[Epic] Declarative connectors — connector manifest

[serge-ivo]

Turn "add an integration" from a code file + deploy into a reviewed JSON manifest. Design doc: docs/connector-manifest.md. The next flexibility unlock after declarative agent capabilities landed (#141), and the "open tool catalog" half of the third-party plan (#51 / docs/third-party-agents-plan.md).

Core idea: a connector becomes data ({id,label,auth,baseUrl,tools[]}); compileConnector(manifest) emits the same Connector/ToolDef[] the registry already consumes → zero downstream change (tool catalog, capabilities.tools gating, consent gate, all three surfaces keep working). The http connector's request engine becomes the shared executor.

Sub-issues:

• Phase 1: extract runManifestTool executor · compileConnector + manifest schema/validation · convert one connector as proof.
• Phase 2: generic OAuth2 handler (fold Drive/Gmail/GitHub OAuth into manifest-driven auth).
• Phase 3: creator-supplied manifests behind curated review (folds into Epic: first-party exemplary agents → mature the platform → open to third parties (demand-gated) #58 / [3P] Curated publish + review pipeline (submission → review → versioned listing) #53 / [3P] Automated pre-review safety scanning #54).

Non-breaking throughout: tool names + consent keys unchanged; SSRF/consent/secret handling inherited.

[serge-ivo]

Phase 1 substrate landed (#144 + #145, commit 69f145b): the executor is shared and compileConnector/sanitizeConnectorManifest are in place + unit-tested, zero downstream change. Remaining: #146 (convert existing connectors via the handler escape hatch) and #147 (generic OAuth2 handler).

[serge-ivo]

Phase 1 complete (commit 59e01b2): all three first-party auth'd connectors — web-search (f618e79), then github + meta — now flow through the manifest layer via compileConnector, each keeping its custom tool logic behind the handler escape hatch. Added a platform-token auth variant for meta's env-backed token. Behavior-identical (173 connector tests green). The substrate + escape hatch + reference conversions are done; #147 (generic OAuth2 handler → new SaaS as data-only) is the remaining piece.

[serge-ivo]

Epic complete. The connector-manifest system is fully landed:

• [connectors] Phase 1a: extract runManifestTool (shared request executor from http.ts) #144 shared executeHttpRequest executor · [connectors] Phase 1b: manifest schema + compileConnector + sanitizeConnectorManifest #145 compileConnector + sanitizeConnectorManifest
• [connectors] Phase 1c: convert web-search + github/meta to manifests (proof, non-breaking) #146 handler escape hatch + web-search/github/meta converted to manifests (behavior-identical)
• [connectors] Phase 2: generic OAuth2 handler (manifest-driven authorize/callback/refresh) #147 generic OAuth2 handler — manifest-driven authorize/callback/refresh at /v1/connectors/:id/oauth/*

Net: a connector is now DATA. Adding an api-key/bearer SaaS = a manifest object; adding an OAuth SaaS = a manifest + an OAuth app registration. No bespoke route/tool code, no deploy per integration. Security boundary held throughout (platform-token/handler/oauth-creds are built-in-only; creator manifests are request-as-data with no platform-secret access). All conversions behavior-identical — 174 connector tests green, api suite 1353. Design: docs/connector-manifest.md.