[pareilly]

What

The dtwo-gateway-config skill gets guidance for arming human-gated clearing on a gateway that authenticates against the customer's own IdP:

• Okta clearing app: a Native OIDC app with an Okta-generated client ID (not a Client ID Metadata Document), included in the custom authorization server's access policy, alongside the apps the MCP clients sign in with.
• Redirect URI: <gateway origin>/session-control/clear/callback, or the session_control.redirect_uri value, and when that override is required.
• Intent capture: intent clears need gateway.intent.enabled: true; without it set_intent stores nothing.
• Identity claim: the gateway detects Entra ID and Okta from the issuer host. For an Okta custom domain or a sovereign-cloud Entra ID issuer, set SESSION_SUBJECT_PROVIDER in gateway.advanced.

The vendored schema-reference.json is re-copied from the product's schema generator, picking up the updated session_control.client_id guidance. The digest is regenerated and the pinned artifact hash bumped. Only that one rationale string changed, so no safe-default seed moved.

The plugin version goes to 1.3.5 in all three manifests.

Merge timing

This describes gateway behaviour in the next gateway release. Keep it as a draft until that release is out.

Checks

• node scripts/generate-schema-digest.mjs --check passes.
• skill-harness: pnpm test (183 pass), biome:check and typecheck are clean.
• node scripts/build-openai-plugin.mjs --check passes.

[pareilly]

Ready for review, but shouldn't merge yet. This needs to wait until after the production deploy that includes the updated gateway version, since the guidance describes behaviour that ships in that release.

[oschaaf]

Approving, but please don't merge until the gateway release that carries this behaviour is in production. The body says to keep this as a draft, but it isn't marked as one, and skill content reaches users as soon as it merges.

Checked:

• All three plugin.json manifests are at 1.3.5, with no 1.3.4 left anywhere. marketplace.json is untouched.
• The vendored schema-reference.json is byte-identical to the product's regenerated copy. The pinned hashes in schemaArtifact.ts and validatorBundle.ts match their files. The bundle diff comes only from the embedded client_id rationale and an adjacent comment, so there is no behaviour change.
• generate-schema-digest --check and build-openai-plugin --check pass, and CI is green.

Should-fix

• SKILL.md ~415, the Okta bullet: besides including the app in the authorization server's access policy, the policy rule must allow the Authorization Code grant and the openid and email scopes. Otherwise authorize fails. The redirect URI bullet is correct as written.

Nits

• SKILL.md ~418-419, "anything else fails the deploy": that's only true once the gateway doing the validation runs a build that knows the setting. Older builds ignore it. Suggest "is rejected by a gateway build that supports the setting".
• If the product schema text changes before merge, schema-reference.json, the digest hash, both pinned constants and the bundle need re-vendoring together.

[oschaaf]

Round 2 at bfdba85: approval stands. Leaving schema-reference.json and schemaArtifact.ts alone is correct, because the client_id rationale is unchanged and the vendored schema is still byte-identical to the product's. Only the bundle moved, since it embeds the reworded comment, and its hash matches both the pin and the product's bundle hash. generate-schema-digest --check and build-openai-plugin --check pass, skill-harness is 183/183, and the manifests are still at 1.3.5 in lockstep.

As before, please hold the merge until the gateway release is in production. If the product schema text changes again, re-vendor all of it together.