Repository navigation
[Decision] E4 of #27293 — official connector apps: which are open edition (this repository) and which commercial (cloud repository), and when the first shelf starts #27302
Description
epic:#27293#1 · sunhaolin · session_017xRBcVBKAFk1ntXSjvPt7U
Ruled: 6486157794 · letter A (phased) · 2026-10-29T02:27Z
Blocked-by: #26709
Blocked-by: #27237
Filing gate: ② a decision only the maintainer can take, on ③ the maintainer's direct instruction in session_017xRBcVBKAFk1ntXSjvPt7U, 2026-10-28, verbatim, in order: 「连接器先不考虑」 · 「连接器立决策卡」 · 「连接器分开源版和商业版，商业版在 cloud 仓库。」 Sub-issue of #27293 (E4 row). ⛔ Not a claim; nothing in E4 is dispatched while this card is open.
维护者速读
- 改了什么：不改代码。[Epic] Marketplace and connector auto-shelf — E1 platform prerequisites (openapi/mcp hardening, outbound OAuth, request signing), E2 administrator credential hand-off, E3 author recipes and handbook, E4 the first shelf of official connector apps #27293 的 E4「首批 20–30 个官方连接器应用」从待立卡改为待裁。已定：连接器分开源版与商业版，商业版在 cloud 仓。待裁：哪些应用算开源版、哪些算商业版（按什么划线），以及何时开工。
- 为什么改：你说「连接器先不考虑」；划线规则没有定过 —— 现有的开源/企业线（ADR-0097，经 ADR-0143 修订）只管平台能力，不管上架的应用归哪一版。
- 风险与回滚：卡挂着期间 E1–E3 照常推进，E4 不动；裁决可随时改。
- 先看：「选项」表与「推荐」。注意：按 ADR-0143 的现行能力线，清单上 20–30 个应用的认证方式（静态密钥 / OAuth2 / 签名）全部属于开源层。
- 两分钟验证：
git show origin/main:docs/adr/0097-declarative-connector-instances.md | sed -n 125,145p。 - 需要你做的：选 A / B / C（或带条件）。
Background
#27293's E4 row asks the epic PM to file 20–30 official connector apps as metadata packages (normalized spec + include + listing + README credentials section): a static-key batch (Stripe read, GitHub, Twilio, Okta, Adyen, OpenAI, monday, Neon) after E1 #26709 and E2 #27237; an OAuth batch (Microsoft Graph, Notion, Atlassian, Google) after #26702; a signature batch (Alipay v3) after #26710; DocuSign as the first declarative verification of the OAuth path. The parent assigns ingestion and listing generation to the cloud repository.
Settled by the maintainer (verbatim above): connectors come in an open edition and a commercial edition; the commercial edition lives in the cloud repository.
Governing text: docs/adr/0097-declarative-connector-instances.md §"Open / enterprise line (ADR-0015)", as amended by ADR-0143 (2026-10-27): open source = the rest / openapi / mcp provider factories, static auth, env-resolved credentialRef, and now oauth2 / app-credential / signed with the connection record and Connect / Reconnect flow; enterprise keeps the vault-backed CredentialResolver backend and per-tenant connection lifecycle. That line is about platform capabilities; no text says which listed app belongs to which edition. Searched: git grep -n -iE "official (app|package|connector)|first-party (app|package|listing)" origin/main -- docs/adr docs/NORTH-STAR.md packages/spec/src/marketplace → 1 hit (ADR-0141:310, a dependency table row, not this); docs/design/marketplace-publishing.md for official|first-party|repo|source|seed|curat → none.
Protocol statement: nothing an author can write changes here; every option consumes E1–E3's keys as they land.
Premises (each with its re-check)
- No package home for official connector apps exists in this repository. Re-check:
git ls-tree --name-only origin/main packages/apps/→ 3 entries (account,setup,studio), all platform apps (read 2026-10-28T15:39Z). - Every auth kind the named apps need is open tier after ADR-0143. Re-check: the
sed -n 125,145pread above (static: Stripe…Neon;oauth2: Microsoft Graph, Notion, Atlassian, Google, DocuSign;signed: Alipay v3). - Every E4 batch is gated on an open card: connectors: auto-shelf readiness — declarative
includeand a loud Swagger 2.0 refusal for connector-openapi;tools/listpagination, fatal 401 and a tool-snapshot hash for connector-mcp; an offline spec-normalization tool #26709 open (items 1, 3(c), 4 remain), connectors:sys_connector_credential+ open-tier resolver chain (env → credential object → vault), reconcile on credential change, install-local prompt for missingcredentialRefs (ruling A on #27230) #27237 open (in flight,domain:serverseat 3), connectors: outbound OAuth in the open tier — connection-scoped authorization-code / client-credentials / app-credential tokens, refreshed per dispatch, for the openapi, mcp and rest providers #26702 and connectors: request-signing auth kind for the openapi and rest providers (RSA2 / HMAC canonical-request signers: Alipay, WeChat Pay, Aliyun, Tencent Cloud, e签宝) — the vendor-auth half that #26702 does not cover #26710 open andpm:blockedon ADR: move outbound connector auth (OAuth2 grants, app-credential exchange, request signing) into the open tier — the successor record #26702 and #26710 both wait on #26768. Re-check:gh api repos/objectstack-ai/objectstack/issues/N --jq .statefor each. - No named customer has asked for a specific connector app on the board. Re-check: the dedupe below.
The question
When the marketplace gets official connector apps, which of them does a self-hosting open-source user get from this repository, and which come only with the commercial edition from the cloud repository — and does the work start now or after E1 + E2?
Options
| What it does | What a customer sees | Effort | |
|---|---|---|---|
| A | The edition follows the ADR-0097/0143 capability line: an app whose every key runs on the open tier is open edition and lives in this repository (private, validated by this repo's CI against the runtime at HEAD); an app that needs an enterprise capability (vault backend, per-tenant connection lifecycle) or a commercial-only provider is commercial edition in the cloud repository. On today's list that puts all 20–30 in the open edition. Start after E1 + E2. | Open-source users get the whole first shelf; the commercial edition adds the apps that need its capabilities, plus hosting. | domain:devx ~3 PRs (one per batch) + 1 cloud pipeline card; no precedent |
| B | The edition is a business choice per listing: this repository ships only a small open reference set (DocuSign + 2–3 static-key apps, the ones #27293's Done-when needs); the rest of the shelf is commercial edition in the cloud repository even though it runs on the open tier. Start after E1 + E2. | Open-source users get a few samples and the E3 recipes to build the rest; the full shelf is a commercial feature. | domain:devx 1 PR + repo:cloud ~3 PRs; no precedent |
| C | Every official connector app is commercial edition in the cloud repository; the open edition ships the providers and E3's recipes only. Start after E1 + E2. | Open-source users build their own from the recipes; no official apps outside the commercial edition. | repo:cloud ~3 PRs; no precedent |
Business meaning: A is "the edition is decided by what the engine can do, so one rule sorts every app"; B is "a few free samples, the catalogue is the paid product"; C is "the catalogue is entirely the paid product".
四维分析
os-decision-facets
- ① 项目长远合理性：两年后的样子是「开源版与商业版的边界只有一条，且写在 ADR 里」；A 复用 ADR-0143 已裁的能力线，新应用按其所需能力机械归版，不新增第二份手工名单；B、C 是逐个应用的商业判断，需要一份长期维护的归属清单，边界随清单漂移。
- ② 实际业务拉动：板上无具名客户点名要某个连接器（检索见下）；拉动来自 [Epic] Marketplace and connector auto-shelf — E1 platform prerequisites (openapi/mcp hardening, outbound OAuth, request signing), E2 administrator credential hand-off, E3 author recipes and handbook, E4 the first shelf of official connector apps #27293 的 Done-when 与北极星第④步。零客户拉动 ⇒ 三个选项都先停到 E1/E2 落地；商业版靠目录收费有多大拉动，席位测不到，只有你知道。
- ③ 防 AI 犯错：A 的归版判据可机械判定（应用用到的认证种类是否全在开源枚举内），写应用的 agent 放错仓会被检查出来；B、C 靠名单，放错仓不会有任何报错（静默）。开源仓内的应用还能在同一 CI 里过
os validate，契约变化当场响亮失败。 - ④ 创业阶段不扩散：每个上架应用都是永久维护义务（厂商 API 漂移、来源 sha256、许可证复核）；B 让开源仓只背 3–4 个，最省；A 让开源仓背全部 20–30 个；C 让开源仓零负担但维护全落到 cloud。
Prior rulings read: connector app,shelf,official listing,marketplace seed → 0 hits; ADR-0097 §Open/enterprise line amended by ADR-0143 (capabilities, not listings); thread: none; repo: objectstack-ai/objectstack
Recommendation
A, phased: park now; when E1 + E2 land, start with only the apps #27293's Done-when needs (DocuSign for the OAuth path plus two or three static-key apps), and grow toward 20–30 on customer pull. Not B: it adds a second, hand-kept edition boundary next to the ADR one, and a misplaced app fails nowhere. Not C: it leaves the open edition's marketplace with no reference the E3 recipes can point at. Confidence gap: the commercial edition's revenue model is not on the board; if its value is meant to be the curated catalogue itself, B is the shape that serves it. Also unverified: whether hosted runtimes ship the openapi / mcp / rest providers by default (#27293 Risks).
Self-check: 只看①选 A；②③④ 是否翻转：否（②④ 只把时序推到 E1/E2 之后并分期；④ 偏 B 但不翻字母）。
After the ruling
- A or B: this card →
pm:blockedwithBlocked-by: #26709andBlocked-by: #27237; when both close, the epic PM files one card per batch (static-key; OAuth after connectors: outbound OAuth in the open tier — connection-scoped authorization-code / client-credentials / app-credential tokens, refreshed per dispatch, for the openapi, mcp and rest providers #26702; signature after connectors: request-signing auth kind for the openapi and rest providers (RSA2 / HMAC canonical-request signers: Alipay, WeChat Pay, Aliyun, Tencent Cloud, e签宝) — the vendor-auth half that #26702 does not cover #26710) as sub-issues of [Epic] Marketplace and connector auto-shelf — E1 platform prerequisites (openapi/mcp hardening, outbound OAuth, request signing), E2 administrator credential hand-off, E3 author recipes and handbook, E4 the first shelf of official connector apps #27293 in the edition's repository, plus the cloud pipeline card in the cloud repository. - C: the cloud repository's seat owns E4; this card closes with a carrier card filed there; [Epic] Marketplace and connector auto-shelf — E1 platform prerequisites (openapi/mcp hardening, outbound OAuth, request signing), E2 administrator credential hand-off, E3 author recipes and handbook, E4 the first shelf of official connector apps #27293's E4 row and its Done-when "E4 lists at least 20 connector apps" are rewritten to point at it.
Related
#27293 (parent) · #26709 · #26702 · #26710 · #27237 · #27240 (handbook) · #27284 (#27108 M4's plugin shelf, shares the listing enum) · #25747 (closed, DocuSign pointer) · ADR-0097 · ADR-0143 · ADR-0015.
Dedupe
- The 500 most recent issues and PRs, all states, titles grepped for
connector app|shelf|docusign|stripe|alipay|microsoft graph|marketplace: 3 hits ([Epic] Marketplace and connector auto-shelf — E1 platform prerequisites (openapi/mcp hardening, outbound OAuth, request signing), E2 administrator credential hand-off, E3 author recipes and handbook, E4 the first shelf of official connector apps #27293, ADR-0025 M4 — the administrator plugin shelf: ADR-0019 D2 amended,packageType: pluginlistings behindmanage_platform_settings, install / upgrade / uninstall from Setup through the M2 path, one Installed list with a Kind column #27284, docs: a marketplace handbook for app authors — listing metadata, README conventions,os package publish --submit, review, the customer install experience (credentials, sample data, upgrade, uninstall) and staying current with platform versions #27240), none this question. - Semantic search "official connector apps first shelf Stripe GitHub Twilio DocuSign metadata package listing", all states: 4 hits ([Epic] Marketplace and connector auto-shelf — E1 platform prerequisites (openapi/mcp hardening, outbound OAuth, request signing), E2 administrator credential hand-off, E3 author recipes and handbook, E4 the first shelf of official connector apps #27293, connectors: auto-shelf readiness — declarative
includeand a loud Swagger 2.0 refusal for connector-openapi;tools/listpagination, fatal 401 and a tool-snapshot hash for connector-mcp; an offline spec-normalization tool #26709, docs: a marketplace handbook for app authors — listing metadata, README conventions,os package publish --submit, review, the customer install experience (credentials, sample data, upgrade, uninstall) and staying current with platform versions #27240, Electronic-signature connector family:connector-esignwith DocuSign first, three fixed actions, consumed by apps as a declarativeprovider: 'docusign'instance #25747 closed), none this question.
Activity
objectstack-fleet commentedon Oct 29, 2026
director#1 · os-bill · session_01Utp6CbQLcy8yg6vhJVXXi8
Brief-claimed-by: session_01Utp6CbQLcy8yg6vhJVXXi8 · batch #426 · 2026-10-29T02:15Z
Director seat, summon #54 (ledger objectstack#12708, opening mark 6485456694). Presented to the maintainer in batch #426 as item 3 of 3, together with #27298 and #27299.
Seat increment (re-read at
origin/main73725c20, 2026-10-29T02:15Z):packages/apps/holdsaccount,setup,studioonly (no home for connector apps); ADR-0097 §"Open / enterprise line" with the ADR-0143 amendment note (L125–145) puts static,oauth2,app-credentialandsignedauth on the open tier, so every app on the E4 list runs on open-tier capabilities; the E4 gates are all open — connectors: auto-shelf readiness — declarativeincludeand a loud Swagger 2.0 refusal for connector-openapi;tools/listpagination, fatal 401 and a tool-snapshot hash for connector-mcp; an offline spec-normalization tool #26709 (pm:epic+pm:retriage), connectors:sys_connector_credential+ open-tier resolver chain (env → credential object → vault), reconcile on credential change, install-local prompt for missingcredentialRefs (ruling A on #27230) #27237 (pm:dispatched, p1), connectors: outbound OAuth in the open tier — connection-scoped authorization-code / client-credentials / app-credential tokens, refreshed per dispatch, for the openapi, mcp and rest providers #26702 and connectors: request-signing auth kind for the openapi and rest providers (RSA2 / HMAC canonical-request signers: Alipay, WeChat Pay, Aliyun, Tencent Cloud, e签宝) — the vendor-auth half that #26702 does not cover #26710 (pm:blocked, security, p1); no card on the board names a customer asking for a specific connector app.check-prior-rulings.mjs --card 27302names ADR-0143 D1 / D3 / D7, ADR-0097 §3, ADR-0023 §4, ADR-0022 §4, ADR-0024 §4 — all about capabilities and contracts; none assigns a listed app to an edition. Thread: the maintainer's three verbatim instructions in the card's filing gate (「连接器先不考虑」 · 「连接器立决策卡」 · 「连接器分开源版和商业版，商业版在 cloud 仓库。」) — the split itself is settled, the dividing rule is the question.os validatein this repository's CI); under B or C a misplaced app fails nowhere. ② the pull the seat can measure is zero; the pull the seat cannot measure is the commercial edition's — if the curated catalogue is meant to be what the commercial edition sells, B is the shape that serves it, and the maintainer's 「商业版在 cloud 仓库」 may mean exactly that. ④ B keeps the open repository's permanent maintenance load (vendor API drift, source hashes, licence review) at 3–4 apps instead of 20–30.includeand a loud Swagger 2.0 refusal for connector-openapi;tools/listpagination, fatal 401 and a tool-snapshot hash for connector-mcp; an offline spec-normalization tool #26709) and E2 (connectors:sys_connector_credential+ open-tier resolver chain (env → credential object → vault), reconcile on credential change, install-local prompt for missingcredentialRefs (ruling A on #27230) #27237) land, start with only the apps [Epic] Marketplace and connector auto-shelf — E1 platform prerequisites (openapi/mcp hardening, outbound OAuth, request signing), E2 administrator credential hand-off, E3 author recipes and handbook, E4 the first shelf of official connector apps #27293's Done-when needs (DocuSign for the OAuth path plus two or three static-key apps) and grow toward 20–30 on customer pull. The one condition that flips the letter is a business fact only the maintainer holds: if the catalogue itself is the commercial product, rule B and the seat records a hand-kept edition list as a maintained artefact (with its cost named). Not C: the open edition's marketplace would have no reference the E3 recipes can point at.domain:devx~3 PRs (one per batch, metadata packages validated by this repository's CI) + 1repo:cloudpipeline card · after E1 + E2 · no precedent. B: devx 1 PR + cloud ~3 PRs. C: cloud ~3 PRs.pm:blockedwithBlocked-by: #26709andBlocked-by: #27237, the epic PM files one card per batch in the ruled repository when both close; C → the cloud seat owns E4 and [Epic] Marketplace and connector auto-shelf — E1 platform prerequisites (openapi/mcp hardening, outbound OAuth, request signing), E2 administrator credential hand-off, E3 author recipes and handbook, E4 the first shelf of official connector apps #27293's E4 row is rewritten.Prior rulings read: connector app, shelf, official listing, open edition, commercial → ADR-0097 §Open/enterprise line (capabilities only), ADR-0143 D1; thread: none; repo: objectstack-ai/objectstack
objectstack-fleet commentedon Oct 29, 2026
director#1 · os-bill · session_01Utp6CbQLcy8yg6vhJVXXi8
Ruling: batch #426 item 3 · letter A (phased) · maintainer 「同意」 2026-10-29T02:23Z
Director seat, summon #54 (ledger objectstack#12708, opening mark 6485456694, brief 6486036679). The maintainer answered batch #426 in the summon chat with one word, verbatim: 「同意」 — the seat's letter on each of the three cards; for this card A, phased. The condition the brief named for B (the curated catalogue itself being the commercial product) was put to the maintainer in the same presentation and not taken up.
What the ruling binds (letter A, phased): the edition of an official connector app follows the ADR-0097 / ADR-0143 capability line, mechanically: an app whose every key runs on the open tier is open edition and lives in this repository (a metadata package validated by this repository's CI against the runtime at HEAD); an app that needs an enterprise capability (the vault-backed
CredentialResolver, per-tenant connection lifecycle) or a commercial-only provider is commercial edition in the cloud repository. On today's E4 list every app runs on open-tier auth, so the first shelf is open edition. Timing: park now; when E1 (#26709) and E2 (#27237) have landed, start with only the apps #27293's Done-when needs — DocuSign for the OAuth path plus two or three static-key apps — and grow toward 20–30 on customer pull, batch by batch (static-key; OAuth after #26702; signature after #26710). Ingestion and listing generation stay with the cloud repository as #27293 assigns them. Not taken: B (a second, hand-kept edition list beside the ADR line; a misplaced app fails nowhere), C (the open edition's marketplace with no reference the E3 recipes can point at).Governing text: ADR-0097 §"Open / enterprise line" as amended by ADR-0143 (capabilities); the maintainer's 2026-10-28 instructions quoted in this card's filing gate (the split itself); #27293 E4 row and Done-when. Premises re-read at
origin/main73725c20(brief 6486036679).Workload of the letter:
domain:devx~3 PRs (one per batch, metadata packages) + 1repo:cloudpipeline card · after E1 + E2 · no precedent.Execution: this card moves
needs-user-decision→pm:blockedin this act withBlocked-by: #26709andBlocked-by: #27237(body and thread);pm:epicstays. When both close, the epic PM of #27293 files one card per batch as sub-issues of #27293 in this repository, plus the pipeline card in the cloud repository, each citing this comment on aRuling-ref:line; #27293's E4 row is updated by the epic PM to this ruling.os-decision-facets
① 长远：开源与商业只有一条边界且写在 ADR 里，按应用所需能力机械归版，不新增第二份手工名单
② 拉动：板上无客户点名；先停到 E1/E2 落地，首批只做验收所需，再按拉动增长
③ 防错：归版判据可机械判定，放错仓可被检查出来；开源仓内应用在同一 CI 里过
os validate④ 不扩散：分期把开源仓的永久维护义务压到首批 3–4 个应用，20–30 只随拉动增长
objectstack-fleet commentedon Oct 29, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: 发布并装进一个环境 | none | P④
Triage: p2 · ruled A (phased) · coordination · 2026-10-29T04:06Z
⛔ Not a claim.
pm:epic, children included. That is fixed from this round.pm:epicstays, since it is the epic PM's subtree reservation.pm:blockedon connectors: auto-shelf readiness — declarativeincludeand a loud Swagger 2.0 refusal for connector-openapi;tools/listpagination, fatal 401 and a tool-snapshot hash for connector-mcp; an offline spec-normalization tool #26709 (items 1 and 3(c), triage-routed this round) and connectors:sys_connector_credential+ open-tier resolver chain (env → credential object → vault), reconcile on credential change, install-local prompt for missingcredentialRefs (ruling A on #27230) #27237 (in flight, PR feat(service-automation, runtime, spec): connector credential store and open-tier credentialRef chain (#27237) #27344 under triage review).domain:*. Each E4 connector-app child gets its own lane and grade from triage when the epic PM files it. Open-edition apps live in this repository, and commercial ones go to the cloud PM whole (cloud rule).priority:p2.Generated by Claude Code