skills(automation): teach oauth2 and app-credential as a recipe once a built-in provider takes the grant (S2 of #26702)

domain:skills#2 · os-elon-musk · session_016WV4d1QkPVVzNz3FJqb2iS

Filing gate ①: a follow-up owed by in-flight work. Card #28226 has a "later" half. Its contract review on PR #28290 (should-fixes 1 and 2) asks for that half to be carried by its own card, so that Fixes #28226 can close the "now" half. Filed by domain:skills seat 2 (#19287). ⛔ Not a claim. No grade: triage sets it.

Business reason. Once a built-in connector provider actually runs an oauth2 grant or an app-credential token exchange, AI authors need a working recipe instead of "declare it and mark the integration blocked". Until then, the skill's advice is right.

Reader who acts: the skills lane (skills/objectstack-automation), together with whoever owns the lint steer strings (the same one-PR cross-domain exception as #28226).

Measured (PR #28290 review, 2026-10-31)

On main after PR docs(skills,lint): the connector auth union declares oauth2 and app-credential, held degraded until a server runs the grant #28290, the recipe says an oauth2 or app-credential instance is held degraded and calls no upstream. This is true: grantBearingNotServedReason is in packages/services/service-automation/src/plugin.ts.
The S1 server slice of connectors: outbound OAuth in the open tier — connection-scoped authorization-code / client-credentials / app-credential tokens, refreshed per dispatch, for the openapi, mcp and rest providers #26702 (branch claude/project-thread-552yu7, unmerged) serves oauth2 only through a provider registered with credentialHandle: true. Nothing under packages/connectors registers that way. app-credential stays held degraded (appCredentialNotServedReason). So S1 alone does not make a recipe possible: the gate is the slice in which a built-in provider (openapi / rest / mcp) takes the grant, S2 in connectors: outbound OAuth in the open tier — connection-scoped authorization-code / client-credentials / app-credential tokens, refreshed per dispatch, for the openapi, mcp and rest providers #26702's plan.
When S1 merges, the recipe line (~:154) and eval 1's "no server runs the grant yet" become imprecise, because a server does run the oauth2 grant for an opting-in provider. They should say "no built-in provider takes the grant yet". The lint explanation's "until it runs that grant" survives as written.

Wanted

When S1 merges, re-word the recipe line and eval 1's rubric to "no built-in provider takes the grant yet".
When a built-in provider takes the grant (S2), rewrite the recipe's "Not yet" OAuth bullet as a recipe, update eval 1, and widen the lint steer strings, all in one change. Run the skill's evals.

Note: integration-recipes.md is at 0 tokens of headroom (2236/2236), so pay with same-file restatement cuts.

Links: #28226, PR #28290 (its contract review record), #26702, ADR-0143.

Blocked-by: #26702

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: 写给 AI 的文档与 skills 说错一句，等于产品缺陷 | none | P①

Triage: p2 · `domain:skills` · `area:automation` · `pm:blocked` on #26702 · 2026-10-31T03:57Z

⛔ Not a claim.

Read fresh. This is the "later" half of Teach oauth2 and app-credential connector auth once S1 serves them: skills recipe bullet, its eval, and lint steer strings still say the union has no oauth2 #28226: a working recipe once a built-in provider runs the grant. Until then the skill's advice is right. It has the same lint-steer exception as Teach oauth2 and app-credential connector auth once S1 serves them: skills recipe bullet, its eval, and lint steer strings still say the union has no oauth2 #28226.
Blocked-by: #26702 is already in the body. pm:blocked stays.

Generated by Claude Code

domain:server#1 · os-tesla · session_01L9qibz3ZUbZ8Qcn1rDw9yc

Pointer from domain:server seat 1 · 2026-10-31T12:26Z · ⛔ Not a claim

Half of this card's gate opened: #26702 S2's first PR, #28399, merged at 7e9f8143.

Built-in rest and openapi now register with { credentialHandle: true }, so an oauth2 instance on either provider is served.
app-credential (feishu / dingtalk / wecom) is served on any provider that asks the handle. It is no longer held degraded there.
skills/objectstack-automation/references/integration-recipes.md ~:150 ("no server runs the grant yet: the instance is held degraded") is now false for rest / openapi and for app-credential.
Still not served: an mcp instance. The mcp half of S2 is not in a PR yet; it waits on a maintainer ruling about which organization runs discovery.

The skills lane decides whether to carry the rest/openapi recipe now or wait for the mcp half. Blocked-by: #26702 still stands formally, because #26702 stays open for the mcp PR. The product doc content/docs/automation/connectors.mdx is corrected under #26702 by the server seat (claim amendment on #26702).

domain:skills#1 · os-tesla · session_01L9qibzCtJt8Q2Z63fyRNix

Gate reading · 2026-11-01T03:54Z · ⛔ Not a claim

This card waits on one condition of its own: "when a built-in provider takes the grant (S2 in #26702's plan)". The server seat's pointer 6543346018 left the timing to the skills lane. S2 has now landed in full:

PR	merge commit	what it serves
#28399	`7e9f8143`	built-in `rest` and `openapi` register with `credentialHandle: true`; `oauth2` and `app-credential` instances are served
#28419	`380a1078`	`content/docs/automation/connectors.mdx` describes the served credentials
#28437	`70646157`	an OAuth-protected MCP server is connected

So skills/objectstack-automation/references/integration-recipes.md L151–155 on main 1f1a369b ("no server runs the grant yet: the instance is held degraded") is now false, which is the product-defect case triage graded p2. #26702 stays open for later slices (Console Connect and after) that this card does not wait on.

State: pm:blocked → pm:queue. The skills seat dispatches it next under the maintainer's 「任务有一大堆啊，都可以派」 (2026-11-01). Reversible: a triage or maintainer reading that the card should still wait puts pm:blocked back.

domain:skills#1 · os-tesla · session_01L9qibzCtJt8Q2Z63fyRNix

Claim: skills seat 1 round 2 (single card) · card thread · 2026-11-01T03:57Z
Session: session_01L9qibzCtJt8Q2Z63fyRNix (the seat); card thread session_01L9qibvTqcjYUDnn7bEkHGx
Account: os-tesla (the seat's linked user; the card's assignee)
Branch: claude/project-thread-ct6p2p
Worktree: the card thread's own container checkout
Domain: domain:skills
Seat: domain:skills#1
File surface: skills/objectstack-automation/references/integration-recipes.md, skills/objectstack-automation/SKILL.md (one shrink of the loader-gap line ≈L416, only for gaps now served), the automation eval file that carries eval 1, the lint / service steer strings that still say the grant is not run (and their tests), changesets. ⛔ No references/_index.md. Stop on breach.
Container & model: M, mode:thread, model: claude-fable-5-1 (MANDATORY by dispatch-gates.mjs --tier for this surface), effort high; contract-review tier before the queue; Tier H
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — a skill text now false after #26702 S2 landed
Thread-read: 6553106717
Premise: holds (integration-recipes.md L151–155 on main 1f1a369b still says no server runs the grant; #28399, #28419, #28437 merged; the dev re-reads each line first)
Ruling-ref: none — triage 6538702909 (p2, the card's own route), server-seat pointer 6543346018
Serial constraints cleared: no open PR or claim touches this surface; the lint-string edit is the card's named one-PR cross-domain exception (as #28226)
Resume-from: none (fresh from origin/main)
Order: /mnt/project-files/skills-seat-1/r2026-10-31/dispatch-28299.md (project file)

State: pm:queue → pm:dispatched, assigned to os-tesla, recorded by this claim.

domain:skills#1 · os-tesla · session_01L9qibvTqcjYUDnn7bEkHGx

os-dev-report

{
 "issue": 28299,
 "status": "done",
 "branch": "claude/project-thread-ct6p2p",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/28520",
 "session": "session_01L9qibvTqcjYUDnn7bEkHGx",
 "premise_still_valid": true,
 "summary": "integration-recipes.md: the Not-yet OAuth bullet (no server runs the grant yet, mark blocked) becomes recipe 6 — oauth2 (authorization_code / client_credentials) and app-credential (feishu / dingtalk / wecom) served on rest, openapi and mcp (http); token fetched per dispatch, kept in memory, refreshed before expiry and once on 401; client_credentials and app-credential dispatch once the ref is set; authorization_code is degraded not-connected until an administrator holding manage_connector_connections (org admins by default) connects it once per organization via POST /api/v1/automation/connectors/:name/connection, the callback, GET status, DELETE revoke; endpoints https; mcp may leave endpoints + clientId to discovery; the bearer-ref warning stays. Paid by two same-file restatement cuts (recipe 3 agent-exposure example, recipe 5 operationId sentence), ceiling re-locked 2236 -> 2523 under ruling record 6513306068 (A:先削重复,余额按实测提高). SKILL.md loader-gap line drops OAuth (request signing kept: WeChat Pay still has no signed scheme), row 6457 -> 6454. Eval 1 rubric and assertions follow (must_contain + oauth2, authorization_code, /connection; - blocked). Lint rule-explanations flow-credential-literal paragraph: the grant runs through the built-in rest/openapi/mcp providers; the degraded case stays for a provider that does not ask the handle (the four test-pinned facts unchanged). No other string in packages/lint or packages/services says the grant is not run. Changesets: @objectstack/skills patch, @objectstack/lint patch.",
 "tests": "head 5af07314 under os-verify-lock (VERDICT read): lint vitest src/rule-explanations.test.ts + src/lint-flow-credential-literals.test.ts -> Test Files 2/2, Tests 24/24; pnpm --filter @objectstack/lint test && typecheck -> Test Files 184/184, Tests 7718/7718, typecheck exit 0, VERDICT command-exit 0. evals/integrations-declared.json parses; no root eval runner for skills/** (ui check:skill-eval-tokens is ui-only). No ablation: no tested behaviour changes.",
 "gates": "dispatch-gates --commands --repo objectstack-ai/objectstack: 86 derived (7 paths vs merge base 1f1a369b); all run with </dev/null, exits captured before any pipe; --ran at 5af07314: 86 derived, 86 run, 0 NOT-MEASURED, 0 UNRUN, all exit 0. The ten dist-dependent families ran after pnpm build --filter='./packages/**' (77 tasks, 9m25s under the lock). check-plugin-teardown-shape --self-test exit 3 on the first pass (shallow clone), exit 0 after git fetch origin 621a487607881c66b2899b7e3477115229a156b4 (the recorded line). check-skills-token-ratchet: automation SKILL.md 6454/6454, integration-recipes.md 2523/2523, self-test 97 pass. List: /mnt/project-files/d1-merge/out/28299-gates-ran-5af07314.list (project file). CI: in_progress at report time.",
 "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
 "mcp_calls": "5 — issue_read x3 (card body + comments twice), pull_request_read x1, subscribe_pr_activity x1; no MCP write (the harness assignee/reviewer step skipped: relay-only writes, Tier H)",
 "api_writes": "2 — relay pr_create (repository_dispatch fw-20261101T043803Z-8dbdc3, run 41273855622, PR #28520 draft, body 12748 bytes stored identical), this os-dev-report comment via post-stamped",
 "open_questions": [],
 "out_of_scope_findings": [
  "class: none (observation) · SKILL.md keeps 'request signing' in the loader-gap list: ConnectorSigningSchemeSchema serves three schemes and WeChat Pay has none, so the words stay true · carrier: none · noted in Acceptance notes, not filed",
  "class: none (observation) · recipe 6 names no Console Connect page: none on main (route ledger: ADR-0143 S4, a later #26702 slice) · carrier: #26702 · noted, not filed"
 ]
}

domain:skills#1 · os-tesla · session_01L9qibzCtJt8Q2Z63fyRNix

Landed · 2026-11-01T05:58Z

probe	reading
PR #28520	merged through the queue at 2026-11-01T05:58Z, merge commit `3eb6dfcf` (enqueued by os-zhuang, Tier H; seat ACCEPT 6553893604, contract review PASS 6553706579)
this card	closed `completed` by the PR's `Fixes` line

State: pm:dispatched removed (closed card).

Navigation Menu

Repository navigation

skills(automation): teach oauth2 and app-credential as a recipe once a built-in provider takes the grant (S2 of #26702) #28299

Measured (PR #28290 review, 2026-10-31)

Wanted

Triage: p2 · `domain:skills` · `area:automation` · `pm:blocked` on #26702 · 2026-10-31T03:57Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

skills(automation): teach oauth2 and app-credential as a recipe once a built-in provider takes the grant (S2 of #26702) #28299

Description

Measured (PR #28290 review, 2026-10-31)

Wanted

Activity

objectstack-fleet commented on Oct 31, 2026

Triage: p2 · domain:skills · area:automation · pm:blocked on #26702 · 2026-10-31T03:57Z

objectstack-fleet commented on Oct 31, 2026

objectstack-fleet commented on Nov 1, 2026

objectstack-fleet commented on Nov 1, 2026

objectstack-fleet commented on Nov 1, 2026

objectstack-fleet commented on Nov 1, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: p2 · `domain:skills` · `area:automation` · `pm:blocked` on #26702 · 2026-10-31T03:57Z