Purpose: clean-room public staging adapter for the bounded RUMBO IA CRM OpenAI candidate.

Source binding:

• canonical repository: RUMBO-IA/rumbo-product-runtime
• candidate SHA: 9152f5a50de42be55508f0effed5ed09aee44c60
• protocol: MCP 2025-06-18
• source contract: lib/openai-plugin/mcp-contract.ts
• source HTTP route: app/api/openai-plugin/mcp/route.ts
• source health route: app/api/openai-plugin/health/route.ts

This Val Town implementation is an explicit clean-room adapter of the intended public bounded contract. It is not claimed byte-identical to the private Next.js source tree.

Public surface is intentionally limited to:

• crm_get_service_readiness
• crm_prepare_note
• crm_prepare_lead_stage_change
• crm_prepare_outreach_draft

Safety/authority boundaries:

• no customer-data reads
• no CRM mutations
• no autonomous message sending
• proposal outputs require review
• side_effect=false
• outreach returns send_authorized=false
• productionAuthority=false
• submissionAuthority=false
• no secrets, database, billing integration, or external side-effect service is used

Hosting cost for this staging val: $0 on the existing Val Town Free account.

STAGING_CONFORMANCE_PASS != PRODUCTION_AUTHORITY != OPENAI_SUBMISSION_AUTHORITY != PUBLICATION.

Fresh OpenAI submission requirements were reconciled against this host. Remote MCP-only plugins are supported through a stable public HTTPS endpoint; OpenAI does not require Vercel specifically.

Current verified host properties:

• httpPrivacy=public
• fixed endpoint: https://rumbo-crm-openai-staging.val.run/
• exact candidate binding: 9152f5a50de42be55508f0effed5ed09aee44c60
• four-tool catalog only
• every tool advertises readOnlyHint=true, openWorldHint=false, destructiveHint=false
• /.well-known/openai-apps-challenge is implemented fail-closed: 404 while OPENAI_APPS_CHALLENGE_TOKEN is unset; when configured it returns only the configured token as text/plain
• complete verifier remains PASS after challenge-route addition

Remaining external/publication gates:

• obtain the exact domain-verification token from the OpenAI submission portal and configure it without exposing it
• prove the challenge endpoint returns the exact token
• decide whether this endpoint is the production submission URL rather than staging-only
• verify OpenAI Platform Apps Management=Write and matching verified developer/business identity
• run portal Scan Tools
• prepare/finalize at least 5 positive and 3 negative reviewer test cases
• set country/region availability
• submit only under separate submission authority

VALTOWN_PROVIDER_COMPATIBILITY=PASS_BY_OPENAI_DOCS DOMAIN_CHALLENGE_CAPABILITY=IMPLEMENTED_FAIL_CLOSED TOOL_ANNOTATIONS=PASS_BY_CODE_AND_CONFORMANCE OPENAI_SUBMISSION=NOT_EXECUTED MONEY_SPEND=0