# Recent Optimizer Manus credentials

<!-- auto-oncall-optimization-record
{
  "schemaVersion": "auto-oncall-optimization-record-v1",
  "optimizationId": "recent-optimizer-manus-credentials-2026-07-21",
  "problems": [
    {
      "problemId": "recent-optimizer-manus-credentials-missing",
      "summary": "The staging Recent Optimizer CronJob does not inject the existing Manus read-only credentials, so required Manus evidence is inconclusive.",
      "status": "optimized_verified",
      "issueKeys": ["APID-29174"],
      "sourceRefs": [],
      "signalTextIncludesAny": ["manus grafana health preflight", "manus read-only credentials", "manus 只读监控凭证"],
      "observedThrough": "2026-07-20",
      "effectiveAt": "2026-07-21T11:31:47+08:00",
      "verifiedAt": "2026-07-21T11:31:47+08:00",
      "attemptedAction": "Inject the existing Manus Grafana and TiDB Dashboard read-only Secret keys into the staging Recent Optimizer CronJob.",
      "evidenceUrl": "https://github.com/tidbcloud/app-delivery/pull/75027"
    }
  ]
}
-->

- Optimization ID: `recent-optimizer-manus-credentials-2026-07-21`
- Owner: auto-oncall-services
- Source type: Recent Evaluation runtime blocker
- Source reference: Focus #375 baseline checkpoint for `APID-29174`

## Bounded problem

The staging service Deployment already receives the four Manus Grafana and
TiDB Dashboard read-only credentials from `auto-oncall-services-secret`, but the
Recent Optimizer CronJob does not. Manus evidence preflight therefore stops
before it can query the fixed `vida` target during Recent Evaluation.

## Implementation and effective status

- Add the existing `MANUS_GRAFANA_USERNAME`, `MANUS_GRAFANA_PASSWORD`,
  `MANUS_DASHBOARD_USERNAME`, and `MANUS_DASHBOARD_PASSWORD` Secret references
  to the staging Recent Optimizer CronJob.
- Effective/deployment: merged in `tidbcloud/aisupport#396`, synced by
  `tidbcloud/app-delivery#75027`, and present in the live staging CronJob since
  2026-07-21 11:31 +08:00.
- Status: `optimized_verified` for the missing-CronJob-credentials problem.

## Validation evidence

- The rendered live CronJob references all four expected keys in
  `auto-oncall-services-secret`; all four keys exist, and no values were read or
  printed.
- A temporary Job derived from the live CronJob executed only
  `manus_op_grafana.py health --target vida`. It returned `status=ok`, resolved
  the exact `vida` Prometheus datasource, and connected to Grafana and TiDB
  Dashboard using the CronJob environment.
- The temporary verification Jobs were deleted after validation.

## Unresolved gaps and next action

- The credential injection is verified. Focus #375 still needs its next normal
  Recent Evaluation to judge `APID-29174` and determine whether the Focus is
  ready to close or still has a confirmed capability gap.