosis and had
an exact cluster ID, org ID, incident timestamp, and error message. Staging had
disabled Investibook, so diagnostic preflight returned `human_required` before
Codex analysis. The existing contract treated Clinic only as supplemental and
did not select the available read-only Clinic route.

Applicability is limited to ST and TCID Cloud `sql_performance_tuning` and
`cluster_runtime_issue` diagnostics that were routed to Investibook and have an
exact cluster ID. It does not alter OP/Wetech/Manus routing, customer-visible
reply policy, production automation, Jira transition behavior, or write
permissions.

## Implementation

When Investibook is disabled, failed, or returns not found, rewrite the bounded
workspace route to `evidenceProvider=clinic` and the diagnostic manifest policy
to `agent_read_only`. Persist both files before the runner starts so Clinic
skill access and execution accounting use the same provider contract. A
completed but coverage-unverified Investibook result keeps its existing
monitoring-semantics boundary and is not silently reclassified as unavailable.

Keep fail-closed behavior when the Cloud case has no exact cluster ID. If the
Clinic evidence path is attempted but remains unavailable or inconclusive, the
existing diagnostic execution and safety contracts must retain
`human_required` rather than manufacturing a diagnosis.

## Verification evidence

- Repository typecheck and all `616` tests passed, including the ST-2863-shaped
  contract that persists `evidenceProvider=clinic`,
  `providerPolicy=agent_read_only`, and the Investibook-to-Clinic fallback
  signal before runner execution.
- aisupport PR `#608` merged as
  `642bdeda688e4a0f629f3edb1b03e6956e99d963`; app-delivery PR `#76215` changed
  only the staging image tag and passed kustomize, protected-path, merge-policy,
  and image-sync checks.
- The staging Deployment reached that exact image at
  `2026-08-04T14:02:54Z`. The live pod was Ready with zero restarts, both health
  endpoints returned HTTP 200, `AUTO_ONCALL_INVESTIBOOK_ENABLED=false`, and the
  Clinic skill was installed.
- A read-only Clinic capability check for ST-2863 resolved the exact cluster,
  returned a successful canonical metrics response, found twelve process-memory
  series in the incident window, and exposed a `tiflash` Loki container stream.
- ST-2863 write replay run `97c91a3d-5e62-4312-bdb3-4e968368fc46` persisted
  `evidenceProvider=clinic`, the `investibook_disabled` fallback signal, and
  `providerPolicy=agent_read_only`. The diagnostic route and synthesis both
  succeeded, Clinic skill use was recorded in DB run `120008`, and response
  generation completed with a bounded TiFlash memory-limit analysis instead
  of the preflight failure template.
- The replay updated the existing Jira internal comment `23422952` in place.
  Service Desk API readback returned HTTP 200, `public=false`, and the expected
  analysis body. The DB run and single-case evaluation were written, and the
  ticket Base record was synchronized at `2026-08-04T14:32:47.381Z`.

## Unresolved gaps

- Clinic could confirm the TiFlash process memory-limit boundary, but this case
  did not contain enough aligned SQL digest, plan, instance, and incident-time
  evidence to identify the memory-consuming operator. The memory-oom scenario
  therefore retained `human_required` with
  `diagnostic_workload_identity_correlation_invalid`. This is an unresolved
  case-evidence gap, not a recurrence of the stop-before-Codex fallback problem.
- Production automation remains disabled and was not changed.

## Next validation action

Monitor later ST/TCID Cloud cases for the same fallback signal. Treat a new case
that again stops before Codex as a regression; treat incomplete SQL, plan,
instance, or incident-time correlation as a separate evidence-quality problem.