fix(planner): rich incident pastes stay assistant_handoff, never investigation_start (#4868)

Author: YauhenBichel

DEPLOYMENT.md

@@ -79,18 +79,6 @@ make destroy-gateway-on-new-server
 
 ---
 
-## Fargate multi-tenant deployment (Terraform)
-
-The shared ECS Fargate foundation, the IAM lifecycle API and the public-run API
-are no longer part of this repository. They live with the web application, in
-`opensre-webapp/opensre-infra-aws/`, and are deployed from there.
-
-This repository keeps only what the gateway itself needs at runtime: the
-`SizeProfile` contract in `platform/deployment_contracts/`, and credential
-hydration from the control-plane bootstrap / integrations secrets
-(`gateway/core/runtime/credential_hydration.py`). Remote agent-run polling and its
-Postgres store are owned by the webapp stack, not the gateway process.
-
 ## Runtime Environment (Hosted / General)
 
 Deploy OpenSRE as a standard Python/FastAPI app using the repo `Dockerfile`, Railway,

core/agent_harness/prompts/action/text.py

@@ -242,7 +242,11 @@
   has elevated 500s and latency after deploy" — states a fact but does not ask
   you to find a cause. Emit assistant_handoff, even when integrations are
   connected and even when it reads urgent or "critical". Do NOT start an
-  investigation for it.
+  investigation for it. A multi-line dashboard paste with Service / Region /
+  Recent deploy / Logs lines and no investigate/analyze/diagnose/RCA verb is
+  still a bare incident → assistant_handoff (set evidence_kind=incident), never
+  investigation_start. Rich context does not upgrade a symptom paste into an
+  explicit investigate instruction.
 - A diagnostic question that is a FOLLOW-UP about a result you already produced
   (see RECENT CONVERSATION) — e.g. "why did it fail?" / "what caused the spike?"
   / "what happened?" after a completed investigation — is answered from that
@@ -350,7 +354,8 @@
   the assistant's previous reply — synthesize alert_text from that prior
   conversation (the original question plus the key evidence it reported). An
   implicit diagnostic cause question and a bare pasted alert blob remain
-  assistant_handoff.
+  assistant_handoff — including multi-line Service/Region/deploy/logs pastes
+  with no investigate verb.
 - synthetic_run — run synthetic benchmark scenario by id. Use the exact scenario
   number the user supplied. If the user gives only a three-digit prefix, choose
   the enum value beginning with that prefix.

tests/core/agent/prompts/prompt_characterization_snapshot.json

@@ -23,13 +23,16 @@ notes:
   rather than blindly executing opensre investigate --input-json with potentially malformed JSON.'
 - Complements 307-new-alert-checkout-502 (single-line) by covering the structured multi-line format users
   naturally paste from incident dashboards.
+- 'Planner contract: NO investigate/analyze/diagnose/RCA verb → assistant_handoff (evidence_kind=incident),
+  never investigation_start. Rich Service/Region/deploy/logs context must not upgrade a symptom paste.'
 turn:
   expected_kind: agent
 policy:
   executes_terminal_action: false
 planned_actions:
 - kind: assistant_handoff
   content: incident_description:checkout_api_500_db_timeout
+  evidence_kind: incident
   source: llm
 response_contract:
   must_contain_any: []