# ISS-0056: Activity Hub 事件 API 对部分集群返回 HTML "Access Denied" 而非 JSON

## Background

In O11Y-2489480 (GCP Japan Dedicated cluster, cluster_id=10766841556523235152), the agent queried
Activity Hub cluster events via collect_evidence.py A5, but received an HTML "Access Denied" page
instead of JSON. This prevented confirming whether the TiDB pod restart was caused by K8s OOMKilled.

Workspace: ws-1777512849128-e855d536a

## Observed Error

From tool call output in the workspace:
```
err: Expecting value: line 1 column 1 (char 0)
<!DOCTYPE html>
<html>
  <title>Access Denied</title>
  ...
```

The collect_evidence.py A5 segment records this in `errors` but the diagnosis continues silently.
The agent reported the error text in a tool call but did not propagate the "cannot verify OOMKilled"
statement into the final diagnosis.

## Root Cause Analysis

1. The Activity Hub API endpoint used in collect_evidence.py may require different authentication
   or authorization scopes for GCP Japan region clusters vs AWS clusters.
2. The token from clinic-auth.sh may have insufficient permissions for this cluster type.
3. Alternative: the API endpoint URL for GCP Japan may differ from the default.

## Fix Plan

1. **Investigate scope**: Confirm whether the Access Denied is due to token scope, IP allowlist,
   or API endpoint difference for GCP Japan clusters.
2. **Update clinic-auth.sh**: If additional scope is needed, add it to the token acquisition logic.
3. **Improve error surfacing**: In collect_evidence.py A5, when Activity Hub returns non-JSON,
   add a clear message in the evidence_summary Key Findings:
   `"Activity Hub events unavailable (Access Denied) — K8s OOMKilled event cannot be confirmed"`
4. **Update SKILL.md**: In Node C analysis, if events section is empty AND errors contain A5
   Access Denied, instruct agent to note this limitation in the diagnosis output.

## Verification

After fix: Run collect_evidence.py against the same cluster (10766841556523235152) and confirm
Activity Hub returns valid JSON. Check that when A5 fails, the evidence_summary includes the
"unavailable" key finding.

## Related Issues

- ISS-0039: Activity Hub not proactively checked for node restarts
- ISS-0036: Loki returns empty results for panic alerts