# Shared Provider Auth Gate

<!-- auto-oncall-optimization-record
{
  "schemaVersion": "auto-oncall-optimization-record-v1",
  "optimizationId": "shared-provider-auth-gate-2026-08-12",
  "problems": [
    {
      "problemId": "shared-auth-failure-allows-unexecutable-scenario-pipeline",
      "summary": "A failed shared Wetech readiness bootstrap still allowed scenario planning and synthesis even though no provider query could execute.",
      "status": "optimized_unverified",
      "issueKeys": ["APID-29194"],
      "sourceRefs": [],
      "signalTextIncludesAny": ["auth bootstrap", "bounded_failure", "targetReference null"],
      "observedThrough": "2026-08-12",
      "effectiveAt": "2026-08-12T06:49:36Z",
      "verifiedAt": null,
      "attemptedAction": "Make shared provider bootstrap a hard runner prerequisite and stop before scenario evidence phases after failure.",
      "evidenceUrl": "https://github.com/tidbcloud/aisupport/tree/main/auto-oncall-services/docs/opts/2026-08-12-shared-provider-auth-gate.md"
    }
  ]
}
-->

- Owner: auto-oncall-services
- Source: APID-29194
- Status: optimized_unverified

Shared provider readiness is now a hard precondition. A failed bootstrap is
recorded once and stops before scenario evidence, provider, and synthesis work.
The gate is deployed and its failure path is contract-tested. Both live
replays authenticated successfully, so no post-change provider-auth failure
occurred to verify the hard-stop behavior end to end.