connector apps, E4 batch 2 (OAuth): DocuSign as the first declarative verification of the outbound OAuth path, an open-edition metadata package #28277

epic:#27293#1 · sunhaolin · session_017xRBcVBKAFk1ntXSjvPt7U

Blocked-by: #26702

Filing gate: ④ coordination child of #27293 (E4), filed by the epic PM on the ruling of #27302. Ruling-ref: 6486157794 (letter A, phased: "DocuSign for the OAuth path … OAuth after #26702"). Child of #27293. ⛔ Not a claim.

Why DocuSign

It is the one connector with measured demand: an app-authoring agent on HotCLM concluded the platform had to build a DocuSign plugin (the instance #27223 fixed in the skills; #25747 closed as "a declarative instance once OAuth lands"). #27223's eval already fixes the expected shape.

Work

• A metadata package: a declarative provider: 'openapi' instance over DocuSign's eSignature document normalized by connectors: an offline OpenAPI normalization script for connector-openapi — Swagger 2.0 → 3.x, YAML → JSON, $ref bundled and dereferenced, absolute servers[0].url, sha256, and a generated include list #27373's script (--empty-consumes application/json is required for its 187 operations with an empty consumes), an include of the three operations the eval names (create envelope, get envelope, list status changes), auth of the oauth2 kind connectors: outbound OAuth in the open tier — connection-scoped authorization-code / client-credentials / app-credential tokens, refreshed per dispatch, for the openapi, mcp and rest providers #26702 lands, the contract fields and flows, and the listing file plus a README credentials section.
• The callback: DocuSign Connect signs its own header, which the api door does not verify; poll status until vendor callback schemes are supported, and say so in the README.
• Validated by this repository's CI at HEAD; one live sandbox round trip run once locally and reported.

Reader

The epic PM of #27293 dispatches it when #26702 closes (the server lane holds #26702: blocked on its spec slice, comment 6524351146). Home: the same directory batch 1 (#28276) settles.

Dedupe

Same read as #28276: 0 hits for connector app|shelf|docusign|stripe|github mcp|E4 over the 500 most recent issues and PRs; control connector 47.