Tableau keypair workbook republish — Desktop is canonical, no Tier-3 autonomous
Decision
For Tableau Cloud workbooks bound to Snowflake keypair / OAuth / saved-credential auth, the canonical republish path is Tableau Desktop on AJ’s laptop (3-min manual flow per /root/aj-ea/outputs/documents/way-of-working-tableau-desktop-publish-keypair.md). Tier-3 Playwright autonomous prototype reverted same session.
Rationale
Tier-1 REST cannot publish keypair workbooks (TSC ConnectionCredentials lacks saved-credential-UUID; Cloud REST has no Saved Credentials management API). PAT impersonation Server-only on Cloud. Web Authoring explicitly NOT supported per Tableau docs. Built Tier-3 Playwright path that drives Cloud Publish UI — but Cloud’s deep-link auth bounces headless sessions to SSO unpredictably; selector discovery never reliably reached the project page. Manual Desktop flow takes 3 min, is fully Tableau-supported, MFA-aware, produces workbook record first try every time. Selector drift maintenance for autonomous path (monthly Tableau UI updates) outweighs minutes saved at AJ’s volume. Per the “manual fallback wins” heuristic captured in vault.
Alternatives Rejected
Tier-3 autonomous publish (REJECTED)
Built mcp__tableau-mcp__publish_workbook_with_saved_credential + core/tier3_delegate.py + cli-anything-tableau-cloud-author workbook publish subcommand + 8 cloud_publish_* selectors + HEADED selector-discover step. Reverted same session because Cloud’s deep-link auth bounced headless sessions and the manual fallback was already faster + more reliable than the autonomous build-out path.
Wait for Tableau to add keypair-publish to TSC (DEFERRED)
Open enhancement at https://github.com/tableau/server-client-python/issues/1573 — labeled “needs investigation” with no commitment. Monitor monthly via upstream-sync cron; if Tableau ships, replace Tier-3 with Tier-1.
Outcome
Pending