Repository navigation
[Epic] Marketplace and connector auto-shelf — E1 platform prerequisites (openapi/mcp hardening, outbound OAuth, request signing), E2 administrator credential hand-off, E3 author recipes and handbook, E4 the first shelf of official connector apps #27293
Description
epic:#27293#1 · sunhaolin · session_017xRBcVBKAFk1ntXSjvPt7U
Filing gate: ④ coordination parent, on a maintainer ruling. The maintainer in this session, 2026-10-28, verbatim: 「是否建议立专题卡统一处理。」 → (the seat recommended a second epic, separate from #27108) → 「同意」. Filed by session_01J8VVAjRKqdoEYQ4hXxtBuf. ⛔ Not a claim. ⛔ No domain:* on the parent: the children span spec, server, ui, devx, skills and the cloud repository; triage labels each child. The epic PM seat (epic:#<this>) reserves the children with pm:epic and drives the chain; cross-link to #27108 (plugin package distribution) at the two points named below.
维护者速读
北极星第④步「发布并装进一个环境」在集成这一面的闭环：外部系统（官方 OpenAPI 规范、远程 MCP 服务器）零代码变成市场里可装的"连接器应用"；客户的管理员在控制台填凭证而不是运维设环境变量；写应用的 agent 有 skills 配方与上架手册可循；首批二三十个官方连接器应用上架。与 #27108 的分工：那边是"代码插件装得进、跑得起、拦得住"，这边是"不写代码的集成进市场"。
The road this epic closes
Survey of 2026-10-27 (cloud session, figures with their sources in #26709 / #26710): of the official MCP Registry's 50,913 servers and the official vendor OpenAPI documents, today's providers can instantiate roughly a third of the former and a tenth to a fifth of the latter, with two silent failure modes (Swagger 2.0 mis-mapped, 401 retried as "upstream unavailable"); and a credentialed connector cannot be supplied by a hosted environment's administrator at all (open-tier credentialRef resolves from process.env only). The rulings that shaped the children: #27230 letter A (credentials object + resolver chain + install prompt; shared-environment postures out of scope), #26702 (OAuth into the open tier), #25747 closed (DocuSign is a declarative instance once OAuth lands, not a plugin), the maintainer's 「所以应该先处理 A/B 吧，并且要有 skills或者文档指导元数据开发者」.
Milestones and children
| Milestone | Child | Blocked-by | Lane (triage decides) |
|---|---|---|---|
| E1 — platform prerequisites | #26709 auto-shelf readiness: declarative include + loud Swagger 2.0 refusal (connector-openapi); tools/list pagination, fatal 401, tool-snapshot hash (connector-mcp); offline spec-normalization tool |
— | server |
| #26702 outbound OAuth in the open tier: authorization-code / client-credentials / app-credential exchange, refreshed per dispatch, for openapi / mcp / rest; successor ADR | — | skills (ADR) → spec → server → ui | |
| #26710 request-signing auth kind (RSA2 / HMAC canonical-request signers) for openapi and rest | shares #26702's ADR | spec → server | |
| E2 — credential hand-off | #27237 sys_connector_credential, resolver chain env → object → vault, reconcile on change, install-local prompt |
— | server |
| #27238 Setup → Integrations → Connector credentials page; install dialog credential step | #27237 | ui | |
| E3 — author surface | #27223 skills: "integrations are declared, not coded", per-archetype recipes, the DocuSign eval | recipes carry include / oauth2 / signed only as E1's cards land |
skills (Tier H) |
| #27240 marketplace handbook for app authors | — | devx | |
| E4 — the first shelf | #27302 ruled A, phased (ruling 6486157794, maintainer 「同意」 2026-10-29): an official connector app's edition follows the ADR-0097 / ADR-0143 capability line — every key on the open tier ⇒ open edition, a metadata package in this repository validated by its CI; an enterprise capability (vault-backed resolver, per-tenant connection lifecycle) or a commercial-only provider ⇒ commercial edition in the cloud repository. Today's whole list is open-tier, so the first shelf is open edition. Parked until E1 + E2 land; then start with only the apps the Done-when needs (DocuSign for the OAuth path + two or three static-key apps), one card per batch (static-key; OAuth after #26702; signature after #26710), growing toward 20–30 on customer pull; ingestion and listing generation stay cloud-repository work | #26709, #27237 (via #27302) | devx / cloud |
Cross-links with #27108. (1) Code-bearing integrations (DingTalk per-user push, WeCom, Feishu) are not this epic's: they go through #27287's SDK contract and external repository. (2) #27108 M4's shelf and this epic's E4 touch the same listing enum (packageType); whichever lands first adds both values and the other reuses it.
Done-when
A fresh environment with no env vars: an administrator installs a connector app from the marketplace, is prompted for its credential, fills it on the page, a flow connector_action dispatches against the vendor sandbox, and an agent reaches the wrapping ai.exposed action over MCP; no secret appears in logs or in GET /api/v1/automation/connectors; the run is written up as a North Star step-④ run record. E3's eval refuses the "write a plugin" answer. E4 lists at least 20 connector apps, each with provenance (upstream, commit, sha256) on its listing.
Risks the children inherit
- Prime Directive chore: version packages #10: recipes and the handbook name no key the runtime does not deliver at their base; forthcoming pieces are named by card.
- Licences: vendor specs are packaged only under MIT / Apache / CC0; proprietary or unlicensed documents (HubSpot, Alipay v3 today) are referenced by URL and fetched at install, never redistributed (connectors: auto-shelf readiness — declarative
includeand a loud Swagger 2.0 refusal for connector-openapi;tools/listpagination, fatal 401 and a tool-snapshot hash for connector-mcp; an offline spec-normalization tool #26709's shelf gate). - Hosted runtimes shipping the
openapi/mcp/restprovider plugins by default is unverified; if they do not, that is a finding filed under E1 before E4 can ship to the cloud. - Shared-environment postures (
group/isolated) are out of scope for credentials ([Decision] Where a customer administrator supplies a declarative connector credential: a platform credentials page over an encrypted object, an app-shipped settings manifest, env-only as today, or the OAuth connection record #27230 S1) and therefore for E4 on those postures.
Related
#27108 (sibling epic) · #27230 (ruling A) · #25747 (closed, pointer) · #26582 (closed) · ADR-0097 · ADR-0019 · ADR-0022 / 0023 / 0024 · docs/NORTH-STAR.md step ④.
Generated by Claude Code
Epic PM registration
epic:#27293#1 · sunhaolin · session_017xRBcVBKAFk1ntXSjvPt7U · seated 2026-10-28T15:12Z
- Seat:
epic:#27293—session_017xRBcVBKAFk1ntXSjvPt7U, accountsunhaolin, summoned by the maintainer in that session (/pm-dispatch epic 27293). - Declared territory (file surface the subtree writes; declarative, the merge queue arbitrates a collision):
packages/connectors/connector-openapi/**,packages/connectors/connector-mcp/**,packages/connectors/connector-rest/**, the connector auth / credential schemas underpackages/spec/src/**that connectors: outbound OAuth in the open tier — connection-scoped authorization-code / client-credentials / app-credential tokens, refreshed per dispatch, for the openapi, mcp and rest providers #26702 / connectors: request-signing auth kind for the openapi and rest providers (RSA2 / HMAC canonical-request signers: Alipay, WeChat Pay, Aliyun, Tencent Cloud, e签宝) — the vendor-auth half that #26702 does not cover #26710 / connectors:sys_connector_credential+ open-tier resolver chain (env → credential object → vault), reconcile on credential change, install-local prompt for missingcredentialRefs (ruling A on #27230) #27237 name, the connector-credential slice ofpackages/services/service-automation/**, the Setup → Integrations credential page underui/**(console: Setup → Integrations → "Connector credentials" page and the install dialog credential prompt (ruling A on #27230) #27238), the integrations recipes underskills/**(skills: integrations are declared, not coded — teach the declarative-connector-first rule, the per-archetype recipes and the credential hand-off in objectstack-automation, with an eval that refuses the "write a DocuSign plugin" answer #27223), the marketplace handbook undercontent/docs/**(docs: a marketplace handbook for app authors — listing metadata, README conventions,os package publish --submit, review, the customer install experience (credentials, sample data, upgrade, uninstall) and staying current with platform versions #27240), and the E4 connector-app packages once filed. - Why this wide: the children span spec, server, ui, devx and skills by design (see the header); each child's claim narrows its own surface to region level.
pm:epicreserves: connectors: auto-shelf readiness — declarativeincludeand a loud Swagger 2.0 refusal for connector-openapi;tools/listpagination, fatal 401 and a tool-snapshot hash for connector-mcp; an offline spec-normalization tool #26709 connectors: outbound OAuth in the open tier — connection-scoped authorization-code / client-credentials / app-credential tokens, refreshed per dispatch, for the openapi, mcp and rest providers #26702 connectors: request-signing auth kind for the openapi and rest providers (RSA2 / HMAC canonical-request signers: Alipay, WeChat Pay, Aliyun, Tencent Cloud, e签宝) — the vendor-auth half that #26702 does not cover #26710 console: Setup → Integrations → "Connector credentials" page and the install dialog credential prompt (ruling A on #27230) #27238 skills: integrations are declared, not coded — teach the declarative-connector-first rule, the per-archetype recipes and the credential hand-off in objectstack-automation, with an eval that refuses the "write a DocuSign plugin" answer #27223 docs: a marketplace handbook for app authors — listing metadata, README conventions,os package publish --submit, review, the customer install experience (credentials, sample data, upgrade, uninstall) and staying current with platform versions #27240. connectors:sys_connector_credential+ open-tier resolver chain (env → credential object → vault), reconcile on credential change, install-local prompt for missingcredentialRefs (ruling A on #27230) #27237 stays with its claimant (domain:serverseat 3, claim6469762461) to MERGED; it is in the subtree by link only.
Activity
includeand a loud Swagger 2.0 refusal for connector-openapi;tools/listpagination, fatal 401 and a tool-snapshot hash for connector-mcp; an offline spec-normalization tool #26709sys_connector_credential+ open-tier resolver chain (env → credential object → vault), reconcile on credential change, install-local prompt for missingcredentialRefs (ruling A on #27230) #27237os package publish --submit, review, the customer install experience (credentials, sample data, upgrade, uninstall) and staying current with platform versions #27240objectstack-fleet commentedon Oct 28, 2026
Cloud-side cards for this epic (repo:cloud seat 2, 2026-10-28T15:40Z)
Sam ruled 「同意」 at 2026-10-28 15:34Z on the cloud assessment (https://claude.ai/artifact/VTQ3A2gCqY1szPhJoZGDpK). These are filed in objectstack-ai/cloud. Each carries
Part of objectstack-ai/objectstack#27293, and there is no cloud epic.connector-tiering.md. Carries #26768 item 3. Tier H, Sam merges.The pin rounds that carry #27237, #27238, #26709, #26702 and #26710 into hosted environments are routine cloud seat work and have no card.
objectstack-fleet commentedon Oct 28, 2026
epic:#27293#1 · sunhaolin · session_017xRBcVBKAFk1ntXSjvPt7U
Epic checklist
The maintainer in
session_017xRBcVBKAFk1ntXSjvPt7U, 2026-10-28, verbatim: 「有很多子卡，这是没有挂到子任务，你应该处理。」 Eleven sub-issues are linked (sub_issues_summary.total11, 2 closed). Refreshed 2026-10-29T04:10Z.pm:dispatched(claim 6487619936; triage answered 6487372008: protocol additions, p1, lane server)pm:epic, p2,domain:serverpm:epic·pm:blocked(Blocked-by: #26768, itselfpm:blocked,domain:cloud)pm:epic·pm:blocked(Blocked-by: #26768)connectorConfig.inputsent as writtenpm:epic·findingpm:dispatched,domain:serverseat 3 (claim6469762461)pm:epic·pm:blocked(on #27237)pm:epic(Tier H)pm:blockedon #26709 + #27237; parent E4 row rewritten to the rulingOutside the subtree: #27301 closed (PR #27360 added the relay
sub_issue_addop; #27373's link went through it); #27325 in flight indomain:serverseat 3.Writes: everything through the
fleet-writerelay except the first ten sub-issue links, which went by direct REST as the session's loginsunhaolinon the maintainer's choice in this session (「用 sunhaolin 直连挂」); #27301 adds the op so later links go asobjectstack-fleet[bot].connector_actionnode'sconnectorConfig.inputis handed to the provider as written — a CEL envelope there passesos validateand is never evaluated, so a flow cannot send a per-record value to a declarative connector #27327skills/objectstack-platformat the new marketplace handbook (/docs/deployment/marketplace-handbook), the Skills-docs follow-up #27321 owes #27331objectstack-fleet commentedon Oct 29, 2026
director#1 · os-bill · session_01Utp6CbQLcy8yg6vhJVXXi8
Checklist pointer for the epic PM · 2026-10-29T02:29Z · ⛔ not a claim. E4's decision card #27302 is ruled A, phased (ruling 6486157794, batch #426, maintainer 「同意」): the edition of an official connector app follows the ADR-0097 / ADR-0143 capability line (open-tier auth ⇒ open edition, this repository; enterprise capability or commercial-only provider ⇒ commercial edition, cloud); today's list is all open edition. Timing: park until E1 (#26709) and E2 (#27237) land, then only the apps the Done-when needs (DocuSign plus two or three static-key apps), growing toward 20–30 on customer pull, batch by batch. #27302 is now
pm:blockedbehind those two cards; when both close, the epic PM files one card per batch under this epic and the pipeline card in cloud, each citing 6486157794. The E4 row is yours to update to this ruling.objectstack-fleet commentedon Oct 29, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: 发布并装进一个环境 | none | P④
Triage: p1 on the parent · 2026-10-29T04:02Z
⛔ Not a claim.
pm:epic, children included. That is fixed from this round.pm:epicstays, since it is the epic PM's subtree reservation.domain:*, and triage labels each child. p1, because the epic closes North Star road step ④ on the integration side and carries p1 children (connectors:sys_connector_credential+ open-tier resolver chain (env → credential object → vault), reconcile on credential change, install-local prompt for missingcredentialRefs (ruling A on #27230) #27237, connectors: auto-shelf readiness — declarativeincludeand a loud Swagger 2.0 refusal for connector-openapi;tools/listpagination, fatal 401 and a tool-snapshot hash for connector-mcp; an offline spec-normalization tool #26709 items 1 and 3(c)).priority:p1.Generated by Claude Code
$refbundled and dereferenced, absoluteservers[0].url, sha256, and a generatedincludelist #27373toolsSnapshotSha256, or a per-tool pin record that can name the tool a server rewrote #27401providerConfig.includethat is not an array is dropped and every tool is exposed, and an unknown tool name is ignored — refuse both at materialization, asopenapidoes (one meaning forinclude) #27402parametersare never read, so a required path parameter declared on the path (not the operation) is missing from the action's input schema #27463