# ISS-0020: 需区分负载触发问题与产品 bug

## Background

多个 case 中 agent 混淆了"负载导致问题"和"产品 bug / 运维操作导致问题"。agent 倾向于将所有异常归因于负载或查询问题，而不考虑：
- 是否是人工运维操作触发的（扩容、升级、维护）
- 是否是产品 bug（已知 TiDB/TiKV issue）
- 负载本身是否在预期范围内

### TCOC-5019 中的表现

P999 SQL Duration spike 的真实原因是 TiDB v8.5.4 的已知 bug (#66096)，但 agent 倾向于归因于负载。

### TCOC-5140 中的表现

Latency spike 的真实原因是人工 ScaleResourcePool 操作（CPU 升级触发滚动重启），但 agent 首先归因于 OOM（内存问题 → 负载/配置问题），完全没考虑运维操作的可能性。

## Root Cause

SKILL.md 的推理流程中缺少"因果归因分类"步骤。Agent 发现异常后直接跳到负载/查询分析，没有先排除其他类别的原因。

## Fix Plan

### Step 1: 在 SKILL.md Node D 增加归因分类检查点

在给出根因结论之前，强制 agent 回答以下分类问题：

```markdown
### Root Cause Attribution Check (MANDATORY before final conclusion)

Before stating root cause, classify:

1. **Is this caused by a human operation?**
   - Check Activity Hub for recent operations (scale, upgrade, maintenance, config change)
   - If yes → root cause = "Planned operation impact", recommend operational improvements

2. **Is this caused by a known product bug?**
   - Search GitHub issues for error messages, stack traces, or behavior patterns
   - If yes → root cause = "Known bug [#issue]", recommend upgrade or workaround

3. **Is the workload within expected parameters?**
   - Compare current load vs historical baseline (7-day average)
   - If workload is normal but system failed → likely product bug or config issue
   - If workload is abnormal (spike, new pattern) → likely application-side change

4. **Is this a configuration mismatch?**
   - Compare resource usage vs resource limits (memory, CPU, disk)
   - If usage is within 80% of limits under normal load → config needs adjustment
   - If usage only exceeds under spike → application-side or need capacity planning

Only after answering these, state the root cause with proper attribution.
```

### Step 2: 添加 incorrect-conclusion 条目

```json
{
  "id": "ic-005",
  "trigger": "Agent attributes root cause to workload/load without checking for operations, known bugs, or config issues",
  "correction": "Before blaming workload, check: (1) Activity Hub for recent human operations, (2) GitHub issues for known bugs matching the symptoms, (3) whether the load is actually abnormal vs historical baseline."
}
```

### Step 3: 验证

1. Replay TCOC-5140：agent 应检查 Activity Hub 并归因为"人工操作"
2. Replay TCOC-5019：agent 应搜索 GitHub issues 并找到 known bug #66096
3. Replay O11Y-2328599：agent 应归因为"缺少索引"（应用侧问题），而非笼统的"负载问题"