Current synthesis from the research packet. Exact records and complete source artifacts remain visible below.
Separate catalogue, OAuth engine, connection storage and action runtime; prove one tenant-safe connector flow.
research/actionmodel-builder-research-2026-08-26/phase-8/external-opus-inputs/connectors/connector-research-summary.mdresearch/openconnector-spike-2026-08-27.mdresearch/connectors-licensing-2026-08-27.mdLovable reached roughly 100 connectors in six months by building them; the permissively licensed catalogues already carry far more, and Activepieces alone ships 113 OAuth2 integrations with refresh logic and credential encryption. Importing the catalogue while owning tenant-keyed connections and the action ledger converts their multi-year roadmap into an integration exercise.
32 mined records. Search and inspect the full agent output; nothing is collapsed into a top-ten headline.
| Rank | Identity | What the agent found | Evidence | Source |
|---|---|---|---|---|
| — | Paragonembedded-ipaas | Embedded iPaaS with managed integration auth; markets an explicit AI-agent security posture (tokens never exposed to agent runtime). | observedregister | Source ↗ |
| — | Merge.devunified-api | Unified API across HRIS/ATS/CRM/file-storage etc.; per-end-user Linked Accounts addressed by account_token. | observedtop10 | Source ↗ |
| — | Pipedream Connectembedded-ipaas | Managed auth + connector runtime where the host app's own user identity is the isolation key. | observedregister | Source ↗ |
| — | Arcade.devagent-actions | Explicitly positions as an actions/MCP runtime for agents, with per-tool OAuth scopes and token injection so the model never sees a token. | observedtop10 | Source ↗ |
| — | Zapier AI Actionsagent-actions | Exposes Zapier actions to AI apps with a first-class preview-before-execute contract. | observedtop10 | Source ↗ |
| — | OpenAI ChatGPT Apps / Actionsagent-actions | Ships a tiered, admin-governable consent model graded by action consequence rather than a binary allow/deny. | observedtop10 | Source ↗ |
| — | Basis Theorycredentials | Tokenization vault whose Proxy lets a system USE a secret in an outbound call without ever holding the plaintext. | observedtop10 | Source ↗ |
| — | Prismaticembedded-ipaas | Embedded iPaaS built on an integration/instance split: one definition deployed as many per-customer instances. | observedregister | Source ↗ |
| — | Apideck Vault / Unifyunified-api | Unified API where a single consumer ID drives server-side token look-up and injection. | observedregister | Source ↗ |
| — | Browserbase + Stagehandbrowser-automation | Productizes the browser itself as a connector runtime for services with no usable API. | observedtop10 | Source ↗ |
| — | Anthropic MCP / Connectors Directoryagent-actions | Curated registry of MCP servers gated by a published safety policy, with initial AND ongoing review. | observedregister | Source ↗ |
| — | Alloy Automationembedded-ipaas | Embedded iPaaS plus unified/connectivity API; connector actions follow discover -> schema -> create credential -> execute. | observedregister | Source ↗ |
| — | Workato Embeddedembedded-ipaas | Enterprise embedded iPaaS with nested per-customer workspaces and an explicit agentic layer. | observedregister | Source ↗ |
| — | HashiCorp Vaultcredentials | Reference implementation of dynamic, leased, auto-revoked credentials. | observedregister | Source ↗ |
| — | Infisicalcredentials | MIT-licensed community edition with a Vault-shaped dynamic-secrets model. | observedregister | Source ↗ |
| — | Dopplercredentials | Static-secret storage and sync with strong developer ergonomics. | observedrejected | Source ↗ |
| — | Anonbrowser-automation | User-permissioned auth layer letting agents act as the user inside services with no clean API. | observedregister | Source ↗ |
| — | Cross-vendor idempotency gapunified-api | SYNTHESIS ROW, not a company: across every surface read, documented WRITE-side idempotency keys were essentially absent. | inferredregister | Source ↗ |
| — | Stripe (idempotency-key contract)reference-contract | THE positive control for the whole P11 idempotency question: a fully specified, publicly documented client-supplied idempotency-key contract on a high-volume money-moving API. Every other surveyed surface should be measured against this. | observedtop10 | Source ↗ |
| — | Composio (as paid hosted dependency)agent-actions | Re-surveyed deliberately as a PAID HOSTED DEPENDENCY rather than as OSS. The MIT badge covers an SDK that calls a metered hosted API; the economics and credential custody below are the real integration decision. | observedtop10 | Source ↗ |
| — | Paragon (docs security page - flag (a) resolution)embedded-ipaas | RESOLVES EVIDENCE-HONESTY FLAG (a) from P11-C-001. The prior agent could not reach a docs security page (URL 404'd) and had to rest on marketing. The real page EXISTS at https://docs.useparagon.com/security/security - and it materially contradicts the blog. | observedtop10 | Source ↗ |
| — | Anon (flag (b) resolution - UNVERIFIED)browser-automation | RESOLVES EVIDENCE-HONESTY FLAG (b) from P11-C-017 as NEGATIVE. The 'never stores credentials' claim CANNOT be verified and must stay labelled marketing. | observedrejected | Source ↗ |
| — | Finchunified-api | Unified API for HR and payroll; one access token per employer connection. Notable as a HIGH-CONSEQUENCE write surface (payroll deductions, benefit enrolment) with NO idempotency key. | observedregister | Source ↗ |
| — | Kombounified-api | Unified API for HR tech (HRIS, ATS, LMS, ATS-Assessment), Europe-oriented, with a broad write surface across all four verticals. | observedregister | Source ↗ |
| — | Hotglueembedded-ipaas | Embedded ETL/iPaaS for SaaS vendors shipping integrations to their own users; built on the open connector ecosystem (Singer spec and Airbyte YAML). | observedregister | Source ↗ |
| — | OpenAI AgentKitagent-actions | OpenAI's first-party agent-building stack: Agent Builder (visual multi-agent workflow canvas with versioning), ChatKit (embeddable agent UI), Connector Registry (central admin control of data/tool connections), and expanded Evals. | observedtop10 | Source ↗ |
| — | Skyvernbrowser-automation | LLM-driven browser automation - a Playwright Page augmented with AI methods (act, extract, validate, prompt) plus an agent task loop. Available self-hosted and as cloud (app.skyvern.com / api.skyvern.com). | observedregister | Source ↗ |
| — | Hyperbrowserbrowser-automation | Hosted cloud-browser infrastructure for AI agents and scraping, plus a separate sandbox compute primitive (volumes, images, snapshots). | observedrejected | Source ↗ |
| — | Browser Use Cloudbrowser-automation | Hosted arm of the popular Browser Use OSS project: two products - Agents ('give an agent a task and get the result') and Browser Infrastructure (a cloud browser you drive over CDP). | observedregister | Source ↗ |
| — | HCP Vault Dedicatedcredentials | HashiCorp-operated hosted Vault Enterprise. Included specifically to test whether the lease/dynamic-secret invariant that made P11-C-014 valuable survives in the managed form - it does. | observedregister | Source ↗ |
| — | Trutounified-api | Unified API positioned for SaaS products AND AI agents; claims 700+ integrations across 50+ categories, declarative config-driven connectors ('connectors as data, not code'), launched 2023. | observedregister | Source ↗ |
| — | Vesselunified-api | Developer-first native integration platform with unified APIs across CRM, Sales Engagement, Chat, Marketing Automation and Dialer, plus an Action API of prebuilt actions and managed data pipelines. | observedrejected | Source ↗ |
45 mined records. Search and inspect the full agent output; nothing is collapsed into a top-ten headline.
| Rank | Identity | What the agent found | Evidence | Source |
|---|---|---|---|---|
| — | temporalio/temporalretry-workflow | Durable execution server: workflow state persisted as an event history, so retries, timers and long-running action sequences survive process death. 22.5k stars, pushed 2026-08-27. | observedregister | Source ↗ |
| — | restatedev/restateretry-workflow | Durable execution runtime with built-in idempotency keys on invocations and a single embedded binary — far lighter to run than Temporal for the same durable-retry guarantee. 4.3k stars, pushed 2026-08-27. | observedregister | Source ↗ |
| — | inngest/inngestretry-workflow | Event-driven durable step functions with automatic retry/backoff per step and a local dev server. 5.8k stars, pushed 2026-08-27. | observedrejected | Source ↗ |
| — | triggerdotdev/trigger.devretry-workflow | Background-job platform with durable retries, checkpoint/resume and concurrency controls, self-hostable. 16.1k stars, pushed 2026-08-27. | observedregister | Source ↗ |
| — | hatchet-dev/hatchetretry-workflow | Postgres-backed distributed task queue with durable execution, retries and rate limits — no separate broker beyond Postgres. 7.8k stars, pushed 2026-08-27. | observedtop10 | Source ↗ |
| — | resonatehq/resonateretry-workflow | Durable promises as the primitive: async/await semantics that survive crashes, deliberately smaller surface than Temporal. 657 stars, pushed 2026-08-27. | observedregister | Source ↗ |
| — | dbos-inc/dbos-transact-tsretry-workflow | Durable workflows as a TypeScript library backed by Postgres — no separate server process, which is the lightest embeddable durable-execution seam found. 1.3k stars, pushed 2026-08-26. | observedtop10 | Source ↗ |
| — | paveg/hono-idempotencyidempotency | Stripe-style Idempotency-Key middleware implementing IETF draft-ietf-httpapi-idempotency-key-header: SHA-256 request fingerprinting to block key reuse with a different payload, optimistic locking for concurrent replays, RFC 9457 problem details, non-2xx deliberately not cached, pluggable memory/Redis/KV/D1 stores. README read directly. | observedtop10 | Source ↗ |
| — | hardcoretech/djangorestframework-idempotency-keyidempotency | DB-backed idempotency-key middleware for Django REST Framework; second-most maintained idempotency package located. 14 stars, pushed 2026-08-11. | observedregister | Source ↗ |
| — | stripe/stripe-nodeidempotency | Reference CLIENT-side implementation of idempotency-key generation and automatic safe retry against a server that honours the header. 4.5k stars, pushed 2026-08-27. | observedregister | Source ↗ |
| — | upstash/ratelimit-jsrate-limit | Redis-backed rate limiting with fixed-window, sliding-window and token-bucket algorithms plus multi-region support; small enough to read end to end. 2.0k stars, pushed 2026-08-24. NOTE: canonical repo is upstash/ratelimit-js, not upstash/ratelimit. | observedtop10 | Source ↗ |
| — | envoyproxy/ratelimitrate-limit | Standalone gRPC rate-limit service with hierarchical domain/descriptor config — the production pattern for a limiter shared across many callers. 2.7k stars, pushed 2026-08-26. | observedregister | Source ↗ |
| — | ThreeDotsLabs/watermilloutbox | Go event-driven library with a first-class Forwarder/outbox component: publish inside the DB transaction, forward to the broker after commit — the transactional-outbox seam as a library. 9.9k stars, pushed 2026-08-25. | observedtop10 | Source ↗ |
| — | debezium/debeziumoutbox | CDC platform with a documented outbox-event-router SMT — the reference implementation of the transactional outbox pattern at scale. 13.0k stars, pushed 2026-08-27. | observedregister | Source ↗ |
| — | obsidiandynamics/goharvestoutbox | Focused Go implementation of Postgres-to-Kafka outbox harvesting with leader election. | observedrejected | Source ↗ |
| — | openbao/openbaosecrets | Linux Foundation fork of Vault taken from the last MPL-2.0 commit before the BSL relicense; keeps dynamic secrets, leasing/renewal, transit encryption and audit under a genuine OSI licence. 7.2k stars, pushed 2026-08-27. | observedtop10 | Source ↗ |
| — | hashicorp/vaultsecrets | The incumbent secrets manager: dynamic secrets, leasing, transit encryption, broad audit. 36.2k stars, pushed 2026-08-26. | observedrejected | Source ↗ |
| — | Infisical/infisicalsecrets | Developer-friendly secrets platform with per-environment secrets, rotation and dynamic secrets; strong UX for the credential-management surface. 29.0k stars, pushed 2026-08-27. | observedregister | Source ↗ |
| — | getsops/sopssecrets | CNCF file-level encryption for config and secrets with KMS/age/PGP backends; encrypts values while leaving keys readable in git. 22.9k stars, pushed 2026-08-26. | observedregister | Source ↗ |
| — | bitnami/sealed-secretssecrets | One-way-encrypted Kubernetes Secrets safe to commit to git; controller decrypts in-cluster. 9.3k stars, pushed 2026-08-27. NOTE: repo has moved to bitnami/sealed-secrets. | observedrejected | Source ↗ |
| — | oauth2-proxy/oauth2-proxytoken-broker | Battle-tested reverse proxy performing OAuth2/OIDC against many providers, with session and token storage. 14.9k stars, pushed 2026-08-27. | observedregister | Source ↗ |
| — | ory/hydratoken-broker | Certified OAuth2/OIDC server with a hardened token lifecycle: issuance, refresh, rotation, revocation and introspection. 17.5k stars, pushed 2026-07-29. | observedregister | Source ↗ |
| — | dexidp/dextoken-broker | CNCF federated OIDC provider that brokers to upstream identity providers via connectors — the closest OSS analogue to a multi-provider credential broker. 11.1k stars, pushed 2026-08-24. | observedregister | Source ↗ |
| — | svix/svix-webhookswebhooks | Webhook-sending service with signature verification, retry schedules, endpoint management and replay. 3.4k stars, pushed 2026-08-26. | observedtop10 | Source ↗ |
| — | frain-dev/convoywebhooks | Webhook gateway handling both ingest and dispatch with retries, rate limiting, fan-out and a replay UI — functionally the best fit for the connector webhook plane. 2.9k stars, pushed 2026-08-27. | observedrejected | Source ↗ |
| — | hookdeck/hookdeck-cliwebhooks | Apache-2.0 CLI for local webhook forwarding and replay against the Hookdeck service. 360 stars, pushed 2026-08-24. | observedrejected | Source ↗ |
| — | modelcontextprotocol/serversmcp-runtime | Reference MCP server collection, the de facto catalog of the MCP tool ecosystem. 89.9k stars, pushed 2026-08-20. | observedregister | Source ↗ |
| — | modelcontextprotocol/registrymcp-runtime | Official community registry for MCP server discovery — the closest thing to a canonical connector catalog for the MCP ecosystem. 7.2k stars, pushed 2026-08-26. | observedregister | Source ↗ |
| — | lasso-security/mcp-gatewaymcp-runtime | Security gateway sitting between agent and MCP servers to inspect and filter tool traffic, including secret-leak detection — one of very few OSS projects owning MCP runtime safety. | observedregister | Source ↗ |
| — | Portkey-AI/gatewaymcp-runtime | Fast AI gateway with retries, fallbacks, load balancing and guardrails across providers — a mature example of the interception-point pattern applicable to tool calls. 12.8k stars. | observedregister | Source ↗ |
| — | microsoft/playwrightbrowser-runtime | The browser-automation substrate nearly every agentic browser tool builds on: cross-browser, strong isolation via contexts, deterministic waiting. 95.2k stars, pushed 2026-08-26. | observedtop10 | Source ↗ |
| — | Skyvern-AI/skyvernbrowser-runtime | LLM-driven browser workflow automation for sites with no API — directly relevant to the long tail of connectors. 22.9k stars, pushed 2026-08-27. | observedrejected | Source ↗ |
| — | browser-use/browser-usebrowser-runtime | Most-starred agentic browser library at 111.3k stars, pushed 2026-08-26; MIT, unlike the AGPL Skyvern alternative. | observedregister | Source ↗ |
| — | browserbase/stagehandbrowser-runtime | Playwright-layered automation exposing act/extract/observe primitives, allowing deterministic Playwright and AI steps to be mixed in one script. 24.1k stars, pushed 2026-08-27. | observedregister | Source ↗ |
| — | e2b-dev/infrasandbox | The self-hostable Firecracker-based infrastructure behind E2B sandboxes — the actual isolation layer, as opposed to the SDK repo. 1.3k stars, pushed 2026-08-27. | observedtop10 | Source ↗ |
| — | firecracker-microvm/firecrackersandbox | AWS microVM monitor giving hardware-virtualization isolation with ~125ms boot — the strongest isolation-per-millisecond boundary available for untrusted action code. 36.3k stars, pushed 2026-08-26. | observedregister | Source ↗ |
| — | google/gvisorsandbox | Userspace kernel intercepting syscalls to isolate containers without full virtualization; runs as an OCI runtime, so it drops into existing container tooling. 19.2k stars, pushed 2026-08-27. | observedregister | Source ↗ |
| — | cloudflare/workerdsandbox | The Workers runtime: V8 isolates with per-isolate memory limits and a capability-style binding model where code reaches only explicitly granted resources. 8.6k stars, pushed 2026-08-27. | observedregister | Source ↗ |
| — | denoland/denosandbox | JS/TS runtime with deny-by-default permissions: --allow-net, --allow-read and friends make egress and filesystem access an explicit per-process grant. 108.3k stars, pushed 2026-08-26. | observedregister | Source ↗ |
| — | bytecodealliance/wasmtimesandbox | WASM runtime with capability-based WASI security: a module has no ambient authority and can touch only pre-opened handles the host grants. 18.6k stars, pushed 2026-08-26. | observedregister | Source ↗ |
| — | nestybox/sysboxsandbox | OCI runtime enabling unprivileged containers to run Docker/systemd inside, strengthening the container boundary without a VM. 3.8k stars, pushed 2026-08-25. | observedregister | Source ↗ |
| — | open-policy-agent/opaaction-policy | Graduated CNCF general-purpose policy engine; Rego can express per-tenant allow/deny over an action request including target host, method and parameters, evaluated as a library in-process. 12.2k stars, pushed 2026-08-27. | observedtop10 | Source ↗ |
| — | cerbos/cerbosaction-policy | Authorization service with YAML resource/action policies — markedly more readable than Rego and natively shaped as principal-performs-action-on-resource, which maps directly onto tool calls. 4.6k stars, pushed 2026-08-27. | observedregister | Source ↗ |
| — | permitio/opalaction-policy | Real-time policy and data distribution layer keeping OPA agents live-synced with policy and application data — the missing piece for revoking a tenant's connector permission instantly. 5.5k stars, pushed 2026-08-24. | observedregister | Source ↗ |
| — | apache/casbinaction-policy | Embeddable authorization library with a model/policy split and mature ports across most languages. 20.4k stars, pushed 2026-08-21. NOTE: repo now redirects to apache/casbin. | observedregister | Source ↗ |
21 mined records. Search and inspect the full agent output; nothing is collapsed into a top-ten headline.
| Rank | Identity | What the agent found | Evidence | Source |
|---|---|---|---|---|
| 1 | Server-side idempotency keyed per tenant and connector with request fingerprinting— | The highest-consequence must-build. Key store, SHA-256 request fingerprint so a reused key with a mutated payload is a hard error, optimistic locking for concurrent replays, TTL, and an explicit replay receipt header. Every action declares its idempotency class and the runtime refuses to auto-retry the unsafe class, defaulting to unsafe when undetermined. | observedtop10 | — |
| 2 | Idempotency layer positioned inside the rate limiter and auth check— | Ordering is load-bearing, not an implementation detail. If the rate limiter runs first, a throttled request can produce a different result under the same key, and the key's safety guarantee silently does not apply. | observedtop10 | — |
| 2 | Outbound token broker with per-tenant-per-connector custody— | Storage, auto-refresh, rotation and instant revocation for many long-lived third-party tokens. The caller passes an identity, never a secret; the broker injects credentials server-side so generated app code and model context never hold a third-party token. Refresh 15 minutes early under a lock keyed by tenant and connection, discriminating invalid_grant (user's problem, mark the connection ERROR) from invalid_client and invalid_scope (our bug, must not mark the connection bad). | observedtop10 | — |
| 3 | Tenant-keyed connection store with per-tenant key derivation— | Tenant column from the first migration, per-tenant key derivation, stable externalId as the reference rather than a UUID or display name, envelope encryption with AAD asserting purpose and app so a wrapped key cannot be replayed elsewhere. | observedtop10 | — |
| 4 | Dry-run as a non-disableable first-class action mode— | Return the exact resolved outbound request that would be sent, with empty results and no side effect, on by default and forceable by the action author so a tenant cannot disable it. | observedtop10 | — |
| 5 | Unified per-tenant action-attempt ledger— | Every attempt, retry, idempotency replay, policy denial and approval in one queryable trail, with receipts that deliberately exclude payload bodies. | inferredtop10 | — |
| 6 | Egress allow-list derived from the connector manifest and bound to an enforcing proxy— | Supply the enforcement half that policy engines lack, with live revocation so disabling a connector takes effect immediately rather than at cache expiry. | observedtop10 | — |
| 7 | Named connection selection with no ambient authority— | When a tenant holds several accounts for one provider, the action must name which connection it uses. Silent selection is a defect class. | observedtop10 | — |
| 8 | Consent graded by consequence with policy on action payload— | Three tiers (read, reversible, irreversible-or-financial) defaulting to the middle, with policy evaluated over the payload itself (amount, recipient, record count) and a human-approval branch above a per-tenant threshold, expressible as a composable workflow step. | observedtop10 | — |
| 9 | Browser connectors as a separate authority class— | Browser automation must not inherit the API connector's authority model, because its credential is a replayable session blob rather than a scoped token. | observedtop10 | — |
| 11 | Per-tenant-per-connector fair-share rate limiting with provider-signal backoff— | One tenant cannot exhaust a shared third-party quota; backoff honours Retry-After and observed 429 rates per connector rather than a fixed exponential curve. | observedregister | — |
| 11 | Effectively-once composition— | Transactional outbox for delivery plus a consumer-side idempotency gate, since at-least-once delivery alone never reaches once. | inferredregister | — |
| 12 | Signed connector manifests with provenance checked at load— | Fill the trust gap the MCP registry leaves open. | observedregister | — |
| 13 | Capability-binding execution with tiered sandbox selection— | No ambient network or filesystem, only injected capabilities; sandbox tier selected per action from its manifest (isolate for trusted, gVisor for semi-trusted, microVM for arbitrary). | observedregister | — |
| 14 | Webhook ingest with signature verification and operator-triggered replay— | Durable capture of inbound callbacks with replay, covering the half Svix does not. | observedregister | — |
| 15 | Durable execution as an embedded library rather than a server— | Keep the runtime deployable as one artifact by preferring a library-shaped durable-execution engine over a server with its own persistence and matching tiers. | observedregister | — |
| 16 | Catalogue state flags so a listed integration is never mistaken for an executable one— | Keep catalogue-only, needs-credential and locally-executable distinct, enabling a large browsable catalogue where only some entries are wired without lying to the agent about what it can call. | observedregister | — |
| 17 | Generated setup forms from constrained provider schemas— | Render every connector's credential step from data rather than maintaining one component per connector. | observedregister | — |
| 18 | Scope-aware action gating— | Surface per-action requiredScopes against the connection's grantedScopes to enable reconnect-with-more-scopes, and capture a CredentialProfile at connect time so the UI can say who an action runs as without exposing the token. | observedregister | — |
| 19 | Fail fast on ambiguous or unsafe configuration— | Refuse to boot on mutually exclusive credential configuration rather than silently choosing, and never degrade to plaintext storage. | observedregister | — |
| 20 | Connect-session token with origin-checked postMessage handshake— | Server mints a short-lived token scoped to allowed integrations per customer; the iframe is created without the token in the URL, the child posts ready, the parent verifies event.origin and only then posts the token, keeping secrets out of browser history, referrers and access logs. | observedregister | — |
7 mined records. Search and inspect the full agent output; nothing is collapsed into a top-ten headline.
| Rank | Identity | What the agent found | Evidence | Source |
|---|---|---|---|---|
| — | P11-S-001local-research-report | Licensing map verified from LICENSE bodies: OpenConnector Apache-2.0 (1,445 provider dirs confirmed via git trees API, truncated false, 7,338 entries, 39.5MB provider source; definition.ts 1445/1445, executors.ts 1445/1445, actions.ts 1443/1445); Activepieces MIT except packages/ee; Composio MIT covers the SDK only with toolkits behind a paid API; Nango and Airbyte ELv2 with the hosting clause quoted; n8n fair-code; dify bars multi-tenant operation verbatim; panoratech/Panora AGPL-3.0; langgenius/dify-plugins licence NONE. Auth-type mix from the live Activepieces API: 761 pieces, SECRET_TEXT 374, CUSTOM_AUTH 205, OAUTH2 96, none 75, BASIC_AUTH 11. Nango 982 providers with 91.1% pure data (895 of 982 carry no scripts) but 17 of the 36 'popular' providers are scripted. Activepieces-Nango overlap only 182 of ~1,500 distinct services. jentic/jentic-public-apis CC0-1.0 with 4,140 vendor dirs verified via git trees. | observedload-bearing | clients/actionmodel/research/connectors-licensing-2026-08-27.md |
| — | P11-S-002local-execution-receipt | Executed spike, since cleaned up: local generator produced 1,445 providers and 15,156 actions from repo source with no network; server booted with 11 migrations in 10ms; a no-auth Hacker News action and an authenticated GitHub action both executed live; credentials verified encrypted at rest by reading the SQLite file directly; a fake token was rejected by live credential verification before persistence; CredentialProfile auto-resolved; a correctly parameterized Google Drive OAuth authorization URL was generated with access_type=offline and encrypted state. Corrected auth-type counts from the running server: api_key 1302, oauth2 103, custom_credential 75, no_auth 20. Tenancy falsifier demonstrated not inferred: two tenant connections returned together in one flat list under a single admin token; connections keyed (service, connection_name) with no tenant column; oauth_client_configs keyed on service alone; keySalt a hardcoded constant; secret codec silently returns PlainTextSecretCodec when the key is unset; runtime API auth is a third switch separate from admin auth. | observedload-bearing | clients/actionmodel/research/openconnector-spike-2026-08-27.md |
| — | P11-S-003local-research-input | Architecture implications already settled: treat catalogue, credential runtime and tenant connection store as separate governed blocks; import declarative provider metadata where rights permit; generate setup forms from constrained provider schemas rather than one React component per connector; use short-lived capability-scoped runtime tokens, stable external IDs, refresh locks, explicit refresh errors, envelope-encryption AAD and lazy executor loading; keep catalogue-only, needs-credential and locally-executable states distinct. | observedgoverning | clients/actionmodel/research/actionmodel-builder-research-2026-08-26/phase-8/external-opus-inputs/connectors/connector-research-summary.md |
| — | P11-S-004local-synthesis | A26 connector catalogues cannot be adopted with their storage layers (rejected, with the OpenConnector admin-token receipt); A27 OpenConnector catalogue/OAuth/action mechanics are reusable, observed at spike level. | observedgoverning | clients/actionmodel/knowledge/02-ASSUMPTION-LEDGER.md |
| — | P11-S-005local-research-report | The 27 Aug correction: the teardown's 'connectors = ZERO for the scoped case' row was wrong because owning Actionist's own DB says nothing about a client dashboard wanting Gmail, Slack, Stripe, HubSpot or Notion. Records the method lesson that a confident ZERO in a buy-vs-build table deserves one search before it ships. Lovable ships roughly 100 connectors. | observedsupporting | clients/actionmodel/research/lovable-teardown-2026-08-26.md |
| — | P11-S-006this-run-packet | 45 OSS projects on the execution-safety layer, 10 top10, 8 licence bodies read. Landmines all invisible at badge level: Vault BSL 1.1 under IBM (OpenBao is the MPL-2.0 LF fork answer), Inngest SSPL-1.0, Restate BSL with a nuanced grant that permits executing services the licensee wrote but forbids letting third parties register their own, Convoy ELv2, Infisical MIT with an ee/ carve-out, both MCP repos NOASSERTION because they are mid-relicence with per-file provenance, hookdeck-cli Apache on the CLI only with the gateway closed SaaS, Skyvern AGPL-3.0. Four repo identities corrected. Gap map names three must-builds: idempotency has no production OSS supply (most-starred result 14 stars), outbound token brokering does not exist (every mature project runs inbound), egress policy enforcement is unbuilt (OPA and Cerbos decide, neither enforces). | observedthis-run-evidence | clients/actionmodel/research/workstreams/p11-connectors-integration-runtime/runs/2026-08-27-sprint-1-fable/top-repos.jsonl |
| — | P11-S-007this-run-packet | Commercial safety-mechanics survey (18 rows at first pass, backfill pending). Named convergent patterns: connect-session tokens; the caller passes an identity not a secret with the broker injecting server-side; scope narrowing at connect time; consent graded by consequence not resource; approval as a composable workflow step; per-tenant instance rather than per-tenant row; receipts excluding payload; retry without idempotency as the norm. Best primitive found: Zapier preview_only dry-run returning exact resolved arguments with no side effect, on by default and not tenant-disableable. Two hazards: Pipedream silently selects the most-recently-created account when several exist for one app; Browserbase Contexts replay cookies and tokens with MFA completed once and reused, a durable bearer blob outside any scope or revocation model. | observedthis-run-evidence | clients/actionmodel/research/workstreams/p11-connectors-integration-runtime/runs/2026-08-27-sprint-1-fable/top-companies.jsonl |
Source: site/system-map/data/parts.json#P11 · preserved research datasets remain inline below their source-backed synthesis.