# Clinic Runtime Configuration Read

<!-- auto-oncall-optimization-record
{
  "schemaVersion": "auto-oncall-optimization-record-v1",
  "optimizationId": "clinic-runtime-configuration-read-2026-08-27",
  "problems": [
    {
      "problemId": "exact-runtime-config-values-require-metric-enumeration",
      "summary": "Auto-oncall had no bounded operation for exact current PD and TiKV values, so TCID-13091 spent most of its run searching unrelated observability evidence instead of answering four direct lookups.",
      "status": "optimized_unverified",
      "applicability": "Identified TiDB Cloud clusters with one to sixteen exact non-secret PD, TiKV, TiDB, or TiDB-variable configuration keys.",
      "issueKeys": ["TCID-13091"],
      "sourceRefs": [
        "https://tidb.atlassian.net/browse/TCID-13091#problem:exact-runtime-config-values-require-metric-enumeration"
      ],
      "signalTextIncludesAny": [
        "configuration values",
        "schedule.max-pending-peer-count",
        "server.concurrent-send-snap-limit",
        "TCID-13091"
      ],
      "observedThrough": "2026-08-27",
      "effectiveAt": "2026-08-27T10:29:40Z",
      "verifiedAt": null,
      "attemptedAction": "Add one exact-key configuration operation that uses canonical Clinic first and DevOps CloudConfig only for rejected or missing keys, returning requested non-secret values instead of enumerating metrics, logs, or activities.",
      "evidenceUrl": "https://tidb.atlassian.net/browse/TCID-13091"
    }
  ]
}
-->

- Optimization ID: `clinic-runtime-configuration-read-2026-08-27`
- Owner: Evidence Agent plan contract and Clinic Provider Executor
- Source: TCID-13091 original run
- Implementation status: merged, Managed Clinic v18 installed, and live in image `bf6b666986fe63d88f4eb8fcbf3a5f926dfa19a1`
- Effective status: `optimized_unverified`

## Bounded problem

TCID-13091 asks for four exact current PD and TiKV configuration values. The
existing Clinic evidence surface had no configuration operation, so the run
planned 22 observability queries and spent about eight minutes in the evidence
pipeline without using the direct configuration source.

## Candidate change

- Add one `configuration` operation with one to sixteen exact component/key
  selectors.
- Query the canonical Clinic Dashboard configuration endpoint first with the
  resolved organization and cluster headers.
- Use DevOps CloudConfig only for keys Clinic rejects or omits. Prefer explicit
  cluster values, then the exact cluster-version default.
- Return only requested non-secret values and provenance. Do not export the full
  configuration, omit the organization header, or mutate the cluster.

## Verification evidence

Local unit tests cover Clinic success, correct tenant headers, Clinic rejection
with explicit/default CloudConfig fallback, cross-org rejection, and sensitive
key rejection. Read replay `299f6cf7-ccfb-49ff-9675-ea8b2a850500` exercised the
live v18 operation: Clinic returned 403 and CloudConfig returned both requested
PD values with `cloudconfig_default` provenance. The Tool boundary worked, but
the Agent supplied noncanonical TiKV key spellings and expanded the factual
lookup into unrelated diagnostic evidence, so this capability remains
unverified for the complete four-value case.

## Unresolved gaps

- The first live replay returned only two of four values because the upstream
  evidence objective did not preserve the ticket's parameter spellings.
- No Jira internal comment refresh is authorized by this read-replay task.

## Next validation action

Deploy the separate current-configuration lookup-scope repair, replay
TCID-13091, and confirm one direct configuration objective returns all four
values with bounded Clinic-to-CloudConfig provenance.