Electronic-signature connector family: connector-esign with DocuSign first, three fixed actions, consumed by apps as a declarative provider: 'docusign' instance #25747

Activity

1. objectstack-fleet

   added

   area:apiThe API a customer can call, and integrations — REST, connectors, webhooks, jobsThe API a customer can call, and integrations — REST, connectors, webhooks, jobs

   domain:serverDomain lane — seat card indexed by label:pm:seatDomain lane — seat card indexed by label:pm:seat

   enhancementNew feature or requestNew feature or request

   pm:queueReady for the PM dispatch loopReady for the PM dispatch loop

   priority:p2Medium: important, M3Medium: important, M3

   on Oct 25, 2026
2. objectstack-fleet commented on Oct 25, 2026

   

   objectstack-fleetBot

   on Oct 25, 2026

   Contributor

   More actions

   Triage: first grade — enhancement · priority:p2 · domain:server · area:api · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-25T05:55Z

   ⛔ Not a claim, ⛔ not a dispatch.

   • Lane: domain:server (packages/connectors/; domain:services is now its alias). p2: the ruled hotclm card's milestone is M4, and this card does not lower it. If hotclm's card is p1, say so here and triage raises it.
   • Scope check before the claim: a new connector package under ADR-0097 (factory registration, closed action set, credentialRef) adds no spec key. If the dev finds it needs one (for example a provider enum entry, or a callback payload shape in spec), that half is filed as a domain:spec card first. A protocol change there goes to the maintainer.
   • A new published package joins the fixed release group, and its changeset says so.

   ---

   Generated by Claude Code
3. objectstack-fleet

   added

   pm:awaiting-maintainerAwaiting a manual maintainer action — ruling already given; no dispatch, no machine exitAwaiting a manual maintainer action — ruling already given; no dispatch, no machine exit

   and removed

   pm:queueReady for the PM dispatch loopReady for the PM dispatch loop

   on Oct 26, 2026
4. objectstack-fleet commented on Oct 26, 2026

   

   objectstack-fleetBot

   on Oct 26, 2026

   Contributor

   More actions

   Seat 2 record · 2026-10-26T15:05Z
   Ruled: 「这个改维护者处理」 (the maintainer, verbatim) — this card moves to the maintainer and leaves the server lane's dispatch queue.
   Maintainer-action: the maintainer handles #25747 (including the DocuSign developer sandbox credential its acceptance needs, premise 1) — done when the maintainer records on this card that the lane may dispatch it, or closes it.

   Context: the maintainer gave that ruling at 2026-10-26T15:04Z. Seat 2 put the card to the maintainer because its acceptance must run against a DocuSign developer sandbox (not faked, not gate-only) and no sandbox credential is reachable from the dev containers. The card is pm:awaiting-maintainer: not dispatched, not chased. · domain:server seat 2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo

   ---

   Generated by Claude Code
5. objectstack-fleet commented on Oct 27, 2026

   

   objectstack-fleetBot

   on Oct 27, 2026

   Contributor

   More actions

   Seat 1 record · domain:server seat 1 · os-project-manager · session_01R1q2xdtYgU6FKrZ7LgjPCC · 2026-10-27T04:11Z

   Re-confirmed: 「25747 转维护者」 (the maintainer, verbatim, 2026-10-27T04:08:44Z). The ruling 6419423580 (「这个改维护者处理」, 2026-10-26) stands unchanged: the maintainer handles this card, pm:awaiting-maintainer stays, and no seat dispatches from it.

   ---

   Generated by Claude Code
6. objectstack-fleet commented on Oct 28, 2026

   

   objectstack-fleetBot

   on Oct 28, 2026

   Contributor

   More actions

   Blocked-by: #26702

   Re-scoped by maintainer ruling · 2026-10-28T12:26Z

   Maintainer ruling (objectstack session session_01J8VVAjRKqdoEYQ4hXxtBuf, 2026-10-28, verbatim, not translated): 「25747 按照新的决策改，而且是不是就不需要这个插件了。」 — given after the rulings on #27230 (letter A: credentials are supplied by the customer's administrator through a platform credentials object, #27237 / #27238) and the maintainer's earlier line 「所以应该先处理 A/B 吧，并且要有 skills或者文档指导元数据开发者。前面agent还在建议我开发 DocuSign」 (#27223).

   What changes. No connector-esign code plugin. DocuSign is a declarative openapi instance inside the consuming app (HotCLM first, HotCRM second): the official docusign/OpenAPI-Specifications eSignature document (MIT, Swagger 2.0), normalized offline to 3.x JSON and trimmed to the three operations this card named — create envelope, get envelope status, download the signed document — packaged with the app with an include allowlist; auth is the OAuth variant #26702 adds (DocuSign authorizes by JWT grant / authorization code — a static key does not reach it); the inbound Connect callback is the app's api-triggered flow, as this card already said. The "fixed three-action contract across providers" that justified a plugin is deferred by name: it is a product choice, not a technical necessity, and is re-opened only when a second provider (e签宝 / 法大大 / 契约锁, which wait on request signing, #26710) is actually declared by an app.

   Why this card is blocked rather than closed. The declarative shape needs two platform pieces that do not exist at c3fb185a: the OAuth auth variant and per-dispatch token refresh (#26702), and the declarative include plus offline normalization of a Swagger 2.0 document (#26709). When #26702 lands, this card's remaining deliverable is a documented, verified recipe, not code: the normalized DocuSign document and include list as a reusable package, the callback payload mapping two apps share, the sandbox run that takes a HotCLM contract signing → active with the signed PDF attached (the acceptance stays), and a docs page. Triage decides whether that lands as a domain:devx recipe (the natural home, alongside #27223's integration recipes) or stays on this card re-labelled; the title above still names the plugin and reads as superseded by this comment.

   Premises the lane re-checks at dispatch stay as written (a DocuSign developer sandbox credential provided by the maintainer; whether @objectstack/connector-openapi ships in the published runtime). Premise 2's answer now matters more: if the hosted runtime does not carry the openapi provider plugin, that is its own finding.

   pm:awaiting-maintainer → pm:blocked in the same stroke (the maintainer's action — this ruling — is done).

   ---

   Generated by Claude Code
7. objectstack-fleet

   added

   pm:blockedBlocked by another issue/PR — body carries Blocked-by: #NBlocked by another issue/PR — body carries Blocked-by: #N

   and removed

   pm:awaiting-maintainerAwaiting a manual maintainer action — ruling already given; no dispatch, no machine exitAwaiting a manual maintainer action — ruling already given; no dispatch, no machine exit

   on Oct 28, 2026
8. objectstack-fleet commented on Oct 28, 2026

   

   objectstack-fleetBot

   on Oct 28, 2026

   Contributor

   More actions

   Ruled: closed as not planned · 2026-10-28T12:32Z

   Maintainer ruling (objectstack session session_01J8VVAjRKqdoEYQ4hXxtBuf, 2026-10-28, verbatim, not translated): 「25747 按照新的决策改，而且是不是就不需要这个插件了。」 then 「25747 不需要了不是应该关卡吗」. The re-scope comment above (posted earlier today) stands as the record of why: no connector-esign code plugin; DocuSign becomes a declarative openapi instance inside the consuming app once #26702 (OAuth) and #26709 (include + offline normalization of the Swagger 2.0 document) land.

   Where the remaining pieces live, so nothing is lost by closing:

   • the platform capabilities: connectors: outbound OAuth in the open tier — connection-scoped authorization-code / client-credentials / app-credential tokens, refreshed per dispatch, for the openapi, mcp and rest providers #26702, connectors: auto-shelf readiness — declarative include and a loud Swagger 2.0 refusal for connector-openapi; tools/list pagination, fatal 401 and a tool-snapshot hash for connector-mcp; an offline spec-normalization tool #26709 (and connectors: request-signing auth kind for the openapi and rest providers (RSA2 / HMAC canonical-request signers: Alipay, WeChat Pay, Aliyun, Tencent Cloud, e签宝) — the vendor-auth half that #26702 does not cover #26710 for the signature-authenticated regional providers e签宝 / 法大大 / 契约锁);
   • the author-facing recipe (normalized document, include list, callback mapping, the OAuth "not yet" entry): skills: integrations are declared, not coded — teach the declarative-connector-first rule, the per-archetype recipes and the credential hand-off in objectstack-automation, with an eval that refuses the "write a DocuSign plugin" answer #27223's integration recipes, and the marketplace handbook docs: a marketplace handbook for app authors — listing metadata, README conventions, os package publish --submit, review, the customer install experience (credentials, sample data, upgrade, uninstall) and staying current with platform versions #27240;
   • the business acceptance (a HotCLM contract signing → active with the signed PDF attached, against the DocuSign developer sandbox): HotCLM's own F8 card in objectstack-ai/hotclm, which consumes the platform pieces above; the sandbox credential stays the maintainer's to provide there;
   • the deferred product question (one fixed three-action contract across providers) is re-opened only when a second provider is declared by an app — a new card then, with that app as the consumer.

   An open pull request in a sibling repository cross-references this card (timeline shows #120 of that repository, read only as a cross-reference here); it is not affected by this closure, and its author should point it at #26702 / #26709 instead of this card. The Blocked-by: #26702 line in the re-scope comment is void with this closure. pm:blocked leaves in the same stroke.

   Closed by session_01J8VVAjRKqdoEYQ4hXxtBuf on the maintainer's instruction.

   ---

   Generated by Claude Code
9. objectstack-fleet

   removed

   pm:blockedBlocked by another issue/PR — body carries Blocked-by: #NBlocked by another issue/PR — body carries Blocked-by: #N

   on Oct 28, 2026
10. objectstack-fleet

    closed this as not plannedon Oct 28, 2026