# Capacity Action Internal Handoff

<!-- auto-oncall-optimization-record
{
  "schemaVersion": "auto-oncall-optimization-record-v1",
  "optimizationId": "capacity-action-internal-handoff-2026-08-11",
  "problems": [
    {
      "problemId": "capacity-ownership-leaks-into-customer-draft",
      "summary": "A conditional backend scale-out mitigation could remain internal_only and expose service-tier ownership and PingCAP-versus-customer responsibility in the simulated customer reply.",
      "status": "optimized_verified",
      "issueKeys": ["ST-2863"],
      "sourceRefs": [
        "https://tidb.atlassian.net/browse/ST-2863#problem:capacity-action-publication-boundary"
      ],
      "signalTextIncludesAny": [
        "PingCAP-managed capacity",
        "Dedicated capacity is customer-managed",
        "temporary backend scale-out in customer draft",
        "capacity action remained internal_only"
      ],
      "observedThrough": "2026-08-11",
      "effectiveAt": "2026-08-11T09:28:05Z",
      "verifiedAt": "2026-08-11T09:44:49Z",
      "attemptedAction": "Keep tier ownership and backend scale-out in the internal replay handoff, force human_required for an actual scale-out recommendation, sanitize the customer draft, and preserve the stable public=false Jira internal-comment path.",
      "evidenceUrl": "https://github.com/tidbcloud/aisupport/tree/main/auto-oncall-services/docs/opts/2026-08-11-capacity-action-internal-handoff.md"
    }
  ]
}
-->

- Optimization ID: `capacity-action-internal-handoff-2026-08-11`
- Owner: auto-oncall-services diagnostic synthesis and publication boundary
- Source reference: operator review of `ST-2863` replay wording on 2026-08-11
- Implementation status: deployed to staging in image `184f890885ff352d16731ea9d5e660ab557c044a`
- Effective status: `optimized_verified`

## Bounded problem

The diagnostic contract correctly preserved a temporary capacity mitigation,
but Final Synthesis could put internal service-tier ownership and the backend
scale-out recommendation into `customerReplyMarkdown` while returning
`internal_only`. That mixed the internal operational handoff with the simulated
customer reply.

This record owns only the publication and human-ownership boundary for a
temporary backend capacity action. It does not change when scale-out is
technically appropriate, service ownership itself, provider routing, or Jira
customer-publication enablement.

## Candidate change

- Keep service-tier ownership, control-plane responsibility, and the exact
  scale-out recommendation in `internalHandoffMarkdown` and scenario
  `humanHandoff`.
- Force `human_required` when a capacity scenario recommends temporary backend
  scale-out.
- Remove internal ownership/action sentences from the simulated customer draft
  and retain only a generic statement that Support is internally evaluating a
  safe temporary mitigation.
- Continue writing or updating the stable Jira internal comment with
  `public=false`; put the concise capacity-review reason in its status line.

## Verification evidence

Focused contract tests cover deterministic decision promotion, customer-draft
sanitization, and the existing live `human_required` Jira write path.

The staging replay for `ST-2863` completed as run
`918a761e-5e2c-4aa7-ad7b-561e8352affd` (DB run `120075`) on
2026-08-11. It returned `human_required` for Support review of a temporary
capacity mitigation. The customer draft contained no service-tier ownership or
PingCAP-versus-customer responsibility mapping, while the internal replay
context retained the capacity handoff. The replay updated existing Jira comment
`23422952` in place, and a Jira Service Management readback confirmed
`public=false`.

## Unresolved gaps

- Clinic acquisition remained degraded by retried HTTP 500 and 502 responses in
  this replay. That provider reliability problem is separate from this
  publication-boundary optimization.
- A human still owns the decision and any actual capacity operation.

## Next validation action

Monitor later capacity cases for regressions in customer-draft sanitization and
keep actual capacity actions behind `human_required` plus an internal handoff.