# Clinic Observability SQL Boundary

<!-- auto-oncall-optimization-record
{
  "schemaVersion": "auto-oncall-optimization-record-v1",
  "optimizationId": "clinic-observability-sql-boundary-2026-08-18",
  "problems": [
    {
      "problemId": "clinic-planned-customer-schema-query",
      "summary": "TCID-12989 planned bank-transaction-index-metadata as a Clinic SQL operation even though Clinic Data Proxy queries exported observability datasets and cannot connect to the customer database or retrieve table, index, or partition metadata.",
      "status": "optimized_verified",
      "applicability": "Clinic-backed diagnostic scenarios where schema, index, partition, statistics, SHOW, DESCRIBE, or EXPLAIN evidence is considered while the customer database is not directly accessible.",
      "issueKeys": ["TCID-12989"],
      "sourceRefs": [
        "https://tidb.atlassian.net/browse/TCID-12989#problem:clinic-planned-customer-schema-query"
      ],
      "signalTextIncludesAny": [
        "bank-transaction-index-metadata",
        "clinic_sql_partition_filter_missing",
        "query customer schema through clinic",
        "information_schema through clinic"
      ],
      "observedThrough": "2026-08-18",
      "effectiveAt": "2026-08-18T10:52:19Z",
      "verifiedAt": "2026-08-18T11:54:00Z",
      "attemptedAction": "Define Clinic as an observability-only Provider for both the Evidence Agent and Scenario Diagnostic Agent, require supplied ticket DDL to remain the schema source, forbid customer-schema SQL planning, and reject custom SQL without a Clinic-exported observability source before any provider request.",
      "evidenceUrl": "https://tidb.atlassian.net/browse/TCID-12989"
    }
  ]
}
-->

- Owner: Clinic Evidence Agent planning contract and Clinic Provider Executor
- Source: `TCID-12989`
- Implementation status: merged in PR `#970`, deployed, and replay verified
- Effective status: `optimized_verified`

## Bounded problem

The frozen ticket already supplied the relevant old and new DDL. The diagnostic
plan nevertheless added `bank-transaction-index-metadata` as a generic Clinic
SQL operation. Clinic Data Proxy accepts SQL syntax for its exported
observability datasets; it is not a connection to the customer's TiDB database
and cannot retrieve that table's schema, indexes, partitions, or statistics.
The local partition guard rejected the query before HTTP, but that rejection
was downstream of the planning error and did not improve the diagnosis.

## Intended change

- State the database-access boundary in the Clinic skill, Evidence Agent
  prompt, Scenario Diagnostic Agent contract, and managed Tool description.
- Require supplied ticket DDL or reply-safe artifacts to be used directly as
  schema evidence.
- If schema is absent, preserve that limitation instead of generating a Clinic
  metadata query.
- Reject custom Clinic SQL that does not reference a Clinic-exported
  observability dataset before partition validation or HTTP execution.

## Verification status

Local contract and Provider Executor tests are pending. Case-specific replay,
deployment, and Jira internal-comment refresh have not started.

## Unresolved gaps

The separate TCID-12989 diagnostic-quality question remains: after removing the
invalid metadata plan, the Scenario Diagnostic Agent must use the supplied DDL
plus Slow Query and TiKV write-path evidence to distinguish the immediate
latency mechanism from workload-distribution triggers.

## Next validation action

Run focused prompt, Provider Executor, managed Tool, build, and optimization
record tests; then perform one branch-local historical read replay and judge the
mechanism chain rather than the absence of the old partition-filter error.