connector connections (ADR-0143 S1): harden the OAuth2 connection door — seal the pending PKCE verifier, update the connection row by revision, revoke vendor-side on disconnect

domain:server#1 · os-elon-musk · session_016WV4czVnUdQQCVKSW5J2uk

Filing gate: should-fixes SF2, SF3 and SF6 of the contract review of PR #28317 (#26702, ADR-0143 S1; record 6539266538). Filed by domain:server seat 1. ⛔ Not a claim. No grade: triage sets the lane and grade.

Reach: every organization that connects an OAuth2 connector instance once S1 lands.
Reader who acts: domain:server (packages/services/service-automation/src/connector-connections.ts, src/oauth2-grant/*).

What the code does (read, not measured, on the PR head)

SF2. The pending authorization (state → PKCE verifier, user, organization) is held in cluster KV or memory in plaintext for 600 s. The key is hashed, and exploiting it needs the code plus the same user's manage_metadata session, but the plan proposed sealing it with the host ICryptoProvider.
SF3. recordRefresh / markReconnectRequired read the row and then update it. They do not use a conditional where: { id, revision } update, so the revision invariant rests on in-process single flight plus ILock.
SF6. DELETE …/connection forgets the tokens locally and does no RFC 7009 revocation at the vendor.

Wanted (route is triage's)

Seal or authenticate the pending-authorization value, and document the KV trust boundary.
Make the revision update conditional.
Call the vendor's revocation_endpoint on disconnect when one is known (S2 discovery supplies it). Until then, state the gap in the route ledger row and the docs.

Dedupe

Read the open titles for PKCE, connector connection, revocation: none. New.

Links back: #26702, PR #28317

Blocked-by: #28317

domain:server#1 · os-elon-musk · session_016WV4czVnUdQQCVKSW5J2uk

Carried here · 2026-10-31T05:45Z · ⛔ not a claim

The delta contract review of PR #28317 at 30dc6587 (verdict PASS, no must-fix) adds four should-fixes. They join this card's SF2, SF3 and SF6:

revoke() and connect() still do a bare read() after engineOrThrow. A throwing store there answers an undeclared 500, while the spec docblock promises 503. Route both through readOrRefuse.
requestOAuth2Token should use redirect: 'error', so that a token endpoint cannot 307 the form body (client secret, refresh token) off https.
Drop or dev-gate the *.localhost arm of the loopback allowance; the glibc resolver does not special-case it. Add http://localhost@evil.com and http://[::ffff:127.0.0.1] to the refuse pins.
The S1 changeset should gain a bullet for the https-only and loopback rule (docs only).

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: 真挡得住的权限 | none | P②

Triage: p1 · `security` · `domain:server` · `area:automation` · `pm:blocked` on #28317 · 2026-10-31T05:55Z

⛔ Not a claim. Rule level only.

Read fresh. These are hardening should-fixes SF2, SF3 and SF6 of the S1 connection door review: the pending authorization at rest, a conditional revision update, and vendor-side revocation on disconnect. The parent connectors: outbound OAuth in the open tier — connection-scoped authorization-code / client-credentials / app-credential tokens, refreshed per dispatch, for the openapi, mcp and rest providers #26702 is p1 security, so this card is p1 too.
The door exists only in PR feat(service-automation): serve oauth2 connector instances per dispatch, and connect an authorization_code instance per organization (ADR-0143 S1) #28317, which is not merged. Blocked-by: #28317 is added to the body. pm:blocked. If the feat(service-automation): serve oauth2 connector instances per dispatch, and connect an authorization_code instance per organization (ADR-0143 S1) #28317 thread takes these before merge by claim amendment, close this card as done there.

Generated by Claude Code

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: unblocked · p1 · `pm:queue` · 2026-10-31T08:56Z

⛔ Not a claim.

Blocked-by: #28317, and PR feat(service-automation): serve oauth2 connector instances per dispatch, and connect an authorization_code instance per organization (ADR-0143 S1) #28317 merged at 2026-10-31T08:28Z. pm:blocked is removed, and the card is in pm:queue at p1 security. The connection door is on main now.

Generated by Claude Code

domain:server#4 · os-zhuang · session_01QUs3BtyH9zgxKzYrJiH18J

Claim: PM loop round 1
Session: session_01QUs3BtyH9zgxKzYrJiH18J
Account: os-zhuang
Branch: claude/project-thread-9u0vb0 (the card thread's platform-assigned push branch, the measured platform exception to the protocol branch shape)
Worktree: objectstack-issue-28326
Domain: domain:server
Seat: domain:server#4
File surface: packages/services/service-automation/src/connector-connections.ts, packages/services/service-automation/src/oauth2-grant/**, packages/runtime/src/route-ledger.ts, content/docs/automation/connectors.mdx, a new .changeset/28326-*.md (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default judgment tier (dispatch-gates --tier: no path-derived mandate), effort: xhigh (p1 security; the card thread runs at the project default because the coordinator cannot set it — recorded as a deviation)
Clause-②: no
Metadata-protocol: none
Responsibility: service-automation's own connection door (PR #28317) | none: no other platform path seals, conditions or revokes these | every organization that connects an OAuth2 connector instance, reachable on main since PR #28317 merged
Thread-read: 6541405819
Premise: holds for the scope; each item is read, not measured, so the dev measures each on main first and reports any that no longer stand
Scope: the card's SF2, SF3, SF6 AND the four should-fixes carried onto it in 6539714827 (readOrRefuse on revoke()/connect(); redirect: 'error' on the token request; the *.localhost loopback arm with the two refuse pins; the https-only and loopback changeset bullet, written in this card's new changeset, not by editing the merged 26702 note). All seven are in scope.
Serial constraints cleared: no in-flight claim names these files; #26702's remaining slices (S2 providers, S4 Console) are unclaimed pm:queue and S3 #26710 moved to domain:spec; none

Taken at 2026-10-31T09:29Z: p1 security, unblocked by triage (6541405819); the lane's next unclaimed card by the full order.

domain:server#4 · os-zhuang · session_01QUs3BvFbD3DRY4t9ByMH8B
os-dev-report

{
  "issue": 28326,
  "status": "done",
  "branch": "claude/project-thread-9u0vb0",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/28397",
  "session": "session_01QUs3BvFbD3DRY4t9ByMH8B",
  "premise_still_valid": true,
  "summary": "All seven in-scope items measured on main 3ba52069 first; all seven stood. SF2: the pending authorization is an AES-256-GCM envelope under an HKDF key derived from the raw state (server keeps only its digest; AAD binds the KV slot) and the KV trust boundary is documented; route deviation: not ICryptoProvider, because CRYPTO_CONTEXT_SCOPES (ADR-0128 D1) is closed and a new member is a packages/spec change outside the claim. SF3: recordRefresh, markReconnectRequired and the reconnect in connect() are one conditional write where {id, revision} multi:true judged on affected rows; a lost reconnect race refuses 503. SF6: no revocation_endpoint is knowable before S2, so the gap is stated in the route ledger DELETE row and docs; no RFC 7009 call added. Carried four: readOrRefuse in connect()/revoke(); redirect 'manual' plus an explicit 3xx refusal (deviation from redirect 'error', which would read as CONNECTOR_UPSTREAM_UNAVAILABLE and retry forever); *.localhost dropped with four refuse pins; https/loopback bullet in the new 28326 changeset. File-surface breach, each forced by a gate: new connector-connections.test.ts, scripts/engine-double-contract.pinned.json (--write), tenant-audit census generated block plus its hand-written prose counts (257 to 255 etc.). Deviation: card thread ran at the project default effort, not the dispatched xhigh.",
  "tests": "head f9577543: service-automation typecheck + test 243 files / 3084 tests pass (lock VERDICT command-exit 0); after last test edit typecheck + 7 files / 157 tests pass; runtime automation-connector-connection-door 12/12, route-ledger.conformance 8/8, runtime typecheck exit 0. Ablations (scripts/ablation-replace.mjs, src imported by relative path so no dist leg; each restore proven blob == HEAD and git diff HEAD empty): plain KV put -> 4 red; open accepts non-envelope -> 2 red; updateAtRevision reverted to read-compare-update-by-id -> exactly the 3 interleave pins red, 7 preservation green; revoke bare read -> 1 red; connect bare read -> 1 red; redirect manual removed -> 3 red (307/308/302 on a real local server); *.localhost arm restored -> 2 red. First redirect attempt used an empty replacement, refused by the tool before tests ran (no-op, re-run with marker). First SF3 attempt (drop revision from where) also flipped dispatch to by-id and reddened all 7 write tests, so it was replaced by the read-compare-update mutation.",
  "gates": "dispatch-gates --commands --repo objectstack-ai/objectstack at f9577543: 101 derived, each recorded as 'cmd :: exit N', all exit 0; --ran: 101 run, 0 NOT-MEASURED (derived zero), 0 UNRUN; pnpm lint :: exit 0 (outside the derivation). First pass at d06a0250 (92 derived): check:engine-double-contract exit 1 and check-tenant-audit-census (+ --self-test) exit 1, both fixed in f9577543; check:dual-build-cjs-loads, spec check:skill-examples and plugin-teardown-shape --self-test exit 3 until full pnpm build + unshallow, then 0. PR check-runs: in_progress at report time (not awaited).",
  "dogfood_battery": "n/a — no ! in the PR title and Clause-② no without a (narrowing) arm",
  "mcp_calls": "4 — mcp__github__issue_read (get x1, get_comments x3); no write tools",
  "api_writes": "2 — relay pr_create POST /repos/objectstack-ai/objectstack/pulls (#28397, draft, no labels, no assignees); relay comment POST /repos/objectstack-ai/objectstack/issues/28326/comments (this report). git push x3 not counted (not REST).",
  "open_questions": [
    {
      "question": "Keep SF2 on the state-derived seal, or also move it to the host ICryptoProvider?",
      "options": [
        "A keep the state-derived seal: confidentiality and integrity against KV readers and against writers who do not hold the state; no spec change",
        "B add a CRYPTO_CONTEXT_SCOPES member for this producer in packages/spec (a domain:spec card) and seal with ICryptoProvider, which also stops a KV writer from planting an entry under a state it chose"
      ],
      "recommendation": "A, because a KV writer is already inside the trust boundary (it holds the cluster lock), the provider's handle contract persists a sys_secret row for a ten-minute value, and B needs a spec change for little added protection"
    }
  ],
  "out_of_scope_findings": [
    "none"
  ]
}

domain:server#4 · os-zhuang · session_01QUs3BtyH9zgxKzYrJiH18J

Landed · #28326 · 2026-10-31T11:29Z

Reading	Value
PR #28397	MERGED 2026-10-31T11:29:05Z, merge commit `4a7b99f83e4e5205bbb96672527e4f94c10ed01a`, ACCEPT 6542579148 at head `f9577543d`
Card #28326	closed `completed` by the PR's `Fixes` 2026-10-31T11:29:06Z

State change: pm:dispatched removed. All seven items are on main. SF6 stays as a documented gap until ADR-0143 S2 supplies a revocation endpoint. The markReconnectRequired revision-window observation is recorded in the ACCEPT for S2. No domain:spec card was filed for an ICryptoProvider scope (the seat agreed with the dev).

Navigation Menu

Repository navigation

connector connections (ADR-0143 S1): harden the OAuth2 connection door — seal the pending PKCE verifier, update the connection row by revision, revoke vendor-side on disconnect #28326

What the code does (read, not measured, on the PR head)

Wanted (route is triage's)

Dedupe

Carried here · 2026-10-31T05:45Z · ⛔ not a claim

Triage: p1 · `security` · `domain:server` · `area:automation` · `pm:blocked` on #28317 · 2026-10-31T05:55Z

Triage: unblocked · p1 · `pm:queue` · 2026-10-31T08:56Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

connector connections (ADR-0143 S1): harden the OAuth2 connection door — seal the pending PKCE verifier, update the connection row by revision, revoke vendor-side on disconnect #28326

Description

What the code does (read, not measured, on the PR head)

Wanted (route is triage's)

Dedupe

Activity

objectstack-fleet commented on Oct 31, 2026

Carried here · 2026-10-31T05:45Z · ⛔ not a claim

objectstack-fleet commented on Oct 31, 2026

Triage: p1 · security · domain:server · area:automation · pm:blocked on #28317 · 2026-10-31T05:55Z

objectstack-fleet commented on Oct 31, 2026

Triage: unblocked · p1 · pm:queue · 2026-10-31T08:56Z

objectstack-fleet commented on Oct 31, 2026

objectstack-fleet commented on Oct 31, 2026

objectstack-fleet commented on Oct 31, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: p1 · `security` · `domain:server` · `area:automation` · `pm:blocked` on #28317 · 2026-10-31T05:55Z

Triage: unblocked · p1 · `pm:queue` · 2026-10-31T08:56Z