# Agent9 diagnosis Skill ownership

<!-- auto-oncall-optimization-record
{
  "schemaVersion": "auto-oncall-optimization-record-v1",
  "optimizationId": "agent9-diagnosis-skill-ownership-2026-09-02",
  "problems": [
    {
      "problemId": "diagnosis-skills-installed-on-evidence-agent",
      "summary": "Agent9 installed the three diagnosis Skills on Evidence Agent while Scenario Diagnostic Agent had no diagnosis Skills and its runtime audit rejected Skill instruction reads.",
      "status": "candidate",
      "applicability": "Agent9-backed provider-assisted Scenario diagnosis.",
      "issueKeys": [],
      "sourceRefs": [
        "manual://agent9-role-skill-audit#problem:diagnosis-skills-installed-on-evidence-agent"
      ],
      "signalTextIncludesAny": [
        "Evidence Agent has diagnosis Skills",
        "Scenario Diagnostic Agent has no Skills",
        "diagnosis Skill instruction read rejected"
      ],
      "observedThrough": "2026-09-02",
      "effectiveAt": null,
      "verifiedAt": null,
      "attemptedAction": "Pin Provider query Skills only to Evidence Agent, pin diagnosis Skills only to Scenario Diagnostic Agent, remove stale cross-role installations, and permit only diagnosis-package instruction reads in the isolated Scenario Diagnostic workspace.",
      "evidenceUrl": "manual://agent9-role-skill-audit"
    }
  ]
}
-->

- Owner: Auto-oncall Agent9 Skill release and Scenario Diagnostic runtime
- Source: manual Agent9 role/Skill audit
- Implementation status: local repair and deterministic contract tests
- Effective status: `candidate`

## Bounded problem

The unified release published six Skills and pinned all six to Evidence Agent.
That mixed Provider query guidance with diagnosis reasoning guidance, while the
Scenario Diagnostic Agent had no diagnosis Skill installation. Its prompt and
offline audit also rejected all file reads, so moving the pins alone would have
left the diagnosis Skills unusable.

## Intended change

Publish all six packages once, then reconcile exact role sets. Evidence keeps
only `clinic-api`, `wetech-op-grafana`, and `manus-op-grafana`. Scenario
Diagnostic keeps only `op-diagnosis`, `tidb-latency-diagnosis`, and
`tidb-query-tuning`. Diagnosis runs use a separate empty working directory and
may read only those installed diagnosis package instructions and directly
referenced files. Provider Skills, Managed Tools, commands, workspace data, and
Provider calls remain forbidden to Scenario Diagnostic.

## Verification

Deterministic tests cover append, install/upgrade, stale cross-role uninstall,
the exact workflow Agent IDs, Agent9 read-path preservation, and the
Scenario-Diagnostic-only Skill-read audit.

## Unresolved gaps

The first post-deployment ST-2933 read replay exposed a wire-shape mismatch:
Agent9 returns Core Tool operations with `toolName` and `args` directly under
`operation.input`, while the adapter had only tested the older wrapped mock
shape. The diagnosis Skill reads succeeded in Agent9 but were misclassified by
the AOS audit as forbidden tool use. The adapter now normalizes both shapes;
fresh replay verification is still required.

## Next validation action

After deployment, read back both Agents' exact Skill installations, then run one
post-deployment `mode=read` replay and verify that Scenario Diagnostic reads the
applicable diagnosis Skill without any Provider Tool call while Evidence reads
only its selected Provider Skill.