root_cause_category: cpu_saturation_bad_query
equivalent_root_cause_categories:
  - cpu_saturation
required_keywords:
  - rollout
  - query
  - sequential scan
  - cpu
  - performance insights
required_evidence_sources:
  - aws_performance_insights
  - aws_cloudwatch_metrics
  - k8s_rollout
  - k8s_pod_metrics
forbidden_categories:
  - infrastructure
  - connection_exhaustion
optimal_trajectory:
  - query_grafana_metrics
  - query_grafana_logs
  - query_grafana_alert_rules
  - describe_rds_instance
  - describe_rds_events
max_investigation_loops: 3
model_response: |
  ROOT_CAUSE: A query regression introduced in the latest checkout-api rollout caused cpu_saturation_bad_query on payments-prod. The new endpoint query removed a selective index predicate, triggering repeated sequential scans on orders and driving RDS CPU to 96%. This is application-query behavior correlated to rollout revision checkout-api-9bdaf, not an infrastructure failover.
  ROOT_CAUSE_CATEGORY: cpu_saturation_bad_query

  VALIDATED_CLAIMS:
  - Kubernetes rollout checkout-api-9bdaf completed 6 minutes before the CPU inflection, and no other service revisions changed. [evidence: k8s_rollout]
  - Performance Insights top SQL is a high-frequency SELECT with Seq Scan on orders and dominant CPU waits. [evidence: aws_performance_insights]
  - CloudWatch CPUUtilization increased from 38% to 96% while connections rose only moderately, ruling out pure connection exhaustion. [evidence: aws_cloudwatch_metrics]
  - Pod metrics show steady traffic growth, but the slope change aligns with rollout timing and SQL regression, not retry amplification. [evidence: k8s_pod_metrics]

  CAUSAL_CHAIN:
  - Rollout introduced query-plan regression.
  - Repeated sequential scans increased per-request DB work.
  - CPU saturated and request latency exceeded SLO.