# Wetech Managed Tool Target Output Redaction

<!-- auto-oncall-optimization-record
{
  "schemaVersion": "auto-oncall-optimization-record-v1",
  "optimizationId": "wetech-target-output-redaction-2026-09-01",
  "problems": [
    {
      "problemId": "wetech-browser-state-target-collision",
      "summary": "Wetech repeated the runner-owned cluster and issue key in its result, so Agent9's protected-secret output check could reject otherwise safe evidence when browser storage state contained the same target string.",
      "status": "ineffective",
      "applicability": "Agent9-backed Wetech OP evidence acquisition whose private browser storage state contains a string also repeated in the Tool result.",
      "issueKeys": ["APID-29338"],
      "sourceRefs": ["https://tidb.atlassian.net/browse/APID-29338#problem:wetech-browser-state-target-collision"],
      "signalTextIncludesAny": [
        "Managed Tool output contained protected secret material",
        "runtime_error",
        "APID-29338"
      ],
      "observedThrough": "2026-09-01",
      "effectiveAt": "2026-09-01T19:12:00+08:00",
      "verifiedAt": "2026-09-01T19:19:00+08:00",
      "attemptedAction": "Publish Wetech Managed Tool v6 without echoing the runner-owned cluster or issue key; retain only the provider, operation, authorized window, and already-redacted metric or Dashboard summary.",
      "evidenceUrl": "https://internal.us-west-2.agent.mem9.ai/api/sessions/sess_a7f6255b714b423f949ef5b03bc6b2d8"
    }
  ]
}
-->

- Owner: Wetech Managed Tool result projection
- Source: APID-29338 read replay `c2fb85c8-fdfd-45ac-bda3-b3fcfb4bbaa6`
- Implementation status: deployed in AOS `87b2f5a45c2a74ab69ca9e53250f7a9c3a7e45cb` with Agent9 Managed Wetech v6
- Effective status: `ineffective`

## Bounded problem

The Wetech Tool repeated the exact cluster name and Jira issue key in its
compact result even though the runner already owns both facts. The private
browser storage state can contain the same target string, so Agent9's generic
secret-output check correctly blocked the repeated value and reduced the
Provider result to `runtime_error`.

## Intended change

Do not repeat the cluster or issue key in Tool output. Preserve the provider,
operation, authorized time window, query identifier, unit, and already-redacted
summary. Target authorization and binding remain enforced on input, and the
runner continues to own the exact target in the scenario workspace.

## Verification

The immutable v6 bundle loaded with Agent9's image unchanged, loader exit 0,
and the Pod Ready. Both the Evidence and Primary Agent installations and actual
Agent config snapshots referenced v6 with the existing Auth configured.

APID-29338 `mode=read` replay `1ed04251-b6db-431d-a6fa-a0a9acaf4929`
completed with HTTP 200 in 374.033 seconds and made no Jira, database,
evaluation, or Feishu write. All five Wetech Operations remained failed with
`runtime_error: Managed Tool output contained protected secret material`.
Removing the target and issue-key echoes therefore did not satisfy the bounded
criterion. The result projection remains blocked by a separate Agent9 generic
secret-output classification collision.

## Next validation action

Investigate the exact Agent9 protected-output classifier collision without
printing credential values. Change the Agent9-owned generic scanner only after
the harmless colliding field is identified; do not keep removing required
Provider-result fields or repeat APID-29338 before that owner is repaired.