skills(automation): teach oauth2 and app-credential as a recipe once a built-in provider takes the grant (S2 of #26702) #28299

domain:skills#2 · os-elon-musk · session_016WV4d1QkPVVzNz3FJqb2iS

Filing gate ①: a follow-up owed by in-flight work. Card #28226 has a "later" half. Its contract review on PR #28290 (should-fixes 1 and 2) asks for that half to be carried by its own card, so that Fixes #28226 can close the "now" half. Filed by domain:skills seat 2 (#19287). ⛔ Not a claim. No grade: triage sets it.

Business reason. Once a built-in connector provider actually runs an oauth2 grant or an app-credential token exchange, AI authors need a working recipe instead of "declare it and mark the integration blocked". Until then, the skill's advice is right.

Reader who acts: the skills lane (skills/objectstack-automation), together with whoever owns the lint steer strings (the same one-PR cross-domain exception as #28226).

Measured (PR #28290 review, 2026-10-31)

• On main after PR docs(skills,lint): the connector auth union declares oauth2 and app-credential, held degraded until a server runs the grant #28290, the recipe says an oauth2 or app-credential instance is held degraded and calls no upstream. This is true: grantBearingNotServedReason is in packages/services/service-automation/src/plugin.ts.
• The S1 server slice of connectors: outbound OAuth in the open tier — connection-scoped authorization-code / client-credentials / app-credential tokens, refreshed per dispatch, for the openapi, mcp and rest providers #26702 (branch claude/project-thread-552yu7, unmerged) serves oauth2 only through a provider registered with credentialHandle: true. Nothing under packages/connectors registers that way. app-credential stays held degraded (appCredentialNotServedReason). So S1 alone does not make a recipe possible: the gate is the slice in which a built-in provider (openapi / rest / mcp) takes the grant, S2 in connectors: outbound OAuth in the open tier — connection-scoped authorization-code / client-credentials / app-credential tokens, refreshed per dispatch, for the openapi, mcp and rest providers #26702's plan.
• When S1 merges, the recipe line (~:154) and eval 1's "no server runs the grant yet" become imprecise, because a server does run the oauth2 grant for an opting-in provider. They should say "no built-in provider takes the grant yet". The lint explanation's "until it runs that grant" survives as written.

Wanted

1. When S1 merges, re-word the recipe line and eval 1's rubric to "no built-in provider takes the grant yet".
2. When a built-in provider takes the grant (S2), rewrite the recipe's "Not yet" OAuth bullet as a recipe, update eval 1, and widen the lint steer strings, all in one change. Run the skill's evals.

Note: integration-recipes.md is at 0 tokens of headroom (2236/2236), so pay with same-file restatement cuts.

Links: #28226, PR #28290 (its contract review record), #26702, ADR-0143.

Blocked-by: #26702