# Wetech WSS fixed egress: deployed verification

<!-- auto-oncall-optimization-record
{
  "schemaVersion": "auto-oncall-optimization-record-v1",
  "optimizationId": "wetech-wss-fixed-egress-2026-09-08",
  "problems": [
    {
      "problemId": "cross-sandbox-p81-egress-auth-reuse",
      "summary": "P81 application authorization cannot be reused across changing E2B egress addresses.",
      "status": "optimized_verified",
      "applicability": "Wetech Managed Tool metrics and Dashboard transport across fresh E2B sandboxes.",
      "issueKeys": [
        "APID-29464"
      ],
      "sourceRefs": [
        "https://tidb.atlassian.net/browse/APID-29464#problem:cross-sandbox-p81-egress-auth-reuse"
      ],
      "signalTextIncludesAny": [
        "cached_api_session_auth_required"
      ],
      "observedThrough": "2026-09-08",
      "effectiveAt": "2026-09-07T17:13:47Z",
      "verifiedAt": "2026-09-07T17:21:42.018Z",
      "attemptedAction": "Deployed Wetech v61 and the AOS WSS proxy. Four real Managed Tool calls in four fresh E2B sandboxes returned metrics/slow-query data; subsequent metrics and Dashboard calls reused Drive9 sessions without browsers. TLS, token rejection, loopback blocking and fixed NAT egress verified.",
      "evidenceUrl": "docs/WETECH_EGRESS_PROXY.md"
    }
  ]
}
-->

This record covers only Wetech transport and cross-sandbox P81 session reuse.
It does not change APID-29464 diagnosis, Judge, or the previously published
answer. Pure-runtime canaries satisfy this bounded criterion under
`AUTO_ONCALL_EVALUATION.md` section 9.1; no ticket replay or Jira write was made.

Source PR [#1400](https://github.com/tidbcloud/aisupport/pull/1400) merged as
`69f112606f8cf9f921b41249f09932c50a49c2ac`. App-delivery PRs
[#79460](https://github.com/tidbcloud/app-delivery/pull/79460),
[#79461](https://github.com/tidbcloud/app-delivery/pull/79461), and
[#79462](https://github.com/tidbcloud/app-delivery/pull/79462) merged and GitOps
synchronized. Both AOS and `wetech-egress-proxy-agent9` were Ready on image digest
`sha256:686eb85728b263fca0657a17c85298526a89614393fd5a0bcb91186768257149`.
The proxy runs in an admin private subnet. ExternalSecret synchronization is Ready.

Wetech v61 package:
`456d1775887a6eea81fc076508683f6c528e33b19cd521887d5d78f35ee4ffc1`.
AOS loader bundle:
`ac7157aefe24a27ffb98fb70b0f8a49b690bb0f20c61d254d3b0004f69169642`.
The loader rollout kept the Agent9 image unchanged. Installation switched atomically
to v61 and separate Auth `auth_6395c4c1-c35d-4aa6-a551-8e0c871bade0`, retaining
the previous Auth for inflight operations and rollback.

## Live criterion

Through `wss://oncall.ops-staging.pingcap.net/aos-wetech-proxy`, a TLS-verified
checkip.amazonaws.com query returned `44.245.243.63`. An invalid token returned
401; an authenticated loopback target returned 403. The first checkip probe ended
without an HTTP body; a subsequent bounded probe verified the expected IP. This
was not a Wetech Provider call and is not counted among the canaries below.

Four sequential Evidence Agent sessions each invoked exactly one deployed Managed
Tool operation against Wetech `asia-prod / yk-qfxt`, window
`1788798480..1788798780` (five minutes). Metrics used `vector(1)`, step 60;
Dashboard used `slow_query`, limit 1. The actual Drive9 session store, Organization
Auth, E2B lifecycle, ALB, proxy and Provider APIs were exercised.

| Call | Provider result | Tool operation seconds | Inner Tool execution seconds | Browser |
| --- | --- | ---: | ---: | --- |
| a-metrics | 6 points | 22.584 | 18.656 | yes |
| a-dashboard | 1 slow-query row | 30.505 | 26.861 | yes |
| b-metrics | 6 points | 10.641 | 6.124 | no |
| b-dashboard | 1 slow-query row | 12.403 | 7.618 | no |

Tool operation duration includes sandbox/runtime work; inner Tool execution uses
its stage timing log. Neither number includes the Agent's reasoning/Skill reads.
These observations do not isolate the proxy's incremental latency from other
network and runtime work. WSS `connectMs` sums connection durations and is not
whole-query wall time because browser connections overlap.

Both subsequent calls emitted `cached_api_session_ready`, `browserStarted=false`
and zero tunnel failures. First calls refreshed application authorization through
the browser; this was not a live empty-state password/TOTP test. Controlled empty
state and partial-form regression passed locally before release, as recorded in
[the login repair](../WETECH_DASHBOARD_LOGIN_FORM.md). A first-browser background
connection had a 403 under the port-443-only policy; all four Provider calls
returned actual query data successfully.

## Exact runtime evidence

Each Provider sandbox below is the unique sandbox whose lifetime falls within the
same session's Managed Tool operation. Billing readback confirms four distinct
sandbox IDs, all closed after execution.

- `a-metrics`: operation `op_a568eb942737411ead8a48ea40214843`, sandbox `ib9b7lg36hye9oelke08e`, session `sess_10b824263bc44ccea26dc566cedb698b`; completed `2026-09-07T17:15:06.870Z`.
- `a-dashboard`: operation `op_e1f1921d2498432c8cea757b0f203688`, sandbox `imi6svv8qw2lrd97vluac`, session `sess_cc04be75f1544972912c3eb37bc88984`; completed `2026-09-07T17:17:57.183Z`.
- `b-metrics`: operation `op_ae76dce3160443179eb56b6c91b403a8`, sandbox `ij7zeecjd1i5qpfbxuo6n`, session `sess_48a96a0d8dd948b19e6906c138fa0826`; completed `2026-09-07T17:19:44.978Z`.
- `b-dashboard`: operation `op_d7f17d7386294e2a980ca2d071dfdb26`, sandbox `i6j6rfat6org3u66vr8w7`, session `sess_0d014212abd44a96af6b1d21c27252a4`; completed `2026-09-07T17:21:42.018Z`.

Private raw turns, diagnostics, sandbox readback, installation metadata and Ready
image proof were exported under the operator's
`~/.cache/auto-oncall-services/investigations/wetech-wss-deploy-20260908/`.
No credential values are included in this record.

Validation before release: 1,196 service tests and six isolated-runner tests passed;
two browser tests were skipped on the host and passed among nine tests inside the
pinned Playwright 1.61.1 Docker image. The actual browser form race failed against
old source and passed against the repair. All source and deployment CI passed.

The runtime criterion is verified for these calls. Broader reliability, concurrent
session updates, and other OP targets are not established by four canaries.