ADR: move outbound connector auth (OAuth2 grants, app-credential exchange, request signing) into the open tier — the successor record #26702 and #26710 both wait on

carries item 1 of #26702 and item 1 of #26710; #26702 keeps items 2–7, #26710 keeps items 2–4.

Split by the domain:server seat 3 (session_01QSeKYmQXM3rHJcPnrEPk4B), because both queued cards put the ADR first and the ADR is a governed surface outside the server lane (docs/adr/**, Tier H). ⛔ Not a claim. No domain:* label: triage sets lane, area and grade. Both parent cards go to pm:blocked with Blocked-by: this card.

Maintainer rulings this record carries (verbatim, not translated, from #26702)

OAuth 放开源层，先起草 ADR 修订

平台基于 better-auth ，怎么会有没有 oauth

创建issue 就行

And from #26710's filing: 「三条行动建议立卡」 → 「建议 1+2立卡」 → 「3 不考虑」 (recommendation 2 = request signing).

Work

A successor ADR in this repository that moves outbound connector auth into the open tier: OAuth2 (authorization_code + PKCE + refresh, client_credentials), the vendor app-credential exchange (Feishu / DingTalk / WeCom), and a signed request-signing kind with a closed scheme enum (connectors: request-signing auth kind for the openapi and rest providers (RSA2 / HMAC canonical-request signers: Alipay, WeChat Pay, Aliyun, Tencent Cloud, e签宝) — the vendor-auth half that #26702 does not cover #26710's proposed shape). One record decides all of it (connectors: request-signing auth kind for the openapi and rest providers (RSA2 / HMAC canonical-request signers: Alipay, WeChat Pay, Aliyun, Tencent Cloud, e签宝) — the vendor-auth half that #26702 does not cover #26710: "this card adds the signing decision to that record rather than opening a second one").
Status-line amendments to ADR-0015, ADR-0022, ADR-0023, ADR-0024 and ADR-0097 where they place OAuth2 in the enterprise tier (connectors: outbound OAuth in the open tier — connection-scoped authorization-code / client-credentials / app-credential tokens, refreshed per dispatch, for the openapi, mcp and rest providers #26702 item 1). ADRs are append-only (AGENTS.md Prime Directive 13): dated amendment notes, not rewrites.
Per Prime Directive 13, the open/enterprise boundary half also owes a cloud ADR-NNNN record with a ## Provenance pointer back here (connectors: outbound OAuth in the open tier — connection-scoped authorization-code / client-credentials / app-credential tokens, refreshed per dispatch, for the openapi, mcp and rest providers #26702 item 1). That is a cloud-repository card; the drafting seat files it there.

Decisions the ADR puts to the maintainer (from #26702)

Connection ownership and execution identity: org-shared vs per-user connection, and whose grant a flow run uses (ADR-0073).
Storage: reuse better-auth account storage and refresh, or a dedicated connection object (a linked account is also a sign-in method, which an integration grant must not become).
First products for the first acceptance.
From connectors: request-signing auth kind for the openapi and rest providers (RSA2 / HMAC canonical-request signers: Alipay, WeChat Pay, Aliyun, Tencent Cloud, e签宝) — the vendor-auth half that #26702 does not cover #26710: which signing schemes ship first; the secret is always a credentialRef (ADR-0097 §3).

Governing text

AGENTS.md Prime Directive 13: an accepted ADR binds until a superseding ADR says otherwise.
packages/spec/src/shared/connector-auth.zod.ts: "OAuth2 is intentionally absent (enterprise tier, ADR-0015)." Re-check: git grep -n "intentionally absent" origin/main -- packages/spec/src/shared/connector-auth.zod.ts.
ADR-0097: "The open tier deliberately omits OAuth2 from ConnectorInstanceAuthSchema". Re-check: git grep -n "deliberately omits OAuth2" origin/main -- docs/adr/0097-declarative-connector-instances.md.

Done when

The successor ADR and the five amendment notes are merged by the maintainer (Tier H), with the decisions above answered in the record; #26702 and #26710 are then released from pm:blocked for their spec, runtime and console slices.

Who acts

Per both parent cards: the domain:skills seat drafts, the maintainer lands. Triage confirms.

Generated by Claude Code

Hand-off · domain:skills#1 · session_01ADHkmSrRBdu9MdC6fc33Uu · 2026-10-28T03:32Z — the seat stands down (maintainer, 2026-10-28 03:30Z: 「你手上的任务处理完，合并后就下班」).

Landed: ADR-0143 as Proposed (PR docs(adr): ADR-0143 — outbound connector auth is open tier: OAuth2 grants, vendor app-credential exchange and request signing in one declarative auth contract #26833).
Open, with the maintainer:
- The answers to the ADR's Q1–Q4.
- Who files the cloud Provenance record (item 3; no objectstack lane can reach the cloud repo).
Next step: once the answers are in, one Tier H PR writes them into ADR-0143 and moves Status to Accepted.
pm:dispatched → pm:awaiting-maintainer; assignee cleared.

Ruling record · ADR-0143 Q1–Q4

Recorded by domain:skills#1 (session_01ADHkmSrRBdu9MdC6fc33Uu; the seat is vacant since 07:56Z, and this is recorded at the card thread's request) · 2026-10-28T11:24Z

Maintainer, verbatim, in the #26768 card thread:

2026-10-28 09:39Z: 「具体四个决定，用fable 综合分析一下，给我建议。」
2026-10-28 11:22Z, on the analysis below: 「同意」

Ruled (all four recommendations accepted as posted):

Q1 — A, org-shared, plus a rule in D4: an org-less (scheduled) run uses the instance's connection only when exactly one exists; otherwise it is refused.
Q2 — B, a dedicated connection object, scoped to the refresh token, the MCP dynamically registered client and status. Short-lived access tokens (Feishu, DingTalk, WeCom) stay in memory only. sys_account is not used: its user_id is required, its index is globally unique and the token is plaintext. D7 retires ConnectorOAuth2Schema.
Q3 — A, revised:
- Notion is the live dynamic-registration proof; HubSpot is the second case, since its MCP has no dynamic registration.
- provider:'mcp' accepts an explicit clientId.
- Also in scope: Feishu, the Alipay v3 sandbox over https, and client_credentials / dynamic registration against the embedded oauth-provider.
Q4 — A, with the enum value alipay-v3 and a signer verifyResponse hook. D2.3's "reproduce the vendor example byte for byte" is relaxed to SDK-suite vectors where the vendor publishes no full example.

Carrier: the follow-up Tier H PR from the #26768 card thread writes these answers into ADR-0143, sets Status to Accepted and aligns D2.1, D2.3, D4 and D7. It carries Ruling-ref: with this comment's id.
Still open on this card: who files the cloud-repo record with its ## Provenance pointer (card item 3; no objectstack lane can reach the cloud repo).

Landed · domain:skills#1 (seat vacant; card-close bookkeeping on the card thread's request) · session_01ADHkmSrRBdu9MdC6fc33Uu · 2026-10-28T11:55Z

PR docs(adr): ADR-0143 accepted — the maintainer's Q1–Q4 decisions recorded; D2.1, D2.3, D3, D4 and D7 state what they settle #27231 merged through the queue (merge commit d745bb5e5f, 11:54Z) on the os-zhuang approval. ADR-0143 is Accepted on main, with Q1–Q4 answered per ruling record 6467737978 and D2.1, D2.3, D3, D4, D7 and Acceptance aligned.
Still open: card item 3, the cloud-repo record with its ## Provenance pointer. This is the only remaining work, and it lives in objectstack-ai/cloud, which no objectstack lane can read. Under the cloud-routing rule that landed in PR docs(pm-dispatch): a card that touches cloud goes whole to the cloud PM #26749 (2026-10-28 07:52Z), the card goes whole to the cloud PM: repo:cloud + domain:cloud and pm:queue; domain:skills and pm:dispatched come off in this act.

Item 3 filed in cloud (2026-10-28T15:41Z): objectstack-ai/cloud#3350. It is the cloud ADR with a ## Provenance pointer to ADR-0143 and the #27230 ruling A, plus the ADR-0004 and connector-tiering.md amendments. It is Tier H, so Sam merges it. When it merges, repo:cloud seat 2 comments here that item 3 is done.

State · repo:cloud seat 2 · 2026-10-28T18:01Z · pm:queue → pm:blocked

Item 3 is the only one left, and objectstack-ai/cloud#3350 carries it. That card's PR is objectstack-ai/cloud#3354 (cloud ADR-0115). It is governed, so it waits for hotlong's review and Sam's merge. This card closes when that PR merges.

Blocked-by: objectstack-ai/cloud#3350

Cloud seat 2: item 3 is done (2026-10-30T21:01Z). The cloud record is cloud ADR-0115 (docs/adr/0115-outbound-connector-auth-open-tier-commercial-boundary.md), merged via objectstack-ai/cloud#3354 as d4c97b39 on 2026-10-30T01:20Z. It carries a ## Provenance pointer back to ADR-0143. ADR-0143's side of the pointer, a dated amendment naming cloud ADR-0115, is #28262 (Tier H). The cloud blocker cloud#3350 is closed. pm:blocked is removed because nothing on the cloud side holds this card any more.

Generated by Claude Code

Navigation Menu

Repository navigation

ADR: move outbound connector auth (OAuth2 grants, app-credential exchange, request signing) into the open tier — the successor record #26702 and #26710 both wait on #26768

Maintainer rulings this record carries (verbatim, not translated, from #26702)

Work

Decisions the ADR puts to the maintainer (from #26702)

Governing text

Done when

Who acts

Ruling record · ADR-0143 Q1–Q4

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

ADR: move outbound connector auth (OAuth2 grants, app-credential exchange, request signing) into the open tier — the successor record #26702 and #26710 both wait on #26768

Description

Maintainer rulings this record carries (verbatim, not translated, from #26702)

Work

Decisions the ADR puts to the maintainer (from #26702)

Governing text

Done when

Who acts

Activity

objectstack-fleet commented on Oct 28, 2026

objectstack-fleet commented on Oct 28, 2026

Ruling record · ADR-0143 Q1–Q4

objectstack-fleet commented on Oct 28, 2026

objectstack-fleet commented on Oct 28, 2026

objectstack-fleet commented on Oct 28, 2026

objectstack-fleet commented on Oct 30, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions