# Target SQL evidence and diagnostic citations

<!-- auto-oncall-optimization-record
{
  "schemaVersion": "auto-oncall-optimization-record-v1",
  "optimizationId": "provider-sql-evidence-2026-09-07",
  "problems": [
    {
      "problemId": "target-sql-dropped-or-diagnostic-quote-rejected",
      "summary": "Selected Wetech Slow Query drops SQL text and scenario output validation rejects legitimate diagnostic SQL references.",
      "status": "optimized_unverified",
      "applicability": "Selected Wetech SQL execution detail and diagnostic SQL citations in scenario packets.",
      "issueKeys": [
        "APID-29470"
      ],
      "sourceRefs": [
        "https://tidb.atlassian.net/browse/APID-29470#problem:target-sql-evidence"
      ],
      "signalTextIncludesAny": [
        "SQL 文本",
        "scenarioEvidence_sensitive_value"
      ],
      "observedThrough": "2026-09-07",
      "effectiveAt": "2026-09-07T11:41:17.716483+00:00",
      "verifiedAt": null,
      "attemptedAction": "Merged PR #1381; deployed AOS 898fe5b6 and Wetech v49, confirmed Ready and HTTP 200 health endpoints. Ticket replay deferred by operator.",
      "evidenceUrl": "https://github.com/tidbcloud/aisupport/actions/runs/34116735089"
    }
  ]
}
-->

Owner: AOS Provider output and scenario result validation. Source: operator-requested review of main PR #1378 on 2026-09-07.
Base: 8d723cd6.

Keep selected Wetech execution SQL with its own plan; broad discovery remains compact. Treat SQL text as evidence rather than credentials. Preserve credential, structure and length checks. Missing-plan logging distinguishes absent input, unrecognized content and an empty decode response without logging raw SQL/plan. Returned plan behavior is unchanged.

Implementation is complete. Local regressions cover SQL/plan pairing, broad-list omission, legitimate diagnostic SQL and credential rejection, and metadata-only diagnostics on successful Tool output. Wetech package v49 is immutable; publication and runtime activation are separate. Deployment is authorized; ticket replay is explicitly deferred. Do not claim target SQL diagnosis or plan parsing verified from a package rollout.

## Deployment verification

- Implementation PR: https://github.com/tidbcloud/aisupport/pull/1381
- AOS deployed SHA: `898fe5b6ea9c88d55563ffbb6706701fa9907d26`.
- Image digest: `sha256:2d72c5a5afb3ca9551a80fb9ede33ef5e1a4db5c8f96234b26657f8b85c58eb2`.
- Staging app-delivery PRs #79440 and #79441 merged. New AOS Pod Ready;
  `/healthz` and `/readyz` both HTTP 200.
- Wetech v49 active on Evidence Agent; package
  `f65348e5648f8a95ec6557c385b27cc5ed6889f9634cd59b219d7798e3de25bb`;
  bundle `4599baa7fc42ebf506f1a161b987aca93a98e6de9f458010170131ef75d70390`.
  Agent9 rolled out with its application image unchanged.
- Local tests: 1131 service tests and 6 isolated-runner script tests passed;
  PR CI passed. First release attempt reached Tool installation before the
  new bundle finished loading; retry succeeded after package readiness.
- No Provider canary, ticket replay or Jira publication was run. This proves
  deployment and local contracts, not recovered target SQL evidence or diagnosis.
  Next validation is an operator-authorized APID-29470 isolated replay.