Ray-56 · Nov 2, 2026 · Nov 2, 2026
diff --git a/.changeset/calle-mcp-oauth-setup-boundary.md b/.changeset/calle-mcp-oauth-setup-boundary.md
@@ -0,0 +1,21 @@
+---
+---
+
+Release independently distributed standalone `calle` `1.0.4` as a patch:
+keep MCP connection setup separate from API Key acquisition and storage.
+Prefer host-managed OAuth discovery without a preliminary website visit or
+manual metadata fetch. Derive any host-required OAuth fields or allowed hosts
+from actual server metadata and the host schema; a separately hosted OAuth
+authorization server remains part of the MCP route.
+
+Preserve MCP-first routing, existing connection reuse, explicit interface
+choices, API fallback conditions, and authentication failure boundaries.
+Add synthetic acceptance variants and manual checks without claiming Muse
+connection success or a confirmed cause for the connector error.
+
+No npm package or plugin bump is needed. Synchronize current Skill/evaluation
+metadata and installation guidance at `1.0.4`, and publish the accepted commit
+under the new immutable `skills/calle@1.0.4` tag with the complete ZIPs, source
+manifest, and checksums. Preserve earlier published artifacts. The new Agent
+variants remain `NOT_RUN` until executed; observations from the pre-versioning
+Muse candidate do not establish completed live-call acceptance for this release.
diff --git a/AGENTS.md b/AGENTS.md
@@ -35,7 +35,7 @@ Productized OpenClaw skill source lives in `packages/openclaw-cli-skill/skills`.
 
 Before changing standalone Skill identities, install/update origins or migration
 checks, follow [the staged migration plan](docs/calle-skill-migration-plan.md).
-The standalone entries are `calle` version `1.0.3` for the MCP/API workflow and
+The standalone entries are `calle` version `1.0.4` for the MCP/API workflow and
 `calle-cli` for CLI compatibility; CLI and plugin names remain `calle`. Preserve historical verification
 records and add new candidate evidence rather than relabeling earlier runs.
 

diff --git a/README.md b/README.md
@@ -115,7 +115,7 @@ Choose the integration path that fits your use case:
 ```text
 Install CALL-E for me: https://raw.githubusercontent.com/CALLE-AI/call-e-integrations/main/docs/install/CALL-E-installation-guide.md
 ```
-The linked guide installs the standalone `calle` 1.0.3 Skill and selects the
+The linked guide installs the standalone `calle` 1.0.4 Skill and selects the
 host-supported connection path. The initial live acceptance baseline is Codex
 MCP; API and other clients identify unexecuted live checks separately.
 
@@ -127,7 +127,7 @@ see [calle installation](docs/install/calle.md). Business operations and updates
 use non-CLI host facilities. MCP setup prefers native host management, with a
 limited exception for the current host's official MCP management commands.
 
-The standalone Skill is now `calle` version `1.0.3`. Users retaining the legacy
+The standalone Skill is now `calle` version `1.0.4`. Users retaining the legacy
 CLI workflow can install `calle-cli` through the
 [compatibility guide](docs/install/skills-sh-skill.md#existing-calle-users).
 Plugin-owned `calle` Skills have independent installation and release lifecycles.
@@ -502,7 +502,7 @@ This is a multi-ecosystem integration monorepo with packaged plugins and standal
 | `packages/openclaw-cli-skill` | OpenClaw CALL-E skill source. |
 | `packages/skills-sh-skill` | skills.sh compatible CALL-E skill package. |
 | `skills/calle-cli/` | Portable CLI compatibility Skill; official installation uses `--skill calle-cli`. |
-| `skills/calle/` | Canonical standalone Skill at version 1.0.3; prefers host-managed OAuth MCP, with direct HTTPS/API Key fallback governed by the [interface selection rules](docs/install/calle.md#choose-the-interface). |
+| `skills/calle/` | Canonical standalone Skill at version 1.0.4; prefers host-managed OAuth MCP, with direct HTTPS/API Key fallback governed by the [interface selection rules](docs/install/calle.md#choose-the-interface). |
 | `tests/` | Offline standalone Skill validation and Agent/mock scenario definitions; execution states are recorded separately. |
 | `examples/` | Runnable MCP client demos. |
 | `docs/` | Integration guides, install docs, and troubleshooting. |

diff --git a/docs/agent-integration-layout.md b/docs/agent-integration-layout.md
@@ -42,7 +42,7 @@ Current standalone layout:
 
 ```text
 skills/calle-cli/  # Official CLI compatibility entry
-skills/calle/      # Canonical MCP/API Skill at version 1.0.3
+skills/calle/      # Canonical MCP/API Skill at version 1.0.4
 ```
 
 Current Claude Code layout:
@@ -161,7 +161,7 @@ intentionally exposes multiple CALL-E marketplaces in the same client UI.
 
 The [migration plan](calle-skill-migration-plan.md) records the formal standalone
 cutover to `calle` `2.0.0`. The current canonical MCP/API Skill is `calle` version
-`1.0.3`, with directory, frontmatter, display name and invocation aligned to
+`1.0.4`, with directory, frontmatter, display name and invocation aligned to
 `calle`. `calle-cli` remains the legacy CLI compatibility entry. The temporary
 installable `callev2` source is retired; its historical verification records
 retain their original inputs.

diff --git a/docs/calle-skill-migration-plan.md b/docs/calle-skill-migration-plan.md
@@ -16,7 +16,7 @@ This is a maintainer-selected version reset, not a numeric upgrade from `2.0.1`.
 Record it in an empty Changeset; no npm package version bump is needed.
 
 The existing numeric updater does not offer older remote versions. Users with
-`2.0.x` installed must explicitly install the current complete `1.0.3` release
+`2.0.x` installed must explicitly install the current complete `1.0.4` release
 and verify host loading before receiving subsequent `1.x` update offers. Follow the
 [installation guidance](install/calle.md#version-designation-and-existing-20x-installations).
 Publication, installation, skills.sh indexing and security audit freshness remain

diff --git a/docs/documentation-maintenance.md b/docs/documentation-maintenance.md
@@ -26,7 +26,7 @@ commands.
   install, migration and local ZIP guidance lives in `docs/install/calle.md`.
   Keep `docs/install/callev2.md`, `docs/install/calle-connect.md` and
   `docs/install/dual-skills.md` as pointers for earlier links. The canonical
-  identity is `calle` with metadata/evaluation version `1.0.3`; the cutover scope
+  identity is `calle` with metadata/evaluation version `1.0.4`; the cutover scope
   is recorded in `docs/calle-skill-migration-plan.md`. The Skill's
   metadata version is independent of the CLI-based skills.sh package attribution.
   Shared routing and business workflow live in `SKILL.md`; MCP and API contracts
@@ -120,7 +120,7 @@ commands.
   attribution `skills_sh/skills_sh_skill/<version>`, authentication and recovery
   paths. Plugin names and package-scoped `calle` Skills are separate surfaces.
 - The stable `docs/install/CALL-E-installation-guide.md` defaults to `calle`
-  `1.0.3` and must remain at that path. Codex MCP is the initial live acceptance
+  `1.0.4` and must remain at that path. Codex MCP is the initial live acceptance
   baseline; API and other clients must identify unexecuted live checks.
 - Repository-local Codex helper skills live in `.agents/skills/`.
 

diff --git a/docs/install/calle-connect.md b/docs/install/calle-connect.md
@@ -1,7 +1,7 @@
 # Earlier calle-connect Installation Guide
 
 The current canonical standalone MCP/API workflow is
-[`calle` 1.0.3](calle.md). Follow that guide for complete installation, host
+[`calle` 1.0.4](calle.md). Follow that guide for complete installation, host
 requirements, interface selection, updates and validation scope. The legacy
 CLI workflow remains available through [`calle-cli`](skills-sh-skill.md).
 

diff --git a/docs/install/calle.md b/docs/install/calle.md
@@ -6,7 +6,7 @@ host-managed OAuth MCP, including authorized setup of a missing connection.
 Before business writes, it can select direct HTTPS with an API Key when the
 host explicitly lacks MCP support or complete discovery confirms the required
 capability is missing. Missing connections, unloaded tools, authentication
-failure, or cancellation do not trigger fallback. The source metadata version is `1.0.3`.
+failure, or cancellation do not trigger fallback. The source metadata version is `1.0.4`.
 The directory, Skill name and display name are `calle`; invoke it as `$calle`.
 This is the canonical standalone Skill. The CLI executable and plugin-owned
 `calle` Skills have independent installation and release lifecycles.
@@ -48,7 +48,7 @@ with their original contents.
 Version checks compare numeric versions and do not offer downgrades. Existing
 `2.0.x` installations therefore do not receive automatic offers for `1.0.0` or
 later `1.x` versions. To move to this release sequence, explicitly install the
-complete `1.0.3` Skill using the source or ZIP procedure below, then reload the
+complete `1.0.4` Skill using the source or ZIP procedure below, then reload the
 host and verify the loaded version. Preserve local edits, account configuration
 and saved call records under the existing installation and rollback guidance.
 

diff --git a/docs/install/callev2.md b/docs/install/callev2.md
@@ -1,7 +1,7 @@
 # Retired callev2 Testing Guide
 
 The temporary `callev2` testing identity has been retired. Install the canonical
-[`calle` 1.0.3 Skill](calle.md) for the current standalone MCP/API workflow, or use
+[`calle` 1.0.4 Skill](calle.md) for the current standalone MCP/API workflow, or use
 [`calle-cli`](skills-sh-skill.md) to retain the legacy CLI workflow.
 
 Migration of installed `callev2` copies is outside this release's scope. This

diff --git a/docs/install/dual-skills.md b/docs/install/dual-skills.md
@@ -1,7 +1,7 @@
 # Earlier Dual-Skill Installation Guide
 
 The earlier separate API and MCP entries were merged during testing. The current
-canonical standalone workflow is [`calle` 1.0.3](calle.md), which prefers MCP
+canonical standalone workflow is [`calle` 1.0.4](calle.md), which prefers MCP
 and supports API Key access under its interface selection rules. Users retaining
 the legacy CLI workflow can install [`calle-cli`](skills-sh-skill.md).
 

diff --git a/docs/install/install-guide.md b/docs/install/install-guide.md
@@ -23,7 +23,7 @@ its own environment.
 
 <!-- sync-with: docs/install/calle.md#install-the-source-or-zip -->
 
-Install the canonical standalone `calle` `1.0.3` Skill globally from the
+Install the canonical standalone `calle` `1.0.4` Skill globally from the
 repository root:
 
 ```bash

diff --git a/docs/install/skills-sh-skill.md b/docs/install/skills-sh-skill.md
@@ -4,7 +4,7 @@ This guide covers the CLI-based `calle-cli` skill. Its source of truth lives at
 `skills/calle-cli` so skills.sh can index the public skill page and search results
 directly from the repository root.
 
-For the default standalone `calle` 1.0.3 Skill, which prefers MCP with API Key fallback,
+For the default standalone `calle` 1.0.4 Skill, which prefers MCP with API Key fallback,
 see [calle installation](./calle.md) and its
 [interface selection rules](./calle.md#choose-the-interface).
 Business operations and updates use non-CLI host facilities. MCP setup follows

diff --git a/docs/install/troubleshooting.md b/docs/install/troubleshooting.md
@@ -2,7 +2,7 @@
 
 ## Which standalone Skill is installed?
 
-The canonical standalone MCP/API Skill is [`calle` 1.0.3](calle.md). Verify its
+The canonical standalone MCP/API Skill is [`calle` 1.0.4](calle.md). Verify its
 loaded name and version after host reload, not just its directory on disk.
 Plugin-owned `calle` entries have separate lifecycles; identify the intended
 standalone or plugin entry when the host exposes overlapping names.

diff --git a/docs/skill-update-mechanism.md b/docs/skill-update-mechanism.md
@@ -1,7 +1,7 @@
 # Standalone Skill Update Mechanism Design Record
 
 Design first recorded on 2026-10-15. Current guidance applies to the canonical
-standalone `calle` entry, metadata/evaluation version `1.0.3`; the dated
+standalone `calle` entry, metadata/evaluation version `1.0.4`; the dated
 third-party audit examples below remain historical snapshots. The selected
 repository is `CALLE-AI/call-e-integrations`.
 
@@ -194,7 +194,7 @@ requires review.
 
 The earlier MCP/API merge was tested as `calle-connect` version `0.2.0`.
 The formal cutover promoted the `callev2` `2.1.1` implementation to `calle`
-`2.0.0`. The current canonical `calle` version is `1.0.3`, with evaluation inputs
+`2.0.0`. The current canonical `calle` version is `1.0.4`, with evaluation inputs
 at `tests/behavior/calle-evals.json`.
 Keep historical acceptance tied to its original names and hashes; source binding
 and host activation need candidate-specific evidence under the

diff --git a/docs/verification/calle-1.0.4-oauth-setup-2026-11-02.md b/docs/verification/calle-1.0.4-oauth-setup-2026-11-02.md
@@ -0,0 +1,78 @@
+# calle 1.0.4 OAuth setup boundary verification
+
+Date: 2026-11-02 (Asia/Shanghai).
+
+## Release scope
+
+The standalone `calle` Skill keeps MCP-first routing and separates MCP connection
+setup from API Key acquisition and storage. Start with the host connection
+manager and let it discover OAuth metadata. A preliminary website visit or
+manual metadata fetch is unnecessary when the host supports discovery. Any
+host-required OAuth fields or allowed hosts come from actual server metadata
+and the host schema, without a fixed authorization-host list. A separately
+hosted authorization server remains part of MCP and is distinct from the
+configured MCP server URL.
+
+Skill/evaluation metadata and current installation references use `1.0.4`.
+Existing interface choices, fallback conditions, authentication boundaries,
+and existing-call recovery remain in place. npm and plugin package versions
+are unchanged. Earlier verification records and release artifacts are preserved.
+
+## Local validation
+
+| Check | Result |
+| --- | --- |
+| `corepack pnpm check` | PASS |
+| `corepack pnpm test` | PASS: full Node/package suite |
+| `.venv/bin/python -m tests.run_offline` | PASS: 274 tests |
+| `corepack pnpm pack:skill:calle` | PASS: complete 19-file Skill |
+| `corepack pnpm pack:skill:calle-cli` | PASS: unchanged four-file compatibility Skill |
+| `corepack pnpm pack:dry-run` | PASS |
+| ZIP CRC, inventory, and byte comparison with source | PASS for both ZIPs |
+| Added and rewritten repository text | English |
+
+The local npm launcher is a shell wrapper. The full Node/package suite used a
+temporary PATH entry pointing directly to the installed npm JavaScript entry
+point, without changing repository or global tooling. The generic Skill Creator
+validator rejects the pre-existing `compatibility` frontmatter field; the
+unmodified base revision produces the same rejection. The repository's Skill
+metadata, compatibility, reference, and packaging checks pass.
+
+| Artifact | SHA-256 |
+| --- | --- |
+| `calle.zip` | `f0755a90f86a3e9cfa2277a37ce6bc66769c8dce122be8dacd7e8cf325b4a316` |
+| `calle-cli.zip` | `40a2fdde2640b13997bdf4e29804498060494c239fd87526d9e647f6871bc23b` |
+
+The compatibility ZIP is byte-identical to the published `1.0.3` release asset.
+The release manifest binds the final publication revision, per-file source
+hashes, ZIP hashes, and GitHub CI evidence to `skills/calle@1.0.4`. Public source
+and asset delivery are checked after publication.
+
+## Pre-versioning Muse observations and limits
+
+Before the metadata bump, the same instruction changes were tested as a local
+candidate still labeled `1.0.3`. Its ZIP SHA-256 was
+`d6d1b00e9db23ca8026694f8e1bb978a8fe5cf1f6a84c67fc9e0d647aa4256e2`.
+USB transfer was verified by reading back and comparing the complete archive.
+In a new Muse side chat, Muse reported installation of all 19 files, matching
+archive and per-file checksums, and loading from its custom Skill directory.
+
+After one user-authorized greeting-call instruction, the native connection card
+displayed an added state, and Muse reported that its MCP connection succeeded
+and call preparation was in progress. No API Key request was observed. The
+terminal call result and complete tool inventory were not observed before USB
+access became unavailable; the user then took over phone operation.
+
+These are limited observations of the pre-versioning candidate, not complete
+live acceptance of the `1.0.4` artifact or proof of the earlier error's cause.
+The new `route-15` host-managed-discovery and separate-OAuth-host variants are
+synthetic definitions and remain `NOT_RUN` until an Agent is evaluated.
+No release-specific security scan, skills.sh index refresh, or completed live
+call is claimed.
+
+## Release decision
+
+Patch release recommended for independently distributed standalone `calle`,
+prepared as `1.0.4`. The empty-package Changeset
+`calle-mcp-oauth-setup-boundary.md` records this independent release; no npm
+package or plugin version bump is needed.
diff --git a/skills/calle/SKILL.md b/skills/calle/SKILL.md
@@ -5,7 +5,7 @@ description: >-
 compatibility: >-
   MCP requires host-managed remote MCP, OAuth, and real tool discovery; cards are optional when start_call is exposed. Prefer native connection management; an existing official host MCP command may manage the connection lifecycle. API requires HTTPS tools or a trusted runtime with secure credential injection. Updates require anonymous public reads. Business calls and Skill updates do not use a CLI.
 metadata:
-  version: "1.0.3"
+  version: "1.0.4"
   update-source: "https://raw.githubusercontent.com/CALLE-AI/call-e-integrations/main/skills/calle/SKILL.md"
   source: "https://github.com/CALLE-AI/call-e-integrations/tree/main/skills/calle"
   verified-on: "2026-10-28"
@@ -55,7 +55,7 @@ First identify the requested operation, any explicit interface choice, and wheth
 
 Inspect the host's connection manager or custom-connector capabilities as well as its loaded business tools. An absent CALL-E connector or empty tool list does not establish that the host lacks MCP support.
 
-Select according to the table and read only the selected path's instructions:
+Select according to the table and read only the selected path's instructions. MCP setup follows the [connection guidance](references/connection.md); API Key acquisition and storage instructions apply only after selecting the API path.
 
 | Situation | Action |
 | --- | --- |

diff --git a/skills/calle/references/connection.md b/skills/calle/references/connection.md
@@ -15,7 +15,16 @@ This is the fixed production target for the customer-facing Skill; no environmen
 See [public publisher attribution](sources-mcp.md#public-publisher-attribution-verified-on-2026-10-28)
 for the official CALL-E and AI Rudder source chain behind this target.
 
-A compatible host manages OAuth registration, callbacks, and the token lifecycle. If the service requires a preregistered client ID/secret, explain the specific missing information and have the user supply it through secure configuration; do not guess or put secrets in chat. Use the host management preference below for configuration, authentication, and authorized cleanup. Do not build an OAuth client or read the host's token cache.
+Start setup through the selected host manager with the MCP URL above. Let the
+host discover OAuth metadata and manage registration, callbacks, and tokens;
+no preliminary website visit or manual metadata fetch is required when it
+supports discovery. If its actual setup schema requires explicit OAuth fields
+or allowed hosts, derive only those fields from server metadata rather than
+guessing endpoints or hardcoding a host list. Validate the configured MCP URL
+separately from discovered OAuth endpoints: an authorization server on another
+hostname remains part of MCP.
+
+If the service requires a preregistered client ID/secret, explain the specific missing information and have the user supply it through secure configuration; do not guess or put secrets in chat. Use the host management preference below for configuration, authentication, and authorized cleanup. Do not build an OAuth client or read the host's token cache.
 
 ## Identify the requested stage first
 

diff --git a/skills/calle/references/setup.md b/skills/calle/references/setup.md
@@ -1,5 +1,8 @@
 # API Key configuration and lifecycle
 
+Use this guide only after selecting the API Key interface. MCP OAuth setup
+follows [Connection lifecycle](connection.md).
+
 This Skill provides Agent instructions; it is not a deployed HTTP tool or standalone application. The host needs actual HTTPS request capability that can securely read credentials. A public webpage browser generally cannot replace an authenticated arbitrary HTTP request tool.
 
 ## Initial setup and reuse of existing configuration