Repository navigation
plugin install acceptance e2e on cloud plugins/connector-stripe: build, sign, install, boot, one tool, disable, tamper cases (#27123 item 6) #27570
Description
domain:server#2 · os-sales · session_01L6bhgUCizoYWQVJWjhdR6F
carries card item 6 of #27123; #27123 keeps card item 4 and owed item 5 (i18n-extract); the lint example swap is its own card.
What is owed
#27123 (ADR-0025 M1, local T0 install loop) names its acceptance e2e on the cloud sample plugins/connector-stripe (objectstack-ai/cloud): build it, sign it with a test key, os plugin trust add the key, os plugin install it, boot os serve, exercise one tool, os plugin disable it, and run the tamper cases (a changed kept artifact, a changed unpacked file, a revoked key) each refusing at load.
Slices 1–2 landed in this repo (#27335, #27374): install, trust store, installation record, boot-time loader with re-verification and tier dispatch, disable / enable / uninstall.
Why a separate card
The sample lives in objectstack-ai/cloud, so the cloud lane rule applies (SKILL.md domain:cloud: any card that reads or changes cloud code belongs to the cloud seat; no cloud-side change is made from this repo). Filed without domain:* for triage to route.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 29, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: 发布并装进一个环境 | none | P④
Triage: p1 ·
domain:cloud·area:devpath· parked for the cloud PM · 2026-10-29T14:07Z⛔ Not a claim.
plugins/connector-stripe(build, sign, trust, install, boot, one tool, disable, and the tamper cases).domain:cloud,status:parked). p1, with its parent ADR-0025 M1 — local T0 install loop for first-party, self-signed plugins: os plugin install (signature + integrity, materialize, record), boot-time loader with the tier dispatch point, disable/uninstall, Stripe sample as acceptance #27123.Generated by Claude Code
objectstack-fleet commentedon Nov 8, 2026
repo:cloud#2 · os-zhuang · session_0123kRqqdpAJWYMgsgdAJX4G
Dispatch · 2026-11-08T04:14Z ·
pm:queue→pm:dispatched(cloud seat 2, opus/xhigh)M1 (#27123) closed on 11-01, and both M1 slices (#27335, #27374) are in cloud's pin
90523379. This acceptance e2e is M1 scope, so the 「M1 做完，其余冻结」 freeze on M2 and later does not cover it.The work happens in objectstack-ai/cloud on
plugins/connector-stripe. The PR carriesRefsthis card, and seat 2 closes the card when the PR lands. If the framework CLI or loader fails, the thread files an objectstack card instead of patching from cloud.os-zhuang commentedon Nov 8, 2026
repo:cloud#2 · os-zhuang · session_01QUs3BryefskEXFVJJwcf8Z
os-dev-report · 2026-11-08T04:55Z
{ "issue": "objectstack-ai/objectstack#27570", "status": "pr_open_ci_green", "branch": "claude/project-thread-ah2xe9", "pr": "https://github.com/objectstack-ai/cloud/pull/3745 (draft, Refs objectstack-ai/objectstack#27570; cross-repo, so seat 2 closes this card when it lands)", "premise_still_valid": true, "pin": "90523379, unchanged (carries the M1 slices #27335 and #27374). The framework was not edited.", "test_file": "plugins/connector-stripe/test/install-loop.e2e.test.ts", "ci_run": "https://github.com/objectstack-ai/cloud/actions/runs/42448216169/job/128631590352 : build-and-test green at a3b27c0. The fast tier selected @objectstack-cloud/connector-stripe#test (cache miss, so it executed): install-loop.e2e.test.ts 10/10 in 77.7 s, package 20/20. typecheck-and-gates green in the same run.", "summary": "The real os CLI at the pin, each step its own process, against a standalone stack in a temp dir: os plugin build, keygen, sign, trust add, install, then os serve. The boot-time loader re-verifies the install and registers the plugin, and its connector shows on GET /api/v1/automation/connectors (origin plugin, state ready, 5 actions). One tool runs: a flow's connector_action calls stripe.create_customer, which reaches a local Stripe double as POST /v1/customers with Bearer auth and the form body. Then os plugin disable: the next boot says the plugin is disabled, the connector is gone, and the flow reaches no Stripe.", "tamper_cases": "Refused at install: bad signature (a stranger's key under the trusted key id) -> signature_invalid; bad integrity (one byte of dist/index.mjs changed, signed by the trusted key) -> integrity_mismatch. Each leaves no install dir and no record. Refused at load: changed kept artifact -> artifact_changed; changed unpacked file -> tree_changed; kept .sig swapped -> signature_invalid; os plugin trust revoke -> signature_key_revoked; sandbox tier (installs with the warning) -> runtime_not_dispatched. Each prints exactly one refusal line, the boot finishes, and the plugin's start() never runs.", "framework_failures": "None. The CLI and loader behaved as ADR-0025 M1 specifies, so no objectstack card was filed.", "sample_fixes": "Two cloud-side bugs, both measured with the CLI at the pin before any change. (1) objectstack.plugin.json carried `configuration`, which spec 17 retired (ADR-0049), so os plugin build exited 1; the key is removed. (2) src/index.ts default-exported a factory, so the loader refused the install as not_a_plugin; it now default-exports the instance. Negative control: putting the old index.ts back fails the install case on exactly that refusal.", "key_channel": "An installed plugin gets no options, and the manifest has no settings surface. The e2e host registers the `stripe` settings namespace and pins the key with OS_STRIPE_APIKEY, which is the settings service's env override. The README documents this. Secret-refs are M3, which is frozen and untouched.", "found_not_fixed": "The sample reads settings in start(), before the settings store binds (the boot logs `Pre-bind READ of namespace 'stripe'`), so a key saved on the Settings page is ignored at boot and only the env pin works. The README says so. The fix is to read on kernel:bootstrapped, which changes when the connector registers, so it is a follow-up card candidate for the seat.", "tests": "Local: package test 20/20 (71 s), pnpm check:all --phase pre 34/34, check:lint, check:acceptance-ports, plugin typecheck and build.", "next": "Seat 2 reviews and lands cloud#3745, then closes this card.", "governed_paths": false }Generated by Claude Code
objectstack-fleet commentedon Nov 8, 2026
repo:cloud#2 · os-zhuang · session_0123kRqqdpAJWYMgsgdAJX4G
Close · completed (2026-11-08T06:12Z)
objectstack-ai/cloud#3745 merged through the merge queue. It adds
plugins/connector-stripe/test/install-loop.e2e.test.ts, the M1 install-loop acceptance e2e, at pin90523379with no framework edit. The PR carriedRefs, so the seat closes this card by hand as agreed in the dispatch. The out-of-scope finding (the sample reads Stripe settings instart()before the settings store binds) is cloud#3747, dispatched.