automation: connector triggers start flows, and a connector action's `description` / `outputSchema` reach the flow designer (7 keys)

[objectstack-fleet]

Ruled: 5881831013 · letter B (connector triggers family retired now; ADR-0041 Tier 3 stands; action half per the seat) · 2026-09-29T01:26Z

Filing gate: ① a declared≠enforced family, filed as one sweep card per family under ruling A′ item ④ on #18900 (5727134555). This is triage's standing request 5857165909 on the seat post. Family connector-flow-surface, seat verdict ENFORCE.

• reach: the declared authoring door. packages/spec parses these keys and publishes them in the reference docs. The liveness ledger rows cited below record them as not enforced, and the census re-measured the reader side (§5 cross-checks, each with a lit control).
• The criterion is the maintainer's: 「每族该问的是:主流平台有没有这个能力 —— 有 ⇒ 补消费端(一次做对);没有 ⇒ 退役,而不是看仓里有没有人读」.
• The maintainer's one word, per ruling A′ ④: ENFORCE (the seat's proposal: the mainstream has it, so build the consumer once, correctly) or RETIRE (retire the keys together with their ledger rows).

Census by the domain:spec execution seat 1 (session_01Rjy9MeetSfq34PKn81CRiN, seat post #6017), 2026-09-27. Bases: objectstack a9fb83ef, re-checked against 4d7e740d, where no ledger file or cited surface moved; objectui 6fa5f64a1 (pin f8a9d0fb); cloud 96eb092. Ledger instrument: check-liveness.mts --json, whose byStatus equals the committed state-counts.md row for row. ⛔ Filed bare: routing and grading belong to triage. ⛔ Not a claim. The ranking is by value, user-visible risk × keys. This family's rank is 5 of 16. The sibling family cards filed so far are #20273, #20274, #20281 and #20282.

Capability: Connector triggers (polling / webhook) that start automations; connector action descriptions shown in the designer; typed action outputs usable downstream

key	ledger status	ledger row	what the ledger cites
connector.actions.description	dead (verified 2026-09-17)	packages/spec/liveness/connector.json:87	note: Projected onto the wire and read by nobody. engine.ts#getConnectorDescriptors copies description: a.description into the GET /api/v1/automation/connectors payload, and no consumer in either repo reads it back: objectui's three connector-descriptor con…
connector.actions.outputSchema	dead (verified 2026-09-17)	packages/spec/liveness/connector.json:100	note: The twin of inputSchema, projected the same way and consumed by nothing — which is exactly what makes this row falsifiable rather than a guess. engine.ts#getConnectorDescriptors publishes outputSchema: a.outputSchema; the census over both repos finds …
connector.triggers.key	dead (verified 2026-09-17)	packages/spec/liveness/connector.json:116	note: The whole trigger sub-surface is declared and unread, and the schema says so itself: ConnectorTriggerSchema's docblock reads '⚠️ NOT YET ENFORCED — declared but never read by the runtime (#3197). AutomationEngine.registerConnector ignores a connector's tr…
connector.triggers.label	dead (verified 2026-09-17)	packages/spec/liveness/connector.json:121	note: Dead for the one reason recorded on triggers.key — nothing reads a connector trigger.
connector.triggers.description	dead (verified 2026-09-17)	packages/spec/liveness/connector.json:126	note: Dead for the one reason recorded on triggers.key.
connector.triggers.type	dead (verified 2026-09-17)	packages/spec/liveness/connector.json:131	note: Dead for the one reason recorded on triggers.key. polling and webhook name two engines that do not exist for connectors: no polling loop reads intervalSeconds, and the webhook dispatcher is driven by sys_webhook rows materialized from the TOP-LEVE…
connector.triggers.intervalSeconds	dead (verified 2026-09-17)	packages/spec/liveness/connector.json:136	note: Dead for the one reason recorded on triggers.key. Renamed from interval by the protocol-18 conversion (#15680/#14478) so the unit lives in the key name — a rename that made the declaration honest without making it enforced.

Mainstream evidence:

• Power Automate custom connectors: polling triggers and webhook triggers (OpenAPI x-ms-trigger); action summary/description shown in the designer; response schema becomes "dynamic content" tokens.
• Salesforce Flow + External Services: OpenAPI-registered actions with typed outputs usable as Flow resources.
• ServiceNow IntegrationHub spokes: actions with typed outputs used as data pills. Spoke webhook triggers are UNVERIFIED.
• Zapier (iPaaS): polling and REST-hook triggers, the reference shape for connector triggers.

Verdict: ENFORCE — the mainstream has the capability, so build the consumer once, correctly.

Reader that must exist / disposition: objectstack packages/services/service-automation/src/engine.ts#registerConnector (walks parsed.actions only, :3698) must register triggers into the flow trigger registry with a polling loop / webhook receiver; #getConnectorDescriptors already projects description/outputSchema. objectui packages/app-shell/src/views/metadata-admin/inspectors/FlowReferenceField.tsx#connectorActionsToOptions (:342, reads key+label only) must show description, and flow output refs must be typed from outputSchema.

User-visible risk (2): The schema docblock itself says triggers are NOT YET ENFORCED (#3197), yet a descriptor that authors them parses clean. outputSchema is published on the wire and ignored.

Acceptance: Every ledger row listed leaves dead/planned/experimental for live, citing the new reader as file#symbol (and a producer where the read depends on a supplied input); pnpm check:liveness green; the family's byStatus in state-counts.md regenerated.

Lane: domain:spec parent; objectstack domain:services sub-issue (triggers, descriptors) + objectui sub-issue (designer), per the A′ seam rule

File surface: packages/spec/src/integration/connector.zod.ts:940-941 · packages/services/service-automation/src/engine.ts (registerConnector, getConnectorDescriptors, trigger registry) · objectui packages/app-shell/src/views/metadata-admin/inspectors/FlowReferenceField.tsx

Dedupe: ConnectorTrigger \| connector.{0,40}triggers?\b \| triggers\.intervalSeconds → 3 open hits. None carries a key of this family:

• fix(spec): one D3 entry per major-18 retirement family — the census and the 25 missing entries (#20201) #20255(PR) — D3 entries for ALREADY-RETIRED keys (tombstoned triggers.interval, circuitBreaker.monitoringWindow, cube sub-day granularities); does not carry any open key
• PM corpus audit (maintainer-directed): classify every instruction line — keep / duplicate / demote / delete — then rewrite and re-lock every ratchet #13597 — keyword coincidence: a package list naming connectors / triggers
• [PM seat] domain:services — 🟢 os-justin #6021 — keyword coincidence: the services seat post lists packages/connectors/* and packages/triggers/*

Dedupe: actions\.outputSchema \| actions\.description \| getConnectorDescriptors \| connectorActionsToOptions \| nodeOutputRefs → 0 open hits.

四轴:

• 实际业务需求: 「外部事件触发自动化」和「在设计器里看到动作说明、引用动作输出」是 Power Automate 连接器的基本体验。作者今天声明了触发器,流程永远不会被触发。
• 项目长远合理性: 触发器挂进现有的 flow trigger 注册表,输出类型来自已经上线的描述符投影。复用现有机制,不另起一套。一次做对:polling 与 webhook 两种触发器,同一个注册入口。
• 防 AI 写错: outputSchema 真正约束下游引用之后,AI 引用不存在的输出字段会在设计期报错,而不是运行期取到 undefined。
• 创业阶段不扩散: 7 个键,消费端都落在已存在的模块里(engine、描述符、设计器选择器),新增面小。

Blocked-by: objectstack-ai/objectui#11028

[objectstack-fleet]

Path: approvals and automation | 缺项 (no item starts a flow from a connector trigger) | P2

Triage: first grade — enhancement · priority:p3 · domain:spec · area:workflow · pm:queue. Verdict: ENFORCE, by the maintainer's criterion

Triage: the readers land in packages/services/service-automation/src/engine.ts#registerConnector (which walks parsed.actions only, :3698) and objectui's flow designer ⇒ domain:spec parent, with a domain:services sub-issue and an objectui sub-issue that the spec seat files at dispatch (ruling A′ ②). Rationale: a descriptor that authors triggers parses clean, although its own docblock says NOT YET ENFORCED (#3197), and outputSchema is published and ignored. No measured author ⇒ p3.

Triage seat (objectstack-wide, seat post #6015) · session_01W89enF2dYV7K4N2Fbfj33f · 2026-09-27T20:31Z. ⛔ Not a claim, ⛔ not a dispatch. Read: this card (no comments), the criterion on #18900 (5727134555), and the #20273 / #20274 / #20282 grades that applied it this week.

Verdict. Connector triggers and typed action outputs are mainstream: Power Automate custom-connector polling and webhook triggers with dynamic content, Salesforce Flow with External Services, and Zapier REST-hook triggers. By the criterion ⇒ ENFORCE, 「补消费端(一次做对)」. It is not a decision-box round-trip. The verdict records the direction, and the priority keeps it behind the road.

Execution notes.

1. Register triggers into the flow trigger registry, with a polling loop and a webhook receiver on the mainstream shape.
2. #getConnectorDescriptors already projects description / outputSchema. The objectui designer shows the description and offers the output fields as data tokens.
3. Each ledger row flips to live, citing its reader.

[objectstack-fleet]

Claim: PM loop round 1 · stage 1 only (measure, then report) · 2026-09-28T23:26Z
Session: session_01Sfe5YjBLwB9J3y8fvm2xq1
Account: os-justin (the seat's linked user as GET /user answers it; the card's assignee from this act)
Branch: claude/issue-20287-connector-triggers (stage 1 pushes nothing)
Worktree: objectstack-issue-20287
Domain: domain:spec
Seat: domain:spec#5 (seat post #19357)
File surface: stage 1 edits no file. It reads packages/spec/src/integration/connector.zod.ts, packages/services/service-automation/src/engine.ts (registerConnector, getConnectorDescriptors, the flow trigger registry), packages/spec/liveness/connector.json, and whatever door those readings lead to. (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus (dispatch-gates --tier at 397572ed5d: no path-derived mandate; connector.zod.ts is a clause-② SUSPECT path, so the stage-2 PR owes the at-tier review)
Clause-②: no (stage 1 changes nothing; the dev reports the stage-2 arm from the measured surface)
Thread-read: 5859576732
Serial constraints cleared: none. Read at this stamp: the file lists of the 12 open PRs touch none of connector.zod.ts, service-automation/src/engine.ts, liveness/connector.json or SYNC_ARCHITECTURE.md. #20273 (same schema file, RETIRE) closed completed on 2026-09-28. #20281 (same schema file, ENFORCE) is unclaimed.

Why this card, from the lane's open unassigned cards read at this stamp:

• P1: [epic] hotcrm ADR-0130 拆包的上游依赖集 —— 一条代码门禁(#18202) + 一次发版，其余五张是作者体验 #18215 is an epic; refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204, feat(spec,services): deployment-level state has no organization column — settings global rung, plumbing objects, the audit ledger, #12699 made total (ADR-0131 D7) #15207, feat(spec,drivers,objectql,plugin-security): organization_id NOT NULL per cleared table; one predicate for Layer 0 and every driver; both orWhereNull arms, the __global__ sentinel and the #13491 ledger retire (ADR-0131 D1/D8/D9) — protocol 18 #15212 and feat(spec,objectql,cli): the template install mode — a package copied once into the environment ledger, fully editable, refused on shared-database multi-tenant postures (ADR-0131 D6) #15213 are pm:blocked.
• P2: analytics: an authored cube's public, refreshKey, format, granularities and descriptions take effect (8 keys) #20282 stage 2 waits on spec(analytics): retire the inner name on cube measures and dimensions; the record key is the identity (2 keys) #20300 (seat 2's note 5869426939); picklist metadata kind — spec: picklist collection, Field.select({ picklist }), server-resolved options, translation face (phase 1 of objectstack#18164) #19518 is fenced by its own road-order line; spec: a shared picklist (global value set) metadata kind — option lists reused across objects and packages are TypeScript constants today #18164 is its coordination parent; [Decision] How does a filter say 「is empty」 on a multi-value field? A declared $empty operator, or reopen the empty-list refusal (ruling B on #20311, its third arm) #20399 is a Decision card; One artifact, N packages: let a release bundle carry co-owning packages so a product can be split into modules without renaming objects #14122 is tracking.
• P3: spec(integration): build the connector sync executor that syncConfig and fieldMappings declare (14 keys), once and on the mainstream shape #20281 (rank 2) asks the maintainer for one word in its own body; spec: the number-comparand refusal says "a declared number field" and "PostgreSQL with a server error" at having and the per-aggregation filter, where the column is aggregated and the engine evaluates the clause on every driver #20510 is serial after driver-sql on PostgreSQL answers 500 for a boolean or Date compared against a number field (where { amount: { $gt: true } }), while memory answers no rows and SQLite every row: the non-string half #20336 / #20351 left out #20502; i18n: the flow launcher and runner header read translation.flows.<flow>.label (1 key) #20318 waits on a contract-shape fork (seat 4's note 5880531686); studio: show the authored label / description on flows, hooks, app areas, RLS policies and the view container (7 keys) #20299's readers are objectui's; spec(ui): retire list.tabs and the view container's body name (2 keys); listViews + ViewTabBar and the row name already deliver both #20301 stage 2 waits on cloud's writer; [finding] the six ComponentPropsMap rows #20371 added cite about a hundred objectui anchors by line number alone: no quoted first line, so --verify-anchors checks none of their content #20471 and [finding] check-issue-citations reads the pre- in pre-#N (and post- in post-#N) as a repository qualifier, so a dead number in that spelling is classed cross-repo and never judged #20330 are tooling. This card is rank 5, ahead of realtime: RealtimeEventType names the emitted data.record.* / data.records.* vocabulary (open-core contract half; the transport stays out, #14646 A and #8347 甲) #20288 (rank 6).

Stage 1 asks the dev to measure these, on origin/main:

1. How a flow is started today: which trigger types the flow trigger registry holds, and the entry point a connector trigger would join.
2. Polling: whether a scheduler exists that a polling loop can ride, and where an outbound poll's credentials come from. If a trigger needs a credential or scheduling contract the spec does not declare, report it; do not invent one.
3. Webhook: whether an inbound receiver exists, and how an inbound call is authenticated. A receiver that starts flows is a new inbound surface. Read what spec(integration): retire the connector health-probe, circuit-breaker, authored status and nested webhooks keys (16), which nothing enforces #20273 retired from the connector's nested webhooks keys before relying on them.
4. actions.description / actions.outputSchema: whether any objectstack-side reader is meaningful (for example, a publish-time check of a flow's output references against outputSchema), or whether both readers are objectui's only.
5. A batch plan for stage 2: each batch's file surface, its Clause-② arm, its serial constraints, and every fork that needs the maintainer.

No commit, no PR. The only write is the report comment on this card.

[objectstack-fleet]

os-dev-report

{
  "issue": 20287,
  "stage": "1",
  "status": "needs_decision",
  "branch": null,
  "pr": null,
  "session": "session_01Sfe5YjBLwB9J3y8fvm2xq1",
  "premise_still_valid": true,
  "summary": "Measured on origin/main fb386074f5 (2 commits past the seat's 397572ed5d; git diff 397572ed5d fb386074f5 is empty over every path read here). Every factual premise on the card holds. registerConnector walks parsed.actions only (engine.ts:3740). getConnectorDescriptors projects description and outputSchema (:4019/:4021), and nothing in either repo reads them back. The seven ledger rows are dead at the lines the card cites. The description/outputSchema half can be built now as an objectui designer batch: the inputSchema row is live on an objectui-only reader, so the same kind of reader flips both rows. The trigger half cannot be built yet. The flow trigger registry holds one FlowTrigger per KIND, and the kind set is closed at four. No contract exists for a trigger handler, a poll cursor or dedup, or a flow-to-connector-trigger binding. The one inbound receiver authenticates only by a URL token plus an OPTIONAL per-flow HMAC. Accepted ADR-0041 places connector-event triggers (webhook-subscribe and poll) in Tier 3, marketplace/vertical, promotable only by its own rule. Neither the card nor triage cites that ADR. So the trigger direction is a maintainer fork (F1), and F2-F7 follow if the answer is to build.",
  "tests": "None run. Stage 1 edits nothing: no build, no test, no gate. Every reading is a git grep, sed or jq on the detached worktree at fb386074f5, a REST read of issues, PRs and objectui files, or a depth-1 objectui clone at 797a30f485 in the scratchpad.",
  "mcp_calls": "0",
  "api_writes": "1 - this comment: POST /repos/objectstack-ai/objectstack/issues/20287/comments through the fleet-write relay (post-stamped.mjs, transport dispatch)",
  "measurements": {
    "m1_how_a_flow_starts": {
      "registry": "AutomationEngine.triggers is a Map keyed by trigger TYPE and holds ONE FlowTrigger per kind (engine.ts:2395). registerTrigger fills it (engine.ts:3368) and also binds already-registered flows of that type.",
      "kinds": "Closed FlowTriggerKind = record_change | time_relative | schedule | api (spec automation/flow-trigger-kind.ts:44, FLOW_TRIGGER_KINDS :47). resolveFlowTriggerKind (:64) resolves the kind from the start node config and the flow type. The engine builds the binding per kind in resolveTriggerBinding (engine.ts:3431, exhaustive never-check at :3565) and arms it in activateFlowTrigger (engine.ts:3577) with trigger.start(binding, callback into execute). Flow type enum: autolaunched|record_change|schedule|screen|api (flow.zod.ts:1052). The start node config is an open record (flow.zod.ts:591).",
      "registered_where": "Four implementations. Method: git grep 'implements FlowTrigger' over *.ts with tests excluded; each known trigger package is hit. ApiTrigger api-trigger.ts:104 (type 'api' :105), registered at trigger-api plugin.ts:75. RecordChangeTrigger record-change-trigger.ts:200 (:201), plugin.ts:64. ScheduleTrigger schedule-trigger.ts:621 (:622), plugin.ts:105. TimeRelativeTrigger time-relative-trigger.ts:265 (:266), time-relative-plugin.ts:105. All four register on kernel:ready.",
      "manual": "Screen and autolaunched flows resolve to no kind and run through AutomationEngine.execute (engine.ts:5236) from POST /api/v1/automation/NAME/trigger (runtime/src/domains/automation.ts:440, the caller's own identity).",
      "entry_point_for_a_connector_trigger": "registerTrigger(FlowTrigger), as ONE NEW KIND. The registry holds kinds, not per-connector trigger instances, so 'register a connector's triggers into the flow trigger registry' (card, triage) means: a new FlowTriggerKind member, a resolveFlowTriggerKind branch, a resolveTriggerBinding case (the never-check forces it), one FlowTrigger for the kind, and the defineStack requires refusal plus lint validate-flow-trigger-readiness, both of which read the resolver. The connector side is missing too. registerConnector (engine.ts:3734) checks parsed.actions for handlers (:3740) and stores the whole def (:3748), so triggers stay in the def unread. handlers are ConnectorActionHandler (engine.ts:588), and ConnectorMaterialization is { def, handlers } (spec integration/connector-provider.ts:42-44). No slot for a trigger handler exists anywhere.",
      "producers_of_connector_triggers": "Zero measured. Method: git grep for intervalSeconds, type: 'polling' and type: 'webhook' over *.ts outside packages/spec, tests excluded. The only hits are driver-turso sync (a different subject) and lint-liveness-properties.ts:496 (the webhook metadata type). The token 'triggers' in packages/connectors hits only CHANGELOG.md; the same token lights up engine.ts this.triggers (control). DeclarativeConnectorEntrySchema refuses triggers on a provider-bound instance (connector.zod.ts:1238-1244). On a catalog descriptor, triggers parse and never reach the registry (header :111-121)."
    },
    "m2_polling": {
      "scheduler": "YES. IJobService (spec contracts/job-service.ts:192) takes JobSchedule type cron|interval|once with intervalMs (:34-45). service-job implements interval in interval-job-adapter.ts:67 and cron-job-adapter.ts:136. db-job-adapter.ts:251-260 routes interval through the leader-elected cron adapter and warns that every replica fires when that adapter is absent. trigger-schedule already rides it: ScheduleTriggerPlugin depends on com.objectstack.service.job (plugin.ts:51). A poll loop could be one IJobService.schedule(name, interval intervalSeconds*1000, handler).",
      "dedup": "A persisted claim ledger exists: AutomationEngine.claim(key) over sys_flow_dispatch (engine.ts:2620; FlowDispatchStore :2069). It could key per item as (flow, trigger, item id). No cursor or high-watermark store is declared anywhere.",
      "gate_and_identity": "OS_AUTOMATION_SCHEDULED_WORK_ENABLED is default OFF (packages/types/src/env.ts:174, :237-240). Its own definition covers 'everything a package ships that fires on a clock rather than on a caller' (:181). The engine gates only schedule and time_relative, though (isTimeTriggeredKind engine.ts:2264, applied :3606), and states that a new kind is OUTSIDE the switch until someone decides (:2255). The time kinds also require a declared acting organization (FlowTriggerBinding.organization, engine.ts:528-547).",
      "credentials_after_20273": "connector.zod.ts declares two auth keys. First, authentication (:911): the runtime shape with inline secrets (oauth2|api-key|basic|bearer|none, shared/connector-auth.zod.ts:79), supplied by a plugin at registerConnector; the authoring door refuses any non-none value (:1205-1212). Second, auth (:953): ConnectorInstanceAuthSchema, i.e. none|bearer|api-key|basic with credentialRef (connector-auth.zod.ts:118-163). It requires provider and is resolved at materialization by CredentialResolver (service-automation plugin.ts:224; the open-tier env default is at :233) onto ConnectorProviderContext.auth (connector-provider.ts:74). OAuth2 is intentionally absent from instance auth (enterprise tier, ADR-0015; connector-auth.zod.ts:96, :113). #20273 removed health, status and the nested webhooks; nothing about sessions or token refresh remains. retryConfig and requestTimeoutMs are live. So a poll handler that a plugin or a provider builds can close over the credential it already holds. Only static credentials exist in the open tier.",
      "stop_valve": "Four contracts a polling trigger needs are NOT declared by the spec, so they are reported as forks and not designed here: (1) how a flow selects a connector trigger (F2); (2) the poll handler contract (F3); (3) cursor/dedup (F4); (4) the switch and organization policy for the new kind (F5). A fifth gap is OAuth2 in the open tier (F7). ConnectorTriggerSchema carries key|label|description|type|intervalSeconds only (connector.zod.ts:848-866)."
    },
    "m3_webhook": {
      "inbound_receivers": "Exactly one receiver starts a flow from an external call: trigger-api's POST /api/v1/automation/hooks/:flowName/:hookId (HOOKS_PATH trigger-api plugin.ts:25). It is mounted at :83 on the RAW Hono app, outside dispatcher routes; its route ledger (trigger-api-route-ledger.ts) records it as server-only. Method: enumerated every rawApp POST|PUT|ALL mount in packages/**/*.ts, tests excluded. The other mounts are cloud-connection, marketplace and plugin-auth. /api/v1/approvals/act acts on an existing approval by one-time token and starts no flow. /api/v1/webhooks/redeliver (webhook-outbox-plugin.ts:396) re-queues OUTBOUND deliveries. Only four FlowTrigger implementations exist (m1).",
      "authentication_measured": "(1) A hookId path token, compared in constant time. An unknown flow and a wrong hookId both answer 404 (api-trigger.ts:184). hookId defaults to the literal 'default' when the flow sets none (:123). (2) An OPTIONAL HMAC-SHA256 over the raw body in x-objectstack-signature, spelled 'sha256=' plus hex (verifySignature :72-76, checked :187). It is checked ONLY when the flow's start node declares secret. Without one, unsigned posts are accepted and the only signal is a warning at arm time (:151-155). (3) No session or credential check. The only kernel server.use middleware found is the optional inbound rate limiter (runtime/src/dispatcher-plugin.ts:870). The raw-app use() middlewares are server timing (hono-plugin.ts:317), CORS (:417), the hostname guard (cli serve.ts:5541) and the auth-path IP gate (auth-plugin.ts:2169); none authenticates this path. (4) No timestamp or replay window is covered by the signature. x-idempotency-key is sender-supplied and outside the signature (:208), and ingestion is at-least-once through the queue (ADR-0041 section 5). (5) The HMAC secret is a LITERAL read from the flow start node's config.secret (api-trigger.ts:124), so it is stored in flow metadata with no credentialRef indirection. hookId and secret are declared by no spec schema: the start node config is an open record (flow.zod.ts:591), and hookId has 0 hits in spec schema code. (6) Upstream signature schemes are not verifiable by verifySignature (Stripe-Signature and Slack signing both carry a timestamp; GitHub uses X-Hub-Signature-256). This is read from the header name and the format the code checks.",
      "outbound_is_distinct": "The top-level webhooks: collection goes through bootstrapDeclaredWebhooks (plugin-webhooks bootstrap-declared-webhooks.ts:166) into sys_webhook rows, and the AutoEnqueuer signs each delivery. The signing secret has been persisted ENCRYPTED since #7799 (webhook-secret.ts header). That is outbound delivery and receives nothing.",
      "what_20273_retired": "The connector's nested webhooks array is now a retiredKey tombstone (WEBHOOKS_RETIRED connector.zod.ts:736, carrier :981). WebhookConfig, WebhookEvent and WebhookSignatureAlgorithm left whole. They were outbound-shaped and never delivered; their prescription points at the top-level webhooks: collection. Nothing inbound survives on a connector. An inbound WebhookReceiverSchema was declared once and removed as never consumed (automation/webhook.zod.ts:105-106). The only declared inbound connector shape is ConnectorTrigger type 'webhook', which has no secret, verification or subscription field."
    },
    "m4_actions_description_outputSchema": {
      "objectstack_readers": "Only the projection: engine.ts#getConnectorDescriptors (:4006; description :4019, outputSchema :4021), served unchanged by GET /api/v1/automation/connectors (runtime/src/domains/automation.ts:2180-2187). Method: git grep outputSchema over *.ts, *.tsx, *.mts, *.mjs and *.js, excluding packages/spec, tests and dist, gives 11 files. The rest are producers (connector-openapi :216, connector-slack :114/:130/:144, connector-rest :152, connector-mcp :58/:260, showcase connectors :176), a doc comment on flow nodes.outputSchema (lint-liveness-properties.ts:405), four generated form-label translations (platform-objects metadata-forms :2450), and the projection itself. getConnectorDescriptors has two callers: the runtime route, and plugin.ts:1370, which reads names only.",
      "objectui_readers": "objectui main 797a30f485; FlowReferenceField.tsx, flow-scope.ts and connector-input-fields.ts are byte-identical at the pin dd3f7e1be3. Three fetchers call /automation/connectors (FlowReferenceField.tsx:434 and :472, connector-input-fields.ts:258). They read connectorsToOptions name/label/origin, connectorActionsToOptions key/label (:342), and connectorActionInputSchema key/inputSchema (:117, the lit control). Neither description nor outputSchema is read. nodeOutputRefs (flow-scope.ts:178) offers NO connector_action output: 0 connector_action hits in that file, while the approval branch there is the control. Yet the engine writes each output key as a variable named NODEID.KEY (engine.ts:10159). The other objectui outputSchema hits are AI-tool metadata (ToolPreview.tsx, default-schemas.ts:150).",
      "is_an_objectstack_check_possible": "Yes, at two doors; neither is needed to flip the ledger. (a) Runtime: AutomationEngine.registerFlow (engine.ts:4160) already runs validateNodeConfigKeys (:9266), validateDecisionModes (:9329) and validateFlowExpressions (:9454). The post-seal soft-fail precedent is sealNodeTypeVocabulary (:9125, called from service-automation plugin.ts:1156), where unknown node types WARN. It sees the live registry, plugin and materialized connectors included. A degraded instance exposes no actions, and outputSchema is JSON Schema by convention only (an open record), so the check could only ever advise. (b) Build time: the @objectstack/lint reference-integrity suite (reference-integrity-suite.ts:119 into validateFlowTemplatePaths :507, run by os validate/lint/compile) today leaves every non-get_record outputVariable and node-id root unjudged. Its only oracle is the stack, and a stack carries action outputSchema only on catalog descriptors: provider-bound entries refuse actions (connector.zod.ts:1231), and plugin connectors are not in the stack. The ledger precedent: connector.actions.inputSchema is live on an objectui-only reader (connector.json:92-99), so the designer reader alone meets the card's acceptance."
    },
    "m5_liveness_rows": {
      "method": "jq over props.actions.children and props.triggers.children of packages/spec/liveness/connector.json at fb386074f5.",
      "rows": [
        "connector.actions.description :87 dead verifiedAt 2026-09-17",
        "connector.actions.outputSchema :100 dead verifiedAt 2026-09-17",
        "connector.triggers.key :116 dead verifiedAt 2026-09-17",
        "connector.triggers.label :121 dead verifiedAt 2026-09-17",
        "connector.triggers.description :126 dead verifiedAt 2026-09-17",
        "connector.triggers.type :131 dead verifiedAt 2026-09-17",
        "connector.triggers.intervalSeconds :136 dead verifiedAt 2026-09-17"
      ],
      "counts": "state-counts.md:68 connector: live 29, exp 0, elsewhere 0, dead 30, planned 1, classified 60. The hand-written README.md:942 partitions the 30 dead by name, including actions.description/.outputSchema and triggers (6).",
      "drift": "The triggers.type note (:131-135) still says 'see the webhooks subtree below'. Since #20273, webhooks is one leaf tombstone row (:231). This is prose only; any batch that edits the triggers rows carries the fix."
    }
  },
  "stage2_plan": [
    {
      "batch": "B1 objectui sub-issue: the flow designer reads actions[].description and actions[].outputSchema",
      "buildable_without_maintainer": true,
      "file_surface": "objectui packages/app-shell/src/views/metadata-admin/inspectors/: FlowReferenceField.tsx (connectorActionsToOptions :342 carries description into the option); connector-input-fields.ts (an outputSchema finder beside connectorActionInputSchema :99-117); flow-scope.ts (nodeOutputRefs :178 gains a connector_action branch that emits NODEID.PROP per top-level outputSchema property; it is synchronous over node config today, so the fetched descriptor must be passed in); FlowNodeInspector.tsx (wiring); i18n.ts only if new strings; tests beside each file.",
      "counting_pins": "objectui i18n parity gates if strings are added (NOT MEASURED which gate). No objectstack pin moves in B1.",
      "clause2": "no. It reads two fields already on the wire; no spec, accept-set or public-surface change.",
      "serial_constraints": "None measured: none of objectui's 6 open PRs (11025, 11023, 10930, 10777, 10278, 5400) touches these files.",
      "forks": "none"
    },
    {
      "batch": "B2 objectstack: flip connector.actions.description and .outputSchema to live",
      "buildable_without_maintainer": true,
      "depends_on": "B1 merged and carried by .objectui-sha, so the shipped console holds the reader before the ledger says live.",
      "file_surface": ".objectui-sha bump plus the manifest regeneration (node scripts/gen-sdui-manifest-node.mjs, AGENTS.md Frontend section), when this PR carries the bump; packages/spec/liveness/connector.json :87 and :100 (status live, evidenceScope cross-repo, evidence citing the objectui symbols at the new sha, producer citing connector-openapi/slack/rest/mcp, same two-door caveat as the actions.key row); .changeset (patch: @objectstack/spec publishes liveness/ per its files[]).",
      "counting_pins": "packages/spec/liveness/state-counts.md connector row, regenerated with gen:liveness-counts (29/0/0/30/1/60 becomes 31/0/0/28/1/60); packages/spec/liveness/README.md:942, the hand-written dead partition ('sums to 30' and the '29/1/30 split').",
      "clause2": "no. Ledger and prose only.",
      "serial_constraints": "#20458 edits liveness/README.md in a hunk at :940-946, adjacent to :942, so a text conflict is certain if both are open; land after it or resolve by hand. #20281 (unclaimed, pm:queue) owns the same connector.json and state-counts connector row (state-counts carries merge=os-regen). Other seats may bump the objectui pin (NOT MEASURED).",
      "forks": "none"
    },
    {
      "batch": "B3-retire (only if F1 = B): retire the connector triggers subtree",
      "buildable_without_maintainer": false,
      "file_surface": "The #20273 / PR #20350 kit. connector.zod.ts: a triggers carrier tombstone on ConnectorBaseSchema (both published carriers); the DeclarativeConnectorEntrySchema triggers refusal (:1238-1244) deleted; ConnectorTriggerSchema (:848) and ConnectorTrigger to retired defs; header prose. migrations retired-keys entries plus the regenerated registry. conversions: a D2 strip plus a D3 entry, and the triggers[].interval to intervalSeconds rename in connector-health-and-trigger-durations-unit-in-key (conversions/registry.ts:9536) absorbed as monitoringWindow was. retiredAfter stamps, required since #20390. liveness/connector.json: the 6 triggers child rows collapse to one leaf tombstone row. connector-resilience-keys-retirement.test.ts fixtures that author triggers (:293, :301). .changeset with FROM/TO and the ADR-0087 marker. The prescription names what delivers today: an api flow (trigger-api HMAC) for inbound, and a schedule flow whose first node is a connector_action read for polling.",
      "counting_pins": "state-counts.md connector row (dead 30 to 25, classified 60 to 55); README.md:942 partition; authorable-surface/integration.json (7 lines name triggers or ConnectorTrigger; authorable-surface.base.json only via gen:authorable-surface-base); api-surface, export-origins and declaration-map (ConnectorTrigger exports); type-alias-convention.pin.test.ts (Iso_integration_connector__ConnectorTriggerSchema :941, count minus 1); content/docs/references/integration/connector.mdx (generated); spec-changes.json; protocol-upgrade-guide.",
      "clause2": "no (narrowing). An authored triggers key becomes a tsc and parse error: breaking, with a migration.",
      "serial_constraints": "migrations/registry.ts is touched by #20460, #20458 and #20504; conversions/registry.ts by #20458; liveness/README.md by #20458 (:940-946); api-surface/root.json and export-origins/root.json by #20460. #20281 shares connector.zod.ts and connector.json. Use os-regen-merge.sh for every main merge.",
      "forks": "F1"
    },
    {
      "batch": "B3-enforce (only if F1 = A): three sequential PRs. B3a is the contract; B3b polling and B3c webhook are runtime.",
      "buildable_without_maintainer": false,
      "file_surface": "B3a spec: flow-trigger-kind.ts (a new kind in FlowTriggerKind and FLOW_TRIGGER_KINDS, a resolver branch); flow.zod.ts:1052 (type enum) or a DECLARED start-node binding block; connector.zod.ts ConnectorTriggerSchema binding fields; connector-provider.ts (materialization gains trigger handlers); connector-descriptor.ts (the descriptor projects triggers for the designer); contracts/automation-service.ts; stack.zod.ts requires refusal; lint validate-flow-trigger-readiness. B3b: engine.ts registerConnector refuses a declared trigger with no handler; resolveTriggerBinding case; isTimeTriggeredKind per F5. A new trigger package (ADR-0041 naming: trigger-connector-event) rides IJobService interval plus the claim ledger. serve.ts trigger wiring (:1916-1937) and platform-capabilities.ts:189. B3c: the receiver route plus its route ledger and conformance test (trigger-api-route-ledger precedent); verify and subscribe handlers; queue ingestion (ADR-0041 section 5); new error codes in error-code-ledger.",
      "counting_pins": "Liveness: 5 triggers rows go live and every new authorable key gets a new row; state-counts.md; README.md:942. authorable-surface integration.json and automation.json; api-surface, export-origins and declaration-map; spec-changes.json; type-alias-convention pin count for new exported schemas. Generated connector.mdx and the flow reference page; platform-objects metadata-forms.generated.ts x4. FLOW_TRIGGER_KINDS pins: flow-trigger-kind.test.ts, flow-trigger-kind-shared-resolver.test.ts, stack-requires.test.ts. check:error-code-casing; docs/qa/platform-checklist items. A new ADR (Tier H, governed) superseding or amending ADR-0041's Tier 3 placement.",
      "clause2": "yes (widening) for each of B3a/B3b/B3c: new kind, new keys, new exports, a new public route.",
      "serial_constraints": "The same registry and projection collisions as B3-retire, plus #20460 on stack.zod.ts. B3a before B3b and B3c. The ADR PR is Tier H and lands only by the maintainer's hand.",
      "forks": "F1, F2, F3, F4, F5, F6, F7"
    },
    {
      "batch": "B4 (optional): an objectstack-side advisory check of NODEID.KEY references against the action's outputSchema",
      "buildable_without_maintainer": false,
      "file_surface": "Door (a): engine.ts registerFlow (:4160) plus the post-seal pass (sealNodeTypeVocabulary :9125). Door (b): lint validate-flow-template-paths.ts (:507) through reference-integrity-suite.ts:119.",
      "counting_pins": "A new diagnostic code in lint (door b) or a new warn text (door a); no ledger count moves, because B2 already flips the row.",
      "clause2": "no if it only warns; no (narrowing) if it errors (breaking).",
      "serial_constraints": "None among open PRs (engine.ts and packages/lint are untouched by all 10).",
      "forks": "F8"
    }
  ],
  "forks": [
    {
      "id": "F1",
      "question": "Connector triggers: build them in the open core now (the card's and triage's ENFORCE), or keep ADR-0041's placement?",
      "evidence": "ADR-0041 (Accepted), docs/adr/0041-flow-trigger-family.md:141-153: 'Tier 3 - marketplace / vertical (future, possibly commercial)': a trigger-connector-event family, 'one package per ecosystem ... supports both webhook-subscribe and poll modes'. Promotion rule: 'a Tier-2/3 trigger moves up when (a) two independent real projects request it, or (b) it unblocks a Tier-1 acceptance criterion. Nothing is built speculatively.' ADR-0097:80 leaves triggers out of scope. The card, both thread comments, connector.zod.ts and connector.json have 0 hits for ADR-0041. Ruling A-prime item 4 on #18900 asks the maintainer for one word per family; triage recorded the direction without that round-trip. AGENTS.md Prime Directive 13: an accepted ADR binds until a superseding ADR says otherwise. Today the flow-level capability is delivered by composition: an api flow (inbound, HMAC) and a schedule flow with a connector_action (poll). Zero producers declare a connector trigger (m1).",
      "options": [
        "A: supersede or amend ADR-0041 (a new ADR, Tier H) and build B3-enforce; F2-F7 then need answers.",
        "B: keep ADR-0041 and retire the triggers subtree (B3-retire), with a prescription to the api and schedule+connector_action composition; a future trigger-connector-event package re-enters by ADR-0041's promotion rule.",
        "C: keep the declaration and re-class the rows as planned against ADR-0041 Tier 3. This keeps a declared-but-inert key and conflicts with Prime Directive 10."
      ],
      "recommendation": "B. The dispatch did not carry the four-axis framework, so these are the card's own four axes. Real business need: 'an external event starts a flow' and 'poll on an interval' are both deliverable today by composition, and no shipped connector declares a trigger. Long-term soundness: packaging is already decided (Tier 3, per ecosystem); building it into service-automation reverses an accepted ADR without a new one. Preventing AI mistakes: today a descriptor's triggers parse and evaporate; B makes that loud now, while A leaves it inert until B3c lands. Startup-stage restraint: B is one batch on the #20273 pattern; A is a new ADR plus three PRs and five new contracts. Choose A if the maintainer wants connector-owned triggers in the open core now; then F2-F7 apply."
    },
    {
      "id": "F2",
      "question": "(Only if F1 = A.) How does a flow name a connector trigger?",
      "evidence": "The kind set is closed at 4 (flow-trigger-kind.ts:44). The flow type enum has 5 members (flow.zod.ts:1052). The start node config is an open record (:591), and api's hookId and secret are undeclared keys inside it.",
      "options": [
        "A: a new FlowTriggerKind 'connector', flow type 'connector', and a DECLARED strict start-node binding { connectorId, triggerKey }.",
        "B: reuse the api/schedule kinds with a declared connectorTrigger sub-block; the kind follows ConnectorTrigger.type.",
        "C: undeclared start-node config keys, as api does today (against Prime Directive 12)."
      ],
      "recommendation": "A: one kind, one binding shape, and the engine's never-check forces the runtime case."
    },
    {
      "id": "F3",
      "question": "(Only if F1 = A.) What runtime contract carries a trigger's implementation?",
      "evidence": "registerConnector handlers and ConnectorMaterialization carry action handlers only (engine.ts:588, :3734-3748; connector-provider.ts:42-44). No provider derives triggers, although the refusal at connector.zod.ts:1242 says one does.",
      "options": [
        "A: add trigger handlers (poll: context and cursor in, items and cursor out; webhook: verify and parse, plus optional subscribe/unsubscribe) to registerConnector and the materialization; registerConnector refuses a declared trigger without one, mirroring the action rule.",
        "B: A for plugins only; keep the provider-bound refusal and correct its message.",
        "C: provider derivation (OpenAPI 3.1 webhooks/callbacks or x-ms-trigger; MCP has no trigger notion)."
      ],
      "recommendation": "B first, which is A scoped to plugins; C deferred."
    },
    {
      "id": "F4",
      "question": "(Only if F1 = A, polling.) Where does poll state live?",
      "evidence": "The claim ledger exists (engine.ts:2620). No cursor store is declared.",
      "options": [
        "A: dedup by item id on the claim ledger, plus a handler-returned cursor persisted in a new sys table.",
        "B: dedup only (the Zapier shape: return recent items, dedup by id).",
        "C: the handler owns its own state."
      ],
      "recommendation": "B: no new table; the Zapier reference shape."
    },
    {
      "id": "F5",
      "question": "(Only if F1 = A, polling.) Does a polling trigger fall under OS_AUTOMATION_SCHEDULED_WORK_ENABLED and the acting-organization rule?",
      "evidence": "The switch is default OFF and defined as covering all clock-fired package work (env.ts:181, :237-240). The engine gates two kinds only and leaves new kinds outside until decided (engine.ts:2255, :2264).",
      "options": [
        "A: yes to both, the same as schedule/time_relative.",
        "B: outside the switch, running as system.",
        "C: under the switch, with the organization taken from the connector instance."
      ],
      "recommendation": "A, by env.ts's own definition; the refusal and audit machinery already exists."
    },
    {
      "id": "F6",
      "question": "(Only if F1 = A, webhook.) How is an inbound connector call authenticated, and where does the secret live?",
      "evidence": "m3: the only receiver arms WITHOUT a secret (warn only). The secret is a literal in flow metadata, there is no replay window, and only the x-objectstack-signature format is verifiable.",
      "options": [
        "A: a dedicated receiver that REFUSES to arm without a connector-supplied verify; the secret comes through credentialRef and CredentialResolver; subscribe/unsubscribe lifecycle; queue ingestion.",
        "B: compile to an api hook with a mandatory HMAC in our header format (upstreams that cannot sign it are excluded).",
        "C: manual URL paste into the upstream, with no subscribe."
      ],
      "recommendation": "A. A receiver that can arm unsigned is exactly the new inbound attack surface this card would add."
    },
    {
      "id": "F7",
      "question": "(Only if F1 = A.) Credentials for an outbound poll.",
      "evidence": "The open tier has static credentials only (none/bearer/api-key/basic via credentialRef). OAuth2 lifecycle is the enterprise tier (ADR-0015; connector-auth.zod.ts:96, :113). Most SaaS trigger APIs need OAuth2.",
      "options": [
        "A: accept static credentials only in the open core.",
        "B: make connector triggers an enterprise (cloud) capability, matching ADR-0041's 'possibly commercial'.",
        "C: bring OAuth2 refresh into the open tier (moves the ADR-0015 line)."
      ],
      "recommendation": "A if F1 = A. B is F1 = B by another route."
    },
    {
      "id": "F8",
      "question": "Should objectstack also check a flow's NODEID.KEY references against the action's outputSchema (B4)?",
      "evidence": "m4: both doors exist. Neither is required for the ledger flip (the inputSchema precedent). Door (b) has no oracle for plugin or provider actions; door (a) can only advise.",
      "options": [
        "A: no; the designer typing (B1) is the reader.",
        "B: an advisory warn at registerFlow after the vocabulary seal.",
        "C: a lint reference-integrity rule over stack-declared descriptors."
      ],
      "recommendation": "A. Revisit B only after B1 shows authors reaching for untyped outputs."
    }
  ],
  "open_questions": [
    {
      "question": "The dispatch did not carry the four-axis framework; F1's recommendation uses the four axes written on the card itself.",
      "options": [
        "A: accept this",
        "B: the seat re-analyses F1 with its own copy of the framework"
      ],
      "recommendation": "B, if the seat's copy differs from the card's axes."
    }
  ],
  "out_of_scope_findings": [
    "noted, not filed · connector.zod.ts:1242: the refusal tells an author that the provider derives triggers from the upstream (ADR-0097 section 5). No provider derives any: 0 *.ts hits for triggers in packages/connectors; ConnectorMaterialization is def plus handlers (connector-provider.ts:42-44); ADR-0097:79 says actions are derived and :80 leaves triggers out of scope. The refusal is right; its reason is wrong. · class: none of a/b/c by itself · carrier: this card's stage-2 trigger batch (B3-retire deletes the rule, B3-enforce rewrites it)",
    "noted, not filed · the trigger-api HMAC secret is a literal read from the flow start node's config.secret (api-trigger.ts:124). The showcase says 'real deployments inject this from configuration' (examples/app-showcase/src/automation/flows/index.ts:1581), but no injection seam exists: the api binding passes the raw start-node config (engine.ts:3551). Outbound sys_webhook secrets, by contrast, are encrypted (#7799). · class: candidate (a), NOT MEASURED: no read-path probe (whether GET /api/v1/meta/flow/NAME serves config.secret to a non-admin persona) · dedupe words: trigger-api secret cleartext, flow start node config.secret, x-objectstack-signature, hookId default · carrier: none unless F6 = A"
  ],
  "not_measured": [
    "cloud repo: GET /repos/objectstack-ai/cloud answered 403 to this session, so whether cloud ships a trigger-connector-event package, OAuth2 connection lifecycle or any connector trigger is unknown.",
    "check-liveness.mts --json was not run (no install in the measuring worktree). Statuses were read from connector.json with jq; counts come from the committed, generated state-counts.md.",
    "No live HTTP probe of POST /api/v1/automation/hooks/... (unsigned acceptance, absence of a session requirement). Read from source, the route ledger and middleware registrations only.",
    "Whether a flow's start node config.secret is readable through the metadata read API by a non-admin persona.",
    "Whether check-liveness existence-checks a cross-repo (objectui) evidence pointer.",
    "Which objectui gates count what B1 adds (i18n parity and the like).",
    "Whether the maintainer gave this family its one word under ruling A-prime item 4 anywhere outside this card's thread.",
    "scripts/adr-anchors entries for ADR-0041 were not read."
  ]
}

Measured at 2026-09-28T23:45Z on origin/main fb38607 (stage 1: measure and report only; no commit, no push, no PR).

---

Generated by Claude Code

[objectstack-fleet]

裁定与请示:第一阶段测量之后(连接器触发器的方向,需维护者一个字母)

domain:spec seat 5(session_01Sfe5YjBLwB9J3y8fvm2xq1),2026-09-28T23:55Z。复核对象:dev 报告 5880862266。

一句话: 连接器上现在可以写"触发器"(例如"Slack 来一条消息就启动流程"),但写了什么都不会发生。要不要现在就在开源核心里把它做出来?A 现在做;B 先把这个不生效的写法拆掉,等有真实客户要再按插件做。本席推荐 B。

复核(本席在 fb386074f5 上重读)

• registerConnector 只遍历 parsed.actions(engine.ts:3740);getConnectorDescriptors 投影了 description 与 outputSchema(:4019、:4021)。
• 流程触发种类闭合为四种(packages/spec/src/automation/flow-trigger-kind.ts:44)。
• 台账七行均为 dead(connector.json:87/100/116/121/126/131/136)。
• objectui 797a30f485:connectorActionsToOptions(FlowReferenceField.tsx:342)不读 description;nodeOutputRefs(flow-scope.ts:178)没有 connector_action 分支;inspectors/ 目录里 outputSchema 0 命中。
• ADR-0041 的原文见下方 Governing text。
• 未复核:报告对 raw-app 中间件的枚举;cloud 仓(报告自述读取 403)。

本席裁定(不上交)

1. 动作这一半(description / outputSchema)按 triage 的 ENFORCE 做,不等触发器的决定。
   • B1:objectui 子卡 flow designer: show a connector action's description in the picker, and offer its outputSchema properties as downstream references (the objectui half of objectstack#20287) objectui#11028 已开(不认领、不打标;本席不执行 objectui 工作)。
   • B2:B1 落地、objectstack 的 .objectui-sha 带上之后,本卡把这两行翻为 live。liveness/README.md:942 与在飞 PR feat(spec)!: retire the inner name on cube measures and dimensions — the record key is the member's name (#20300) #20458 改的 :940-946 相邻,B2 排在它之后。
   • Clause-②:B1、B2 都是 no(B1 只读线上已有的两个字段;B2 只改台账和说明文字)。
2. F8(objectstack 侧再加一道输出引用检查):不做。 inputSchema 那一行就是只靠设计器读者翻成 live 的先例;新增门禁默认否。
3. 报告的出界发现 2 已开成 trigger-api arms a flow's inbound hook without a secret and accepts unsigned posts; ADR-0041's trigger-api acceptance criteria name a per-flow secret and HMAC verification #20529:没配密钥时,trigger-api 也接受未签名的请求,而 ADR-0041 的验收条写的是每个流程一个密钥,加签名校验。不认领、不打标,交 triage。出界发现 1(connector.zod.ts:1242 的拒收理由不对)随触发器那一批处理。

请示:连接器触发器(报告 F1)

Governing text(两条方向相反):

• ADR-0041(Accepted),docs/adr/0041-flow-trigger-family.md:141-153:连接器事件触发器(webhook 订阅与轮询)列在 "Tier 3 — marketplace / vertical (future, possibly commercial)";晋级规则是 "two independent real projects request it, or (b) it unblocks a Tier-1 acceptance criterion. Nothing is built speculatively."
• [Decision] Route declared≠enforced work by the SEAM, not the layer — a Seam: line on filing, vertical dispatch by default in the spec lane, automatic parent + sub-issues for spec↔objectui seams, Journey as a filter, bulk retirement per spec family, Console Pin Gate back to required (the maintainer's 「同意」 on the five-line batch, 2026-09-18) #18900 裁决 A′ ④(5727134555):「主流平台有没有这个能力 —— 有 ⇒ 补消费端(一次做对);没有 ⇒ 退役」,并且每一族由维护者答一个字。
• AGENTS.md:244(Prime Directive 13):已接受的 ADR 在被新 ADR 取代之前一直有效。
• triage 的判定 5859576732 按 A′ ④ 记为 ENFORCE,但没有引用 ADR-0041(卡正文与该评论里 0041 均 0 命中)。两条规则在这一族上方向相反,另外新开一个对外入站入口属于安全边界,所以交您定。

前提(每条带复查命令):

• ADR-0041 把这族放在第三档:sed -n '141,153p' docs/adr/0041-flow-trigger-family.md
• 本仓没有作者声明连接器触发器:git grep -n -E "^\s*triggers\s*:" -- '*.ts' '*.tsx' '*.json' ':!packages/spec/**' ':!*.test.ts' ':!**/dist/**' → 15 处命中,逐条读过,没有一处是连接器触发器:webhook 的 triggers(示例、plugin-webhooks、两个测试夹具)、serve.ts:1911 的插件分组、技能表单 triggers 的四份翻译,以及 plugin-webhooks 对象字段的四份翻译。范围只到本仓。
• 连接器注册只读动作:sed -n '3734,3748p' packages/services/service-automation/src/engine.ts
• ADR-0097 也把 triggers 放在范围之外:sed -n '80p' docs/adr/0097-*.md

选项与代价:

选项	做什么	客户看得到的后果
A 现在做	先写一份新 ADR 改掉 ADR-0041 的档位(受管面,由您亲手合),再建触发器;报告列出的 F2–F7 共六个具体问题要您逐个定(流程怎么指定触发器、触发实现的接口、轮询状态放哪、定时开关、入站鉴权与密钥、轮询凭据)	连接器能直接"被事件叫醒";平台多一个对外入站入口
B 先拆掉	保留 ADR-0041;把连接器上的 triggers 整族退役(破坏性,但本仓零作者)。写了会在解析时被明确拒绝,并指路:外部事件用 api 流程(它的签名目前可选,见 #20529),定时拉取用 schedule 流程调连接器动作。将来按 ADR-0041 的晋级规则,以独立触发器包的形式回来	今天写了不生效的东西,变成写了就报错并告诉你怎么做

业务上等于什么:

• A = 现在就把"连接器自带触发"做成开源核心功能,像 Power Automate 自定义连接器那样。
• B = 这项能力按原计划放进"生态插件,可能收费"那一档,有真实客户要了再做;先把现在这个假按钮拆掉。

四轴(业务立场):

• 实际业务需求: 本仓零作者(见前提)。"外部事件启动流程"和"定时拉取"今天都能靠 api 流程、schedule 流程加连接器动作组合出来(报告 m2、m3 的读法)。
• 项目长远合理性: 两年后的样子按主流平台看:Power Automate 自定义连接器的 x-ms-trigger、Zapier 的 REST hook 与轮询,都是连接器自带触发器,并带订阅/退订、签名校验和去重。现在这个声明形状(key / label / description / type / intervalSeconds)没有这些字段,所以选 A 也得重新设计,不是把现有键接上就行。归属 ADR-0041 已经定了:按生态分包,放第三档。
• 防 AI 写错: 今天 AI 写了 triggers 能通过解析,运行时悄悄什么都不做,出错时没人看到。B 让它在解析时立刻报错并指路。A 要等整族建完才不再静默。
• 创业阶段不扩散: 零拉动,默认不扩散。B 去掉一个永久义务;A 新增一族契约和一个入站安全面。

os-decision-facets

• ① 长远合理性:B 缩小契约(删掉一族没人读的声明);A 扩大(新触发种类、新接口、新入口)。
• ② 业务拉动:本仓零作者;零拉动默认移除。
• ③ 防 AI 犯错:B 在解析时响亮拒绝;A 在建完之前一直静默。
• ④ 不扩散:B 去掉一个永久义务;A 增加一族。
• Prior rulings read: 0041, trigger-connector-event, ConnectorTrigger, [Decision] Route declared≠enforced work by the SEAM, not the layer — a Seam: line on filing, vertical dispatch by default in the spec lane, automatic parent + sub-issues for spec↔objectui seams, Journey as a filter, bulk retirement per spec family, Console Pin Gate back to required (the maintainer's 「同意」 on the five-line batch, 2026-09-18) #18900 A′ ④ → ADR-0041 Tier 3(:141-153)、ADR-0097 §5(:80)、裁决 5727134555;thread: 2(5859576732、5880862266)。

推荐 B。 只看①选 B:现有形状不是两年后的形状,而终态的归属 ADR-0041 已经定了。②③④ 是否翻转:否,三轴同向。
回退 A: 如果您要把连接器触发器放进开源核心,本席先起草一份取代 ADR-0041 相关段落的新 ADR(草稿 PR,由您合),再把 F2–F7 一次呈给您。
置信缺口: 看不到 cloud 仓和客户那边是否已经有两个项目在要;也看不到您对开源和收费边界的打算(ADR-0041 写的是"可能收费")。

裁后执行:

• 选 B:本卡开一个退役 PR。triggers 整族转为退役键墓碑,指向上面两种组合;台账里触发器那五行随之退役;connector.zod.ts:1242 的拒收理由一并改正。带 BREAKING 横幅(Clause-②: no (narrowing)),走在档审查。
• 选 A:按上面的回退执行。

卡片状态: pm:dispatched → needs-user-decision(一笔替换)。认领人保留:动作那一半(B2)仍由本席接着做,等 objectstack-ai/objectui#11028 落地。

---

Generated by Claude Code

[objectstack-fleet]

Ruling: batch #242 item 1 · letter B · maintainer 「同意」 2026-09-29T01:22Z

Director seat (objectstack#12708, summon #30 续 2, session_01AsCNgFBs8HCjwhyHQsFbx3). Provenance: maintainer, live PM chat with the director seat, 2026-09-29, replying 「同意」 to the presented batches #240, #241 and #242 together — this item recommendation B, fallback A, the full four-axis body in chat on 2026-09-29.

Ruled: B. The connector triggers family (ConnectorSchema.triggers → ConnectorTriggerSchema: key / label / description / type / intervalSeconds) is RETIRED now under ADR-0049 enforce-or-remove; ADR-0041 stays as it is (trigger-connector-event at Tier 3, the two-real-projects promotion rule). The retirement is a retiredKey() tombstone on ConnectorSchema.triggers whose prescription names the two shapes that work today: an external event starts an api flow that calls the connector's action; a scheduled pull is a schedule flow that calls the connector's action. A (build connector triggers into the open-source core now, behind a new ADR re-tiering ADR-0041, then the six design questions F2–F7) is not taken. When the promotion rule is met, the family returns as its own trigger package in the mainstream shape — subscribe / unsubscribe lifecycle, signature verification, a dedupe cursor — which the present five keys cannot carry.

The action half of this family is unchanged by this ruling: the seat's own disposition stands (objectui#11028 gives description / outputSchema their designer readers; the two ledger rows flip live after the pin bump; no objectstack output-reference gate). #20529 (the trigger-api inbound hook armed without a secret) is triage's.

Readings that decided it:

• Long-term: ADR-0041 is Accepted and holds until superseded (Prime Directive 13); 「一次做对」 means the mainstream shape re-declared on promotion, not five placeholder keys wired up; ADR-0097 §5 already keeps triggers out of scope; registerConnector walks parsed.actions only (engine.ts:3740) and the flow trigger kinds are a closed set of four.
• Real use: zero in-repo connector-trigger authors (the one triggers: hit outside spec is a webhook-object fixture); external events and scheduled pulls compose from api / schedule flows plus connector actions today.
• AI-safety: today an authored triggers parses clean and does nothing; the tombstone refuses at parse and names the two working shapes; A stays silent until the whole family exists.
• Startup scope: B removes a permanent obligation; A adds a contract family and an inbound security surface.

Execution parameters (ruled in the same stroke):

• domain:spec seat 5 keeps the card and opens the retirement PR per spec-property-retirement: the tombstone on ConnectorSchema.triggers with the prescription above; ADR-0087 D2 conversion (protocol 18, retired from the load path, lossless — nothing ever read the key) stripping triggers from stored connector rows, plus its D3 semantic entry; RETIRED_KEYS_BY_MAJOR[18] per the registry's convention; the five trigger rows in packages/spec/liveness/connector.json (:116 – :136) retired; the refusal reason at connector.zod.ts:1242 corrected; docs and skill mentions swept; Clause-②: no (narrowing); @objectstack/spec minor with the BREAKING banner; at-tier contract review.
• ADR-0041 untouched; no new ADR.
• Confidence gaps recorded: cloud / customer demand for connector triggers (the promotion rule's two projects) is not visible from here; the open-source vs. commercial boundary is ADR-0041's 「possibly commercial」 as written.

State: needs-user-decision → pm:dispatched (the seat's live claim; assignee os-justin stays); the Ruled line goes on the body in the same stroke.