[Paul Lizer (paullizer)]

Summary

• FED-16 exposed a diagnostic gap: the SQL connection check returned HTTP 400 and InterfaceError without enough structured evidence to explain the failure. This fixes that gap, not the unresolved live connection cause.
• Share conservative, credential-safe classification across SQL connection testing and query/schema runtime for SQL Server/Azure SQL, PostgreSQL, MySQL, and SQLite. Clients receive static guidance and an additive application-owned error_code, never raw provider messages.
• Preserve validated SQLSTATE/native error evidence through the real Application Insights boundary in correlated [SQL_CONNECTION] warnings, without requiring debug logging.
• Preserve authentication, identity authorization, driver inputs, timeouts, successful results, and the existing bounded Driver 17-to-18 fallback. Add isolated regressions, troubleshooting documentation, and version 0.261.351. No deployment, live retry, permission change, or federal harness repair is included.

Linked issue

N/A. The user explicitly requested that no GitHub issue be created.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Operator telemetry and troubleshooting guidance change; no new admin settings or UI controls are added.

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application version: base 0.261.350 -> 0.261.351. The initial branch-only SQL version was 0.261.349; conflict resolution preserved the newer base version and synchronized SQL test/documentation references. Both SQL and saved-memory logging sections are retained. No deployer files changed.

Testing / validation

Commands ran locally with external SQL/provider I/O isolated. No live FED-16 rerun was performed. After base integration, the focused SQL, optimized classifier, and documentation checks passed again.

• python -m pytest -q -p no:cacheprovider --disable-warnings --tb=short functional_tests\test_sql_connection_diagnostics.py functional_tests\test_sql_connection_diagnostics_runtime.py functional_tests\test_workspace_authoring_backend.py::test_sql_editor_service_principal_does_not_silently_test_another_authentication_mode functional_tests\test_workspace_authoring_backend.py::test_sql_editor_identity_credentials_override_stale_flat_auth_hints functional_tests\test_workspace_authoring_backend.py::test_editor_connection_identities_fail_closed_without_provider_diagnostics functional_tests\test_workspace_authoring_backend.py::test_sql_editor_driver_failures_do_not_echo_resolved_credentials functional_tests\test_sql_container_odbc_runtime.py - 114 passed, including after base integration.
• python -O -m pytest -q -p no:cacheprovider --disable-warnings --tb=short functional_tests\test_sql_connection_diagnostics.py - 38 passed, including after base integration and a fresh-process probe with explicit checks that survive optimized Python.
• python -m pytest -q -p no:cacheprovider --disable-warnings --tb=short functional_tests\test_sql_odbc_driver_18_support.py functional_tests\test_unified_logging_entrypoint.py functional_tests\test_log_credential_key_redaction.py functional_tests\test_appinsights_logging_recursion_guard.py - 16 passed, 1 pre-existing failure in initial validation. The legacy debug-forwarding test expects rendered text instead of the existing constant [SIMPLE_CHAT_DEBUG_TRACE] record message. Loading the unchanged HEAD logger reproduced the same failure; it was not repaired here.
• python -m pytest -q -p no:cacheprovider --disable-warnings --tb=short functional_tests\test_sql_connection_diagnostics.py functional_tests\test_sql_connection_diagnostics_runtime.py functional_tests\test_logging_tag_standardization.py - initial repository-wide tag check failed on pre-existing mixed-case tags. A separate read-only inventory check also found existing missing/stale tags. Tags in modified product files are normalized, and the new SQL tag is documented. Unrelated sources were left unchanged.
• python functional_tests\route_tests\test_route_blueprint_policy_inventory.py - 15/15 passed in initial validation.
• python functional_tests\route_tests\test_route_unauthenticated_policy_contract.py - 10/10 passed in initial validation.
• python functional_tests\route_tests\test_route_policy_test_coverage.py - 3/3 passed in initial validation.
• python scripts\build_docs_inventory.py - passed, regenerated inventory unchanged at 33 user-facing actions; the diagnostic helper is excluded as infrastructure.
• python functional_tests\test_docs_app_surface_coverage.py - 7/7 passed, including after base integration.
• python functional_tests\test_docs_site_quality.py - 6/6 passed, including after base integration.
• python -m pytest -q -p no:cacheprovider --disable-warnings --tb=short functional_tests\test_orchestration_request_memory_resolution.py functional_tests\test_fact_memory_read_only_context.py functional_tests\test_orchestration_conversation_sources.py with the application and functional-test directories on PYTHONPATH - 10 passed, 5 subtests passed, 47 setup errors. The inherited memory suites encounter the shared installation's pre-existing OpenSSL mismatch (lib.GEN_EMAIL), already noted in the base fix documentation. No memory assertions or shared packages were changed to bypass it.
• git diff --cached --check - passed for conflict resolution. Merged Python files also compiled in memory; SQL version headers and fix documentation match 0.261.351.

The broader authoring fixture has a separately documented, pre-existing missing MCP validator dependency. New diagnostics regressions do not repair or depend on that broken save setup. Harness findings remain in session artifacts and are not committed.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Added docs/explanation/fixes/SQL_CONNECTION_DIAGNOSTICS_FIX.md; updated SQL action troubleshooting and the logging-tag reference. No new feature surface is introduced. Release-note updates were offered, but approval was unavailable, so docs/explanation/release_notes.md remains unchanged.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

No new Flask routes, settings payloads, or browser assets are added. Existing route authorization is retained. Test connection strings and credentials are synthetic fixtures only; live identifiers, investigation artifacts, and credentials are excluded. Provider diagnostics remain operator-side and do not expose raw exception text.