schema_version: 1 case_id: expensive-query-alert-correlation-during-incident-window ground_truth: root_cause: A sustained expensive-query workload drove TiKV-side latency and correlated downstream alerts; background TiFlash jitter and memory signals were secondary judge: semantic_strategy: undecided contract: checks: - id: time_window_match required: true description: Actual diagnosis time window matches one allowed case window. match: all_of rules: - source: trace_fact matcher: bool_true path: time_window_match - id: cluster_scope_match required: true description: Actual diagnosis cluster scope matches expected cluster id. match: all_of rules: - source: trace_fact matcher: bool_true path: cluster_scope_match workflow: checks: - id: architecture_context_loaded weight: 5 required: true description: Architecture context is loaded. match: all_of rules: - source: workflow_fact matcher: bool_true path: architecture_context_loaded - id: misdiagnosis_guardrails_loaded weight: 5 required: true description: Misdiagnosis guardrails are loaded. match: all_of rules: - source: workflow_fact matcher: bool_true path: misdiagnosis_guardrails_loaded - id: diagnosis_run_initialized weight: 5 required: true description: Diagnosis run is initialized. match: all_of rules: - source: workflow_fact matcher: bool_true path: diagnosis_run_initialized - id: evidence_collection_completed weight: 10 required: true description: Evidence collection completes. match: all_of rules: - source: workflow_fact matcher: bool_true path: evidence_collection_completed - id: summary_read_completed weight: 5 required: false description: Summary artifact is read when available. match: all_of rules: - source: workflow_fact matcher: bool_true path: summary_read_completed - id: final_answer_emitted weight: 0 required: false description: Final answer is emitted. match: all_of rules: - source: workflow_fact matcher: bool_true path: final_answer_emitted execution_contract: checks: - id: required_workflow_present required: true description: Required workflow milestones are present. match: all_of rules: - source: workflow_check matcher: subset_observed paths: - architecture_context_loaded - misdiagnosis_guardrails_loaded - diagnosis_run_initialized - evidence_collection_completed - id: required_artifacts_present required: true description: Required evidence artifacts are present. match: all_of rules: - source: artifact_fact matcher: subset_observed paths: - core_evidence_bundle_present - id: preferred_channels_minimum_observed required: true description: At least one preferred evidence channel is observed. match: all_of rules: - source: channel_fact matcher: count_gte paths: - query_or_metric threshold: 1 - id: preferred_channels_all_observed required: false description: Preferred evidence channels are all observed. match: all_of rules: - source: channel_fact matcher: subset_observed paths: - query_or_metric evidence_collection: weight: 5 checks: - id: required_artifacts_present weight: 4 required: true description: Required evidence artifacts are present and readable. match: all_of rules: - source: artifact_fact matcher: subset_observed paths: - core_evidence_bundle_present - id: preferred_channels_minimum_observed weight: 0 required: true description: At least the minimum number of preferred evidence channels are observed. match: all_of rules: - source: channel_fact matcher: count_gte paths: - query_or_metric threshold: 1 - id: preferred_channels_all_observed weight: 6 required: false description: Preferred evidence channels are all observed. match: all_of rules: - source: channel_fact matcher: subset_observed paths: - query_or_metric critical_evidence: weight: 30 checks: - id: expensive_query_signal_present weight: 8 description: Evidence shows an expensive-query spike in the incident window. match: any_of rules: - source: artifact_json artifacts: - queries matcher: json_text_contains_any keywords: - slow_query - expensive query - query_time - expensive - source: artifact_json artifacts: - metrics matcher: json_text_contains_any keywords: - ExpensiveQuery - expensive_query - sql duration - id: correlated_latency_signal_present weight: 8 description: Evidence correlates the expensive-query spike with TiKV-side latency or downstream network-lag alerts. match: any_of rules: - source: artifact_json artifacts: - metrics matcher: json_text_contains_any keywords: - grpc - network lag - latency spike - db-tikv - source: artifact_json artifacts: - summary_json matcher: json_text_contains_any keywords: - correlated alert - NetworkLagIncrease - related alerts - id: workload_path_context_present weight: 9 description: Evidence identifies a dominant expensive-query workload path rather than generic background noise. match: any_of rules: - source: artifact_json artifacts: - queries matcher: json_text_contains_any keywords: - digest - TopSQL - plan - process_keys - source: artifact_json artifacts: - summary_json matcher: json_text_contains_any keywords: - expensive workload - dominant query - primary query evidence_routing: weight: 5 checks: - id: analysis_patch_valid_json weight: 1 required: true description: Analysis patch is valid JSON whenever the patch exists. match: any_of rules: - source: routing_fact matcher: bool_false path: analysis_patch_present - source: routing_fact matcher: bool_true path: analysis_patch_valid_json - id: analysis_items_shape_valid weight: 2 required: true description: Analysis patch items are structurally valid whenever the patch exists. match: any_of rules: - source: routing_fact matcher: bool_false path: analysis_patch_present - source: routing_fact matcher: bool_true path: analysis_items_shape_valid - id: analysis_key_evidence_present weight: 2 required: true description: Analysis patch includes key evidence whenever the patch exists. match: any_of rules: - source: routing_fact matcher: bool_false path: analysis_patch_present - source: routing_fact matcher: bool_true path: analysis_has_key_evidence - id: metric_refs_resolvable weight: 1 required: true description: Metric references resolve whenever the patch requires them. match: any_of rules: - source: routing_fact matcher: bool_false path: analysis_metric_refs_required - source: routing_fact matcher: bool_true path: analysis_metric_refs_resolvable - id: query_refs_resolvable weight: 1 required: true description: Query references resolve whenever the patch requires them. match: any_of rules: - source: routing_fact matcher: bool_false path: analysis_query_refs_required - source: routing_fact matcher: bool_true path: analysis_query_refs_resolvable - id: supporting_evidence_present weight: 0 required: false description: Analysis patch includes supporting evidence whenever the patch exists. match: any_of rules: - source: routing_fact matcher: bool_false path: analysis_patch_present - source: routing_fact matcher: bool_true path: analysis_has_supporting_evidence - id: analysis_log_or_event_channel_resolvable weight: 0 required: false description: Routed log or event items stay resolvable against observed channels. match: all_of rules: - source: routing_fact matcher: bool_true path: analysis_log_or_event_channel_resolvable diagnosis: checks: - id: identify_expensive_query_workload_as_primary_driver mode: blended weight: 3 required: true description: Identifies the expensive-query workload as the primary incident path. deterministic: match: all_of rules: - source: output_text matcher: keyword_any keywords: - expensive query - expensive queries - slow query - dominant query - expensive workload - 慢查询 - 昂贵查询 semantic: id: 1 title: 主路径判断 description: | 判断回答是否把主路径识别为 expensive-query workload， 而不是 generic infrastructure explanation。 - id: identify_correlated_tikv_or_network_impact mode: blended weight: 3 required: false description: Connects the workload to TiKV latency or downstream network-lag impact. deterministic: match: any_of rules: - source: output_text matcher: keyword_any keywords: - TiKV latency - grpc latency - network lag - correlated alerts - TiKV 热点 - 网络抖动 semantic: id: 2 title: 影响链路关联 description: | 判断回答是否把 expensive-query workload 与 TiKV latency、 grpc latency 或 downstream network-lag impact 关联起来。 - id: reject_background_noise_as_primary_root_cause mode: deterministic_only scoring_mode: penalty weight: 3 required: false description: Avoids elevating secondary TiFlash or memory-related background signals into the primary root cause. deterministic: match: any_of rules: - source: output_text matcher: regex_any patterns: - "(secondary|background).{0,80}(signal|noise|condition)" - "(not the primary root cause|not primary).{0,80}(TiFlash|memory)" - "(背景|次要).{0,40}(信号|噪音)" - id: recommend_query_level_optimization mode: blended weight: 4 required: false description: Recommends query-level optimization rather than only infrastructure tuning. deterministic: match: any_of rules: - source: output_text matcher: keyword_any keywords: - add index - optimize query - execution plan - SQL digest - 优化 SQL - 执行计划 semantic: id: 3 title: 查询级修复建议 description: | 判断回答是否优先建议 query-level optimization， 而不是只停留在 infrastructure tuning。 - id: mention_related_alert_correlation mode: blended weight: 4 required: false description: Mentions that related alerts help explain the impact chain. deterministic: match: any_of rules: - source: output_text matcher: keyword_any keywords: - related alerts - correlation - NetworkLagIncrease - related signal - 关联告警 semantic: id: 4 title: 关联告警解释 description: | 判断回答是否提到相关告警或相关信号， 并把它们用于解释 impact chain。 - id: call_out_need_for_query_identification mode: blended weight: 4 required: false description: Calls out the need to isolate the specific expensive SQL digest or plan. deterministic: match: any_of rules: - source: output_text matcher: keyword_any keywords: - SQL digest - TopSQL - slow query log - decoded plan - 慢日志 semantic: id: 5 title: 定位具体查询 description: | 判断回答是否指出需要继续锁定具体的 expensive SQL digest、 TopSQL entry 或 decoded plan。