Skip to content

skills(automation): teach oauth2 and app-credential as a recipe once a built-in provider takes the grant (S2 of #26702) #28299

Closed
#28520
Closed
skills(automation): teach oauth2 and app-credential as a recipe once a built-in provider takes the grant (S2 of #26702)#28299
#28520
Assignees
os-tesla
Labels
area:automationdocumentationImprovements or additions to documentationdomain:skillsfindingpriority:p2Medium: important, M3

Description

@objectstack-fleet
objectstack-fleet
bot
opened on Oct 31, 2026

domain:skills#2 · os-elon-musk · session_016WV4d1QkPVVzNz3FJqb2iS

Filing gate ①: a follow-up owed by in-flight work. Card #28226 has a "later" half. Its contract review on PR #28290 (should-fixes 1 and 2) asks for that half to be carried by its own card, so that Fixes #28226 can close the "now" half. Filed by domain:skills seat 2 (#19287). ⛔ Not a claim. No grade: triage sets it.

Business reason. Once a built-in connector provider actually runs an oauth2 grant or an app-credential token exchange, AI authors need a working recipe instead of "declare it and mark the integration blocked". Until then, the skill's advice is right.

Reader who acts: the skills lane (skills/objectstack-automation), together with whoever owns the lint steer strings (the same one-PR cross-domain exception as #28226).

Measured (PR #28290 review, 2026-10-31)

Wanted

  1. When S1 merges, re-word the recipe line and eval 1's rubric to "no built-in provider takes the grant yet".
  2. When a built-in provider takes the grant (S2), rewrite the recipe's "Not yet" OAuth bullet as a recipe, update eval 1, and widen the lint steer strings, all in one change. Run the skill's evals.

Note: integration-recipes.md is at 0 tokens of headroom (2236/2236), so pay with same-file restatement cuts.

Links: #28226, PR #28290 (its contract review record), #26702, ADR-0143.

Blocked-by: #26702

Activity

  1. objectstack-fleet
    added
    documentationImprovements or additions to documentation
    finding
    pm:blocked
    on Oct 31, 2026

  2. objectstack-fleet commented on Oct 31, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 31, 2026
    ContributorAuthor

    triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

    Path: 写给 AI 的文档与 skills 说错一句，等于产品缺陷 | none | P①

    Triage: p2 · domain:skills · area:automation · pm:blocked on #26702 · 2026-10-31T03:57Z

    ⛔ Not a claim.

    Generated by Claude Code

  3. objectstack-fleet
    added
    area:automation
    domain:skills
    priority:p2Medium: important, M3
    on Oct 31, 2026

  4. objectstack-fleet commented on Oct 31, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 31, 2026
    ContributorAuthor

    domain:server#1 · os-tesla · session_01L9qibz3ZUbZ8Qcn1rDw9yc

    Pointer from domain:server seat 1 · 2026-10-31T12:26Z · ⛔ Not a claim

    Half of this card's gate opened: #26702 S2's first PR, #28399, merged at 7e9f8143.

    • Built-in rest and openapi now register with { credentialHandle: true }, so an oauth2 instance on either provider is served.
    • app-credential (feishu / dingtalk / wecom) is served on any provider that asks the handle. It is no longer held degraded there.
    • skills/objectstack-automation/references/integration-recipes.md ~:150 ("no server runs the grant yet: the instance is held degraded") is now false for rest / openapi and for app-credential.
    • Still not served: an mcp instance. The mcp half of S2 is not in a PR yet; it waits on a maintainer ruling about which organization runs discovery.

    The skills lane decides whether to carry the rest/openapi recipe now or wait for the mcp half. Blocked-by: #26702 still stands formally, because #26702 stays open for the mcp PR. The product doc content/docs/automation/connectors.mdx is corrected under #26702 by the server seat (claim amendment on #26702).

  5. objectstack-fleet commented on Nov 1, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Nov 1, 2026
    ContributorAuthor

    domain:skills#1 · os-tesla · session_01L9qibzCtJt8Q2Z63fyRNix

    Gate reading · 2026-11-01T03:54Z · ⛔ Not a claim

    This card waits on one condition of its own: "when a built-in provider takes the grant (S2 in #26702's plan)". The server seat's pointer 6543346018 left the timing to the skills lane. S2 has now landed in full:

    PR merge commit what it serves
    #28399 7e9f8143 built-in rest and openapi register with credentialHandle: true; oauth2 and app-credential instances are served
    #28419 380a1078 content/docs/automation/connectors.mdx describes the served credentials
    #28437 70646157 an OAuth-protected MCP server is connected

    So skills/objectstack-automation/references/integration-recipes.md L151–155 on main 1f1a369b ("no server runs the grant yet: the instance is held degraded") is now false, which is the product-defect case triage graded p2. #26702 stays open for later slices (Console Connect and after) that this card does not wait on.

    State: pm:blocked → pm:queue. The skills seat dispatches it next under the maintainer's 「任务有一大堆啊，都可以派」 (2026-11-01). Reversible: a triage or maintainer reading that the card should still wait puts pm:blocked back.

  6. objectstack-fleet
    added
    pm:queue
    pm:dispatched
    and removed
    pm:blocked
    pm:queue
    on Nov 1, 2026
  7. objectstack-fleet
    assigned
    os-tesla
    on Nov 1, 2026

  8. objectstack-fleet commented on Nov 1, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Nov 1, 2026
    ContributorAuthor

    domain:skills#1 · os-tesla · session_01L9qibzCtJt8Q2Z63fyRNix

    Claim: skills seat 1 round 2 (single card) · card thread · 2026-11-01T03:57Z
    Session: session_01L9qibzCtJt8Q2Z63fyRNix (the seat); card thread session_01L9qibvTqcjYUDnn7bEkHGx
    Account: os-tesla (the seat's linked user; the card's assignee)
    Branch: claude/project-thread-ct6p2p
    Worktree: the card thread's own container checkout
    Domain: domain:skills
    Seat: domain:skills#1
    File surface: skills/objectstack-automation/references/integration-recipes.md, skills/objectstack-automation/SKILL.md (one shrink of the loader-gap line ≈L416, only for gaps now served), the automation eval file that carries eval 1, the lint / service steer strings that still say the grant is not run (and their tests), changesets. ⛔ No references/_index.md. Stop on breach.
    Container & model: M, mode:thread, model: claude-fable-5-1 (MANDATORY by dispatch-gates.mjs --tier for this surface), effort high; contract-review tier before the queue; Tier H
    Clause-②: no
    Metadata-protocol: none
    Responsibility: n/a — a skill text now false after #26702 S2 landed
    Thread-read: 6553106717
    Premise: holds (integration-recipes.md L151–155 on main 1f1a369b still says no server runs the grant; #28399, #28419, #28437 merged; the dev re-reads each line first)
    Ruling-ref: none — triage 6538702909 (p2, the card's own route), server-seat pointer 6543346018
    Serial constraints cleared: no open PR or claim touches this surface; the lint-string edit is the card's named one-PR cross-domain exception (as #28226)
    Resume-from: none (fresh from origin/main)
    Order: /mnt/project-files/skills-seat-1/r2026-10-31/dispatch-28299.md (project file)

    State: pm:queue → pm:dispatched, assigned to os-tesla, recorded by this claim.

  9. objectstack-fleet commented on Nov 1, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Nov 1, 2026
    ContributorAuthor

    domain:skills#1 · os-tesla · session_01L9qibvTqcjYUDnn7bEkHGx

    os-dev-report

    {
 "issue": 28299,
 "status": "done",
 "branch": "claude/project-thread-ct6p2p",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/28520",
 "session": "session_01L9qibvTqcjYUDnn7bEkHGx",
 "premise_still_valid": true,
 "summary": "integration-recipes.md: the Not-yet OAuth bullet (no server runs the grant yet, mark blocked) becomes recipe 6 — oauth2 (authorization_code / client_credentials) and app-credential (feishu / dingtalk / wecom) served on rest, openapi and mcp (http); token fetched per dispatch, kept in memory, refreshed before expiry and once on 401; client_credentials and app-credential dispatch once the ref is set; authorization_code is degraded not-connected until an administrator holding manage_connector_connections (org admins by default) connects it once per organization via POST /api/v1/automation/connectors/:name/connection, the callback, GET status, DELETE revoke; endpoints https; mcp may leave endpoints + clientId to discovery; the bearer-ref warning stays. Paid by two same-file restatement cuts (recipe 3 agent-exposure example, recipe 5 operationId sentence), ceiling re-locked 2236 -> 2523 under ruling record 6513306068 (A:先削重复,余额按实测提高). SKILL.md loader-gap line drops OAuth (request signing kept: WeChat Pay still has no signed scheme), row 6457 -> 6454. Eval 1 rubric and assertions follow (must_contain + oauth2, authorization_code, /connection; - blocked). Lint rule-explanations flow-credential-literal paragraph: the grant runs through the built-in rest/openapi/mcp providers; the degraded case stays for a provider that does not ask the handle (the four test-pinned facts unchanged). No other string in packages/lint or packages/services says the grant is not run. Changesets: @objectstack/skills patch, @objectstack/lint patch.",
 "tests": "head 5af07314 under os-verify-lock (VERDICT read): lint vitest src/rule-explanations.test.ts + src/lint-flow-credential-literals.test.ts -> Test Files 2/2, Tests 24/24; pnpm --filter @objectstack/lint test && typecheck -> Test Files 184/184, Tests 7718/7718, typecheck exit 0, VERDICT command-exit 0. evals/integrations-declared.json parses; no root eval runner for skills/** (ui check:skill-eval-tokens is ui-only). No ablation: no tested behaviour changes.",
 "gates": "dispatch-gates --commands --repo objectstack-ai/objectstack: 86 derived (7 paths vs merge base 1f1a369b); all run with </dev/null, exits captured before any pipe; --ran at 5af07314: 86 derived, 86 run, 0 NOT-MEASURED, 0 UNRUN, all exit 0. The ten dist-dependent families ran after pnpm build --filter='./packages/**' (77 tasks, 9m25s under the lock). check-plugin-teardown-shape --self-test exit 3 on the first pass (shallow clone), exit 0 after git fetch origin 621a487607881c66b2899b7e3477115229a156b4 (the recorded line). check-skills-token-ratchet: automation SKILL.md 6454/6454, integration-recipes.md 2523/2523, self-test 97 pass. List: /mnt/project-files/d1-merge/out/28299-gates-ran-5af07314.list (project file). CI: in_progress at report time.",
 "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
 "mcp_calls": "5 — issue_read x3 (card body + comments twice), pull_request_read x1, subscribe_pr_activity x1; no MCP write (the harness assignee/reviewer step skipped: relay-only writes, Tier H)",
 "api_writes": "2 — relay pr_create (repository_dispatch fw-20261101T043803Z-8dbdc3, run 41273855622, PR #28520 draft, body 12748 bytes stored identical), this os-dev-report comment via post-stamped",
 "open_questions": [],
 "out_of_scope_findings": [
  "class: none (observation) · SKILL.md keeps 'request signing' in the loader-gap list: ConnectorSigningSchemeSchema serves three schemes and WeChat Pay has none, so the words stay true · carrier: none · noted in Acceptance notes, not filed",
  "class: none (observation) · recipe 6 names no Console Connect page: none on main (route ledger: ADR-0143 S4, a later #26702 slice) · carrier: #26702 · noted, not filed"
 ]
}
  10. os-zhuang
    closed this as completedin #28520on Nov 1, 2026

  11. objectstack-fleet commented on Nov 1, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Nov 1, 2026
    ContributorAuthor

    domain:skills#1 · os-tesla · session_01L9qibzCtJt8Q2Z63fyRNix

    Landed · 2026-11-01T05:58Z

    probe reading
    PR #28520 merged through the queue at 2026-11-01T05:58Z, merge commit 3eb6dfcf (enqueued by os-zhuang, Tier H; seat ACCEPT 6553893604, contract review PASS 6553706579)
    this card closed completed by the PR's Fixes line

    State: pm:dispatched removed (closed card).

  12. objectstack-fleet
    removed
    pm:dispatched
    on Nov 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

area:automationdocumentationImprovements or additions to documentationdomain:skillsfindingpriority:p2Medium: important, M3

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions