# Agent9 Runtime Operation Boundary

<!-- auto-oncall-optimization-record
{
  "schemaVersion": "auto-oncall-optimization-record-v1",
  "optimizationId": "agent9-runtime-operation-boundary-2026-08-20",
  "problems": [
    {
      "problemId": "agent9-runtime-operation-rejected-as-provider-mismatch",
      "summary": "Auto-oncall treated ordinary Agent9 Runtime operations as unauthorized Provider calls, so an Evidence Agent list_dir operation caused a valid second Clinic evidence round to be discarded.",
      "status": "candidate",
      "applicability": "Agent9-backed Evidence Agent Turns that use current-Session file or shell tools alongside the selected Clinic, Wetech, or Manus Managed Tool.",
      "issueKeys": ["ST-2865"],
      "sourceRefs": ["https://tidb.atlassian.net/browse/ST-2865#problem:agent9-runtime-operation-rejected-as-provider-mismatch"],
      "signalTextIncludesAny": [
        "diagnostic_evidence_agent_provider_tool_mismatch",
        "Agent9 Runtime operation rejected as Provider call",
        "valid refinement round discarded after list_dir"
      ],
      "observedThrough": "2026-08-20",
      "effectiveAt": null,
      "verifiedAt": null,
      "attemptedAction": "Classify only recognized Managed Provider Tools during Agent9 evidence materialization, ignore ordinary Runtime operations, and preserve the selected-Provider and required-result checks.",
      "evidenceUrl": null
    }
  ]
}
-->

- Owner: Auto-oncall Agent9 Provider materialization boundary
- Source: Agent9-backed ST-2865 read replay
- Implementation status: candidate
- Effective status: `candidate`

## Bounded problem

Agent9 already owns file, shell, network, authorization, and audit policy for
ordinary current-Session Runtime operations. Auto-oncall nevertheless treated
every unknown `agent9-aos` Tool name as a Provider mismatch. In run
`cfcb778d-4dc6-4730-a991-ef30cf40e40e`, round two completed its Clinic calls but
also used `list_dir`; auto-oncall discarded the whole round instead of
materializing the valid selected-Provider results.

## Candidate change

- Select only the recognized Clinic, Wetech, and Manus Managed Tools when
  materializing Provider evidence.
- Continue rejecting a Managed Tool from a different Provider and requiring at
  least one valid result from the frozen selected Provider.
- Ignore ordinary Agent9 Runtime operations for Provider classification. Their
  output does not become Provider evidence and Agent9 retains their sandbox,
  authorization, and audit ownership.
- Remove prompt-level bans on file writes, shell execution, local code, and
  `curl`; direct Provider access still cannot replace the selected Managed Tool.

## Verification status

The candidate has focused contract coverage but is not effective until its PR
is merged and the passive Agent9 auto-oncall deployment runs the new image.

## Next validation action

After deployment, rerun ST-2865 in read mode and verify that a refinement Turn
using ordinary Runtime operations still materializes every valid Clinic
Managed Tool result. Wetech OP cases are intentionally excluded from this
acceptance check while Wetech OP querying remains disabled for security.