security: a dedicated org-scoped manage_connector_connections capability for connecting OAuth2 connector instances (before ADR-0143 S4's Console flow)

domain:server#1 · os-elon-musk · session_016WV4czVnUdQQCVKSW5J2uk

Filing gate: should-fix SF4 of the contract review of PR #28317 (#26702, ADR-0143 S1; record 6539266538). Filed by domain:server seat 1. ⛔ Not a claim. No grade: triage sets the lane and grade.

Reach: every organization administrator who connects, reconnects or revokes an OAuth2 connector instance, once ADR-0143 S4 ships the Console flow.
Reader who acts: domain:server, with domain:spec for packages/spec/src/security/capabilities.ts.

What the code does (read, not measured, on the PR head)

S1 gates the connection door (status, begin connect, callback, revoke) on manage_metadata. That is the same privilege class as the #27237 credential door, and the review accepted it as a narrowing for S1. But manage_metadata is declared scope: 'platform', while connecting a vendor account is an organization-scoped act. The plan's manage_connector_connections capability (ADR-0143 D5 delegates it to the server slice) was left unused.

Wanted (route is triage's)

Add an org-scoped manage_connector_connections capability with its default grants, eval fixture and Setup widget, and move the four door members onto it, before S4 ships the Console flow.

Dedupe

Read the open titles for manage_connector_connections and connector connection capability: none. New.

Links back: #26702, PR #28317

Blocked-by: #28317

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: 真挡得住的权限 | none | P②

Triage: p1 · `security` · `domain:server` · `area:access` · `pm:blocked` on #28317 · 2026-10-31T05:55Z

⛔ Not a claim. Rule level only.

Read fresh. The S1 connection door is gated on a platform-scoped capability, while connecting a vendor account is an organization act. ADR-0143 D5 already delegates an org-scoped manage_connector_connections capability to the server slice, so no new ruling is needed.
A new capability in packages/spec/src/security/capabilities.ts is a protocol addition. That keeps it p1, with Clause-②: yes and a contract review owed. One PR, with a one-PR exception for the spec capability declaration. It must land before S4 ships the Console flow.
Blocked-by: #28317 is added to the body. pm:blocked.

Generated by Claude Code

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: unblocked · p1 · `pm:queue` · 2026-10-31T08:56Z

⛔ Not a claim.

Blocked-by: #28317, and PR feat(service-automation): serve oauth2 connector instances per dispatch, and connect an authorization_code instance per organization (ADR-0143 S1) #28317 merged at 2026-10-31T08:28Z. pm:blocked is removed, and the card is in pm:queue at p1 security. It must land before S4.

Generated by Claude Code

domain:server#1 · os-tesla · session_01L9qibz3ZUbZ8Qcn1rDw9yc

Claim: PM loop round 1 · card thread · 2026-10-31T09:57Z
Session: session_01L9qibz3ZUbZ8Qcn1rDw9yc (the seat); the card thread is session_01L9qibwTBxFYpcsutpHMRHe
Account: os-tesla (the seat's linked user; the card's assignee)
Branch: claude/project-thread-6ytsf3 (the card thread's harness-pinned branch; it names no issue, so this claim is the identity record)
Worktree: the card thread's own container checkout
Domain: domain:server
Seat: domain:server#1
Ruling-ref: triage 6539801921: ADR-0143 D5 delegates an org-scoped manage_connector_connections capability to the server slice; one PR with a cross-domain exception for the one spec capability declaration; lands before S4.
File surface: packages/spec/src/security/capabilities.ts (one entry, the granted exception), the S1 connection door handlers and route-ledger rows in packages/runtime, default grant sets, eval fixture, Setup widget registration, tests, changeset. ⛔ No provider or connector-credential-source edit (#26702 S2 is in flight there).
Container & model: M, effort high, mode:thread, model: opus
Clause-②: yes (expected: a new capability is a protocol addition; contract review owed)
Metadata-protocol: measured and declared by the dev
Thread-read: 6541409507
Premise: holds (read at origin/main 3ba520691: no manage_connector_connections in capabilities.ts; #28317 merged 08:28Z)
Serial constraints cleared: #26702 S2 (this seat, same round) owns the providers and the credential source; the door and the capability are disjoint from it
Resume-from: none — fresh from origin/main 3ba520691
Order: /mnt/project-files/server-seat-1/r2026-10-31/dispatch-28327.md (project file, not public)

State: pm:queue → pm:dispatched, assigned to os-tesla, recorded by this claim.

domain:server#1 · os-tesla · session_01L9qibwTBxFYpcsutpHMRHe
os-dev-report

{
 "issue": 28327,
 "status": "done",
 "branch": "claude/project-thread-6ytsf3",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/28400",
 "session": "session_01L9qibwTBxFYpcsutpHMRHe",
 "premise_still_valid": true,
 "summary": "PLATFORM_CAPABILITIES gains manage_connector_connections (scope org); ADMIN_FULL_ACCESS_CAPABILITIES carries it and no other shipped set does. The runtime connection door (GET/POST/DELETE /automation/connectors/:name/connection and GET /automation/connectors/oauth/callback) now asks only that capability, fail-closed, isSystem bypassing; route-ledger rows, connectors.mdx, the Setup capability picker and ten locale packs follow. Organization administrators are NOT granted it by default (widening = human floor); that is the open question below.",
 "tests": "at 7354e08f4: runtime door+packages-capability-gate 2 files 101 passed; spec platform-admin-capabilities + src/security 16 files 403 passed; plugin-security test 238 files 5125 passed/45 skipped; runtime test 491 files 7981 passed/19 skipped; runtime+spec typecheck exit 0 (lock VERDICT command-exit 0); ui CapabilityMultiSelectField + locale parity 4 files 68 passed. At merged head 3979c8fbb: door 22, spec 403, five plugin-security files 92, ui 68, all passed; spec check:generated exit 0. Ablations via ablation-replace.mjs (src imported by relative path, no dist hop), each restored blob==HEAD and git diff HEAD empty: (1) gate also admits manage_metadata -> door 4 failed/18 passed (the four manage_metadata-alone pins); (2) gate removed -> 13 failed/9 passed; (3) organization_admin set carries the capability -> plugin-security 4 failed/28 passed (holders pin + three TENANT_ADMIN envelope goldens).",
 "gates": "dispatch-gates --commands at 7354e08f4: 113 derived; --ran: 111 run exit 0, 2 NOT-MEASURED (exit 3 prerequisite: check:dual-build-cjs-loads needs full build, check:i18n needs built CLI closure), 0 UNRUN. First-run exit 3/1 on check-plugin-teardown-shape --self-test (shallow fixture), check:skill-examples and ui scripts vitest (client/client-react dist missing) re-run exit 0 after clearing. Lint: root eslint --no-inline-config on touched non-ui files exit 0; ui eslint on touched ui files exit 0 (3 pre-existing warnings). CI check-runs: in_progress at report time.",
 "line_budget": "25 files, +173 / -28 vs origin/main (well under 3000)",
 "files_changed": 25,
 "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
 "deviations": [
  "ui/ files (Setup capability picker + ten locale packs) and content/docs/automation/connectors.mdx are outside packages/: the spec-parity and locale-parity pins require the ui labels in the same PR, and the doc named manage_metadata for the connect calls, which this diff makes false.",
  "Merge commit 3979c8fbb (origin/main ac09e7b85, no overlapping file) carries git's default message without the trailer pair."
 ],
 "mcp_calls": "4 — mcp__github__issue_read x4 (get, get_comments x3); 0 writes",
 "api_writes": "2 — fleet-write relay pr_create (#28400); post-stamped comment on #28327 (this report)",
 "open_questions": [
  {
   "question": "Should organization administrators (organization_admin / organization_admin_no_bypass) hold manage_connector_connections by default, so S4's Console Connect works for an org owner without a separate grant?",
   "options": [
    "A: no default grant now; org admins get it by explicit grant (this PR). Widen later by ruling.",
    "B: grant it to both org-admin sets in this PR (a widening of the access boundary; human floor)."
   ],
   "recommendation": "A in this PR, with the B ruling taken before S4 ships: ADR-0143 Q1 says Connect is organization-level, so B is the likely end state, but it widens every org owner and the lane floor reserves that to the maintainer."
  }
 ],
 "out_of_scope_findings": []
}

domain:server#1 · os-tesla · session_01L9qibz3ZUbZ8Qcn1rDw9yc

Landing record · #28327 · PR #28400

domain:server seat 1 · session_01L9qibz3ZUbZ8Qcn1rDw9yc · 2026-10-31T12:22Z

Reading	Probe	Result
Merged	`GET pulls/28400`	merged, `9eaa2093`
Ancestry	`git merge-base --is-ancestor 9eaa2093 origin/main`	yes
Content	`git grep -l manage_connector_connections origin/main -- packages`	spec capability, runtime connection door + door test, route ledger, plugin-security grant tables

Landed: connector connections are now gated by an org-scoped manage_connector_connections capability. The card closed via Fixes.
Owed before S4 (human ruling, not this card): whether organization_admin holds manage_connector_connections by default. The seat recommends no for now. Tesla rules.

Release: claim 6541956120 (session_01L9qibz3ZUbZ8Qcn1rDw9yc, branch claude/project-thread-6ytsf3) · landed, card closed.

State: pm:dispatched removed, assignee cleared.
Resume-from: none (the branch merged; nothing unpushed).

domain:server#1 · os-tesla · session_01L9qibz3ZUbZ8Qcn1rDw9yc

Ruled: B, whether organization_admin holds manage_connector_connections by default (ADR-0143 D5; PR #28400 landed as A, with no default grant) · 2026-10-31T15:12Z

Maintainer, verbatim, in the project thread at 2026-10-31T15:10Z: 「同意」. The answer was to the decisions list decisions/2026-10-31-director-rulings.md, whose item 6 recommends B ("开一张跟进卡，在 S4 Console Connect 之前默认授予 organization_admin 与 organization_admin_no_bypass"). So it is B.

B: a follow-up card grants the capability by default to organization_admin and to its derived organization_admin_no_bypass before ADR-0143 S4 (the Console Connect flow). ADR-0143 D5 records the choice.
Not chosen: A, keeping no default grant. Under A an organization admin cannot connect a connector until someone grants it separately.

This card stays closed: PR #28400 delivered what the card asked for. The seat files the follow-up card and links it here.

Navigation Menu

Repository navigation

security: a dedicated org-scoped manage_connector_connections capability for connecting OAuth2 connector instances (before ADR-0143 S4's Console flow) #28327

What the code does (read, not measured, on the PR head)

Wanted (route is triage's)

Dedupe

Triage: p1 · `security` · `domain:server` · `area:access` · `pm:blocked` on #28317 · 2026-10-31T05:55Z

Triage: unblocked · p1 · `pm:queue` · 2026-10-31T08:56Z

Landing record · #28327 · PR #28400

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

security: a dedicated org-scoped manage_connector_connections capability for connecting OAuth2 connector instances (before ADR-0143 S4's Console flow) #28327

Description

What the code does (read, not measured, on the PR head)

Wanted (route is triage's)

Dedupe

Activity

objectstack-fleet commented on Oct 31, 2026

Triage: p1 · security · domain:server · area:access · pm:blocked on #28317 · 2026-10-31T05:55Z

objectstack-fleet commented on Oct 31, 2026

Triage: unblocked · p1 · pm:queue · 2026-10-31T08:56Z

objectstack-fleet commented on Oct 31, 2026

objectstack-fleet commented on Oct 31, 2026

objectstack-fleet commented on Oct 31, 2026

Landing record · #28327 · PR #28400

objectstack-fleet commented on Oct 31, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: p1 · `security` · `domain:server` · `area:access` · `pm:blocked` on #28317 · 2026-10-31T05:55Z

Triage: unblocked · p1 · `pm:queue` · 2026-10-31T08:56Z