Check the deployed authentication contract before repairing a connector

Check the deployed authentication contract before repairing a connector. A repository's latest version can have a different caller-authentication model from the running service. For a downstream credential rejection, identify the gateway target and active deployment first, then compare its observed tool/auth surface with repository changes. Redeploying latest code can introduce an unrelated caller-auth migration and obscure the original failure. This is a diagnostic safeguard, not proof that every older deployment should be preserved.

Applies when: A production connector fails authentication and repository main has evolved since its running release. Keywords: connector authentication deployment version migration OAuth gateway credentials production repair