# Wetech Workspace Admin unrestricted egress

<!-- auto-oncall-optimization-record
{
  "schemaVersion": "auto-oncall-optimization-record-v1",
  "optimizationId": "wetech-workspace-admin-unrestricted-egress-2026-09-03",
  "problems": [
    {
      "problemId": "wetech-browser-egress-installation-authority",
      "summary": "A reviewed Wetech browser package could not traverse the dynamic PZero dependency graph because sandbox network scope was fixed by the package rather than granted at installation time by the Workspace Admin.",
      "status": "optimized_verified",
      "applicability": "Wetech Managed Tool browser execution whose PZero authentication and target navigation require dynamic hosts beyond a stable reviewed package allowlist.",
      "issueKeys": ["APID-29437"],
      "sourceRefs": [
        "https://tidb.atlassian.net/browse/APID-29437#problem:wetech-managed-tool-egress-authority"
      ],
      "signalTextIncludesAny": [
        "restricted host allowlist",
        "networkAccess=unrestricted",
        "workspaceAdminMayAllowUnrestricted"
      ],
      "observedThrough": "2026-09-03",
      "effectiveAt": "2026-09-03T09:58:00Z",
      "verifiedAt": "2026-09-03T10:20:00Z",
      "attemptedAction": "Keep the package restricted by default, let Workspace Admin grant unrestricted network access on the exact installation, and enforce the resolved grant only in the Agent9 sandbox runtime.",
      "evidenceUrl": "https://github.com/tidbcloud/aisupport/pull/1307"
    }
  ]
}
-->

## Problem

The Wetech Managed Tool accepted P81 username, password, and MFA in E2B, but the PZero application-connect step returned `INCONSISTENT_USER_AGENT` before any Grafana request. Expanding the restricted host list through the observed browser dependency graph did not change that result. The same exact package flow, Organization Auth, Drive9 browser state, and bounded `vector(1)` query succeeded in an unrestricted E2B Tool Sandbox.

The provider package must not grant itself unrestricted internet, and the Evidence Agent or a Tool argument must not choose the sandbox network boundary.

## Owner and change

Agent9 installation authorization is the earliest owner. Agent9 adds an explicit `networkAccess` installation field, defaulting to `restricted`. A reviewed restricted package may only declare that it is eligible for a broader grant. The existing Workspace Admin that controls the exact Workspace- or Agent-scoped installation decides whether to set `unrestricted`; Agent9 persists, audits, resolves, and enforces that choice outside the Tool's invocation policy.

The AOS-owned Wetech package v32 declares eligibility and the AOS release orchestration explicitly requests `unrestricted` for the Evidence Agent installation. Clinic remains `restricted`. Wetech browser state continues to use its dedicated Drive9 file and credential values continue to come only from the installation-bound Organization Auth.

The same package also accepts the real Drive9 stat metadata envelope up to the existing bounded state-file limit, instead of rejecting valid state because non-content metadata exceeds the old 4 KiB cap.

## Safety boundaries

- Package publication and catalog registration grant no network authority.
- Default and omitted new-install values remain `restricted`.
- Only an eligible reviewed restricted package can receive the grant; Custom Tools cannot.
- Agent prompts, Tool arguments, package code, and business `policy` cannot request or observe the control-plane grant.
- Public inbound traffic remains disabled and every execution remains a fresh Tool Sandbox.
- Changing the grant is rejected while a non-terminal AgentRun freezes the exact reference.
- Exact package upgrade returns to `restricted` unless the Workspace Admin explicitly grants the new reference.
- Secret-output detection, exact Auth environment matching, query bounds, target binding, result compaction, and sandbox cleanup are unchanged.

## Verification

- Agent9 focused controller, installation-service, registry, and E2B-runtime tests cover Workspace Admin propagation, eligibility, default/preserved state, and effective sandbox options.
- AOS package and release tests cover Wetech v32 eligibility, immutable digest generation, explicit Wetech `unrestricted`, Clinic `restricted`, and readback.
- Internal production readback shows the exact Evidence Agent installation at `networkAccess=unrestricted`; a fresh v34 sandbox traversed the dynamic PZero dependency graph and returned one bounded APID-29437 Slow Query row with no error code.