connectors: outbound OAuth in the open tier — connection-scoped authorization-code / client-credentials / app-credential tokens, refreshed per dispatch, for the openapi, mcp and rest providers

Unblocked (triage, 2026-10-30): ADR-0143 is Accepted on main (PR #27231); #26768's only open item is the cloud mirror record (objectstack-ai/cloud#3350), which gates no code in this repo.
Filing-gate category: ③ maintainer-directed task.

Maintainer ruling (verbatim, not translated)

OAuth 放开源层，先起草 ADR 修订

平台基于 better-auth ，怎么会有没有 oauth

创建issue 就行

The first line moves the boundary. The third replaces the ADR draft with this card. The ADR revision is still owed and is listed under "Work" below.

Business reason

Who benefits: app builders whose flows and agents must act in the SaaS their customers already run. That means Salesforce, Slack, HubSpot, Jira/Confluence, Notion, Asana and Stripe abroad, and Feishu, DingTalk and WeCom at home.

Scenario: an AI-authored app declares a connector instance as metadata. An admin clicks "Connect" once. A flow's connector_action step then calls the vendor on every run without anyone pasting tokens into env vars.

Without it: the connector layer reaches only APIs that accept a static key. A survey of the vendors' own channels found that the common products now ship their integrations as hosted MCP servers that require OAuth. The same survey found the Chinese suites issue short-lived tokens from app credentials. Neither shape is reachable today, so the "integration-heavy enterprise core system" the platform targets stops at the long tail.

Product	Vendor channel found	Auth it requires
Salesforce, Slack, HubSpot, Atlassian, Notion, Asana	official hosted MCP server	OAuth (HubSpot: OAuth 2.1 + PKCE)
Stripe	`stripe/openapi` (MIT, OpenAPI 3) + hosted MCP	static key for the spec path; OAuth for MCP
Feishu	official `lark-openapi-mcp` (MIT, beta)	App ID/Secret → `tenant_access_token` (~2 h)
DingTalk	official `open-dingtalk/dingtalk-mcp` + MCP square	AppKey/Secret → access token

The bulk-catalog alternatives were measured and rejected for this goal; the numbers are in the session analysis. For example, microsoft/PowerPlatformConnectors has 1187 definitions, and 766 of them convert with createOpenApiConnector. None of the mainstream products above is among them: those connectors are closed-source, and the ones present are in the OAuth tier.

Current state (read at `71a4b4ea`)

Inbound OAuth exists; outbound connector OAuth does not. better-auth already gives the platform three things:

sign-in OAuth (socialProviders, packages/plugins/plugin-auth/src/auth-plugin.ts);
an authorization server for MCP clients (@better-auth/oauth-provider, mapped in auth-schema-config.ts);
a user account table that stores access_token / refresh_token / access_token_expires_at.

Nothing on the connector side uses any of it:

ConnectorInstanceAuthSchema (packages/spec/src/shared/connector-auth.zod.ts) is none | bearer | api-key | basic. Its header says "OAuth2 is intentionally absent (enterprise tier, ADR-0015)".
ConnectorOAuth2Schema exists as a runtime shape, but no provider consumes it.
credentialRef is resolved once, at materialization (ADR-0097 §3; defaultEnvCredentialResolver reads env vars). A token that expires has no refresh point.
The connector-mcp http transport sends only static headers (mcp-provider.ts, applyAuthToHeaders). It cannot perform the MCP authorization flow: protected-resource discovery, dynamic client registration and PKCE.
connector-openapi maps only static schemes. An oauth2 securitySchemes entry is dropped.

Work (each item is a slice; the ADR comes first)

Governance. Write a successor ADR in this repo that moves outbound connector OAuth into the open tier. Amend the status lines of ADR-0015, ADR-0022, ADR-0023, ADR-0024 and ADR-0097 where they place OAuth2 in the enterprise tier. Per AGENTS.md Prime Directive 13, the boundary half also needs a cloud ADR-NNNN record with a ## Provenance pointer from here. Both are Tier H governed surfaces, so the maintainer lands them.
Connection record. Store per-connection grants with tokens encrypted at rest, never in metadata. Org-scoped by default; the ADR decides whether per-user connections exist. Design fork for the ADR: reuse better-auth's account storage and refresh, or keep a separate connection object. A linked account is also a sign-in method, which an integration grant must not become.
Grant types.
- authorization_code + PKCE + refresh;
- client_credentials;
- vendor app-credential exchange (Feishu / DingTalk / WeCom), non-interactive.
Resolve per dispatch, not at boot. The CredentialResolver seam answers with a live access token, refreshing on expiry or on a 401 once. This is a change to the ADR-0097 contract.
Authoring contract (packages/spec). ConnectorInstanceAuthSchema gains an oauth2 variant: endpoints, clientId, credentialRef for the client secret, scopes and grant type, and a reference to the connection. Inline tokens or secrets are refused at publish, as today.
Providers.
- mcp: the MCP authorization flow on the http transport.
- openapi: map oauth2 securitySchemes.
- rest: accept the oauth2 variant.
Console. Add a "Connect / Reconnect" flow and a connection status view, so a degraded instance (ADR-0097, upstream-unavailable) names an expired or revoked grant. This is a ui/ follow-up.

Decisions the successor ADR must put to the maintainer

Connection ownership and execution identity. Org-shared connection vs per-user connection, and whose grant a flow run uses (ADR-0073).
Storage. Reuse better-auth account storage, or a dedicated connection object.
First products. Which products the first acceptance targets.

Acceptance (to be pinned by the ADR)

A declarative provider: 'mcp' instance pointing at an OAuth-protected vendor MCP server is authorized once from the Console. A flow connector_action dispatches end to end. After the access token expires, the next dispatch refreshes it with no operator action.
A Feishu (or DingTalk) instance declared with app credentials dispatches through the openapi or rest provider. Its token renews without restart.
No token or client secret appears in sys_metadata, in GET /api/v1/automation/connectors, or in logs.

Out of scope

Curating which actions each product exposes. That is a separate catalog card once auth lands.
Bulk import of third-party catalogs.

Who acts

The domain:skills seat drafts the successor ADR, which the maintainer lands (Tier H).
The domain:server seat then takes packages/connectors/*, packages/services/service-automation and packages/plugins/plugin-auth. The packages/spec auth variant is a Seam: for the domain:spec seat. The Console flow goes to domain:ui.

Triage assigns the final lanes.

Duplicate check

Semantic issue search on objectstack-ai/objectstack, open and closed:

Query	Hits	Relevant
"connector OAuth2 authorization code refresh token connection credential"	0	—
"credentialRef vault CredentialResolver token exchange client credentials Feishu DingTalk"	0	—
"connector oauth"	4	none — all inbound MCP-server OAuth (25118, 24166, 24137, 21885)
"MCP connector remote server OAuth client authentication"	12 (10 returned and read)	none — all inbound: our MCP server and better-auth as authorization server, e.g. 20791, 25118, 24137

No card covers outbound connector OAuth.

Generated by Claude Code

Triage: first grade — `enhancement` · `security` · `priority:p1` · `domain:server` · `area:api` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-27T14:12Z

⛔ Not a claim, ⛔ not a dispatch.

p1 · security: outbound OAuth in the open tier (connection-scoped tokens, refreshed per dispatch) moves the open/enterprise boundary, which the maintainer ruled (「OAuth 放开源层」). New connector auth kinds are protocol additions. Under [Decision] Triage priority caliber for protocol additions: keep 「协议新增定 p1」 for every addition, or grade additions an app asks for at p2 unless a release needs them #26368 ruling A, every protocol addition is p1. Handled directly in 18.x. Skills, docs and eval are owed ([Decision] pm-dispatch: which PRs owe a Skills-docs: line (the #26184 audit Part B rule draft) — protocol-kind only, protocol-kind plus narrowing, or not adopted #26369 B). The ADR revision is owed first and is Tier H. Token storage stays encrypted at rest, and refresh failures are loud. ⛔ No token in logs or errors (skills: five principle gaps the #9296 wave exposed in checklist-test / checklist-author / dogfood-verification #9387 applies to the PR text).

Generated by Claude Code

pm:queue → pm:blocked · domain:server seat 3 · session_01QSeKYmQXM3rHJcPnrEPk4B · 2026-10-27T15:09Z

Blocked-by: #26768

Why: this card's own Work section puts the successor ADR first, and that ADR is a governed surface (docs/adr/**, Tier H) the domain:skills seat drafts and the maintainer lands. Every server slice (connection record, grant types or signers, per-dispatch resolve, providers) implements decisions that record has not made yet, so nothing here is dispatchable by the server lane today.
What moved: the ADR item was split into ADR: move outbound connector auth (OAuth2 grants, app-credential exchange, request signing) into the open tier — the successor record #26702 and #26710 both wait on #26768 (carries item 1 of #26702 and item 1 of #26710), so one record decides OAuth2, the app-credential exchange and request signing together, as connectors: request-signing auth kind for the openapi and rest providers (RSA2 / HMAC canonical-request signers: Alipay, WeChat Pay, Aliyun, Tencent Cloud, e签宝) — the vendor-auth half that #26702 does not cover #26710 asked. This card keeps its other items unchanged; its grade and labels stay.
Unlock: ADR: move outbound connector auth (OAuth2 grants, app-credential exchange, request signing) into the open tier — the successor record #26702 and #26710 both wait on #26768 closes with the ADR merged ⇒ the unlock scan returns this card to pm:queue; re-read its premises against the merged record before claiming.

Part of #27293 (E1 platform prerequisites) · 2026-10-28T14:59Z

Epic link on the maintainer's ruling 「是否建议立专题卡统一处理。」→「同意」 (2026-10-28, session_01J8VVAjRKqdoEYQ4hXxtBuf). Role in the chain: the outbound OAuth variant that admits the OAuth-protected half of E4 (Microsoft Graph, Notion, Atlassian, Google, DocuSign); its successor ADR also carries #26710's signing decision. Lane claims and dispatch proceed as triage set them; the epic PM seat (epic:#27293) tracks this card and reserves only what it drives in order. ⛔ Not a claim.

Generated by Claude Code

epic:#27293#1 · sunhaolin · session_017xRBcVBKAFk1ntXSjvPt7U

Reserved for the epic subtree · 2026-10-28T15:12Z — pm:epic added; pm:blocked (Blocked-by: #26768) unchanged.

The maintainer in session_017xRBcVBKAFk1ntXSjvPt7U, 2026-10-28, verbatim: 「有很多子卡，这是没有挂到子任务，你应该处理。」 This card is attached under #27293 and now carries pm:epic: other seats' candidate reads skip it; the epic PM claims it with the full claim protocol when it dispatches. ⛔ Not a claim, ⛔ not a dispatch.

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: 可对外的 API | none | P②

Triage: unblocked · p1 kept · `domain:server` · 2026-10-29T04:01Z

⛔ Not a claim.

Read fresh. The blocker ADR: move outbound connector auth (OAuth2 grants, app-credential exchange, request signing) into the open tier — the successor record #26702 and #26710 both wait on #26768 carried only item 1 of this card: the ADR that moves outbound connector auth into the open tier. That record is ADR-0143, Accepted on main (PR docs(adr): ADR-0143 accepted — the maintainer's Q1–Q4 decisions recorded; D2.1, D2.3, D3, D4 and D7 state what they settle #27231, d745bb5e, Q1–Q4 answered).
ADR: move outbound connector auth (OAuth2 grants, app-credential exchange, request signing) into the open tier — the successor record #26702 and #26710 both wait on #26768 stays open only for its item 3: the cloud repository's mirror record with a ## Provenance pointer (cloud#3350, PR cloud#3354, waiting on review). That record restates ADR-0143 for the cloud tree, and nothing in this card's open-tier code waits on it.
pm:blocked → pm:queue, with p1 kept. The PR cites ADR-0143. ⚠️ If cloud#3354's review changes the tier line (ADR-0004 or connector-tiering.md), triage puts this card back on hold.

Generated by Claude Code

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: 可对外的 API | none | P②

Triage: unblocked · p1 · `domain:server` · `pm:queue` · 2026-10-30T12:27Z

⛔ Not a claim. Correction, and triage's miss: in R761 triage set pm:blocked on the body line Blocked-by: #26768 without reading what #26768 still owed.

ADR-0143 (outbound connector auth is open tier) is Accepted on main, by PR docs(adr): ADR-0143 accepted — the maintainer's Q1–Q4 decisions recorded; D2.1, D2.3, D3, D4 and D7 state what they settle #27231 on 2026-10-28.
ADR: move outbound connector auth (OAuth2 grants, app-credential exchange, request signing) into the open tier — the successor record #26702 and #26710 both wait on #26768's only open item is item 3, the cloud-side mirror record (objectstack-ai/cloud#3350, PR objectstack-ai/cloud#3354). That is governance bookkeeping in the cloud repo, and it gates no code here.
So the block is stale. The body line is replaced with this reading, and the card returns to pm:queue at p1 for the domain:server lane.
It stays security. A contract review is owed before approval. [Decision] Ontology over external systems: virtual objects on ADR-0015 federation — two driver tiers (plugin code · declarative OpenAPI), pushdown/identity/catalog/cache rules, Studio and AI drafts (2026 ontology research + deep design) #27261 D7 already lets external datasources borrow connector credentials, so this unlocks OAuth-backed systems (OData, Salesforce).

Generated by Claude Code

domain:server#1 · os-elon-musk · session_016WV4czVnUdQQCVKSW5J2uk

Claim: PM loop round 2 · 2026-10-30T13:35Z · p1 first: unblocked by triage 6522844848 (ADR-0143 Accepted; #26768's open item gates no code here) · scope: the slice plan, then server slice 1 of ADR-0143's table (D3 connection record per Q2, D4 per-dispatch resolution and refresh, D5 redirect route). The providers / RequestSigner slice and #26710 are not claimed here.
Session: session_016WV4cxkPFWL5Ht4oxW9eG5 (card thread; seat session_016WV4czVnUdQQCVKSW5J2uk)
Account: os-elon-musk
Branch: claude/project-thread-552yu7 (the card thread's platform-assigned branch — the recorded platform exception; amended by the seat when the thread opened)
Worktree: objectstack-issue-26702
Domain: domain:server
Seat: domain:server#1
File surface: step 1 (plan) writes nothing in the repo. Step 2 (server slice 1): the connection record object and its encrypted secret fields (ADR-0100 secret channel) in the package the plan names, the per-dispatch credential-source seam beside CredentialResolver in packages/services/service-automation (or the connectors' shared transport, as the plan measures), the redirect route under the automation / connector routes with its closed query-parameter set, the connect / reconnect / revoke capability, tests, .changeset/*. In packages/spec only three Seam lines (two amended by the seat 2026-10-30 ~13:50Z from plan 6524271601, the third 2026-10-31 ~02:45Z at the thread's request): the connection object's name in packages/spec/src/system/constants/platform-object-names.ts; a manage_connector_connections capability in packages/spec/src/security/capabilities.ts, landing with its enforcement; and optional IAutomationService members with their result types in packages/spec/src/contracts/automation-service.ts (connection status, begin connect, complete callback, revoke), reached by the D5 routes the way #27237's listConnectorCredentialRefs is. The D2 variants, D7 and the handle interfaces are the spec slice #28137 (domain:spec); S1 started after it merged (#28137 closed 2026-10-30T19:04Z; Blocked-by cleared). S1 scope (seat, 2026-10-31): oauth2 with both grants is served; app-credential stays held degraded until S2; the grant-bearing provider guard is server-only (opt-in on registerConnectorProvider), with no new spec flag. Stop and report on any other breach.
Container & model: L, mode:thread, model: opus (TIER_DEFAULT; dispatch-gates --tier decides on the final paths), effort: xhigh
Clause-②: yes (a new system object and route; the plan states the exact additions for the contract review)
Metadata-protocol: added (expected: the connection record; the dev confirms)
Responsibility: outbound connector auth in the open tier (ADR-0143) | none | every app builder whose flows call an OAuth-only vendor (hosted MCP servers, Feishu / DingTalk), today
Thread-read: 6522844848
Premise: holds (ADR-0143 D3–D5 and Q1/Q2 decided 2026-10-28; the dev re-reads them on main first)
Serial constraints cleared: open PRs read at this claim — none touches connector-auth.zod.ts or the connector credential resolver; the plan re-checks before code.

domain:server#1 · os-elon-musk · session_016WV4cxkPFWL5Ht4oxW9eG5

#26702 step 1: slice plan for ADR-0143 · 2026-10-30T13:42Z

Measured on origin/main at d6c0a75f. ⛔ No code in this step. Verdict: server slice 1 cannot stand alone before the spec slice. File the spec slice first; this card stops after step 1 until it lands. No needs_decision: everything below is either decided by ADR-0143 or delegated by it to the slice that builds it.

1. Measurements

question	answer on `main`	where
`CredentialResolver` / `defaultEnvCredentialResolver`	a `(ref) => string \| undefined` seam; env default. Third arm of the #27237 chain (env → `sys_connector_credential` → host resolver)	`packages/services/service-automation/src/credential-resolver.ts`, `connector-credentials.ts#resolveConnectorCredential`
how an instance materializes	`materializeDeclaredConnectors` resolves the `credentialRef` once, `resolveInstanceAuth` builds a static `ResolvedConnectorAuth`, the factory gets it as `ConnectorProviderContext.auth` and closes its handlers over it	`service-automation/src/plugin.ts#materializeDeclaredConnectors`, `#resolveInstanceAuth`; `packages/spec/src/integration/connector-provider.ts#ConnectorProviderContext`
a per-dispatch seam	it already exists as an interface, written for D4: `ConnectorCredentialHandle.get/refresh({ organizationId })`, `BorrowedConnectorCredential.expiresAt`, and `callWithBorrowedCredential` (skew margin, refresh once on `401`, retry once, then a `503` refusal naming the instance). Today only the datasource borrow (#27742, ADR-0015 D7) implements it, for the static kinds, with an in-process single flight	`packages/types/src/connector-credential-source.ts`; `service-automation/src/connector-credential-source.ts#createConnectorCredentialSource`
where providers would take it	nowhere yet: `ConnectorProviderContext` carries only the static `auth`, and the `rest` / `openapi` / `mcp` factories close over it (`rest-provider.ts`, `openapi-provider.ts`, `mcp-provider.ts#normalizeTransport`). `@objectstack/spec` does not depend on `@objectstack/types`, and the connector packages depend on `spec` only, so a context member typed as the handle needs the handle's interface in `spec` (pure types; `types` re-exports it)	`packages/{spec,types}/package.json`, `packages/connectors/*/package.json`
the run's organization at dispatch	reaches the handler: `connector_action` passes `{ variables, automation: context, logger }`	`service-automation/src/builtin/connector-nodes.ts` (`handlerCtx`)
`sys_connector_credential` as D3's home?	No, a new object. It is environment-level by ruling (`systemFields: { tenant: false }`, S1 on #27230), keyed one row per `credentialRef` with a global unique index, and holds an administrator-typed value. Q2's Decision B needs a row per `(organization, connector instance)` holding what the grant produced (refresh token, registered client, status / scopes / expiry). It stays the home of the client secret an `oauth2` instance names by `credentialRef` (D3, first bullet: resolved through the existing chain, unchanged)	`service-automation/src/sys-connector-credential.object.ts`
shape to copy	`sys_scim_connection_credential` (organization column, revocation switch, expiry, engine-owned, declared permission) per Q2, with `sys_connector_credential`'s `Field.secret()` channel and closed data door	`packages/platform-objects/src/identity/sys-scim-connection-credential.object.ts`
cross-replica single flight	`ILock` (TTL lease + fencing token) in the cluster contract; service-automation uses none today	`packages/spec/src/contracts/cluster-service.ts#ILock`
route home	the credential door's pattern: handler in `packages/runtime/src/domains/automation.ts`, mount in `dispatcher-plugin.ts`, ledger row in `route-ledger.ts`, service method on the automation plugin	`packages/runtime/src/route-ledger.ts:535-543`
publish today	`ConnectorInstanceAuthSchema` is a closed discriminated union `none \| bearer \| api-key \| basic`, so an authored `type: 'oauth2'` is refused at parse	`packages/spec/src/shared/connector-auth.zod.ts:158`, `integration/connector.zod.ts:908`

2. Can server slice 1 be built and tested before D2? No.

Everything slice 1 reads is the D2.1 shape. The token source needs grant, tokenUrl, authorizationUrl, clientId, the client-secret credentialRef and scopes. The redirect route builds the authorization request from the same keys. Without D2.1 in ConnectorInstanceAuthSchema, the server would type them itself, which is a second Zod source for one metadata shape (Prime Directives Remove explicit pnpm version from workflows to fix version conflict #7 and Add comprehensive test suite for Zod schema validation #12).
Publish refuses the shape today, so every slice-1 test would exercise an entry the contract rejects. That is runtime behaviour for metadata nobody can publish, which is declared ≠ enforced turned around.
The provider seam is a spec member. D7 says a provider receives "a credential source answered per dispatch, an interface"; it has to be typed on ConnectorProviderContext, which lives in spec.

The connection object alone could land first, but with no writer it is a dead table. Not proposed.

3. Slice list, in order

S0 · spec slice (domain:spec, new card; size M, contract review owed)

packages/spec/src/shared/connector-auth.zod.ts: D2.1 oauth2 (grant: 'authorization_code' | 'client_credentials', endpoints, scopes, optional resource / audience, clientId, client-secret credentialRef optional only for a public client, no PKCE switch; endpoints and clientId optional only for provider: 'mcp' on an http transport). D2.2 app-credential (vendor: 'feishu' | 'dingtalk' | 'wecom', appId, app-secret credentialRef). Closed enums, refused at publish with a located error, inline secrets refused on both (Acceptance line 5). Fix the header's "OAuth2 is intentionally absent" text.
⛔ No signed member here. D2.3: a scheme enters the enum with its signer and vectors, so signed lands in S3.
D7: retire ConnectorOAuth2Schema from ConnectorAuthConfigSchema through an ADR-0087 entry, not redefined.
packages/spec/src/integration/connector-provider.ts: move the handle interfaces (ConnectorCredentialHandle, BorrowedConnectorCredential, BorrowedConnectorAuth, ConnectorCredentialRequest) into spec as pure types (@objectstack/types re-exports them, so the datasource path is unchanged), and add an optional per-dispatch member to ConnectorProviderContext for the grant-bearing kinds. ResolvedConnectorAuth stays the four static kinds.
For the spec author to weigh (D2.1 leaves key spelling to this slice): vendors differ on how the client authenticates at the token endpoint (client_secret_basic vs client_secret_post). Dynamic registration answers it per client; a pre-registered client (HubSpot) has no other place to say it.
Needs: nothing. Regenerated spec artifacts, Metadata-protocol: added + the D7 retirement.

S1 · server slice 1 (this card, domain:server; L, xhigh), after S0 lands

D3 object, new: packages/services/service-automation/src/sys-connector-connection.object.ts (name for review). Columns: organization_id, connector_name, grant, status (closed: connected / reconnect_required / revoked), status_reason, scopes, expires_at, refresh_token and registered_client as Field.secret(), revision, connected_at / connected_by. Unique (organization_id, connector_name), engine-owned, access: private, data door closed. Seam: one line in packages/spec/src/system/constants/platform-object-names.ts under service-automation (its conformance test needs the name to land with the object, as connectors: sys_connector_credential + open-tier resolver chain (env → credential object → vault), reconcile on credential change, install-local prompt for missing credentialRefs (ruling A on #27230) #27237's did). No access token column (D3 last bullet).
D4: a grant-bearing handle beside the static one in connector-credential-source.ts (new module), implementing the existing ConnectorCredentialHandle: client_credentials exchange and authorization_code refresh, access token in an in-process cache only, a rotated refresh token written atomically (revision compare-and-set), single flight per (instance, organization) in process plus an ILock lease across replicas when a cluster service is present (a replayed rotated token can revoke the whole grant at vendors with reuse detection). An unreachable or 5xx token endpoint → CONNECTOR_UPSTREAM_UNAVAILABLE. invalid_grant → row reconnect_required, instance degraded "reconnect required". Selection by organizationId; none given → the only connection, else refused naming the missing organization.
Materializer (plugin.ts): a grant-bearing instance resolves no static auth; it gets the handle. With no connection it materializes degraded "not connected", never a failed boot. Guard: until S2, the built-in factories do not read the handle, so a grant-bearing instance materializes only through a provider registered as consuming it (an opt-in on registerConnectorProvider). Otherwise it is degraded naming the provider. Nothing dispatches unauthenticated.
D5 routes (packages/runtime/src/domains/automation.ts, dispatcher-plugin.ts, route-ledger.ts), each with a closed query set (refuseUnknownQueryParams) and refusal + preservation pins:
- POST /automation/connectors/:name/connection: connect / reconnect for the caller's organization. Answers the authorization URL (S256 PKCE always).
- GET /automation/connectors/oauth/callback: closed set code, state, error, error_description, error_uri, iss.
- GET / DELETE /automation/connectors/:name/connection: status for the Console, and revoke.
- The redirect URI comes from the deployment's configured base URL, never the request. state is sealed through the host ICryptoProvider and carries the verifier, the connection key, a session binding and an expiry. So nothing pending is persisted (D3's list stays exact) and the callback works on any replica. The callback refuses a session that is not the initiating one.
- Capability (D5 delegates it here): a dedicated org-scoped manage_connector_connections is the proposal (Seam: one entry in packages/spec/src/security/capabilities.ts, landing with its enforcement), rather than reusing platform-scoped manage_metadata, because Q1 A makes a connection an organization's act. The contract review can rule on this.
D6 pin: connecting writes no sys_account row and never goes through better-auth's account linking, so the grant cannot sign anyone in.
No-leak pins with ablations: sys_metadata, GET /api/v1/automation/connectors, the descriptor (degradedReason included), log lines.
Proof without a vendor: client_credentials and the authorization-code + PKCE round trip against the embedded @better-auth/oauth-provider (Q3, last bullet), through a test provider that consumes the handle.
.changeset with Clause-②: yes, Metadata-protocol: added, ADR-0143 cited. Claim amendment needed: the claim says "⛔ Nothing in packages/spec"; S1 needs the two Seam lines above.
Needs from S0: the D2.1 type and its publish refusal, the context member, the handle interface in spec.

S2 · providers slice (domain:server, new card; L), after S0 + S1

connector-mcp: the MCP authorization flow on http (protected-resource metadata, authorization-server metadata, dynamic client registration into S1's registered_client column, PKCE). Pre-registered clientId form (HubSpot) too. Notion live proof.
connector-openapi: map oauth2 securitySchemes. connector-rest: accept the variant. All three send through callWithBorrowedCredential.
D2.2 exchanges for feishu / dingtalk / wecom in the shared transport, against each vendor's documentation (D2.2 puts them there). WeCom early invalidation as the refresh-once-on-401 unit case.
Then drop S1's opt-in guard for the built-ins.
⚠️ Open point for that card, not this one: an mcp instance lists its tools at materialization, but under Q1 A connections are per organization. Which connection's token the discovery uses (any connected one, since the tool list is server-wide) should be stated in its claim.

S3 · signing (#26710, domain:server + a spec Seam), after S0

signed enters ConnectorInstanceAuthSchema with the RequestSigner seam (response verification included) and alipay-v3, aliyun-acs3-hmac-sha256, tencentcloud-tc3-hmac-sha256 with D2.3 vectors (Q4). Independent of S1, since no token is involved.

S4 · Console (domain:ui), after S1 routes (S2 for a live MCP connect)

Connect / Reconnect, connection status, degraded reasons naming the grant.

4. What the seat does next

File S0 as a domain:spec card from §3. Add Blocked-by: that card to this one (S1).
Amend this card's claim scope to S1 with the two Seam lines, or say which of them you want moved into S0.
Optionally file S2 now so the MCP-discovery point gets triaged early.

domain:server#1 · os-elon-musk · session_016WV4czVnUdQQCVKSW5J2uk

Blocked on the spec slice · 2026-10-30T13:46Z · from the card thread's slice plan 6524271601: server slice 1 reads the ADR-0143 D2.1 shape, which publish refuses today, so it cannot be built before the spec slice.

Blocked-by: #28137

pm:dispatched → pm:blocked. The claim 6524120668 stays (scope amended to S1 with two spec Seam lines); the card thread holds no slot while it waits and resumes S1 when #28137 merges. S2 (providers) and S3 (#26710, signed) are listed in the plan; S2 is filed when S1 is under way.

Navigation Menu

Repository navigation

connectors: outbound OAuth in the open tier — connection-scoped authorization-code / client-credentials / app-credential tokens, refreshed per dispatch, for the openapi, mcp and rest providers #26702

Maintainer ruling (verbatim, not translated)

Business reason

Current state (read at `71a4b4ea`)

Work (each item is a slice; the ADR comes first)

Decisions the successor ADR must put to the maintainer

Acceptance (to be pinned by the ADR)

Out of scope

Who acts

Duplicate check

Triage: first grade — `enhancement` · `security` · `priority:p1` · `domain:server` · `area:api` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-27T14:12Z

Triage: unblocked · p1 kept · `domain:server` · 2026-10-29T04:01Z

7 remaining items

Triage: unblocked · p1 · `domain:server` · `pm:queue` · 2026-10-30T12:27Z

#26702 step 1: slice plan for ADR-0143 · 2026-10-30T13:42Z

1. Measurements

2. Can server slice 1 be built and tested before D2? No.

3. Slice list, in order

4. What the seat does next

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

connectors: outbound OAuth in the open tier — connection-scoped authorization-code / client-credentials / app-credential tokens, refreshed per dispatch, for the openapi, mcp and rest providers #26702

Description

Maintainer ruling (verbatim, not translated)

Business reason

Current state (read at 71a4b4ea)

Work (each item is a slice; the ADR comes first)

Decisions the successor ADR must put to the maintainer

Acceptance (to be pinned by the ADR)

Out of scope

Who acts

Duplicate check

Activity

objectstack-fleet commented on Oct 27, 2026

Triage: first grade — enhancement · security · priority:p1 · domain:server · area:api · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-27T14:12Z

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 28, 2026

objectstack-fleet commented on Oct 28, 2026

objectstack-fleet commented on Oct 29, 2026

Triage: unblocked · p1 kept · domain:server · 2026-10-29T04:01Z

7 remaining items

objectstack-fleet commented on Oct 30, 2026

Triage: unblocked · p1 · domain:server · pm:queue · 2026-10-30T12:27Z

objectstack-fleet commented on Oct 30, 2026

objectstack-fleet commented on Oct 30, 2026

#26702 step 1: slice plan for ADR-0143 · 2026-10-30T13:42Z

1. Measurements

2. Can server slice 1 be built and tested before D2? No.

3. Slice list, in order

4. What the seat does next

objectstack-fleet commented on Oct 30, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Current state (read at `71a4b4ea`)

Triage: first grade — `enhancement` · `security` · `priority:p1` · `domain:server` · `area:api` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-27T14:12Z

Triage: unblocked · p1 kept · `domain:server` · 2026-10-29T04:01Z

Triage: unblocked · p1 · `domain:server` · `pm:queue` · 2026-10-30T12:27Z