[setup] Register the Jaah Asana OAuth app

**User-only setup task.** Only a person can do the registration steps below (it needs a human sign-in at the vendor). Runner: do NOT attempt the vendor-side steps yourself and do not open a PR. Ask the operator once through AskUserQuestion (header `Human act`) to do the steps; when they answer that it is done, run the **Runner validation** section on dev and settle with `no_pr` / `no_code_needed`, citing the observed Connect + Test result (never a secret value). If validation fails, say exactly which step looks wrong and ask once more. A person must do this: registering an app at Asana needs a human sign-in at Asana. It lets members connect Asana to Jaah with one **Connect Asana** button, without registering an app of their own. ## Steps 1. Sign in to Asana with the account that should own Jaah's app (a shared company account, never a personal one), and open the developer console: https://app.asana.com/0/my-apps 2. Create a new OAuth app. Name it **Jaah**. 3. Select Create new app, enter the app name Jaah, choose the purpose that fits (an integration for others), and accept the API terms. 4. Open the app's OAuth tab and add the redirect URLs below with Add redirect URL. 5. Under Permission scopes choose specific scopes (not Full permissions) and tick users:read, workspaces:read, teams:read, projects:read, tasks:read, stories:read, tasks:write and stories:write. 6. Open Manage distribution and choose Any workspace, so members of every workspace can connect. 7. On the Basic information tab set the app icon to the Jaah logo, the website to the Jaah website, and the support contact to the Jaah support address, then Save changes. 8. Add both redirect URIs exactly as written: `https://app.dev.jaah.ai/api/credentials/connect/callback` (dev) and `https://app.jaah.ai/api/credentials/connect/callback` (prod). If Asana allows only one redirect URI per app, create a second app named **Jaah** for dev and do the paste step below once per environment. 9. Request exactly these scopes: `users:read`, `workspaces:read`, `teams:read`, `projects:read`, `tasks:read`, `stories:read`, `tasks:write`, `stories:write`. Why each one is needed is in the table below. 10. Copy the app's client ID and client secret. Keep them in your password manager only until the next step is done. 11. In the Jaah console of each environment (dev first, then prod), open **Secrets**, select **New**, and create an **OAuth app** (`oauth_app`) secret on the operator plane named `jaah-asana-app`, with provider `asana`, the client ID and the client secret. 12. Open **Settings > Integrations > OAuth apps > Asana** and pick that secret in the knob `oauth_app.asana`. 13. Never paste the client ID or secret into this task, a comment, a chat or an email. Reply here only with what you did. ## Scopes and why | Scope | Why Jaah asks for it | |---|---| | `users:read` | Read your profile, so the connection shows whose it is | | `workspaces:read` | List your workspaces, so agents know where to look | | `teams:read` | List teams, to find a team's projects | | `projects:read` | Read projects and their sections | | `tasks:read` | Read tasks, their fields and subtasks | | `stories:read` | Read task comments and history for context | | `tasks:write` | Create tasks, update fields and complete tasks when a task reports back | | `stories:write` | Comment on tasks with progress and results | ## Redirect URIs - dev: `https://app.dev.jaah.ai/api/credentials/connect/callback` - prod: `https://app.jaah.ai/api/credentials/connect/callback` ## Review or verification Not required for Any workspace distribution. Listing Jaah in Asana's public App Directory is optional and needs a separate submission. ## Runner validation A runner checks the setup once you mark this task answered: on dev, **Connect Asana** with the Jaah app ends on **Connected** and **Test** passes. It reads only the result, never the secret. ## Out of scope No code change. Do not edit the vendor spec, the catalog engine or any other credential. Never paste the client ID or secret into this task, a comment, a log or a report. ## Done means - The operator confirmed the steps are done. - On dev, the Asana Connect screen no longer says "Jaah app not configured", the consent round trip ends on **Connected**, and **Test** passes — cited from what you observed.