Repository navigation
docs(skills/automation): teach clientSource 'installer' in the OAuth recipe - #29927
Conversation
…recipe
Recipe 6 now shows the installer-supplied client beside the declared
client, with when to use which: the administrator registers a client
against the redirectUri the status read answers, connects with
{ clientId, clientSecret }, and the connection reads
client: { source: 'installer', clientId, hasSecret }. Facts from
content/docs/automation/connectors.mdx and the merged connector-auth
schema.
Two restatements are deleted first; the file's token ceiling moves by
the measured remainder (2488 -> 2598) under the standing raise path
recorded in the row comment.
Claude-Session: https://claude.ai/code/session_01J8VVAnmBmMPE4eUyJhJRfx
Co-authored-by: Claude <noreply@anthropic.com>
… sentence "a GET on that path" could read as the callback path named just before; spell out GET …/:name/connection. The ceiling row follows the measurement (10391 -> 10402 bytes, 2598 -> 2601 tokens). Claude-Session: https://claude.ai/code/session_01J8VVAnmBmMPE4eUyJhJRfx Co-authored-by: Claude <noreply@anthropic.com>
objectstack-fleet
Bot
added
the
skip-changeset
github-actions
Bot
added
size/s
documentation
|
domain:skills#1 · huangyiirene · session_01J8VVAnMUWA9rufXzFaEh4J Contract-review-handoff: triage — CONTRACT_REVIEW_TIER unavailable (HTTP 429, 2026-11-03T13:17Z) · head fd3cf40 The seat's review tier has had no quota since its HTTP 429 at 2026-11-03T04:50Z. The maintainer's word, 2026-11-03: 「没有fable可以用 opus，等契约复审」. So this FULL review of a Tier H Points for the reviewer:
After a PASS the PR stays a draft for Generated by Claude Code |
|
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U Contract-review-claim: session_01AavokzJ5DndAwitDXvKy4U · head fd3cf40 · 2026-11-03T14:16Z Taken on the maintainer's word in the triage session, 2026-11-03: 「契约复审：等分诊做契约复审：#29912、#29924、#29925、#29927、#29928」. This is an exception to #29667 for the Generated by Claude Code |
|
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U Contract reviewServed-tier: Taken by triage on the maintainer's word 「skills#1 转来的都接」 (exception to #29667; handoff 6604877768). ① Derived judgmentsNet diff against merge-base
② Semver level
③ Boundary flags
④ Design judgment
Check-runs at record time: 47 total; 29 success, 18 skipped, 0 failure or pending. Skipped: Test UI (shards), Type Check UI, Lint UI, Build & E2E UI, UI Published Artifacts, Build UI Deps, Build Docs, Dogfood Verify CLI, Dogfood Regression Gate (shards), Temporal Conformance, Check PR Size, Packed-tarball smoke ×2, Auto Label, Check Changeset, 18.x upgrade harness ×2, Schedule gate. Of the duplicate-named jobs, "Check Changeset" has one success and one skip. Its green comes from the label and does not answer M1. Implemented-by: VERDICT: FAIL Generated by Claude Code Generated by Claude Code |
…kills changeset Contract review round: "a reconnect naming none keeps it" could read as "omit the secret and the kept secret stays", but a reconnect that names any client replaces the stored one whole. It now says "naming no client". The bytes are paid inside the new text: the code comment's "each deployment's own client" restated the when-to-use sentence below the block. The ceiling row follows the measurement (10377 bytes, 2595). skills/** ships in @objectstack/skills, so the change carries a patch changeset with both declaration lines instead of the skip label. Claude-Session: https://claude.ai/code/session_01J8VVAnmBmMPE4eUyJhJRfx Co-authored-by: Claude <noreply@anthropic.com>
objectstack-fleet
Bot
removed
the
skip-changeset
Claude-Session: https://claude.ai/code/session_01J8VVAnmBmMPE4eUyJhJRfx Co-authored-by: Claude <noreply@anthropic.com>
|
domain:skills#1 · huangyiirene · session_01J8VVAnMUWA9rufXzFaEh4J Contract-review-handoff: triage — CONTRACT_REVIEW_TIER unavailable (HTTP 429, 2026-11-03T15:03Z) · head f77be06 The seat's review tier still has no quota after its 429 at 2026-11-03T04:50Z. On the maintainer's word 「没有fable可以用 opus，等契约复审」, this DELTA review goes to triage. It answers triage's review 6606409511 on What to check:
After a PASS the PR stays a draft for Generated by Claude Code |
|
domain:skills#1 · huangyiirene · session_01J8VVAnMUWA9rufXzFaEh4J Contract-review-claim: session_01J8VVAnMUWA9rufXzFaEh4J · head f77be06 · 2026-11-03T22:36Z Triage declined the delta handoff 6607275596 under ruling 6617211708 (#29667). The seat therefore takes the delta review back. It runs at CONTRACT_REVIEW_TIER in an isolated subagent (the seat session is not at that tier), against triage's FAIL 6606409511 on Generated by Claude Code |
|
domain:skills#1 · huangyiirene · session_01J8VVAnMUWA9rufXzFaEh4J Contract reviewServed-tier: Delta review of triage's FAIL 6606409511 on ① Derived judgments
② Semver level
③ Boundary flags
④ Design judgment
No must-fix. No should-fix. Check-runs at record time: 46 on Implemented-by: VERDICT: PASS Generated by Claude Code |
|
domain:skills#1 · huangyiirene · session_01J8VVAnMUWA9rufXzFaEh4J 维护者速读
席位核对 — ACCEPT · domain:skills#1 · head
|
domain:skills#1 · huangyiirene · session_01J8VVAnMUWA9rufXzFaEh4J
Requested by Irene · project thread
Fixes #29255
Clause-②: no
Metadata-protocol: none
Model: claude-fable-5-1 mandate waived by the maintainer (Fable quota exhausted); developed on Opus; contract review by triage.
维护者速读
authorization_code)现在教clientSource: 'installer':在声明式客户端旁加一行安装方式,并用一句话说明何时用哪种;管理员先按状态读给出的redirectUri在厂商处注册客户端,再以{ clientId, clientSecret }连接;连接读回client: { source: 'installer', clientId, hasSecret }。sys_connector_connectionstores and uses the installer-supplied OAuth client for anauthorization_codeinstance (#28702 B, server slice) #28866)已上线安装方客户端,开源部署要求管理员自带 OAuth 客户端;技能文本只教clientId+credentialRef,AI 照着写会写出在开源部署上连不上的连接器。skills/objectstack-automation/references/integration-recipes.md第 6 节代码块新增的注释行与「NameclientId…」五行;scripts/check-skills-token-ratchet.mjs该文件的天花板行与其注释。node scripts/check-skills-token-ratchet.mjs,预期 integration-recipes.md 2595 / 2595,全绿。skills/**随@objectstack/skills发布,本 PR 带一份 patch changeset。skills/**),需要GOVERNED_APPROVERS的批准;PR 保持 draft,契约复审交分诊席。What changes
Facts are taken from current
main:content/docs/automation/connectors.mdxas PR #29097 left it, and the merged schemaConnectorInstanceOAuth2AuthorizationCodeAuthSchemainpackages/spec/src/shared/connector-auth.zod.ts(its docblock names the two client sources and when each fits).skills/objectstack-automation/references/integration-recipes.md, recipe 6.authorization_codeexample,// Or clientSource: 'installer' in place of clientId + credentialRef., so the installer form sits beside the declared-client form.clientIdfor an app its publisher deploys,clientSource: 'installer'for one installed on deployments the publisher never sees; the administrator registers a client with the vendor against theredirectUrithatGET …/:name/connectionanswers, then connects with{ clientId, clientSecret }(no secret for a public client; a reconnect naming no client keeps it); the connection keeps it encrypted, and a read showsclient: { source: 'installer', clientId, hasSecret }.client_credentialsrefusingclientSourceis not claimed (the seat's scope note on the card, 6583724593).scripts/check-skills-token-ratchet.mjs, the oneCEILINGSrow of that file: 2488 → 2595, pinned AT the measurement, with a row comment naming this card and the ruling. No other row moves..changeset/29255-installer-client-source-skill.md:'@objectstack/skills': patch, withClause-②: noandMetadata-protocol: none.skills/**ships in@objectstack/skills, so this PR releases that package and carries noskip-changesetlabel.Token ratchet: restatements deleted first, then the measured remainder
The raise runs on the standing path the script's header recognises. Maintainer ruling 2026-10-27 on the seat's decision card 「skills 修复卡的教学和 eval 都撞 token 天花板,怎么付?」, tap A, verbatim and untranslated:
made the recognised path by ruling record 6513306068 on #27847. The surface widening that lets this card move the row is 6583724593.
Deleted first, two restatements in the same file, each with a surviving home:
authorization_codecomment's "A user grants access once" (28 bytes). Home: the paragraph under the block says an administrator connects it, once per organization.client_credentialsandapp-credentialdispatch once the ref is set." (72 bytes with its newline). Home: the file's opening paragraph says an unset ref leaves its instance degraded until set.integration-recipes.mdceil(bytes/4))main(4e0c5d3)Net +451 bytes (−100 cut, +551 added); the ceiling moves +107. The contract-review round's rewording of the reconnect clause was paid inside the new text: the code comment's "each deployment's own client" restated the when-to-use sentence under the block and is gone. No line was re-wrapped: the untouched lines of recipe 6 are byte-identical to
main.Why
PR #29097 (#28866) shipped installer-supplied OAuth clients, and the open edition now expects each deployment's administrator to bring the client (#28702 ruling B). The skill taught only a declared
clientIdwith itscredentialRef, plus MCP dynamic registration, so an assistant authoring from it would keep writing connectors that need the publisher's client and cannot connect on an open-source deployment.Verification
Head
f77be064(four commits: 1bce9ed the change; fd3cf40 spells the status read's path instead of "that path", which could read as the callback; 7c65d0d answers triage's contract review 6606409511 on fd3cf40, M1 the changeset and S1 the reconnect clause; f77be06 renames the changeset file to the seat's name). No code changed, so no package test or typecheck is owed; the derived gate set is the verification.Local gates on f77be06: 61 derived, 61 run, all exit 0 (`dispatch-gates --ran`: 0 NOT-MEASURED)
node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstackderived 61 commands for the three changed files: the 51 of fd3cf40 plus the 10 changeset families the new.changeset/*.mdbrings (check-adr-0087-registration.mjs --base origin/mainand--self-test,check-changeset-no-major.mjs --base origin/main,check-empty-changeset.mjs --base origin/mainand--self-test,release-rehearsal-clone.mjs --self-test,release-pending-publish.mjs --self-test,check:changeset-gate-self-tests,check:closed-ceremony-text,check:published-files).pnpm install --frozen-lockfileand a fullpnpm builddone (the build, exit 0 in 948 s, was taken on fd3cf40; the later commits touch only Markdown, a changeset and a code comment), each with a 900 s timeout and each exit code recorded before any pipe. Every one exited 0, among themcheck-skills-token-ratchet.mjsand its--self-test, the ten changeset families above,check-comment-mask-corpus.mjs,check:doc-authoring,check:skill-refs,check:skill-compatibility,check:skill-frame-sync,check:skill-identifier-liveness,check:pm-skill-id-lint,check:pm-governed-merges,check:dts-closure,check:dual-build-cjs-loadsandcheck:lean-entry-closure.--ranprinted:61 derived famil(ies) accounted for — 61 run, 0 NOT-MEASURED. The same set's first 51 also exited 0 on fd3cf40.node scripts/check-skills-token-ratchet.mjs:integration-recipes.md is 2595 tokens (ceiling 2595; headroom 0);57 authored bundle file(s) within their ceilings.node scripts/check-commit-card-trailers.mjs --range origin/main..HEAD: exit 0 (four commits, no card relation, model-free trailer pair).Check Changesetsuccess. The redLint & Repo GatesandTypeScript Type Checkon 7c65d0d are its lanes cancelled by the push of f77be06, not failures.git push×5 (the bare branch pointer, 1bce9ed, fd3cf40, 7c65d0d, f77be06); one relaypr_create; no GitHub MCP write. Theskip-changesetlabel the create carried was removed by the seat.Acceptance notes
claude/project-thread-0cd35o) in this container's own checkout rather than a sibling worktree; the container is this card's alone.stdioserver's credentials ridetransport.env, whileconnectors.mdxnamestransport.credentialEnv; the spec's redaction list namesproviderConfig.transport.env. Not touched here (outside this card's surface); the seat names card skills(objectstack-automation): integration-recipes recipe 6 still says a stdio MCP server's credentials ridetransport.env; a static credentialRef now reaches stdio throughtransport.credentialEnv(#29434) #29625 as its home.Human Minimum
packages/specholds no runtime logic. (No schema touched.)pnpm lintis CI's repo-wide run.main, one pull request.skills/**publishes in@objectstack/skills:.changeset/29255-installer-client-source-skill.mdcarries apatchand both declaration lines, which are also above.packages/specnot touched.content/docs/references/,packages/*/CHANGELOG.mdorcontent/docs/releases/.🤖 Generated with Claude Code
https://claude.ai/code/session_01J8VVAnmBmMPE4eUyJhJRfx
Generated by Claude Code