# Replay-Safe Jira Comment Identity

## Current Design

- Jira issue comments are fetched through `src/jira.ts` as part of the issue
  snapshot. The raw comment already contains a stable comment ID, `jsdPublic`,
  and structured author fields such as account ID, account type, and email.
- `supportCaseFromJiraIssue` currently reduces every comment to display name,
  created time, and plain-text body. `TicketComment` cannot represent the raw
  identity or visibility fields after this conversion.
- `src/run-workspace.ts` then reconstructs author role from the current
  assignee, reporter display name, author-name keywords, bridge-body patterns,
  and internal-body markers.
- The same heuristic decides live classifier comments, live and dry-run
  workspace comments, replay target indexes, excluded-comment reporting, and
  which comment images may be materialized.
- The live prompt tells the model that `input/comments.md` is already filtered;
  the model is not the owner of this boundary.

## Risks

- Reassignment changes the current assignee and can therefore change the role
  assigned to an immutable historical comment.
- A former support engineer with a normal personal display name is treated as
  an unknown author and currently fails open into customer context.
- Prior support replies can contaminate semantic classification, the generated
  draft, image evidence, and dry-run evaluation independence.
- Internal/public visibility alone is not sufficient: customer and support
  replies can both be public. Stable author identity must be preserved too.
- Adding more display-name or body regexes would remain non-canonical and would
  not cover reassignment, renamed users, localized acknowledgements, or new
  support agents.
- Existing synthetic ticket callers can omit structured metadata. Unknown
  authors must not silently become customer input after this change.

## Target Contract

- `TicketComment` preserves comment ID, JSM public/internal visibility, and
  structured Jira author identity in addition to display text.
- A single deterministic comment-role classifier is the canonical source for
  replay and live filtering.
- Customer inclusion requires `jsdPublic=true` plus one of:
  - Jira author account type is `customer`;
  - stable author account ID/email/display name matches the reporter;
  - a trusted bridge container names an external email or a stable reporter ID.
- Support/internal evidence is one of:
  - `jsdPublic=false`;
  - stable PingCAP identity or current assignee matches the author;
  - direct Jira app account or non-customer account metadata is excluded but is
    not by itself treated as proof of a support author;
  - bot/internal body markers match.
- Unknown authors, name-only reporter matches, name-only support hints, and
  comments with unverified public visibility fail closed with an explicit
  exclusion reason. Body and name regexes remain defense-in-depth only and
  cannot establish a replay support target.
- Current assignee changes do not alter the classification of comments that
  carry structured Jira metadata.
- Classifier input, workspace input, replay targets, exclusion summaries, and
  image visibility all consume the same role decision.
- No prompt, model, coverage, Jira write, notification, or production config
  behavior changes.

## Non-Goals

- Do not make the LLM classify Jira authors.
- Do not retrieve or replay prior support/internal comment bodies through a
  fallback path.
- Do not change the five-minute supplement window or automatic Jira comment
  idempotency contract.
- Do not enable prod or modify customer-visible Jira behavior.

## Implementation Steps

1. Extend the comment contract and preserve raw Jira identity/visibility.
2. Replace current-assignee-first inclusion with one canonical role decision
   that is reused by live and replay paths.
3. Keep bridge-speaker support/customer separation while making unknown direct
   comments fail closed.
4. Update incorrect historical replay expectations and add focused invariance
   tests for reassignment and former support authors.
5. Run typecheck, build, focused tests, full tests, and an independent review.
6. Merge the aisupport PR, build the staging image, merge the app-delivery image
   bump, and verify the live pod image/environment.
7. Create a read-only live workspace for NAID-12133 and assert that only the
   customer attachment comment is visible; Wei, Marian, and Jiamin comments must
   be listed as excluded and must not appear in `input/comments.md`.

## Verification Checklist

- [x] Jira conversion preserves ID, visibility, account ID, account type, and
      author email.
- [x] Public customer comments are included.
- [x] Public support comments are excluded even after reassignment.
- [x] Internal comments and auto-oncall notes are excluded.
- [x] External bridge speakers are included and PingCAP bridge speakers are
      excluded.
- [x] Unknown identity fails closed.
- [x] Reassignment does not change visible comment indexes.
- [x] Classifier/workspace/replay/image visibility share the same indexes.
- [x] Local typecheck, build, focused tests, and full tests pass.
- [ ] Staging pod runs the merged image with the existing GPT-5.6 reasoning
      contract unchanged.
- [ ] NAID-12133 live workspace contains no prior support reply body.