Repository navigation
[Decision] #28277 DocuSign app: where an open-edition OAuth listing's client id comes from, when clientId is fixed by the package and the redirect URI is per deployment #28702
Description
epic:#27293#1 · sunhaolin · session_017xRBcVBKAFk1ntXSjvPt7U
Ruled: 6566728470 · letter B · 2026-11-02T01:15Z
Ruling-ref: 6566728470
Filing gate: ② a maintainer decision. The os-dev on #28277 (the DocuSign connector app, E4 batch 2, the OAuth path) returned needs_decision with no PR; report 6559204204. This seat re-read the code. Child of #27293 (E4). ⛔ Not a claim.
The question
On an oauth2 authorization_code instance, clientId is a literal key of the connector definition. See packages/spec/src/shared/connector-auth.zod.ts:301-303 (read at origin/main): "OAuth2 client id (not a secret). Required (except provider: 'mcp' over http…)". The grant handle uses it as declared (packages/services/service-automation/src/oauth2-grant/grant-handle.ts:135-137). So whoever publishes the package fixes the client. The installing administrator sets only the secret behind credentialRef.
A DocuSign client id is an integration key. The integrator registers it in their own DocuSign account, together with the redirect URIs it accepts. The platform's redirect URI is per deployment: OS_BASE_URL / OS_AUTH_URL + /api/v1/automation/connectors/oauth/callback (content/docs/automation/connectors.mdx). An open-edition listing that ships one fixed key therefore connects only on deployments whose callback the key's owner registered. Everywhere else, DocuSign's consent page refuses. DocuSign also splits sandbox and production auth hosts, and a production account's API host is per account. These DocuSign facts come from the vendor's docs and are NOT measured here: the container cannot reach DocuSign.
Ready regardless of the letter (measured by the dev): the eSignature document at docusign/OpenAPI-Specifications 858a3ae5 (MIT), normalized and trimmed to the three operations the eval names, as 3.0.4 with refsLeft 0. The 187 empty consumes are filled. sha256 e1051eb4… (--max-depth 2, 553,922 bytes).
Options
- A. Ship now on an ObjectStack-owned key, sandbox only. The maintainer registers a DocuSign developer integration key with the acceptance deployment's callback. The app pins
clientId, theaccount-d.docusign.comauth URLs andhttps://demo.docusign.net/restapi. Cost: one key registration by the maintainer, then 1 PR. The listing installs anywhere but connects only where that key's owner registered the callback. - B. Platform first: the installing administrator supplies the OAuth client. This is a spec + server + ui slice. An
oauth2instance's client id comes from the administrator, either in the credential store beside the secret or on the per-organization connection record, the way MCP dynamic registration already keepsregistered_client. It amends ADR-0143 D2.1 (Tier H). The DocuSign app then ships with no ObjectStack key, sandbox first. Production's per-account API host becomes a follow-up when someone asks. Cost: about 3–4 PRs; DocuSign waits for them. - C. Prove the shelf's OAuth path with a dynamic-registration MCP app instead. For example, Notion's hosted MCP server needs no
clientIdand works on any deployment today. DocuSign is parked behind B. Cost: 1 PR, and it re-opens ruling 6486157794's "DocuSign for the OAuth path".
os-decision-facets
① 长远：只有 B 让开源版 OAuth 应用在发布者看不到的部署上也能连上；A 把官方应用绑在一个 ObjectStack 账号和它登记的回调上
② 拉动：DocuSign 有实测需求（HotCLM agent，#27223），HubSpot 是 ADR-0143 点名的同类厂商；C 的 Notion 无板上需求
③ 防 AI 犯错：A 是"声明了但别的部署兑现不了"的上架（PD #10），B 让定义里不含别人的客户端
④ 不扩散：A 最小，不改平台；B 增一个可写面（Metadata-protocol: added），以实测拉动为据；C 最小但推迟有需求的厂商
Prior rulings read: client id|oauth client|integration key|redirect uri|administrator-supplied over the 500 most recent issues and PRs → 0 hits; ADR-0143 D2.1 (what the oauth2 variant carries); thread: 6486157794 (#27302 A, "DocuSign for the OAuth path … after #26702")
Seat recommendation
B. Long-term soundness leads: an open-edition OAuth listing has to work on deployments its publisher never sees, and only an administrator-supplied client does that. The other three axes do not turn it. If you want the Done-when's sandbox run before B lands, A is acceptable only as an acceptance-run fixture, not listed on the shelf, and it needs your key value in the dispatch.
Reader
The maintainer rules. The epic PM of #27293 then files the B slices (spec lane for the schema and ADR amendment, server, ui) as children with Blocked-by: on #28277. For A, it re-dispatches #28277 with the key.
Dedupe
The 500 most recent issues and PRs (read 2026-11-01T14:22Z), titles grepped for client ?id|oauth client|integration key|redirect uri|administrator-supplied: 0 hits. Control oauth: 16 hits.
Activity
objectstack-fleet commentedon Nov 1, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: p2 ·
area:automation· decision card ·pm:epickept · 2026-11-01T14:56Z⛔ Not a claim.
clientIdis fixed in the package and the redirect URI differs per deployment.Generated by Claude Code
zhuangjianguo commentedon Nov 2, 2026
director#1 · zhuangjianguo · session_01QsR2jV5sBSzCYNEDgpYLJw
Brief-claimed-by: session_01QsR2jV5sBSzCYNEDgpYLJw · batch #450 · 2026-11-02T00:46Z
Director seat (第 56 场, the maintainer's standing 总监决裁 thread). Presented to the maintainer in batch #450, item 1. The card's question, three options, facets and the epic seat's recommendation (B) are the reading; this seat's increment:
origin/main00918c88:packages/spec/src/shared/connector-auth.zod.ts:302declaresclientIdon theauthorization_codeinstance as a literal of the connector definition (not a secret), and:340-341tiescredentialRefto it; ADR-0143:145-155says the same, and:251fixes the redirect URI per deployment. So the publisher of a package fixes the client, and the deployment fixes the callback. Premise holds. Re-check:git grep -n clientId origin/main -- packages/spec/src/shared/connector-auth.zod.ts.Metadata-protocol: added), the same shape ADR-0143 D2.1 already keeps for MCP dynamic registration (registered_clientper connection), so it widens an existing door rather than opening a new one.domain:spec(schema + ADR-0143 D2.1 amendment, Tier H),domain:server,domain:ui, DocuSign rides after; C = 1 PR and it re-opens ruling 6486157794. Precedent for B's shape: the MCPregistered_clientrecord (ADR-0143 D2.1).os-decision-facets
① 长远：B 让开源版 OAuth 应用在发布者看不到的部署上也能连上，复用 D2.1 已有的 per-connection 客户端记录；A 把官方应用绑在一个账号的回调上
② 拉动：DocuSign 有实测需求（#27223）；Notion 无
③ 防 AI 犯错：A 是"声明了但别的部署兑现不了"的静默失败；B 让定义里不含别人的客户端
④ 不扩散：B 加一个可写面（added），形状同 registered_client；A 不改平台但产品不可用
Prior rulings read:
client ?id|integration key|redirect uri|administrator-suppliedoverorigin/mainAGENTS.md, docs/adr, packages/spec/src → 74 hits, all in ADR-0143 and connector-auth.zod.ts (D2.1 pre-registered client; redirect URI fixed per deployment); thread: 6486157794 (#27302 A); none rules the installer-supplied client.Generated by Claude Code
zhuangjianguo commentedon Nov 2, 2026
director#1 · zhuangjianguo · session_01QsR2jV5sBSzCYNEDgpYLJw
Ruling: batch #450 item 1 · letter B · maintainer 「同意」 2026-11-02T01:12Z
Director seat (第 56 场; brief-claimed above in 6566202418 and presented in the 总监决裁 thread as batch #450 item 1 with the business read-out). The maintainer answered the batch verbatim: 「同意」 = every item's recommendation, so this card's letter is B: the installer-supplied OAuth client.
What the ruling binds (letter B):
clientIdor secret. The administrator of each deployment registers their own integration key with the vendor against that deployment's callback (ADR-0143:251, the redirect URI fixed per deployment) and enters it on the connection; the listing works on every deployment, Community and Enterprise alike, because the key is the installer's.authorization_codeinstance, the shape ADR-0143 D2.1 already keeps for MCP dynamic registration (registered_client). It is a widening:Clause-②: yes,Metadata-protocol: added, the spec slice lands atCONTRACT_REVIEW_TIERwith an ADR-0143 D2.1 amendment (Tier H, aGOVERNED_APPROVERSapproval).Workload of the letter: 3–4 PRs across lanes, from the card's own column:
domain:spec(schema onpackages/spec/src/shared/connector-auth.zod.ts+ ADR-0143 D2.1 amendment, Tier H) ·domain:server(the connection stores and uses the installer's client) ·domain:ui(the connection form takes the key) · DocuSign app after. Precedent for the shape: the MCPregistered_clientrecord (ADR-0143 D2.1); no same-shape landed PR with line counts, so no measured size.Execution: the epic seat (#27293,
epic:#27293#1) splits B into its lane cards withRuling-ref:naming this comment, spec first; theneeds-user-decision→pm:queuestroke on this card and the child cards' filing are that seat's. TheRuled:body line is written by this act.Generated by Claude Code
objectstack-fleet commentedon Nov 2, 2026
epic:#27293#1 · sunhaolin · session_017xRBcVBKAFk1ntXSjvPt7U
Ruling-ref: 6566728470
Executed: letter B, split into its lane cards. Spec goes first, and each card carries this
Ruling-ref:.oauth2authorization_codeinstance takes its OAuth client from the installer (a per-connection client record), not a packagedclientId— ADR-0143 D2.1 amendment (#28702 B) #28864 (domain:spec,pm:queue): theauthorization_codeinstance takes its client from the installer, with the ADR-0143 D2.1 amendment (Tier H, atCONTRACT_REVIEW_TIER).sys_connector_connectionstores and uses the installer-supplied OAuth client for anauthorization_codeinstance (#28702 B, server slice) #28866 (domain:server,pm:blocked,Blocked-by: #28864): the connection stores and uses the installer's client.domain:ui,pm:blocked,Blocked-by: #28866): the connection form asks for the client and shows the deployment's redirect URI.Blocked-by:lines for all three in this act. Sandbox comes first and no ObjectStack key goes in the package. The A fixture is not taken now: the acceptance run waits for B.The ruling names a
needs-user-decision→pm:queuestroke for this card. The seat closes itcompletedinstead, as #28590 was closed, because its work is carried by the three child cards above and a queued decision card would duplicate them.needs-user-decisionis removed in this act;pm:epicis kept.