cloud: the connector-app shelf pipeline — ingest the open-edition connector-app packages built in objectstack, generate their marketplace listings with provenance, and run the normalization script from an objectstack checkout #28278

epic:#27293#1 · sunhaolin · session_017xRBcVBKAFk1ntXSjvPt7U

Filing gate: ④ coordination child of #27293 (E4), the cloud-repository half the ruling of #27302 assigns. Ruling-ref: 6486157794 (letter A, phased): "Ingestion and listing generation stay with the cloud repository as #27293 assigns them … plus the pipeline card in the cloud repository." Filed here as the repo:cloud carrier because this seat's session cannot reach objectstack-ai/cloud; the cloud seat moves it or files its own and closes this one as moved. ⛔ Not a claim.

What the cloud side receives from objectstack

• Open-edition connector-app packages, one per vendor, built and validated in this repository: batch 1 connector apps, E4 batch 1 (static key): GitHub over its remote MCP server and Stripe read over its OpenAPI document, as open-edition metadata packages validated by this repository's CI #28276 (GitHub over MCP, Stripe read over OpenAPI), batch 2 connector apps, E4 batch 2 (OAuth): DocuSign as the first declarative verification of the outbound OAuth path, an open-edition metadata package #28277 (DocuSign, after connectors: outbound OAuth in the open tier — connection-scoped authorization-code / client-credentials / app-credential tokens, refreshed per dispatch, for the openapi, mcp and rest providers #26702).
• The offline normalizer packages/connectors/connector-openapi/scripts/normalize-openapi.mts (PR feat(connector-openapi): an offline normalize-openapi script — Swagger 2.0 to 3.0, YAML to JSON, $ref bundled and inlined, absolute server, sha256 and an include list #27436, merged): a repository script, not shipped in the npm package (files is dist, README.md, CHANGELOG.md), so the pipeline runs it from an objectstack checkout (pnpm install, then pnpm --filter @objectstack/connector-openapi normalize-openapi). Whether the pipeline can do that is the first thing to measure here; if it cannot, say so on [Epic] Marketplace and connector auto-shelf — E1 platform prerequisites (openapi/mcp hardening, outbound OAuth, request signing), E2 administrator credential hand-off, E3 author recipes and handbook, E4 the first shelf of official connector apps #27293 and the epic PM brings the "publish it as a bin" option to the maintainer (that widens a published surface).
• The listing file and README conventions: content/docs/deployment/marketplace-handbook.mdx.

What is asked

Ingest the packages, publish their listings through the marketplace review flow, and carry provenance (upstream, commit, sha256 the normalizer prints) on each listing — #27293's Done-when.

Reader

The cloud seat (repo:cloud), first touch in the cloud repository. Not needed before #28276 has a merged package.

Dedupe

The 500 most recent issues and PRs in this repository (read 2026-10-31T02:05Z), titles grepped for connector app|shelf|docusign|stripe|github mcp|E4: 0 hits; control connector 47. The cloud repository was not searched (not reachable from this session).