oauth-feedback.md

1. So we're adding a new feature to Streamplace via a place.stream.example.record, which then obviously needs to be in the place.stream.authFull permission set. Am I correct in understanding that the best practice is: release the change to the permission-set, wait 30 minutes, release the feature? And then everything should just work? It's kind of a bummer to add a 30-minute timer to our release process; currently the latest version of the schemas go out automatically with new versions of the software.

2. How the heck do I hack on a permission set in development? If I want to add, say, permissions to create/update/delete place.stream.example.record to the permission set, I can't validate the permission set works until it gets rolled out to production. The only option I can think of is allow the Streamplace dev environment to operate in a fully parallel universe where every record created and indexed is e.g. com.elis-dev-environment.chat.message; but that's a pretty massive change.

(Note: allowing our permission set to do create/update/delete for place.stream.* would solve 1 and 2 at the same time really well. I mean, I still couldn't dev on it, but we could be pretty confident that it wouldn't break.)

3. Filed this separately as bluesky-social/atproto#4424 but that one's rough because our motivation to move off of transition:generic is that users are asking us why we're asking for permissions to access their Bluesky account and we aren't.