Checklist integration system

integration-system

Generated by pnpm gen:checklist-status from docs/qa/platform-checklist/areas/*.json. ⛔ Do not edit this page — edits go to the area JSON and this page follows on the next run. This page is Checklist-integration-system.

Integration & system services — connectors, webhooks, jobs, email templates, notifications

27 active · 0 planned

Active (27)

id	title	priority	status	personas
integration-system.connector-declarative-boot	Provider-bound declarative connectors materialize at boot for every installed provider kind (rest/openapi/mcp), list with origin:'declarative' state:'ready', and dispatch end-to-end from connector_action	P1	active	—
integration-system.connector-degraded-recovery	An unreachable connector upstream degrades that ONE instance (CONNECTOR_UPSTREAM_UNAVAILABLE) instead of failing boot, retries on 5s→300s backoff, and recovers atomically — while config faults stay boot-fatal	P1	active	—
integration-system.connector-stdio-default-deny	Declarative stdio connector transports are denied by default; the host allowlists exact commands (declarativeStdio) — and the deny is a config fault (boot fatal), not a degrade	P1	active	—
integration-system.connector-spec-path-no-escape	Connector openapi spec file refs resolve package-relative only: './…' works, absolute and '../' escapes reject with the confinement error, missing files fail loudly	P2	active	—
integration-system.connector-descriptor-audit	Descriptor-only connector contracts are audited at boot: declared-with-actions-but-unregistered warns with names + remedy; enabled:false is the deliberate, quiet catalog opt-out	P2	active	—
integration-system.flow-connector-picker	The flow designer's connector picker mirrors GET /automation/connectors: same instances, declarative ones annotated, actions and their input schemas offered per pick	P2	active	admin
integration-system.webhook-lifecycle	Outbound webhooks are read from the registry (spec object→object_name, no sys_webhook row) and switched through the activation ledger, fire per trigger variant through the sys_http_delivery outbox with HMAC + timeout honored, redeliver terminal rows tenant-scoped via POST /api/v1/webhooks/redeliver, and reject retired trigger kinds	P1	active	—
integration-system.job-scheduled-run	Job metadata schedules through every ScheduleSchema variant, executes with retry/timeout enforced, records sys_job/sys_job_run truth, and refuses the closed doors (id key, runtime create, missing handler)	P1	active	—
integration-system.email-template-render	Email templates resolve from the registry (no sys_email_template row since ADR-0131 D6/D10), resolve (name, locale) with en-US fallback, render {{path}} holes, gate on required variables and active:false, survive admin edits across redeploys — and the raw POST /api/v1/email/send door authenticates, requires manage_platform_settings, bounds sentBy, from, headers, organizationId and identityMail, refuses anonymous, and 400s malformed input	P2	active	—
integration-system.notify-inbox-delivery	The flow notify node delivers to the recipient's inbox (sys_inbox_message + receipt), readable and markable over /notifications, recipient-scoped — with unimplemented channels dead-lettering, never faking delivery	P1	active	admin (to reassign the task), the assignee member (to read the inbox), a third member (for the scoping negative)
integration-system.external-datasource-federated-read	A declared external datasource federates: its objects query in place over REST, read-only	P1	active	admin
integration-system.datasource-admin-lifecycle	The /api/v1/datasources admin lifecycle: all 11 routes behind ONE manage_platform_settings floor (drivers catalog included), runtime create with provenance+health, draft test probe, credential migration into the store, secret never echoes (hasSecret only), bad drafts 400 DATASOURCE_ADMIN_ERROR, unwired federation degrades 503 naming external-datasource	P1	active	admin — authenticated AND holding manage_platform_settings (the whole family's capability since #9391/#9593), a second authenticated persona holding NO capability, plus an anonymous probe (for the uniform-floor clause)
integration-system.external-schema-introspection	External-datasource schema introspection happy path: remote-tables lists live tables with columnCount (?schema= honoured since #7955), object-draft renders a reviewable *.object.ts, both route spellings answer as one operation behind the platform auth floor	P1	active	admin — authenticated AND holding manage_platform_settings (BOTH spellings' capability gate since #9901/#10255: admin #9391/#9593, federation FEDERATION_READ_CAPABILITY), a second authenticated persona holding NO capability, plus an anonymous probe (for the auth-floor clause)
integration-system.external-schema-drift-gate	Boot-time external-schema drift gate (ADR-0015 §5.2 Gate 2): onMismatch defaults to 'fail' and refuses boot naming the object and mismatched column; 'warn' proceeds logging the diff; 'ignore' is silent; checkOnBoot:false skips a datasource with a loud info line (boot step only — the interval sweep is unaffected); a partial metadata read withholds the all-clear instead of faking one	P1	active	operator — boots os dev / os serve and reads the boot log / exit; no in-app persona needed
integration-system.notification-preference-suppression	A recipient preference muting the inbox channel for a topic suppresses delivery (no inbox row, no dead-letter fake); flipping it back resumes; a sys_notification_template renders through a delivery	P2	active	admin (to fire the notify flow by reassigning the task), the assignee member (whose inbox is checked)
integration-system.datasource-credential-refusal-matrix	A shipped driver's datasource credential can never be authored inline NOR read back: every inline-credential door refuses at publish, and BOTH read doors redact, including legacy alias spellings already sitting in stored rows. A plugin driver's config is its author's to keep credential-free; the platform redacts only its fixed credential spellings there and does not guess	P0	active	seeded admin, authenticated non-admin, anonymous
integration-system.connector-auth-kind-application	Declarative connector static auth kinds (none/api-key/basic/bearer) resolve credentialRef at materialization and land on the wire in exactly their header/query shape; an unresolvable credentialRef degrades its instance, naming the reference, instead of failing the boot; every authored auth kind refuses an inline secret, and oauth2 is open tier with strict keys and a required grant (ADR-0143 D1)	P1	active	—
integration-system.external-schema-browser-ui	Setup → Datasources federation UI (ADR-0015 §6.4): SchemaBrowser mirrors the remote-table listing, ImportObjectDialog lands a REAL object through the metadata channel, Refresh catalog and ValidationPanel drive the three previously-uncovered federation routes (import / refresh-catalog / validate) behind their capability floors	P1	active	admin — authenticated, holding manage_platform_settings (federation reads: tables/validate) AND manage_metadata (federation writes: import/refresh-catalog, which require manage_platform_settings as well, and the /meta write the UI import performs), a second authenticated persona holding NO capability, plus an anonymous probe (for the floor clause)
integration-system.inbound-mailbox-association	Inbound mail (new on v18): with requires:["mailbox"] and an IMAP mailbox, a synced message is stored as sys_mail_message and associated with the record whose mailAssociation email field matches (inline forwards by an org member match on the original participants), attachments land as sys_file + sys_attachment, and an unmatched message is visible only to manage_mailboxes holders	P2	active	seeded admin (admin@objectos.ai / admin123) — the Default Organization owner and platform admin on a fresh boot, org member — created by the admin with POST /api/v1/auth/admin/create-user (stock showcase self-registration is closed: audience posture invite_only answers sign-up 403 SELF_REGISTRATION_CLOSED); joins the Default Organization as member, not platform admin, and lands mustChangePassword:true, i.e. a HELD session until it changes its password (POST /api/v1/auth/change-password)
integration-system.notification-org-and-redeliver-eligibility	Messaging and integration answers on v18: a notify from a system-context run stores the organization of the record it is about (never NULL), mark-read writes a receipt only for notifications delivered to the caller, redelivering for an inactive or deleted webhook subscription is 409 DELIVERY_NOT_ELIGIBLE, and a declarative MCP stdio connector with a relative command boots healthy from another directory	P2	active	seeded admin (admin@objectos.ai / admin123) — the Default Organization owner and platform admin on a fresh boot, org member — created by the admin with POST /api/v1/auth/admin/create-user (stock showcase self-registration is closed: audience posture invite_only answers sign-up 403 SELF_REGISTRATION_CLOSED); joins the Default Organization as member, not platform admin, and lands mustChangePassword:true, i.e. a HELD session until it changes its password (POST /api/v1/auth/change-password)
integration-system.job-package-key	Two packages may each declare a job of one name: the first holder keeps the bare job key, the second is armed under PACKAGE_ID:NAME, and both keys survive a restart unchanged	P2	active	admin (the seeded admin)
integration-system.federation-only-driver-catalog	The driver catalog marks oracle and mssql federation-only, and Studio's New datasource dialog offers them External and Validate only, saying why Managed is not offered	P2	active	seeded admin (admin@objectos.ai / admin123), over REST and in Setup
integration-system.federation-only-managed-refusal	A managed datasource on a federation-only driver is refused at the admin door and at build, naming schemaMode and the fix; an oracle config refuses an inline password and a URL with the sentence that says what to write	P1	active	seeded admin (admin@objectos.ai / admin123), over REST, a developer running os validate
integration-system.oracle-federated-read-write	An Oracle datasource reads its tables as objects, refuses an empty-string comparand (Oracle stores '' as NULL), writes only under the double opt-in, and refuses upsert as a capability gap	P1	active	seeded admin (admin@objectos.ai / admin123), over REST
integration-system.oracle-raw16-uuid-reference	An Oracle RAW(16) key reads as a lower-case uuid, is filtered and written by that text, a reference over it resolves, and a comparand or written value that is not uuid text is refused	P2	active	seeded admin (admin@objectos.ai / admin123), over REST
integration-system.mssql-federated-read-write	A SQL Server datasource reads its tables as objects, matches a uniqueidentifier column in text operators by the lower-case text every read answers, keeps case-exact matching exact, and writes only under the double opt-in	P1	active	seeded admin (admin@objectos.ai / admin123), over REST
integration-system.push-device-registry-and-relay-boot	Mobile push: a device registers under the caller's session with its server origin, the push service boots on the hosted relay only where requires names push, and an air-gapped or unrequested push key says why at boot	P2	active	seeded admin (admin@objectos.ai / admin123): the device calls, org member — created by the admin with POST /api/v1/auth/admin/create-user, password changed so the session is not held: the other-user DELETE, operator (local shell): the three scratch boots