# Secure Bundled Provider Skills

<!-- auto-oncall-optimization-record
{
  "schemaVersion": "auto-oncall-optimization-record-v1",
  "optimizationId": "secure-bundled-provider-skills-2026-08-10",
  "problems": [
    {
      "problemId": "wetech-runtime-skill-pvc-contains-embedded-credentials",
      "summary": "The Kubernetes Wetech Provider Executor depends on a mutable PVC skill whose documentation, helper, and TOTP assets contain authentication material, while the repository's bundled Wetech skill describes a different Agent9-only contract.",
      "status": "optimized_verified",
      "issueKeys": ["APID-29232"],
      "sourceRefs": [],
      "signalTextIncludesAny": [
        "wetech-op-grafana",
        "codex skills pvc",
        "embedded credentials",
        "totp seed"
      ],
      "observedThrough": "2026-08-10",
      "effectiveAt": "2026-08-10T15:42:45Z",
      "verifiedAt": "2026-08-10T16:03:50Z",
      "attemptedAction": "Bundle the Kubernetes Wetech helper and contract with the image alongside Manus, remove the Wetech PVC override, delete credential and TOTP artifacts, read all Wetech authentication values only from Kubernetes Secret-backed environment variables, and expose provider credentials only to runner-owned helper processes rather than Agent environments.",
      "evidenceUrl": "https://github.com/tidbcloud/aisupport/tree/main/auto-oncall-services/docs/opts/2026-08-10-secure-bundled-provider-skills.md"
    }
  ]
}
-->

- Optimization ID: `secure-bundled-provider-skills-2026-08-10`
- Owner: auto-oncall-services runtime packaging
- Source reference: runtime source-of-truth and credential-boundary audit on
  2026-08-10
- Implementation status: deployed to staging
- Effective status: `optimized_verified`

## Bounded problem

Manus was installed from the image, but Wetech was overwritten from the shared
skills PVC at startup. That made the image non-reproducible and kept operational
credentials and TOTP material inside the skill package instead of the existing
Kubernetes Secret boundary.

## Implemented change

- Install both Wetech and Manus as required bundled image skills. Keep the
  external skills mount only for Clinic until its separate ownership changes.
- Retain only Wetech helper code, non-sensitive target routing, references, and
  tests. Do not bundle QR images, TOTP URI files, historical evidence, browser
  state, usernames, passwords, cookies, or tokens.
- Read seven `WETECH_*` values only from Secret-backed environment variables in
  the staging Deployment and optimizer CronJob. Prod references remain optional
  while prod automation is disabled.
- Remove all `CLINIC_*`, `WETECH_*`, and `MANUS_*` values from Support,
  Evidence, Diagnostic, and Synthesis Agent environments. Runner-owned auth and
  Provider Executor subprocesses retain the provider values they need.
- Fail with `provider_credentials_missing` when the runtime secret is absent;
  never fall back to a packaged value.

## Verification

- Installer tests prove an external Wetech directory cannot override the
  bundled copy and startup fails when the bundled copy is absent.
- Wetech package tests prove credential/TOTP assets are absent, login guidance
  cannot return injected secret values, and all 54 transport and batch tests
  pass.
- Runner tests prove Agent environments omit every Clinic/Wetech/Manus value
  while the deterministic Wetech auth helper still receives its runtime secret.
- Staging Deployment and optimizer CronJob reference all seven Wetech keys from
  `auto-oncall-services-secret`; the live Pod has seven non-empty values.
- The live image contains the bundled Wetech and Manus helpers, contains no
  Wetech credential/TOTP asset, and has no external Wetech skill override.
- A live headless Wetech readiness call for `SaaS01` completed successfully and
  discovered 42 Prometheus data sources.

## Unresolved gaps

- No unresolved gap remains for this bounded packaging and credential-boundary
  problem. Manus provider reachability is tracked separately from skill
  packaging.

## Next validation action

Retain the runtime readiness check when the Wetech authentication or packaging
boundary changes again.