README.md

RUMBO IA CRM — zero-spend MCP staging

Purpose: clean-room public staging adapter for the bounded RUMBO IA CRM OpenAI candidate.

Source binding:

  • canonical repository: RUMBO-IA/rumbo-product-runtime
  • candidate SHA: 9152f5a50de42be55508f0effed5ed09aee44c60
  • protocol: MCP 2025-06-18
  • source contract: lib/openai-plugin/mcp-contract.ts
  • source HTTP route: app/api/openai-plugin/mcp/route.ts
  • source health route: app/api/openai-plugin/health/route.ts

This Val Town implementation is an explicit clean-room adapter of the intended public bounded contract. It is not claimed byte-identical to the private Next.js source tree.

Public surface is intentionally limited to:

  • crm_get_service_readiness
  • crm_prepare_note
  • crm_prepare_lead_stage_change
  • crm_prepare_outreach_draft

Safety/authority boundaries:

  • no customer-data reads
  • no CRM mutations
  • no autonomous message sending
  • proposal outputs require review
  • side_effect=false
  • outreach returns send_authorized=false
  • productionAuthority=false
  • submissionAuthority=false
  • no secrets, database, billing integration, or external side-effect service is used

Hosting cost for this staging val: $0 on the existing Val Town Free account.

STAGING_CONFORMANCE_PASS != PRODUCTION_AUTHORITY != OPENAI_SUBMISSION_AUTHORITY != PUBLICATION.

OpenAI submission-readiness delta — 2026-09-10

Fresh OpenAI submission requirements were reconciled against this host. Remote MCP-only plugins are supported through a stable public HTTPS endpoint; OpenAI does not require Vercel specifically.

Current verified host properties:

  • httpPrivacy=public
  • fixed endpoint: https://rumbo-crm-openai-staging.val.run/
  • exact candidate binding: 9152f5a50de42be55508f0effed5ed09aee44c60
  • four-tool catalog only
  • every tool advertises readOnlyHint=true, openWorldHint=false, destructiveHint=false
  • /.well-known/openai-apps-challenge is implemented fail-closed: 404 while OPENAI_APPS_CHALLENGE_TOKEN is unset; when configured it returns only the configured token as text/plain
  • complete verifier remains PASS after challenge-route addition

Remaining external/publication gates:

  • obtain the exact domain-verification token from the OpenAI submission portal and configure it without exposing it
  • prove the challenge endpoint returns the exact token
  • decide whether this endpoint is the production submission URL rather than staging-only
  • verify OpenAI Platform Apps Management=Write and matching verified developer/business identity
  • run portal Scan Tools
  • prepare/finalize at least 5 positive and 3 negative reviewer test cases
  • set country/region availability
  • submit only under separate submission authority

VALTOWN_PROVIDER_COMPATIBILITY=PASS_BY_OPENAI_DOCS DOMAIN_CHALLENGE_CAPABILITY=IMPLEMENTED_FAIL_CLOSED TOOL_ANNOTATIONS=PASS_BY_CODE_AND_CONFORMANCE OPENAI_SUBMISSION=NOT_EXECUTED MONEY_SPEND=0