# Wetech Canonical Targets and Credential Profiles

<!-- auto-oncall-optimization-record
{
  "schemaVersion": "auto-oncall-optimization-record-v1",
  "optimizationId": "wetech-canonical-targets-and-credential-profiles-2026-09-02",
  "problems": [
    {
      "problemId": "managed-wetech-target-inventory-drift",
      "summary": "The Wetech Managed Tool v8 carried one independently maintained SaaS01 target while routing used a 26-target canonical inventory, so a valid Middle East SaaS route failed local validation before any Provider request.",
      "status": "candidate",
      "applicability": "Agent9-backed Wetech OP evidence acquisition for an exact canonical region and cluster pair.",
      "issueKeys": ["APID-29438"],
      "sourceRefs": ["https://tidb.atlassian.net/browse/APID-29438#problem:managed-wetech-target-inventory-drift"],
      "signalTextIncludesAny": [
        "managed Wetech cluster is unavailable",
        "provider_validation_failed",
        "requestCount=0"
      ],
      "observedThrough": "2026-09-02",
      "effectiveAt": null,
      "verifiedAt": null,
      "attemptedAction": "Generate the immutable Managed Tool runtime map and network host allowlist from the canonical Wetech Skill inventory, bind targets by region and alias, select password profiles only from that trusted target, normalize harmless Agent string whitespace, and read browser state from the reviewed regional Drive9 origin that provisioned it.",
      "evidenceUrl": "https://tidb.atlassian.net/browse/APID-29438"
    }
  ]
}
-->

- Owner: Wetech Managed Tool package build and installation Auth
- Source: APID-29438 read replay and Wetech credential rotation
- Implementation status: local candidate
- Effective status: `candidate`

## Bounded problem

The Scenario Router correctly resolved Middle East production `SaaS`, but
Managed Tool v8 had a separate package-local target file containing only Asia
production `SaaS01`. It rejected the exact authorized target before browser or
network startup. The same package also exposed only one Grafana password and
one Dashboard password, while the current Wetech credentials have distinct
Asia-production and default scopes.

## Intended change

- Keep `skills/wetech-op-grafana/data/clusters.json` as the one maintained
  target inventory.
- Generate the digest-bound package target map and target host allowlist from
  that inventory during the existing package build.
- Require the exact Router-owned `region` plus canonical cluster alias in the
  Tool call so duplicate aliases across regions remain unambiguous.
- Select the Grafana and Dashboard password profile from the generated trusted
  target. Do not accept a profile, URL, datasource UID, Dashboard cluster name,
  or credential from the Agent.

## Verification status

Local package tests prove that every canonical target appears exactly once in
the generated map, target fields match the source inventory, both Middle East
hosts and Asia hosts enter the restricted network allowlist, password profiles
follow the scoped rotation, harmless surrounding whitespace does not reject a
valid Tool call, the regional Drive9 origin is explicitly injected and
allowlisted, and package digests remain reproducible. The first v9 runtime
canary exposed a mismatched Drive9 origin and a real replay input rejected by
stricter-than-schema string handling before network execution; v10 owns both
observed failures.

## Next validation action

Publish and load Managed Wetech v10, rotate the shared Wetech installation Auth
without exposing values, install v10 on both active Wetech Agent scopes, then
run bounded read-only replays for the Middle East target and Asia SaaS targets.