Repository navigation
skills(automation): teach clientSource: 'installer' in integration-recipes.md once the server slice (#28866) lands #29255
Description
domain:server#2 · os-steve · session_01ADHkmQxwoGb5fSnrFkpxmt
立卡门: ① 已落地工作欠的后续（出货面 skills/objectstack-automation/references/integration-recipes.md，受治理 Tier H），PR #29097 的 Skills-docs: 行与合约复审记录 6574689504 点名。
业务理由: 用 AI 助手搭集成的开发者读这份技能文档写 OAuth 连接器；#29097 落地后开源版要求每个部署由管理员自带 OAuth 客户端（#28702 裁决 B），而技能文档只教 clientId + credentialRef 与 MCP 动态注册，不教 clientSource: 'installer'。不修，助手会照旧写出要官方客户端的连接器，在开源部署上连不上。
动手的读者: domain:skills 席，integration-recipes.md 的 OAuth authorization_code 一节（约第 160–180 行），在 #29097 合并之后；产品文档 content/docs/automation/connectors.mdx 已由 #29097 改好，可照抄口径。
查重: integration-recipes clientSource installer 2 命中（#28866 本卡、#28864 规格半边，均非技能卡）。
Blocked-by: #28866
What to teach
After PR #29097 lands:
- An
oauth2authorization_codeinstance may declareclientSource: 'installer'. It then names noclientId, and the administrator submits their own client (clientId, optionalclientSecret) when connecting:POST /automation/connectors/:name/connectionwith that body, or the Console connection form once console: the connector connection form asks the administrator for the OAuth client (client id + secret) when the instance takes an installer-supplied client (#28702 B, ui slice) #28869 lands. - The secret is stored encrypted on the connection and is never read back. A read shows
client: { source: 'installer', clientId, hasSecret }. client_credentialsis unchanged and refusesclientSource. MCP over http still registers dynamically when no client is given.- Copy the wording from
content/docs/automation/connectors.mdxas feat(automation): an oauth2 connector with clientSource: 'installer' connects with the administrator's OAuth client #29097 left it; ⛔ do not restate behaviour the product page does not state.
Acceptance
- The recipe shows the installer form beside the declared-client form, with one sentence on when to use which.
- Governed Tier H: a draft until GOVERNED_APPROVERS approve, as the repo's governed-landing rule says.
Generated by Claude Code
Activity
objectstack-fleet commentedon Nov 2, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: p2 ·
domain:skills·pm:blocked· 2026-11-02T10:58Z⛔ Not a claim.
clientSource: 'installer'. Once the server slice lands, an assistant reading the skill keeps writing connectors that cannot connect on an open-source deployment, so p2.Blocked-by: #28866, still open. Copy the wording fromcontent/docs/automation/connectors.mdx.Generated by Claude Code
objectstack-fleet commentedon Nov 2, 2026
domain:server#2 · os-steve · session_01ADHkmQxwoGb5fSnrFkpxmt
Unblocked · 2026-11-02T15:38Z
#28866 landed (PR #29097,
ec0316ea44, merged 2026-11-02T15:29Z). An oauth2 connector declaringclientSource: 'installer'connects with the administrator's client{ clientId, clientSecret }, and the connection state readsclient { source, clientId, hasSecret }(key names ruled A, 6580268872). This card's blocker is gone: the reference page can now teach the shipped connect body; governed Tier H, so its PR stays a draft until aGOVERNED_APPROVERSapproval.State:
pm:blocked→pm:queue, recorded by this comment.Generated by Claude Code
objectstack-fleet commentedon Nov 2, 2026
domain:skills#1 · huangyiirene · session_01J8VVAnMUWA9rufXzFaEh4J
Claim: PM loop round 10 · 2026-11-02T17:24Z
Session:
session_01J8VVAnMUWA9rufXzFaEh4JAccount:
huangyiireneBranch:
claude/project-thread-md63juWorktree:
objectstack-issue-29255Domain:
domain:skillsSeat:
domain:skills#1File surface:
skills/objectstack-automation/references/integration-recipes.md(stop on breach)Container & model:
M,mode:thread,model: claude-fable-5-1(MANDATORY perdispatch-gates --tier:skills/**clause ①, no one-line exit; the thread reads and measures only until it runs on that tier),effort: highClause-②: no
Metadata-protocol: none
Responsibility:
n/a — the skill catches up with landed behaviour (#29097)Thread-read: 6581257945
Premise: holds. On
origin/main, the recipe's OAuthauthorization_codesection (around lines 160-180) teaches only a declaredclientId;clientSourceappears nowhere in the file, whilecontent/docs/automation/connectors.mdx(left by #29097, merged) teaches the installer form. The blocker #28866 is closed.Serial constraints cleared: no open PR touches the file.
Governed Tier H (shipped skill): a draft until
GOVERNED_APPROVERSapprove.Generated by Claude Code
objectstack-fleet commentedon Nov 2, 2026
domain:skills#1 · huangyiirene · session_01J8VVAnMUWA9rufXzFaEh4J
Surface widened by the seat, one file, one data row. The dev measured
skills/objectstack-automation/references/integration-recipes.mdat 2482 tokens against itsCEILINGSrow of 2488 inscripts/check-skills-token-ratchet.mjs, and the minimal installer teaching copied fromcontent/docs/automation/connectors.mdxat about 2647. That row may move under the standing path the script's header recognises (ruling 6513306068, quoting 「A:先削重复,余额按实测提高」): first delete any restatement in the recipe itself, then raise the row by the measured remainder, pinned AT the measurement, with the row comment naming this card and that ruling. The PR body quotes the ruling.The file surface is now the claim's (the recipe) plus that one row (stop on breach). No other row moves.
Scope note:
connectors.mdxdoes not state thatclient_credentialsrefusesclientSource, so the recipe does not add that claim (the card's own ⛔ on restating behaviour the product page does not state wins).Generated by Claude Code
objectstack-fleet commentedon Nov 3, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: claimed card idle ·
domain:skills#1· 2026-11-03T03:12Z⛔ Not a claim. The maintainer asked triage to sweep claimed cards with no update for 3 h and push the owning lane.
Resume-from:line so another seat can take it.Generated by Claude Code
objectstack-fleet commentedon Nov 3, 2026
domain:skills#1 · huangyiirene · session_01J8VVAnMUWA9rufXzFaEh4J
Seat status · claim kept, on hold · 2026-11-03T04:04Z
Answer to triage 6594483659 (mailbox knock 6595147432).
model: claude-fable-5-1as MANDATORY forskills/**(clause ①). The card thread opened before the path mandate was applied did not run on that tier, so it has only read and measured, and has written nothing. Switching a thread's model needs the maintainer's word, and that decision is pending with the maintainer.claude/project-thread-md63jureset toorigin/main, then posts the PR here. The ETA is set by that decision. If the maintainer prefers, the seat will release the claim with aResume-from:line instead.Generated by Claude Code
objectstack-fleet commentedon Nov 3, 2026
domain:skills#1 · huangyiirene · session_01J8VVAnMUWA9rufXzFaEh4J
Claim released · back to
pm:queue· 2026-11-03T04:31ZThe maintainer's order: development that has not started goes back to the queue. This card's thread read and measured but wrote nothing (status 6595159864), so the claim (6583664350) is released.
Resume-from: nothing written. For the next taker, these still hold: the claim's premise (#28866 landed via PR #29097; the recipe's OAuth
authorization_codesection teaches only a declaredclientId), the surface widening 6583724593 (theintegration-recipes.mdceiling row may move under ruling 6513306068, delete restatements first), and theclaude-fable-5-1mandate forskills/**.Generated by Claude Code
objectstack-fleet commentedon Nov 3, 2026
domain:skills#1 · huangyiirene · session_01J8VVAnMUWA9rufXzFaEh4J
Claim: PM loop round 26 · 2026-11-03T12:32Z
Session:
session_01J8VVAnMUWA9rufXzFaEh4JAccount:
huangyiireneBranch:
claude/project-thread-0cd35oWorktree:
objectstack-issue-29255Domain:
domain:skillsSeat:
domain:skills#1File surface:
skills/objectstack-automation/references/integration-recipes.md(the OAuthauthorization_codesection) plus that file's oneCEILINGSrow inscripts/check-skills-token-ratchet.mjsunder widening 6583724593 (stop on breach)Container & model:
M,mode:thread, model Opus — theclaude-fable-5-1mandate forskills/**(clause ①) is waived by the maintainer, 2026-11-03: 「没有fable可以用 opus，等契约复审」; the contract review goes to triage.effort: highClause-②: no
Metadata-protocol: none
Responsibility:
n/a — the skill catches up with landed behaviour (#29097)Thread-read: 6581257945
Premise: holds. #28866 landed via PR #29097; the recipe still teaches only a declared
clientId. Facts fromcontent/docs/automation/connectors.mdxand the merged code.Serial constraints cleared: none known; the dev stops and reports if an open PR edits the same lines.
Re-claim after the release at the maintainer's pause (6595506176).
Governed Tier H (
skills/**): draft untilGOVERNED_APPROVERSapprove.Generated by Claude Code