# Remove Child Handoff Semantic Validation

<!-- auto-oncall-optimization-record
{
  "schemaVersion": "auto-oncall-optimization-record-v1",
  "optimizationId": "remove-child-handoff-semantic-validation-2026-08-05",
  "problems": [
    {
      "problemId": "scenario-parent-packet-rejected-by-child-semantic-sync",
      "summary": "A valid scenario parent packet was discarded when its independent status, completion judgment, or evidence references did not mirror the evidence child's transport handoff.",
      "status": "optimized_unverified",
      "issueKeys": ["ST-2865", "TCID-12973", "APID-29231"],
      "sourceRefs": [
        "https://tidb.atlassian.net/browse/ST-2865#problem:child-handoff-mismatch",
        "https://tidb.atlassian.net/browse/TCID-12973#problem:child-handoff-mismatch",
        "https://tidb.atlassian.net/browse/APID-29231#problem:child-handoff-mismatch"
      ],
      "signalTextIncludesAny": [
        "diagnostic_scenario_packet_child_handoff_mismatch",
        "child_handoff_mismatch",
        "valid child evidence was discarded after parent finalization"
      ],
      "observedThrough": "2026-08-05",
      "effectiveAt": "2026-08-05T04:59:51Z",
      "verifiedAt": null,
      "attemptedAction": "Remove backend semantic synchronization between the terminal scenario parent packet and the child transport handoff. Continue to parse the parent packet under its own strict schema, and retain bounded child-handoff validation only when the backend actually consumes that handoff for reserve recovery.",
      "evidenceUrl": "https://tidb.atlassian.net/browse/ST-2865"
    }
  ]
}
-->

- Optimization ID: `remove-child-handoff-semantic-validation-2026-08-05`
- Owner: auto-oncall-services
- Source references: post-deployment replays for `ST-2865`, `TCID-12973`, and
  `APID-29231`
- Implementation status: deployed to staging in image
  `ae9b0ffac1f9ede67af5781e560a7f5b480fc44b`
- Effective status: `optimized_unverified`

## Bounded problem

The evidence child is a narrow provider-query worker. The scenario parent has
broader context and owns the final diagnostic packet. The runner nevertheless
read the child's transport file again after a terminal parent response and
required the two independent outputs to agree on scenario identity, time
window, every cited evidence reference, completion, and bounded-failure status.
The three source replays returned usable child evidence but the aggregate
`diagnostic_scenario_packet_child_handoff_mismatch` check discarded the parent
packet and prevented its progress checkpoint from being written.

## Implementation

- Parse and checkpoint a terminal parent packet under the existing strict
  packet contract without reading or comparing the child transport handoff.
- Keep current-attempt, size, schema, scenario, and time-window validation for
  the reserve path, where the backend itself consumes a child handoff after the
  parent fails to return before the reserve boundary.
- Do not change provider authorization, org/cluster isolation, parent packet
  parsing, checkpoint parsing, or Jira write boundaries.

## Local verification

- TypeScript typecheck and build pass.
- All 620 repository tests pass, including all 50 runner tests. The new
  regression returns a terminal `complete`
  parent packet while the child transport remains `partial`; the runner accepts
  and checkpoints the parent result instead of emitting
  `diagnostic_scenario_packet_child_handoff_mismatch`.
- Existing reserve tests still accept current complete and partial handoffs and
  reject an oversized handoff when the backend must consume it directly.

## Unresolved gaps

- `ST-2865` run `2905f47f-406e-4f34-a424-0f5b500e9415` passed this
  boundary: a `partial` child handoff with eight artifact refs produced a
  successful `suspected` parent packet and a complete progress checkpoint.
- `TCID-12973` run `01a7c86b-8c89-479c-b114-0bd35590b7d1` did not emit
  `child_handoff_mismatch`, but its complete child handoff was still discarded
  when the independent parent packet failed with
  `diagnostic_workload_identity_provenance_invalid`.
- `APID-29231` run `5ee3e333-ff33-4cd2-bc50-023868e70933` did not emit
  `child_handoff_mismatch`, but its complete handoff with eight observations
  was still discarded when the independent parent packet failed with
  `diagnostic_workload_identity_proof_invalid`.
- Because two source cases still have no progress checkpoint, the bounded
  preservation criterion is not fully verified. The change remains
  `optimized_unverified` rather than promoting the problem from one successful
  case or from the absence of the old error code alone.

## Deployment and replay evidence

- Source PR `tidbcloud/aisupport#619` merged as
  `ae9b0ffac1f9ede67af5781e560a7f5b480fc44b`; app-delivery PR
  `tidbcloud/app-delivery#76236` deployed that exact image.
- The live Deployment reached generation 268 with one Ready Pod, zero
  restarts, and HTTP 200 from both `/healthz` and `/readyz`. Poller and worker
  logs were healthy and the database had no queued or running jobs before the
  replay batch.
- Write replays recorded DB runs 120013, 120014, and 120015. They updated the
  existing Jira internal comments `23432370`, `23327373`, and `23279460`
  respectively; each exact comment was read back with `public=false`.

## Next validation action

Correct the two independent parent-packet failures without reintroducing
cross-agent synchronization: `TCID-12973` must use an admitted provenance for
provider compact artifacts, and `APID-29231` must not mark a workload-identity
gate passed when its own facts remain correlation-only. Preserve otherwise
valid observations proportionally if one semantic field is invalid, then
replay those two cases again and require progress checkpoints before marking
this problem `optimized_verified`.