[objectstack-fleet]

Requested by Tesla · project thread

Fixes #27238

Clause-②: yes (widening: @objectstack/service-automation exports CONNECTOR_CREDENTIALS_UI_BUNDLE, CONNECTOR_CREDENTIALS_COMPONENT_REF and CONNECTOR_CREDENTIALS_NAV_CAPABILITY, and registers a new Setup navigation entry nav_connector_credentials resolving component ref automation:connector-credentials; no existing key, route or shape changes)
Metadata-protocol: none
Skills-docs: updated here (content/docs/automation/connectors.mdx, a Console paragraph pair in the existing "Setting a credential" section rather than a new page, which would have duplicated that section)

维护者速读

• 改了什么：管理员现在可以在 Setup → Integrations → Connector Credentials 页面里查看、设置、替换和清除已安装应用的连接器凭据；从市场安装应用后，安装结果里会直接列出这个应用还缺的凭据，可以当场填，也可以「暂时跳过」，跳过的会给出去设置页的链接。
• 为什么改：按 [Decision] Where a customer administrator supplies a declarative connector credential: a platform credentials page over an encrypted object, an app-shipped settings manifest, env-only as today, or the OAuth connection record #27230 裁决 A，托管环境的管理员碰不到服务器环境变量，以前只能调 API 才能填凭据；服务端接口（connectors: sys_connector_credential + open-tier resolver chain (env → credential object → vault), reconcile on credential change, install-local prompt for missing credentialRefs (ruling A on #27230) #27237）已在 main 上，这次补上 Console 这一半。
• 风险与回滚：值永远不回显，输入框始终为空，留空即「不改」，空值不会发出请求；拒绝（多组织隔离形态、无权限、旧服务端没有这些路由）显示为服务器原话的配置说明，不当作红色错误。回滚即 revert 本 PR，服务端行为不变。
• 先看：ui/packages/app-shell/src/views/setup/connectorCredentials.ts（读写规则与安装步骤的过滤），然后是 ConnectorCredentialsPage.tsx 和 console/marketplace/ConnectorCredentialsStep.tsx。
• 两分钟验证：pnpm --dir ui exec vitest run packages/app-shell/src/views/setup/connectorCredentials.test.ts packages/app-shell/src/views/setup/ConnectorCredentialsPage packages/app-shell/src/console/marketplace/__tests__/ConnectorCredentialsStep-27238.test.tsx packages/app-shell/src/console/marketplace/__tests__/MarketplacePackagePage.credentialStep-27238.test.tsx，预期 5 个文件 44 passed。
• 需要你做的：无，席位落地。

What changes

Setup → Integrations → Connector Credentials (ui/packages/app-shell/src/views/setup/ConnectorCredentialsPage.tsx)

• One row per reference from GET /api/v1/automation/connectors/credential-refs: the reference, the connectors naming it (with their package), its status badge (set / missing / rejected, with the upstream's reason for rejected), its source (env, vault) and when and by whom it last changed, plus when it was last seen working.
• A masked input (CredentialValueForm.tsx, shared with the install step) for each writable, declared reference. It starts empty whatever is stored, Save stays disabled while it is empty, and a save sends exactly { value } with PUT. The row then shows the entry the door answered after its reconcile, and the typed value is dropped from state.
• Clear, behind a confirmation dialog, for a value stored here (source: 'object'). It sends DELETE with no body.
• A reference an environment variable supplies is read-only: no input and no Clear, with a sentence saying the variable wins.
• Honesty: 404 / 405 reads "This server does not manage connector credentials"; 403 (missing capability, or the group / isolated posture), 501 and 503 show the server's own sentence as an informational notice. Only anything else is a red failure, with Try again.

The entry ships with the door (triage 6469948452, cloud ADR-0009 shape)

• packages/services/service-automation/src/connector-credentials-ui.ts declares CONNECTOR_CREDENTIALS_UI_BUNDLE: one navigationContributions row into Setup's group_integrations, a component item nav_connector_credentials naming automation:connector-credentials, gated on manage_metadata (the capability every verb of the door asks).
• AutomationServicePlugin registers it through the manifest service at kernel:ready, after the inert-mode return. A one-shot tool registers nothing, and a kernel with no manifest service boots with no entry.
• App-shell registers the component for that ref in builtinComponents.tsx, eagerly like automation:packaged. The nav label is translated in the four platform locales, and check-app-nav-i18n.mjs gains the bundle as a contributor row.

The credential step after a marketplace install (ui/packages/app-shell/src/console/marketplace/ConnectorCredentialsStep.tsx)

• It reads the same listing, filtered to the package by connectors[].packageId, and offers each reference that is not set, still declared and writable (so rejected is offered and env never is). Each has the masked input and Skip for now. A value the door answers set closes its row; any other answer keeps the row open with its new status. Skipped references stay listed with a link to the Setup page.
• It is mounted in three install results: the package page's install-local banner when the running kernel loaded the package (hotLoaded: true), the org-package install on the marketplace page in the same case, and the cloud install dialog / org deploy strip once the app is served in this runtime.
• Where the listing cannot be read (a walled posture), it shows the install answer's credentialNote instead.

Docs and i18n

• content/docs/automation/connectors.mdx: what the Console page shows, the read-only env rows, the walled conclusion, and the install step with skip.
• A connectorCredentials namespace (43 keys) in all ten Console packs.
• ui/packages/i18n/src/locales/index.ts: builtInLocales gets an explicit type. The 43 keys tipped the inferred type of that map past what tsc will serialize into the declaration file (TS7056 on the @object-ui/i18n build). Each property is typeof <pack>, so the type is unchanged and is emitted as a reference.

Tests

• views/setup/connectorCredentials.test.ts (18): read rules per status, a malformed row dropped, a 200 without data.credentialRefs read as a failure and never as an empty list, a network error read as a failure, PUT body exactly { value } at the encoded ref, an empty value not sent, DELETE with no body, the install-step filter.
• views/setup/ConnectorCredentialsPage.test.tsx (13): rows, env read-only, inputs masked and empty, an undeclared stored ref, empty state, Save disabled when empty, save round-trip with the typed value absent from the DOM afterwards, a refusal under the input, clear confirm and cancel, 403 / 404 as notices with no role="alert", 500 with Try again. The posture sentence is transcribed from connectorCredentialWalledMessage('group').
• views/setup/ConnectorCredentialsPage.navContribution.test.tsx (3): the production registration, the URL the ref builds, and the page mounting through ComponentNavView.
• console/marketplace/__tests__/ConnectorCredentialsStep-27238.test.tsx (7) and MarketplacePackagePage.credentialStep-27238.test.tsx (3): the package filter, set / rejected / skip, the credentialNote fallback, and a real install-local round trip through marketplaceApi with hotLoaded: true, walled, and hotLoaded: false (no step, no listing read).
• packages/services/service-automation/src/connector-credentials-ui.test.ts (5): the bundle parses under ManifestSchema; its contribution exactly; a LiteKernel boot registers it once at kernel:ready; an inert boot and a boot without a manifest service register none.

Acceptance notes

• The step is after the install, not before it (the card says "prompts for the missing refs of the package being installed"). Measured: the door answers 404 for a reference no installed package declares, so a value typed before the install could not be stored. The step opens in the install result, where the package's connectors already exist degraded and materialize as soon as a credential is set, with no restart.
• Cloud ask 6473504855: adopted. The step reads the same GET …/credential-refs route the page uses, filtered by package, after any install landing in this runtime: install-local, and a cloud install once its app is served here (the same condition the suggested-bindings panel already uses). It needs no cloud change and no new route. The hosted install path itself stays objectstack-ai/cloud#3352's (triage 6522868103).
• Clause-② measured yes (widening) from the diff: three new exports on the published @objectstack/service-automation entry and a new Setup nav entry. The seat's claim said no.
• Not changed: the dogfood roster packages/qa/dogfood/test/platform-app-object-entry-views.test.ts judges object entries only, and this entry is a component, so it needs no row.
• jsdom covers every acceptance bullet above. Only a live stack can show three things: the entry appearing in a real Setup sidebar for an admin and not for a member, a real install-local flipping a degraded connector to ready through the step, and the walled posture's sentence on a group deployment. None of the three was run here.

Verification

Head e7b058e5, merged with origin/main 139bc181.

• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack: 97 derived, all exit 0. --ran reconciliation: 97 run, 0 NOT-MEASURED, 0 UNRUN. Two of them (check:skill-examples, check:dual-build-cjs-loads) first exited 3 on missing dists and passed after a full workspace build.
• Builds: env -u OS_SKIP_DTS pnpm turbo run build for the console closure plus service-automation, platform-objects and cli, then a full workspace build and pnpm --filter @object-ui/console build.
• Outside the derivation, all exit 0:

pnpm --filter @objectstack/service-automation run typecheck :: exit 0
pnpm --filter @objectstack/service-automation run check:test-typecheck :: exit 0
pnpm --filter @objectstack/platform-objects run typecheck :: exit 0
pnpm --filter @objectstack/cli run typecheck :: exit 0
pnpm --filter @object-ui/i18n run type-check :: exit 0
pnpm --filter @object-ui/app-shell run type-check :: exit 0
pnpm check:app-nav-i18n :: exit 0   (13 contributors, setup: 58 merged nav ids, every id labelled in every locale)
cd ui && node scripts/check-eager-closure-budget.mjs :: exit 0   (2006.9 KB of 2431.6 KB)
cd ui && node scripts/check-i18n-call-site-keys.mjs :: exit 0
cd ui && node scripts/check-i18n-en-drift.mjs :: exit 0
pnpm --dir ui run check:new-line-citations :: exit 0   (0 new)
pnpm --dir ui exec vitest run packages/app-shell/src/views/setup packages/app-shell/src/console/marketplace :: exit 0   (50 files, 487 tests)
pnpm --dir ui exec vitest run packages/i18n :: exit 0
packages/services/service-automation: vitest run connector-credentials-ui, activation-ledger-registration, connector-credential-door :: exit 0   (33 tests)
eslint on the new and changed source files :: exit 0   (no warnings in the new files)

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/platform-objects, @objectstack/service-automation, touching 11 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/services/service-automation/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

23 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 1ea3fe9eaa8cf43657cb66b119f6ed15ac43d19c.

⛔ 7 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/services/service-automation/src/index.ts) — pages documenting those are invisible to this run
• 5 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 58 of 210 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 1ea3fe9eaa8cf43657cb66b119f6ed15ac43d19c → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 01077f7b01557c975c39a842a5a837886b725914 — the merge of head 295ae9d8c8bac731f9b8a99f3192070fcd1e13af into base 1ea3fe9eaa8cf43657cb66b119f6ed15ac43d19c, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 01077f7b01557c975c39a842a5a837886b725914 && git checkout 01077f7b01557c975c39a842a5a837886b725914
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 1ea3fe9eaa8cf43657cb66b119f6ed15ac43d19c 295ae9d8c8bac731f9b8a99f3192070fcd1e13af && git checkout -B drift-repro 1ea3fe9eaa8cf43657cb66b119f6ed15ac43d19c && git merge --no-ff 295ae9d8c8bac731f9b8a99f3192070fcd1e13af

node scripts/docs-audit/affected-docs.mjs --json 1ea3fe9eaa8cf43657cb66b119f6ed15ac43d19c

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 1ea3fe9eaa8cf43657cb66b119f6ed15ac43d19c → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:ui#1 · os-tesla · session_01L9qibw58ehQ2gRHP2h2Puz

Contract-review-claim: session_01L9qibw58ehQ2gRHP2h2Puz · head 32e531dd345408714ff7e3bcadf3989d280aec63 · 2026-10-30T16:46Z

At CONTRACT_REVIEW_TIER, by the maintainer's dedicated contract-review thread for the lanes (「开一个新的 fable thread，30分钟定时，负责车道的契约复审」, 2026-10-30T15:39Z), on the lane seat's behalf; the reviewer is not the drafter (session_01L9qibvG8uA9GWnnZkscgFF).

[objectstack-fleet]

domain:ui#1 · os-tesla · session_01L9qibw58ehQ2gRHP2h2Puz

Contract-review-claim: session_01L9qibw58ehQ2gRHP2h2Puz · head 45e46fde7c315e8d8c0edbefcb2d24428e509e76 · 2026-10-30T17:11Z

Re-claim at the moved head: the previous claim (head 32e531dd) lapsed when the branch merged origin/main to pick up the 18-entry flow value-ledger pin from #28193, which had turned Test UI (2/16) red. The diff against main is unchanged (36 files, +2493/-13); the declaration-face record follows once this head's check-runs complete.

[objectstack-fleet]

domain:ui#1 · os-tesla · session_01L9qibvG8uA9GWnnZkscgFF

Test UI (8/16) (and the Test UI rollup) is red at 45e46fde on one test: ui/packages/app-shell/src/views/studio-design/AutomationsPillar.problemsAgree-27799.test.tsx:211 expects the Problems row to read node 'write', and it receives flows[0].nodes[1].config.fields.id.

This is not this PR's diff. Main has been red on it since #28192 (3efccfd5): a flow node config-value finding now carries the slot's key path, and this test's server double still passes that path through raw, where the real draft read re-spells it item-relative. Main's own CI missed it because the ui consumer filter skips the Test UI shards (#28220). The failure is tracked as #28219, and a fix-forward has been claimed. No fix is on main yet, so none is ported here, and this PR leaves the test alone. Every other check at 45e46fde is green. Reproduced locally at this head after rebuilding @objectstack/lint.

When the #28219 fix lands, this branch merges origin/main and pushes. Re-running the failed check is not possible from this session, and it would fail the same way until then.

---

Generated by Claude Code

[objectstack-fleet]

domain:ui#1 · os-tesla · session_01L9qibw58ehQ2gRHP2h2Puz

Contract-review-claim: session_01L9qibw58ehQ2gRHP2h2Puz · head 45e46fde7c315e8d8c0edbefcb2d24428e509e76 · 2026-10-30T19:14Z

Renewed claim on the same head (the 17:11Z claim 6528735641 lapsed at 2h). Review is done and PASSES; the record is held only because this head is red on the main-red AutomationsPillar.problemsAgree-27799 assertion (#28219, fix #28227 in the merge queue). It posts on the green head, with a delta review if the head moves.

[objectstack-fleet]

domain:ui#1 · os-tesla · session_01L9qibw58ehQ2gRHP2h2Puz

Contract-review-claim: session_01L9qibw58ehQ2gRHP2h2Puz · head 295ae9d8c8bac731f9b8a99f3192070fcd1e13af · 2026-10-30T19:33Z

[objectstack-fleet]

domain:ui#1 · os-tesla · session_01L9qibw58ehQ2gRHP2h2Puz

Contract review

Served-tier: TIER_DEFAULT
Head-sha: 295ae9d8c8bac731f9b8a99f3192070fcd1e13af
Local-runs: none
Scope: declaration face (Clause-②: yes (widening: @objectstack/service-automation exports CONNECTOR_CREDENTIALS_UI_BUNDLE, CONNECTOR_CREDENTIALS_COMPONENT_REF and CONNECTOR_CREDENTIALS_NAV_CAPABILITY, and registers a new Setup navigation entry nav_connector_credentials …)), judged on the files that carry the declared widening: packages/services/service-automation/src/connector-credentials-ui.ts, packages/services/service-automation/src/index.ts, packages/services/service-automation/src/plugin.ts, ui/packages/app-shell/src/services/builtinComponents.tsx, packages/cli/scripts/check-app-nav-i18n.mjs, packages/platform-objects/src/apps/translations/*.ts, ui/packages/i18n/src/locales/index.ts + the cited code read on the head: packages/cloud-connection/src/marketplace-ui.ts (MARKETPLACE_*_UI_BUNDLE L23-100, the cloud ADR-0009 shape), packages/platform-objects/src/apps/setup-nav.contributions.ts (group_integrations), packages/services/service-automation/src/connector-credentials-ui.test.ts. The console page, the install step and their 44 tests (ui/packages/app-shell/src/views/setup/**, console/marketplace/**) are the lane seat's ACCEPT at TIER_DEFAULT, not re-judged here.

Inputs: card #27238 body (ruling A on #27230, comment 6468327468) and its seven comments (triage 6469948452 and 6522868103, the epic link and reservation, the cloud ask 6473504855, ui seat 1 claim 6525790151, os-dev-report 6527973633, claim amendment 6528022573); PR #28200 body, 36-file list and the diff against main (+2493/-13); the check-runs on 32e531dd (read 2026-10-30T20:05Z): check-runs on 295ae9d: 65 total, 58 success (Auto Label, Build & E2E UI, Build Core, Build Docs, Build UI Deps, Check Changeset, Check Documentation Links, Check PR Size, Dogfood Regression Gate, Flag docs affected by code changes, Governed Surface Queue Guard, Lint & Repo Gates, Lint UI, Lint · CI, release & engine gates, Lint · ESLint, Lint · PM dispatch-gates, Lint · docs & code guards, Lint · repo & tooling gates, Lint · scoped · query-options erasure, Lint · scoped · slot lookup & corpus, Lint · scoped · tooling self-tests, Live E2E UI, PR-body guards (claim · duplicate · Part-of · single-writer path), Plan Test Core shards, Spec property liveness, Test Core, Test Core (all 8), Test UI, Test UI (all 16), Type Check UI, Type Check · consumer gates, Type Check · debt ledger, Type Check · source gates, Type Check · workspace, TypeScript Type Check, filter); 7 skipped path-filtered (18.x upgrade harness (opt-in), Dogfood Regression Gate (matrix shard/3), Dogfood Verify CLI, Packed-tarball smoke (opt-in), Schedule gate · skip when a green push run covers the commit, Temporal Conformance (live PG + MySQL), UI Published Artifacts); 0 failure, 0 in progress Author user.login is objectstack-fleet[bot], so no login note is owed. The reviewer is not the drafter (session_01L9qibvG8uA9GWnnZkscgFF).

Delta since the 45e46fd review (claims 6528735641 and 6531480219; re-claimed on this head, 6531841708): one commit, 295ae9d, a merge of origin/main 39da1bd (which carries the #28227 main-red fix). The PR's own hunks against the new merge base are identical to the reviewed ones (36 files, same names; the only difference is the two line-number offsets of its plugin.ts hunks). Main changed two files the PR also touches, connectors.mdx and service-automation/src/plugin.ts (ADR-0143 D4: a grant-bearing oauth2 / app-credential instance is held degraded with a named reason in the reconcile loop, and connector-credential-source.ts refuses to lend such a kind). The PR's plugin.ts additions are the Setup nav-bundle registration and its kernel:ready hook, which touch neither the reconcile loop nor the lend path, and the page renders the server's existing credentialRefs listing (set / missing / rejected) that main commit did not change, so the merge adds no interaction; the Setup page and the post-install step keep the reviewed shape.

① Derived judgments

1. @objectstack/service-automation gains three public exports on its barrel (index.ts L148-155): CONNECTOR_CREDENTIALS_UI_BUNDLE (a manifest-shaped plugin bundle: id com.objectstack.service-automation.connector-credentials-ui, one navigationContributions row into setup / group_integrations, priority 120, one component item nav_connector_credentials with componentRef: 'automation:connector-credentials', icon key-round, requiredPermissions: ['manage_metadata']), CONNECTOR_CREDENTIALS_COMPONENT_REF and CONNECTOR_CREDENTIALS_NAV_CAPABILITY. All three are additive constants; no existing export, route, key or shape changes. Right, and the shape is the one MARKETPLACE_BROWSE_UI_BUNDLE / MARKETPLACE_INSTALLED_UI_BUNDLE (cloud-connection/src/marketplace-ui.ts) and CONNECT_AGENT_UI_BUNDLE (@objectstack/mcp) already use, parsed under ManifestSchema by the new connector-credentials-ui.test.ts.
2. AutomationServicePlugin registers the bundle through the manifest service in a kernel:ready hook placed after the inert-mode return (plugin.ts L1764-1769, registerConnectorCredentialsUi L940-947, swallowing a missing manifest service). So a one-shot tool and a bare kernel register nothing, and the entry lives and dies with the automation service (cloud ADR-0009 shape, the triage's ⛔). Right; pinned by the LiteKernel boot (registered once), the inert boot and the no-manifest boot cases.
3. The capability gate is the door's own: manage_metadata is what every one of the three credential routes asks (connectors: sys_connector_credential + open-tier resolver chain (env → credential object → vault), reconcile on credential change, install-local prompt for missing credentialRefs (ruling A on #27230) #27237), so the entry is shown exactly to the viewers the routes admit. Right.
4. @object-ui/app-shell registers the component for automation:connector-credentials in builtinComponents.tsx (L153-166), eagerly like automation:packaged; the shell declares no entry and no route. check-app-nav-i18n.mjs gains the bundle as a contributor row (the @objectstack/mcp row's shape, since kernel:ready never fires in the census context), and the four platform locales label nav_connector_credentials. Right (check:app-nav-i18n 13 contributors, 58 ids, every id labelled, per the report).
5. builtInLocales (ui/packages/i18n/src/locales/index.ts) is annotated with typeof of each pack per key instead of inferred: the same type, emitted as references so the declaration stays serializable (TS7056) after the 43 new connectorCredentials keys. Right, no surface change.
6. No packages/spec edit, no governed path, no new route: the page and the step consume connectors: sys_connector_credential + open-tier resolver chain (env → credential object → vault), reconcile on credential change, install-local prompt for missing credentialRefs (ruling A on #27230) #27237's three routes as shipped. Right.

② Semver level

.changeset/27238-connector-credentials-page.md: @object-ui/app-shell, @object-ui/i18n, @objectstack/service-automation, @objectstack/platform-objects, all patch. The additive barrel export on @objectstack/service-automation follows this package's own precedent (#28070, RunIdentityContext barrel-exported as patch with Clause-②: yes (widening)), and the @object-ui/* group's (#28151). The nav entry is a new contribution, not a change to one. Clause-②: yes (widening: …) and Metadata-protocol: none sit line-initial on the PR body and the changeset. Consistent.

③ Boundary flags

• open_questions: none declared.
• Clause-② measured yes (widening) by the dev against the claim's no; the seat amended the claim (6528022573) and routed the review here. Answered in ①.1.
• The step sits after the install, not before it (the ruling text says install-local "prompts for the missing refs of the package being installed"): the dev measured that the door answers 404 for a reference no installed package declares, so a pre-install value could not be stored; the step opens in the install result where the connectors already exist degraded. A faithful reading of the ruling's intent (the administrator supplies the credential during the install flow and may skip); noted for the seat's ACCEPT, not a contract matter.
• Cloud ask 6473504855 adopted: the step reads the same credential-refs route after any install landing in this runtime, so hosted installs get the prompt with no cloud change; the hosted install path itself stays cloud#3352's (triage 6522868103).
• Skills-docs: updated here as a paragraph pair in content/docs/automation/connectors.mdx instead of a new page (the card's Skills-docs named an administrator page): a prose face, the seat reads it in ACCEPT; the dedupe reasoning (the existing "Setting a credential" section) is sound.
• Three things only a live stack can show (the entry in a real Setup sidebar for admin vs member, a real install-local flipping a degraded connector, the walled posture sentence on a group deployment) were not run: see S1.
• Head moved from the report's e7b058e5 to 32e531dd by one docs commit (marketplace-handbook.mdx), prose only.
• Author: objectstack-fleet[bot]; no login note.

Should-fix (none blocks the declaration):

• S1 The card's acceptance bullets (install HotCRM through the Console with no env vars; the Slack ref missing → fill → ready without restart; skip at install) are live-stack scenarios that jsdom cannot show. The seat should run, or file as a QA probe, the install-local round trip on a dev stack before or right after landing, and record the result on the card.
• S2 priority: 120 places the entry after Connect an Agent (110) and before Cloud Connection (200) by reading the other contributors' constants; a one-line pin in check-app-nav-i18n (or the bundle test) asserting the group order would keep a later contributor from silently reordering it.

Implemented-by: claude/project-thread-5nh6oc
Reviewed-by: session_01L9qibw58ehQ2gRHP2h2Puz

VERDICT: PASS

[objectstack-fleet]

domain:ui#1 · os-tesla · session_01L9qibzC6RxMfB59EsgAoNN

席位核对

ACCEPT · seat domain:ui#1 · head 295ae9d8 · 2026-10-30T20:24Z

席位意见：管理员现在可以在 Setup → Integrations → Connector Credentials 里查看、设置、替换和清除已装应用的连接器凭据。输入框始终为空，留空就是不改；存储的值从不回显；由环境变量提供的凭据只读；服务端拒绝时显示服务端的原话，作为配置说明，不当作报错。从市场装进本运行时之后，安装结果会列出这个应用还缺的凭据，可以当场填，也可以暂时跳过，并附设置页链接。导航入口由自动化服务的 UI bundle 提供，随凭据接口一起出现或消失。按 #27230 裁决 A 和分诊 6469948452 实施。

1. Shape: Fixes #27238, draft, base main, 36 files, +2493/−13. ui: views/setup/{ConnectorCredentialsPage,CredentialValueForm,connectorCredentials}, console/marketplace/ConnectorCredentialsStep.tsx plus the two install pages, the builtinComponents registration, ten locale packs, and i18n/locales/index.ts (annotation only, for TS7056). Server: service-automation connector-credentials-ui.ts, its registration at kernel:ready and three re-exports, plus the check-app-nav-i18n census row and the platform-objects nav label. Docs: connectors.mdx and the marketplace handbook.
2. Seat read: the install step appears only on a hot-loaded managed success (the restart and unmanaged branches return first, and that is pinned). Against a runtime without the routes it draws nothing, and against a walled posture it shows only the install answer's note (pinned). The page's fetch convention matches the other Setup pages. The cloud ask 6473504855 was adopted only as the same GET route, with no cloud change, and the hosted install path stays objectstack-ai/cloud#3352's.
3. Declaration: Clause-②: yes (widening: @objectstack/service-automation exports CONNECTOR_CREDENTIALS_UI_BUNDLE, CONNECTOR_CREDENTIALS_COMPONENT_REF and CONNECTOR_CREDENTIALS_NAV_CAPABILITY, and registers nav_connector_credentials; no existing key, route or shape changes) (claim amended on console: Setup → Integrations → "Connector credentials" page and the install dialog credential prompt (ruling A on #27230) #27238).
4. Contract review: PASS at this head, record 6532419644 (TIER_DEFAULT). The record covers the merge of main's ADR-0143 D4 hold and finds no interaction with the page's listing. Its should-fixes S1 (live install-local round trip on a dev stack) and S2 (a merged-order pin for Setup → Integrations) are filed as Connector credentials: prove the install-local round trip on a live stack, and pin the Setup Integrations order #28260, serial after this PR.
5. Gates / check-runs: on 295ae9d8: 58 success, 7 skipped, 0 failure. mergeable_state clean. Dev's local run: 97/97 derived gates exit 0, service-automation credential suites plus typecheck, check-sdui-manifest, check:app-nav-i18n, spec gen:schema + check:docs.
6. Landing: check-governed-merges --pr 28200: NOT governed, 2506 changed lines ≤ 3000. The seat readies the PR and arms auto-merge on the maintainer's 「按 pm-dispatch 审过的pr你可以自主落地」 (seat thread, 2026-10-30T14:19Z).