[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_791":792,"_793":794},"routes/_app.x.$handle.$name",{"_97":96,"_32":45,"_106":87,"_27":107,"_13":14,"_108":-5,"_11":109,"_110":111,"_112":113,"_114":115,"_116":117,"_20":-5,"_118":-5,"_119":-5,"_120":25,"_121":122,"_123":59,"_124":-5,"_125":-5,"_126":127},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":57,"_58":59,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":-5,"_67":-5,"_68":-5,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":80,"_81":82,"_83":84,"_85":25},"version",255,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","submission_gate.ts","latestPath","fileId","fdf0ffb8-ad58-11f1-888a-1607ee4eb77e","name","fileType","script","content","import portalPacket from \"./PORTAL_PACKET.json\" with { type: \"json\" };\n\nconst BASE = \"https://rumbo-crm-openai-staging.val.run\";\nconst EXPECTED_SHA = \"9152f5a50de42be55508f0effed5ed09aee44c60\";\nconst EXPECTED_LOGO_SHA256 = \"3ac48eb17d735ee41d12e6edf0cc0ea0e5a55358cce6b5fd37d93b3fc0372205\";\nconst LISTING_URLS = {\n website: `${BASE}/`,\n support: `${BASE}/support`,\n privacy: `${BASE}/privacy`,\n terms: `${BASE}/terms`,\n};\n\nconst facts: Record = {};\nconst technicalFailures: string[] = [];\nconst workspaceDraftBlockers: string[] = [];\nconst publicDirectoryBlockers: string[] = [];\nconst governanceBlockers: string[] = [];\n\nasync function check(name: string, fn: () => Promise) {\n try {\n const ok = await fn();\n facts[name] = ok ? \"PASS\" : \"FAIL\";\n if (!ok) technicalFailures.push(name);\n } catch (e) {\n facts[name] = `ERROR:${e instanceof Error ? e.message : String(e)}`;\n technicalFailures.push(name);\n }\n}\n\nasync function sha256Hex(bytes: Uint8Array) {\n const digest = new Uint8Array(await crypto.subtle.digest(\"SHA-256\", bytes));\n return Array.from(digest, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nconst mcpHeaders = {\n origin: \"https://chatgpt.com\",\n accept: \"application/json, text/event-stream\",\n \"content-type\": \"application/json\",\n \"mcp-protocol-version\": \"2025-06-18\",\n};\n\nasync function mcpCall(name: string, args: Record) {\n const r = await fetch(`${BASE}/api/openai-plugin/mcp`, {\n method: \"POST\",\n headers: mcpHeaders,\n body: JSON.stringify({ jsonrpc: \"2.0\", id: name, method: \"tools/call\", params: { name, arguments: args } }),\n });\n if (r.status !== 200) throw new Error(`mcp_call_${name}_status_${r.status}`);\n return await r.json();\n}\n\nawait check(\"health_exact_sha\", async () => {\n const r = await fetch(`${BASE}/api/openai-plugin/health`, {\n headers: { origin: \"https://chatgpt.com\", accept: \"application/json\" },\n });\n if (r.status !== 200) return false;\n const b = await r.json();\n return b?.sourceSha === EXPECTED_SHA && b?.productionAuthority === false && b?.submissionAuthority === false;\n});\n\nawait check(\"tool_annotations\", async () => {\n const r = await fetch(`${BASE}/api/openai-plugin/mcp`, {\n method: \"POST\",\n headers: mcpHeaders,\n body: JSON.stringify({ jsonrpc: \"2.0\", id: 1, method: \"tools/list\", params: {} }),\n });\n if (r.status !== 200) return false;\n const b = await r.json();\n const tools = b?.result?.tools ?? [];\n facts.tool_count = tools.length;\n return tools.length === 4 && tools.every((t: any) =>\n t.annotations?.readOnlyHint === true &&\n t.annotations?.openWorldHint === false &&\n t.annotations?.destructiveHint === false\n );\n});\n\nawait check(\"response_minimization\", async () => {\n const fixtures = [\n [\"crm_get_service_readiness\", {}, new Set([\"state\", \"customer_data_tools_exposed\", \"mutating_tools_exposed\", \"production_authority\", \"submission_authority\"])],\n [\"crm_prepare_note\", { workspace_id: \"ws_demo\", subject_id: \"subject_demo\", note: \"Synthetic reviewer note.\" }, new Set([\"kind\", \"state\", \"side_effect\", \"workspace_id\", \"subject_id\", \"note\"])],\n [\"crm_prepare_lead_stage_change\", { workspace_id: \"ws_demo\", lead_id: \"lead_demo\", from_stage: \"new\", to_stage: \"qualified\", reason: \"Synthetic reviewer fixture.\" }, new Set([\"kind\", \"state\", \"side_effect\", \"workspace_id\", \"lead_id\", \"from_stage\", \"to_stage\", \"reason\"])],\n [\"crm_prepare_outreach_draft\", { workspace_id: \"ws_demo\", lead_id: \"lead_demo\", channel: \"email\", objective: \"Prepare a synthetic follow-up draft.\" }, new Set([\"kind\", \"state\", \"side_effect\", \"workspace_id\", \"lead_id\", \"channel\", \"objective\", \"send_authorized\"])],\n ] as const;\n\n const forbiddenKey = /(token|secret|password|api[_-]?key|debug|stack|authorization|cookie)/i;\n for (const [name, args, expectedKeys] of fixtures) {\n const body: any = await mcpCall(name, args as Record);\n const sc = body?.result?.structuredContent;\n if (!sc || typeof sc !== \"object\") return false;\n const keys = Object.keys(sc);\n if (keys.some((k) => forbiddenKey.test(k))) return false;\n if (keys.some((k) => !expectedKeys.has(k as never))) return false;\n const serialized = JSON.stringify(sc).toLowerCase();\n if (serialized.includes(\"bearer \") || serialized.includes(\"sk-\") || serialized.includes(\"stack trace\")) return false;\n }\n return true;\n});\n\nawait check(\"listing_urls_public\", async () => {\n const responses = await Promise.all(Object.values(LISTING_URLS).map((url) => fetch(url, { redirect: \"follow\" })));\n facts.listing_url_statuses = Object.fromEntries(Object.keys(LISTING_URLS).map((key, i) => [key, responses[i].status]));\n return responses.every((r) => r.status >= 200 && r.status < 300);\n});\n\nawait check(\"support_mcp_semantics\", async () => {\n const r = await fetch(LISTING_URLS.support, { redirect: \"follow\" });\n if (!r.ok) return false;\n const text = (await r.text()).toLowerCase();\n return (text.includes(\"rumbo crm\") || text.includes(\"rumbo ia crm\")) &&\n (text.includes(\"proposal-only\") || text.includes(\"review\") || text.includes(\"proposal tools\")) &&\n (text.includes(\"openai\") || text.includes(\"chatgpt\")) &&\n (text.includes(\"sebastian@rumbo.verso.fans\") || text.includes(\"contact support\"));\n});\n\nawait check(\"privacy_mcp_disclosure\", async () => {\n const r = await fetch(LISTING_URLS.privacy, { redirect: \"follow\" });\n if (!r.ok) return false;\n const text = (await r.text()).toLowerCase();\n return (text.includes(\"mcp\") || text.includes(\"chatgpt\") || text.includes(\"plugin\")) &&\n (text.includes(\"note\") || text.includes(\"lead\") || text.includes(\"workspace\") || text.includes(\"identifier\"));\n});\n\nawait check(\"terms_bounded_semantics\", async () => {\n const r = await fetch(LISTING_URLS.terms, { redirect: \"follow\" });\n if (!r.ok) return false;\n const text = (await r.text()).toLowerCase();\n return text.includes(\"human-controlled\") && text.includes(\"proposals\") && text.includes(\"not automatically applied\");\n});\n\nawait check(\"logo_exact_asset\", async () => {\n const r = await fetch(`${BASE}/logo.svg`, { redirect: \"follow\" });\n if (!r.ok || !(r.headers.get(\"content-type\") ?? \"\").includes(\"image/svg+xml\")) return false;\n const hash = await sha256Hex(new Uint8Array(await r.arrayBuffer()));\n facts.logo_sha256 = hash;\n return hash === EXPECTED_LOGO_SHA256;\n});\n\nawait check(\"portal_packet_constraints\", async () => {\n const prompts = portalPacket?.starter_prompts ?? [];\n const unique = new Set(prompts);\n const promptsOk = Array.isArray(prompts) && prompts.length > 0 && prompts.length <= 3 &&\n unique.size === prompts.length && prompts.every((p: unknown) =>\n typeof p === \"string\" && p.length <= 128 && !p.includes(\"@\") && !/[\\r\\n]/.test(p)\n );\n const pkg = portalPacket?.directory_package;\n const packageNameOk = typeof pkg?.package_name === \"string\" && /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(pkg.package_name);\n const versionOk = typeof pkg?.version === \"string\" && pkg.version.length <= 64 && /^\\d+\\.\\d+\\.\\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(pkg.version);\n const developerNameOk = typeof pkg?.developer_name_candidate === \"string\" && pkg.developer_name_candidate.length > 0 && pkg.developer_name_candidate.length <= 80 && !/[\\r\\n]/.test(pkg.developer_name_candidate);\n const capabilities = pkg?.capabilities ?? [];\n const capabilitiesOk = Array.isArray(capabilities) && capabilities.length <= 20 && capabilities.every((c: unknown) =>\n typeof c === \"string\" && c.trim().length > 0 && c.length <= 120 && !/[\\r\\n]/.test(c)\n );\n facts.starter_prompt_count = prompts.length;\n facts.package_name = pkg?.package_name ?? null;\n facts.package_version = pkg?.version ?? null;\n facts.capability_count = capabilities.length;\n facts.annotation_justifications = portalPacket?.review_materials?.annotation_justifications ?? null;\n return promptsOk && packageNameOk && versionOk && developerNameOk && capabilitiesOk &&\n portalPacket?.review_materials?.annotation_justifications === \"PASS_12_OF_12_VALIDATED\";\n});\n\n// Workspace custom-app flow from current official ChatGPT docs:\n// endpoint + required metadata + auth choice -> Scan Tools -> Create draft.\nworkspaceDraftBlockers.push(\"chatgpt_create_app_surface_unverified\");\nworkspaceDraftBlockers.push(\"scan_tools_not_executed\");\nworkspaceDraftBlockers.push(\"create_draft_not_executed\");\n\n// Public Plugin Directory requirements from current official OpenAI plugin submission docs.\npublicDirectoryBlockers.push(\"domain_verification_not_completed\");\npublicDirectoryBlockers.push(\"apps_management_write_unverified\");\npublicDirectoryBlockers.push(\"publisher_identity_unverified\");\npublicDirectoryBlockers.push(\"logo_portal_upload_not_executed\");\npublicDirectoryBlockers.push(\"production_mcp_url_not_authorized\");\npublicDirectoryBlockers.push(\"scan_tools_not_executed\");\npublicDirectoryBlockers.push(\"distribution_scope_unset\");\npublicDirectoryBlockers.push(\"policy_attestations_not_completed\");\n\ngovernanceBlockers.push(\"github_candidate_head_unreconciled\");\n\n// Final public submission of a remote MCP requires completed domain verification.\n// The endpoint stays fail-closed until the portal issues the real token.\nconst challenge = await fetch(`${BASE}/.well-known/openai-apps-challenge`);\nfacts.domain_challenge_status = challenge.status;\nfacts.domain_verification_gate = \"REQUIRED_FOR_FINAL_REMOTE_MCP_SUBMISSION_NOT_COMPLETED\";\nfacts.domain_challenge_capability = challenge.status === 404 ? \"READY_FAIL_CLOSED_NO_TOKEN\" : \"TOKEN_ENDPOINT_ACTIVE_NEEDS_PORTAL_MATCH\";\nfacts.production_url_candidate = portalPacket?.production_mcp_url ?? null;\nfacts.mcp_url_label_contains_staging = portalPacket?.mcp_url_candidate?.includes(\"staging\") === true;\nfacts.production_url_authority = \"SEPARATE_GOVERNANCE_GATE_NOT_INFERRED_FROM_HOSTNAME\";\nfacts.public_submission_execution = \"NOT_EXECUTED_SEPARATE_FROM_READINESS\";\n\nfacts.official_workspace_custom_app_flow = \"ENDPOINT_METADATA_AUTH_SCAN_TOOLS_CREATE_DRAFT\";\nfacts.official_public_submission_type = \"WITH_MCP_REMOTE_MCP_ONLY\";\nfacts.mcp_url_type = \"UNIVERSAL\";\nfacts.auth = \"NONE_FOR_BOUNDED_V1\";\nfacts.ui = \"NONE_CSP_NOT_APPLICABLE\";\nfacts.logo_asset = \"READY_SHA256_3ac48eb17d735ee41d12e6edf0cc0ea0e5a55358cce6b5fd37d93b3fc0372205\";\nfacts.starter_prompts = \"READY_IN_PORTAL_PACKET\";\nfacts.test_cases = \"5_POSITIVE_3_NEGATIVE_READY\";\nfacts.release_notes = \"READY_IN_PORTAL_PACKET\";\nfacts.listing_materials = \"READY_TECHNICALLY\";\nfacts.data_residency_submission_requirement = \"NOT_LISTED_AS_PUBLIC_PLUGIN_SUBMISSION_REQUIREMENT_IN_CURRENT_OFFICIAL_GUIDE\";\nfacts.demo_recording_submission_requirement = \"NOT_REQUIRED_BY_CURRENT_OFFICIAL_SUBMISSION_OR_MCP_REVIEW_DOCS\";\nfacts.github_candidate_head_reconciliation = \"UNAVAILABLE_IN_THIS_SESSION_FAIL_CLOSED\";\nfacts.money_spend = 0;\nfacts.authority = \"NOT_GRANTED_BY_TECHNICAL_GATE\";\n\nconst technicalState = technicalFailures.length === 0 ? \"PASS\" : \"FAIL\";\nconst workspaceDraftState = technicalFailures.length === 0 && workspaceDraftBlockers.length === 0 && governanceBlockers.length === 0\n ? \"READY_TO_CREATE\"\n : \"BLOCKED_FAIL_CLOSED\";\nconst publicDirectoryState = technicalFailures.length === 0 && publicDirectoryBlockers.length === 0 && governanceBlockers.length === 0\n ? \"READY_TO_SUBMIT\"\n : \"BLOCKED_FAIL_CLOSED\";\n\nconst result = {\n candidate_sha: EXPECTED_SHA,\n technical_state: technicalState,\n workspace_draft_state: workspaceDraftState,\n public_directory_state: publicDirectoryState,\n technical_failures: technicalFailures,\n workspace_draft_blockers: workspaceDraftBlockers,\n public_directory_blockers: publicDirectoryBlockers,\n governance_blockers: governanceBlockers,\n facts,\n};\n\nconsole.log(JSON.stringify(result, null, 2));\nif (technicalState === \"PASS\") console.log(\"RUMBO_OPENAI_TECHNICAL_GATE_PASS\");\nif (workspaceDraftState !== \"READY_TO_CREATE\") console.log(\"RUMBO_OPENAI_WORKSPACE_DRAFT_GATE_BLOCKED\");\nif (publicDirectoryState !== \"READY_TO_SUBMIT\") console.log(\"RUMBO_OPENAI_PUBLIC_DIRECTORY_GATE_BLOCKED\");\n","import portalPacket from \"./PORTAL_PACKET.json\" with { type: \"json\" };\n\nconst BASE = \"https://rumbo-crm-openai-staging.val.run\";\nconst EXPECTED_SHA = \"9152f5a50de42be55508f0effed5ed09aee44c60\";\nconst EXPECTED_LOGO_SHA256 = \"3ac48eb17d735ee41d12e6edf0cc0ea0e5a55358cce6b5fd37d93b3fc0372205\";\nconst LISTING_URLS = {\n website: `${BASE}/`,\n support: `${BASE}/support`,\n privacy: `${BASE}/privacy`,\n terms: `${BASE}/terms`,\n};\n\nconst facts: Record = {};\nconst technicalFailures: string[] = [];\nconst workspaceDraftBlockers: string[] = [];\nconst publicDirectoryBlockers: string[] = [];\nconst governanceBlockers: string[] = [];\n\nasync function check(name: string, fn: () => Promise) {\n try {\n const ok = await fn();\n facts[name] = ok ? \"PASS\" : \"FAIL\";\n if (!ok) technicalFailures.push(name);\n } catch (e) {\n facts[name] = `ERROR:${e instanceof Error ? e.message : String(e)}`;\n technicalFailures.push(name);\n }\n}\n\nasync function sha256Hex(bytes: Uint8Array) {\n const digest = new Uint8Array(await crypto.subtle.digest(\"SHA-256\", bytes));\n return Array.from(digest, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nconst mcpHeaders = {\n origin: \"https://chatgpt.com\",\n accept: \"application/json, text/event-stream\",\n \"content-type\": \"application/json\",\n \"mcp-protocol-version\": \"2025-06-18\",\n};\n\nasync function mcpCall(name: string, args: Record) {\n const r = await fetch(`${BASE}/api/openai-plugin/mcp`, {\n method: \"POST\",\n headers: mcpHeaders,\n body: JSON.stringify({ jsonrpc: \"2.0\", id: name, method: \"tools/call\", params: { name, arguments: args } }),\n });\n if (r.status !== 200) throw new Error(`mcp_call_${name}_status_${r.status}`);\n return await r.json();\n}\n\nawait check(\"health_exact_sha\", async () => {\n const r = await fetch(`${BASE}/api/openai-plugin/health`, {\n headers: { origin: \"https://chatgpt.com\", accept: \"application/json\" },\n });\n if (r.status !== 200) return false;\n const b = await r.json();\n return b?.sourceSha === EXPECTED_SHA && b?.productionAuthority === false && b?.submissionAuthority === false;\n});\n\nawait check(\"tool_annotations\", async () => {\n const r = await fetch(`${BASE}/api/openai-plugin/mcp`, {\n method: \"POST\",\n headers: mcpHeaders,\n body: JSON.stringify({ jsonrpc: \"2.0\", id: 1, method: \"tools/list\", params: {} }),\n });\n if (r.status !== 200) return false;\n const b = await r.json();\n const tools = b?.result?.tools ?? [];\n facts.tool_count = tools.length;\n return tools.length === 4 && tools.every((t: any) =>\n t.annotations?.readOnlyHint === true &&\n t.annotations?.openWorldHint === false &&\n t.annotations?.destructiveHint === false\n );\n});\n\nawait check(\"response_minimization\", async () => {\n const fixtures = [\n [\"crm_get_service_readiness\", {}, new Set([\"state\", \"customer_data_tools_exposed\", \"mutating_tools_exposed\", \"production_authority\", \"submission_authority\"])],\n [\"crm_prepare_note\", { workspace_id: \"ws_demo\", subject_id: \"subject_demo\", note: \"Synthetic reviewer note.\" }, new Set([\"kind\", \"state\", \"side_effect\", \"workspace_id\", \"subject_id\", \"note\"])],\n [\"crm_prepare_lead_stage_change\", { workspace_id: \"ws_demo\", lead_id: \"lead_demo\", from_stage: \"new\", to_stage: \"qualified\", reason: \"Synthetic reviewer fixture.\" }, new Set([\"kind\", \"state\", \"side_effect\", \"workspace_id\", \"lead_id\", \"from_stage\", \"to_stage\", \"reason\"])],\n [\"crm_prepare_outreach_draft\", { workspace_id: \"ws_demo\", lead_id: \"lead_demo\", channel: \"email\", objective: \"Prepare a synthetic follow-up draft.\" }, new Set([\"kind\", \"state\", \"side_effect\", \"workspace_id\", \"lead_id\", \"channel\", \"objective\", \"send_authorized\"])],\n ] as const;\n\n const forbiddenKey = /(token|secret|password|api[_-]?key|debug|stack|authorization|cookie)/i;\n for (const [name, args, expectedKeys] of fixtures) {\n const body: any = await mcpCall(name, args as Record);\n const sc = body?.result?.structuredContent;\n if (!sc || typeof sc !== \"object\") return false;\n const keys = Object.keys(sc);\n if (keys.some((k) => forbiddenKey.test(k))) return false;\n if (keys.some((k) => !expectedKeys.has(k as never))) return false;\n const serialized = JSON.stringify(sc).toLowerCase();\n if (serialized.includes(\"bearer \") || serialized.includes(\"sk-\") || serialized.includes(\"stack trace\")) return false;\n }\n return true;\n});\n\nawait check(\"listing_urls_public\", async () => {\n const responses = await Promise.all(Object.values(LISTING_URLS).map((url) => fetch(url, { redirect: \"follow\" })));\n facts.listing_url_statuses = Object.fromEntries(Object.keys(LISTING_URLS).map((key, i) => [key, responses[i].status]));\n return responses.every((r) => r.status >= 200 && r.status < 300);\n});\n\nawait check(\"support_mcp_semantics\", async () => {\n const r = await fetch(LISTING_URLS.support, { redirect: \"follow\" });\n if (!r.ok) return false;\n const text = (await r.text()).toLowerCase();\n return (text.includes(\"rumbo crm\") || text.includes(\"rumbo ia crm\")) &&\n (text.includes(\"proposal-only\") || text.includes(\"review\") || text.includes(\"proposal tools\")) &&\n (text.includes(\"openai\") || text.includes(\"chatgpt\")) &&\n (text.includes(\"sebastian@rumbo.verso.fans\") || text.includes(\"contact support\"));\n});\n\nawait check(\"privacy_mcp_disclosure\", async () => {\n const r = await fetch(LISTING_URLS.privacy, { redirect: \"follow\" });\n if (!r.ok) return false;\n const text = (await r.text()).toLowerCase();\n return (text.includes(\"mcp\") || text.includes(\"chatgpt\") || text.includes(\"plugin\")) &&\n (text.includes(\"note\") || text.includes(\"lead\") || text.includes(\"workspace\") || text.includes(\"identifier\"));\n});\n\nawait check(\"terms_bounded_semantics\", async () => {\n const r = await fetch(LISTING_URLS.terms, { redirect: \"follow\" });\n if (!r.ok) return false;\n const text = (await r.text()).toLowerCase();\n return text.includes(\"human-controlled\") && text.includes(\"proposals\") && text.includes(\"not automatically applied\");\n});\n\nawait check(\"logo_exact_asset\", async () => {\n const r = await fetch(`${BASE}/logo.svg`, { redirect: \"follow\" });\n if (!r.ok || !(r.headers.get(\"content-type\") ?? \"\").includes(\"image/svg+xml\")) return false;\n const hash = await sha256Hex(new Uint8Array(await r.arrayBuffer()));\n facts.logo_sha256 = hash;\n return hash === EXPECTED_LOGO_SHA256;\n});\n\nawait check(\"portal_packet_constraints\", async () => {\n const prompts = portalPacket?.starter_prompts ?? [];\n const unique = new Set(prompts);\n const promptsOk = Array.isArray(prompts) && prompts.length > 0 && prompts.length <= 3 &&\n unique.size === prompts.length && prompts.every((p: unknown) =>\n typeof p === \"string\" && p.length <= 128 && !p.includes(\"@\") && !/[\\r\\n]/.test(p)\n );\n const pkg = portalPacket?.directory_package;\n const packageNameOk = typeof pkg?.package_name === \"string\" && /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(pkg.package_name);\n const versionOk = typeof pkg?.version === \"string\" && pkg.version.length <= 64 && /^\\d+\\.\\d+\\.\\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(pkg.version);\n const developerNameOk = typeof pkg?.developer_name_candidate === \"string\" && pkg.developer_name_candidate.length > 0 && pkg.developer_name_candidate.length <= 80 && !/[\\r\\n]/.test(pkg.developer_name_candidate);\n const capabilities = pkg?.capabilities ?? [];\n const capabilitiesOk = Array.isArray(capabilities) && capabilities.length <= 20 && capabilities.every((c: unknown) =>\n typeof c === \"string\" && c.trim().length > 0 && c.length <= 120 && !/[\\r\\n]/.test(c)\n );\n facts.starter_prompt_count = prompts.length;\n facts.package_name = pkg?.package_name ?? null;\n facts.package_version = pkg?.version ?? null;\n facts.capability_count = capabilities.length;\n facts.annotation_justifications = portalPacket?.review_materials?.annotation_justifications ?? null;\n return promptsOk && packageNameOk && versionOk && developerNameOk && capabilitiesOk &&\n portalPacket?.review_materials?.annotation_justifications === \"PASS_12_OF_12_VALIDATED\";\n});\n\n// Workspace custom-app flow from current official ChatGPT docs:\n// endpoint + required metadata + auth choice -> Scan Tools -> Create draft.\nworkspaceDraftBlockers.push(\"chatgpt_create_app_surface_unverified\");\nworkspaceDraftBlockers.push(\"scan_tools_not_executed\");\nworkspaceDraftBlockers.push(\"create_draft_not_executed\");\n\n// Public Plugin Directory requirements from current official OpenAI plugin submission docs.\npublicDirectoryBlockers.push(\"domain_verification_not_completed\");\npublicDirectoryBlockers.push(\"apps_management_write_unverified\");\npublicDirectoryBlockers.push(\"publisher_identity_unverified\");\npublicDirectoryBlockers.push(\"global_data_residency_unverified\");\npublicDirectoryBlockers.push(\"logo_portal_upload_not_executed\");\npublicDirectoryBlockers.push(\"production_mcp_url_not_authorized\");\npublicDirectoryBlockers.push(\"scan_tools_not_executed\");\npublicDirectoryBlockers.push(\"distribution_scope_unset\");\npublicDirectoryBlockers.push(\"policy_attestations_not_completed\");\n\ngovernanceBlockers.push(\"github_candidate_head_unreconciled\");\n\n// Final public submission of a remote MCP requires completed domain verification.\n// The endpoint stays fail-closed until the portal issues the real token.\nconst challenge = await fetch(`${BASE}/.well-known/openai-apps-challenge`);\nfacts.domain_challenge_status = challenge.status;\nfacts.domain_verification_gate = \"REQUIRED_FOR_FINAL_REMOTE_MCP_SUBMISSION_NOT_COMPLETED\";\nfacts.domain_challenge_capability = challenge.status === 404 ? \"READY_FAIL_CLOSED_NO_TOKEN\" : \"TOKEN_ENDPOINT_ACTIVE_NEEDS_PORTAL_MATCH\";\nfacts.production_url_candidate = portalPacket?.production_mcp_url ?? null;\nfacts.mcp_url_label_contains_staging = portalPacket?.mcp_url_candidate?.includes(\"staging\") === true;\nfacts.production_url_authority = \"SEPARATE_GOVERNANCE_GATE_NOT_INFERRED_FROM_HOSTNAME\";\nfacts.public_submission_execution = \"NOT_EXECUTED_SEPARATE_FROM_READINESS\";\n\nfacts.official_workspace_custom_app_flow = \"ENDPOINT_METADATA_AUTH_SCAN_TOOLS_CREATE_DRAFT\";\nfacts.official_public_submission_type = \"WITH_MCP_REMOTE_MCP_ONLY\";\nfacts.mcp_url_type = \"UNIVERSAL\";\nfacts.auth = \"NONE_FOR_BOUNDED_V1\";\nfacts.ui = \"NONE_CSP_NOT_APPLICABLE\";\nfacts.logo_asset = \"READY_SHA256_3ac48eb17d735ee41d12e6edf0cc0ea0e5a55358cce6b5fd37d93b3fc0372205\";\nfacts.starter_prompts = \"READY_IN_PORTAL_PACKET\";\nfacts.test_cases = \"5_POSITIVE_3_NEGATIVE_READY\";\nfacts.release_notes = \"READY_IN_PORTAL_PACKET\";\nfacts.listing_materials = \"READY_TECHNICALLY\";\nfacts.data_residency_submission_requirement = \"NOT_LISTED_AS_PUBLIC_PLUGIN_SUBMISSION_REQUIREMENT_IN_CURRENT_OFFICIAL_GUIDE\";\nfacts.demo_recording_submission_requirement = \"NOT_REQUIRED_BY_CURRENT_OFFICIAL_SUBMISSION_OR_MCP_REVIEW_DOCS\";\nfacts.github_candidate_head_reconciliation = \"UNAVAILABLE_IN_THIS_SESSION_FAIL_CLOSED\";\nfacts.money_spend = 0;\nfacts.authority = \"NOT_GRANTED_BY_TECHNICAL_GATE\";\n\nconst technicalState = technicalFailures.length === 0 ? \"PASS\" : \"FAIL\";\nconst workspaceDraftState = technicalFailures.length === 0 && workspaceDraftBlockers.length === 0 && governanceBlockers.length === 0\n ? \"READY_TO_CREATE\"\n : \"BLOCKED_FAIL_CLOSED\";\nconst publicDirectoryState = technicalFailures.length === 0 && publicDirectoryBlockers.length === 0 && governanceBlockers.length === 0\n ? \"READY_TO_SUBMIT\"\n : \"BLOCKED_FAIL_CLOSED\";\n\nconst result = {\n candidate_sha: EXPECTED_SHA,\n technical_state: technicalState,\n workspace_draft_state: workspaceDraftState,\n public_directory_state: publicDirectoryState,\n technical_failures: technicalFailures,\n workspace_draft_blockers: workspaceDraftBlockers,\n public_directory_blockers: publicDirectoryBlockers,\n governance_blockers: governanceBlockers,\n facts,\n};\n\nconsole.log(JSON.stringify(result, null, 2));\nif (technicalState === \"PASS\") console.log(\"RUMBO_OPENAI_TECHNICAL_GATE_PASS\");\nif (workspaceDraftState !== \"READY_TO_CREATE\") console.log(\"RUMBO_OPENAI_WORKSPACE_DRAFT_GATE_BLOCKED\");\nif (publicDirectoryState !== \"READY_TO_SUBMIT\") console.log(\"RUMBO_OPENAI_PUBLIC_DIRECTORY_GATE_BLOCKED\");\n","createdAt",["D",1789342307817],"branchVersion","branchId","ceba545d-7cc1-405d-a0c7-d27e7e735161","id","3255f42e-7bba-4583-8764-631437397e4e","rumbo-crm-openai-staging",["D",1789031650837],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","RUMBO IA CRM bounded MCP staging","imageUrl","d3788f19-13c5-4356-87e8-dce639626bb9","pinnedFileId","fbed6f64-acf7-11f1-b3b4-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a04116-f28c-754c-9173-77bf5814fcd6","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_97":96,"_105":101},"org",{"_97":96,"_98":99,"_100":101,"_18":55,"_102":103,"_104":25},"branch",{"_13":86,"_32":87,"_43":42,"_88":44,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":45,"_95":96},"isOwned",284,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","sebas1","handle","displayName","sebas","avatar","https://lh3.googleusercontent.com/a/ACg8ocJaC6uiXPmN9dvgA2XcSlzBSkPJO0GN5zKzPm3a8cbjmXC9HYA=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":787,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":57,"_58":59,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":-5,"_67":-5,"_68":-5,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":788,"_81":789,"_83":790,"_85":25},"tree",[574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626],"files",[574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626],"counts",{"_564":63,"_565":296,"_566":63,"_567":568,"_569":570},"contents",[128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":557,"_32":558,"_30":559,"_184":-5,"_41":42,"_40":560,"_186":59,"_38":561,"_13":63,"_33":20,"_35":562,"_24":25,"_189":-5,"_27":563},{"_43":550,"_32":551,"_30":552,"_184":-5,"_41":42,"_40":553,"_186":59,"_38":554,"_13":63,"_33":20,"_35":555,"_24":25,"_189":-5,"_27":556},{"_43":542,"_32":543,"_30":544,"_184":-5,"_41":42,"_40":545,"_186":59,"_38":546,"_13":547,"_33":20,"_35":548,"_24":25,"_189":-5,"_27":549},{"_43":534,"_32":535,"_30":536,"_184":-5,"_41":42,"_40":537,"_186":59,"_38":538,"_13":539,"_33":20,"_35":540,"_24":25,"_189":-5,"_27":541},{"_43":527,"_32":528,"_30":529,"_184":-5,"_41":42,"_40":530,"_186":59,"_38":531,"_13":63,"_33":20,"_35":532,"_24":25,"_189":-5,"_27":533},{"_43":520,"_32":521,"_30":522,"_184":-5,"_41":42,"_40":523,"_186":59,"_38":524,"_13":63,"_33":20,"_35":525,"_24":25,"_189":-5,"_27":526},{"_43":513,"_32":514,"_30":515,"_184":-5,"_41":42,"_40":516,"_186":59,"_38":517,"_13":63,"_33":20,"_35":518,"_24":25,"_189":-5,"_27":519},{"_43":506,"_32":507,"_30":508,"_184":-5,"_41":42,"_40":509,"_186":59,"_38":510,"_13":63,"_33":20,"_35":511,"_24":25,"_189":-5,"_27":512},{"_43":499,"_32":500,"_30":501,"_184":-5,"_41":42,"_40":502,"_186":59,"_38":503,"_13":63,"_33":20,"_35":504,"_24":25,"_189":-5,"_27":505},{"_43":492,"_32":493,"_30":494,"_184":-5,"_41":42,"_40":495,"_186":59,"_38":496,"_13":63,"_33":20,"_35":497,"_24":25,"_189":-5,"_27":498},{"_43":485,"_32":486,"_30":487,"_184":-5,"_41":42,"_40":488,"_186":59,"_38":489,"_13":63,"_33":20,"_35":490,"_24":25,"_189":-5,"_27":491},{"_43":478,"_32":479,"_30":480,"_184":-5,"_41":42,"_40":481,"_186":59,"_38":482,"_13":63,"_33":20,"_35":483,"_24":25,"_189":-5,"_27":484},{"_43":471,"_32":472,"_30":473,"_184":-5,"_41":42,"_40":474,"_186":59,"_38":475,"_13":63,"_33":20,"_35":476,"_24":25,"_189":-5,"_27":477},{"_43":463,"_32":464,"_30":465,"_184":-5,"_41":42,"_40":466,"_186":59,"_38":467,"_13":468,"_33":20,"_35":469,"_24":25,"_189":-5,"_27":470},{"_43":456,"_32":457,"_30":458,"_184":-5,"_41":42,"_40":459,"_186":59,"_38":460,"_13":359,"_33":20,"_35":461,"_24":25,"_189":-5,"_27":462},{"_43":449,"_32":450,"_30":451,"_184":-5,"_41":42,"_40":452,"_186":59,"_38":453,"_13":63,"_33":20,"_35":454,"_24":25,"_189":-5,"_27":455},{"_43":442,"_32":443,"_30":444,"_184":-5,"_41":42,"_40":445,"_186":59,"_38":446,"_13":63,"_33":20,"_35":447,"_24":25,"_189":-5,"_27":448},{"_43":435,"_32":436,"_30":437,"_184":-5,"_41":42,"_40":438,"_186":59,"_38":439,"_13":63,"_33":20,"_35":440,"_24":25,"_189":-5,"_27":441},{"_43":428,"_32":429,"_30":430,"_184":-5,"_41":42,"_40":431,"_186":59,"_38":432,"_13":63,"_33":20,"_35":433,"_24":25,"_189":-5,"_27":434},{"_43":421,"_32":422,"_30":423,"_184":-5,"_41":42,"_40":424,"_186":59,"_38":425,"_13":63,"_33":20,"_35":426,"_24":25,"_189":-5,"_27":427},{"_43":413,"_32":414,"_30":415,"_184":-5,"_41":42,"_40":416,"_186":59,"_38":417,"_13":418,"_33":20,"_35":419,"_24":25,"_189":-5,"_27":420},{"_43":405,"_32":406,"_30":407,"_184":-5,"_41":42,"_40":408,"_186":59,"_38":409,"_13":410,"_33":20,"_35":411,"_24":25,"_189":-5,"_27":412},{"_43":398,"_32":399,"_30":400,"_184":-5,"_41":42,"_40":401,"_186":59,"_38":402,"_13":63,"_33":20,"_35":403,"_24":25,"_189":-5,"_27":404},{"_43":390,"_32":391,"_30":392,"_184":-5,"_41":42,"_40":393,"_186":25,"_38":394,"_13":395,"_33":20,"_35":396,"_24":25,"_189":-5,"_27":397},{"_43":383,"_32":384,"_30":385,"_184":-5,"_41":42,"_40":386,"_186":59,"_38":387,"_13":63,"_33":20,"_35":388,"_24":25,"_189":-5,"_27":389},{"_43":376,"_32":377,"_30":378,"_184":-5,"_41":42,"_40":379,"_186":59,"_38":380,"_13":63,"_33":20,"_35":381,"_24":25,"_189":-5,"_27":382},{"_43":369,"_32":370,"_30":371,"_184":-5,"_41":42,"_40":372,"_186":59,"_38":373,"_13":63,"_33":20,"_35":374,"_24":25,"_189":-5,"_27":375},{"_43":362,"_32":363,"_30":364,"_184":-5,"_41":42,"_40":365,"_186":59,"_38":366,"_13":63,"_33":20,"_35":367,"_24":25,"_189":-5,"_27":368},{"_43":354,"_32":355,"_30":356,"_184":-5,"_41":42,"_40":357,"_186":59,"_38":358,"_13":359,"_33":20,"_35":360,"_24":25,"_189":-5,"_27":361},{"_43":346,"_32":347,"_30":348,"_184":-5,"_41":42,"_40":349,"_186":25,"_38":350,"_13":351,"_33":20,"_35":352,"_24":25,"_189":-5,"_27":353},{"_43":339,"_32":340,"_30":341,"_184":-5,"_41":42,"_40":342,"_186":59,"_38":343,"_13":296,"_33":20,"_35":344,"_24":25,"_189":-5,"_27":345},{"_43":332,"_32":333,"_30":334,"_184":-5,"_41":42,"_40":335,"_186":59,"_38":336,"_13":63,"_33":20,"_35":337,"_24":25,"_189":-5,"_27":338},{"_43":325,"_32":326,"_30":327,"_184":-5,"_41":42,"_40":328,"_186":59,"_38":329,"_13":63,"_33":20,"_35":330,"_24":25,"_189":-5,"_27":331},{"_43":318,"_32":319,"_30":320,"_184":-5,"_41":42,"_40":321,"_186":59,"_38":322,"_13":63,"_33":20,"_35":323,"_24":25,"_189":-5,"_27":324},{"_43":310,"_32":311,"_30":57,"_184":-5,"_41":42,"_40":312,"_186":59,"_38":313,"_13":314,"_33":315,"_35":316,"_24":25,"_189":45,"_27":317},{"_43":303,"_32":304,"_30":305,"_184":-5,"_41":42,"_40":306,"_186":59,"_38":307,"_13":63,"_33":34,"_35":308,"_24":25,"_189":-5,"_27":309},{"_43":299,"_32":28,"_30":31,"_184":-5,"_41":42,"_40":14,"_186":25,"_38":300,"_13":301,"_33":34,"_35":37,"_24":25,"_189":-5,"_27":302},{"_43":291,"_32":292,"_30":293,"_184":-5,"_41":42,"_40":294,"_186":59,"_38":295,"_13":296,"_33":34,"_35":297,"_24":25,"_189":-5,"_27":298},{"_43":283,"_32":284,"_30":285,"_184":-5,"_41":42,"_40":286,"_186":59,"_38":287,"_13":288,"_33":34,"_35":289,"_24":25,"_189":-5,"_27":290},{"_43":276,"_32":277,"_30":278,"_184":-5,"_41":42,"_40":279,"_186":59,"_38":280,"_13":63,"_33":34,"_35":281,"_24":25,"_189":-5,"_27":282},{"_43":269,"_32":270,"_30":271,"_184":-5,"_41":42,"_40":272,"_186":59,"_38":273,"_13":63,"_33":34,"_35":274,"_24":25,"_189":-5,"_27":275},{"_43":262,"_32":263,"_30":264,"_184":-5,"_41":42,"_40":265,"_186":59,"_38":266,"_13":63,"_33":34,"_35":267,"_24":25,"_189":-5,"_27":268},{"_43":255,"_32":256,"_30":257,"_184":-5,"_41":42,"_40":258,"_186":59,"_38":259,"_13":63,"_33":34,"_35":260,"_24":25,"_189":-5,"_27":261},{"_43":248,"_32":249,"_30":250,"_184":-5,"_41":42,"_40":251,"_186":59,"_38":252,"_13":63,"_33":34,"_35":253,"_24":25,"_189":-5,"_27":254},{"_43":241,"_32":242,"_30":243,"_184":-5,"_41":42,"_40":244,"_186":59,"_38":245,"_13":63,"_33":34,"_35":246,"_24":25,"_189":-5,"_27":247},{"_43":234,"_32":235,"_30":236,"_184":-5,"_41":42,"_40":237,"_186":59,"_38":238,"_13":63,"_33":34,"_35":239,"_24":25,"_189":-5,"_27":240},{"_43":227,"_32":228,"_30":229,"_184":-5,"_41":42,"_40":230,"_186":59,"_38":231,"_13":63,"_33":34,"_35":232,"_24":25,"_189":-5,"_27":233},{"_43":220,"_32":221,"_30":222,"_184":-5,"_41":42,"_40":223,"_186":59,"_38":224,"_13":63,"_33":34,"_35":225,"_24":25,"_189":-5,"_27":226},{"_43":213,"_32":214,"_30":215,"_184":-5,"_41":42,"_40":216,"_186":59,"_38":217,"_13":63,"_33":34,"_35":218,"_24":25,"_189":-5,"_27":219},{"_43":206,"_32":207,"_30":208,"_184":-5,"_41":42,"_40":209,"_186":59,"_38":210,"_13":63,"_33":34,"_35":211,"_24":25,"_189":-5,"_27":212},{"_43":199,"_32":200,"_30":201,"_184":-5,"_41":42,"_40":202,"_186":59,"_38":203,"_13":63,"_33":34,"_35":204,"_24":25,"_189":-5,"_27":205},{"_43":191,"_32":192,"_30":193,"_184":-5,"_41":42,"_40":194,"_186":59,"_38":195,"_13":196,"_33":34,"_35":197,"_24":25,"_189":-5,"_27":198},{"_43":181,"_32":182,"_30":183,"_184":-5,"_41":42,"_40":185,"_186":59,"_38":187,"_13":63,"_33":34,"_35":188,"_24":25,"_189":-5,"_27":190},"6a5ab433-b141-45f6-8966-4592b1bb3580","verify_submission_import.ts","8fe4ec18-ada4-11f1-9cb0-1607ee4eb77e","parentId",61,"latest",["D",1789105772539],"import submission from \"./chatgpt-app-submission.json\" with { type: \"json\" };\n\nconst EXPECTED_TOOLS = [\n \"crm_get_service_readiness\",\n \"crm_prepare_note\",\n \"crm_prepare_lead_stage_change\",\n \"crm_prepare_outreach_draft\",\n] as const;\nconst ALLOWED_CATEGORIES = new Set([\"BUSINESS\",\"COLLABORATION\",\"DESIGN\",\"DEVELOPER_TOOLS\",\"EDUCATION\",\"ENTERTAINMENT\",\"FINANCE\",\"FOOD\",\"LIFESTYLE\",\"NEWS\",\"PRODUCTIVITY\",\"SHOPPING\",\"TRAVEL\"]);\nconst failures: string[] = [];\nconst pass = (name: string, ok: boolean) => { console.log(`${ok ? \"PASS\" : \"FAIL\"} ${name}`); if (!ok) failures.push(name); };\n\npass(\"schema_version=1\", submission.schema_version === 1);\npass(\"schema_url\", submission.$schema === \"https://developers.openai.com/apps-sdk/schemas/chatgpt-app-submission.v1.json\");\npass(\"display_name\", submission.app_info?.display_name === \"RUMBO IA CRM\");\npass(\"subtitle<=30\", typeof submission.app_info?.subtitle === \"string\" && submission.app_info.subtitle.length <= 30);\npass(\"category\", ALLOWED_CATEGORIES.has(submission.app_info?.category));\n\nconst toolNames = Object.keys(submission.tools ?? {}).sort();\npass(\"exact_four_tools\", JSON.stringify(toolNames) === JSON.stringify([...EXPECTED_TOOLS].sort()));\nfor (const name of EXPECTED_TOOLS) {\n const t = submission.tools?.[name];\n pass(`${name}.annotations`, t?.annotations?.readOnlyHint === true && t?.annotations?.openWorldHint === false && t?.annotations?.destructiveHint === false);\n pass(`${name}.justifications`, [t?.justifications?.read_only_justification, t?.justifications?.open_world_justification, t?.justifications?.destructive_justification].every((v) => typeof v === \"string\" && v.trim().length > 0));\n}\n\npass(\"five_positive_tests\", Array.isArray(submission.test_cases) && submission.test_cases.length === 5);\npass(\"three_negative_tests\", Array.isArray(submission.negative_test_cases) && submission.negative_test_cases.length === 3);\nfor (const [i, tc] of (submission.test_cases ?? []).entries()) {\n pass(`positive_${i + 1}_tool_valid`, EXPECTED_TOOLS.includes(tc.tools_triggered));\n pass(`positive_${i + 1}_fields`, [tc.description, tc.user_prompt, tc.expected_output].every((v) => typeof v === \"string\" && v.trim().length > 0));\n}\nfor (const [i, tc] of (submission.negative_test_cases ?? []).entries()) {\n pass(`negative_${i + 1}_no_tool`, tc.tools_triggered === null);\n pass(`negative_${i + 1}_fields`, [tc.description, tc.user_prompt, tc.expected_output].every((v) => typeof v === \"string\" && v.trim().length > 0));\n}\n\nif (failures.length) {\n console.log(JSON.stringify({ state: \"FAIL\", failures }, null, 2));\n throw new Error(`Submission import verifier failed: ${failures.join(\", \")}`);\n}\nconsole.log(JSON.stringify({ state: \"PASS\", tools: EXPECTED_TOOLS.length, positive_tests: submission.test_cases.length, negative_tests: submission.negative_test_cases.length, money_spend: 0 }, null, 2));\nconsole.log(\"RUMBO_CHATGPT_APP_SUBMISSION_IMPORT_PASS\");\n","label",[182],"ea9a32de-fa09-4df0-b697-701b41caf417","verify_portal_packet.ts","9080c38c-adc6-11f1-9a8a-1607ee4eb77e",247,["D",1789335814647],8,"import packet from \"./PORTAL_PACKET.json\" with { type: \"json\" };\n\nconst EXPECTED_SHA = \"9152f5a50de42be55508f0effed5ed09aee44c60\";\nconst failures: string[] = [];\nconst pass = (name: string, ok: boolean) => {\n console.log(`${ok ? \"PASS\" : \"FAIL\"} ${name}`);\n if (!ok) failures.push(name);\n};\n\npass(\"schema\", packet.schema === \"RUMBO_OPENAI_PLUGIN_PORTAL_PACKET_V1\");\npass(\"budget_zero\", packet.budget_usd === 0);\npass(\"candidate_sha\", packet.candidate_sha === EXPECTED_SHA);\npass(\"remote_mcp_only\", packet.submission_type === \"WITH_MCP_REMOTE_MCP_ONLY\");\npass(\"universal_url\", packet.mcp_url_type === \"UNIVERSAL\");\npass(\"production_fail_closed\", packet.production_mcp_url === null && packet.production_mcp_url_status === \"NOT_AUTHORIZED_FAIL_CLOSED\");\npass(\"auth_none\", packet.authentication === \"NONE\");\npass(\"no_custom_ui\", packet.custom_ui === false);\npass(\"listing_policy_semantics\", packet.listing?.policy_urls_submission_semantics_ready === true);\npass(\"logo_hash\", packet.listing?.logo?.sha256 === \"3ac48eb17d735ee41d12e6edf0cc0ea0e5a55358cce6b5fd37d93b3fc0372205\");\npass(\"tests_minimum_met\", Number(packet.tests?.positive) >= 5 && Number(packet.tests?.negative) >= 3);\npass(\"submission_import_linked\", packet.submission_import?.artifact === \"chatgpt-app-submission.json\");\npass(\"official_requirements_linked\", packet.submission_import?.official_requirements_snapshot === \"OFFICIAL_SUBMISSION_REQUIREMENTS_2026-09-13.md\");\npass(\"skill_audit_linked\", packet.submission_import?.openai_submission_skill_audit === \"OPENAI_SUBMISSION_SKILL_AUDIT_2026-09-11.md\");\npass(\"portal_evidence_v16_linked\", packet.submission_import?.portal_evidence_receipt === \"PORTAL_EVIDENCE_RECEIPT_V16.json\" && packet.submission_import?.portal_evidence_verifier === \"verify_portal_evidence_v16.ts\" && packet.submission_import?.portal_evidence_status === \"V16_CURRENT_9_PUBLIC_BLOCKERS_3_WORKSPACE_BLOCKERS_1_GOVERNANCE_BLOCKER\");\npass(\"demo_recording_not_required\", packet.review_materials?.demo_recording_url === null && packet.review_materials?.demo_recording_status === \"NOT_REQUIRED_BY_CURRENT_OFFICIAL_SUBMISSION_OR_MCP_REVIEW_DOCS\");\npass(\"policy_attestations_not_completed\", packet.submission?.policy_attestations === \"NOT_COMPLETED\");\npass(\"tool_count\", packet.tool_contract?.count === 4);\npass(\"tool_annotations\", packet.tool_contract?.readOnlyHint === true && packet.tool_contract?.openWorldHint === false && packet.tool_contract?.destructiveHint === false);\npass(\"domain_not_faked\", packet.domain_verification?.token === null && packet.domain_verification?.status === \"NOT_EXECUTED\");\npass(\"availability_fail_closed\", Array.isArray(packet.availability?.countries_or_regions) && packet.availability.countries_or_regions.length === 0 && packet.availability?.status === \"UNSET_FAIL_CLOSED\");\npass(\"identity_unverified\", packet.publisher?.identity_status === \"REQUIRED_BY_PUBLIC_SUBMISSION_DOCS_UNVERIFIED\");\npass(\"apps_management_unverified\", packet.publisher?.apps_management_write === \"REQUIRED_API_APPS_WRITE_UNVERIFIED\");\npass(\"platform_context_fail_closed\", packet.publisher?.platform_context === \"RUMBO_ORG_DEFAULT_PROJECT_CONNECTED_PORTAL_CONTEXT_UNVERIFIED\");\npass(\"global_residency_unverified\", packet.publisher?.project_data_residency === \"UNVERIFIED_REQUIRES_GLOBAL_FOR_REMOTE_MCP_REVIEW\");\npass(\"scan_tools_not_executed\", packet.scan_tools?.status === \"NOT_EXECUTED\");\npass(\"submission_not_executed\", packet.submission?.submit_for_review === \"NOT_EXECUTED\" && packet.submission?.publication === \"NOT_EXECUTED\");\n\nif (failures.length) {\n console.log(JSON.stringify({ state: \"FAIL\", failures }, null, 2));\n throw new Error(`Portal packet verifier failed: ${failures.join(\", \")}`);\n}\nconsole.log(JSON.stringify({ state: \"PASS\", candidate_sha: EXPECTED_SHA, money_spend: 0 }, null, 2));\nconsole.log(\"RUMBO_OPENAI_PORTAL_PACKET_PASS\");\n",[192],"e919a4ab-9f63-42e0-bcef-bbd7889f7d27","verify_portal_evidence_v9.ts","1f8af2a0-ade5-11f1-af14-1607ee4eb77e",158,["D",1789133501314],"import receipt from \"./PORTAL_EVIDENCE_RECEIPT_V9.json\" with { type: \"json\" };\n\nconst EXPECTED_SHA = \"9152f5a50de42be55508f0effed5ed09aee44c60\";\nconst REQUIRED_BLOCKERS = [\n \"domain_verification_portal_status_unverified\",\n \"apps_management_write_unverified\",\n \"publisher_identity_unverified\",\n \"global_data_residency_unverified\",\n \"logo_portal_upload_not_executed\",\n \"scan_tools_not_executed\",\n \"distribution_scope_unset\",\n \"production_mcp_url_not_authorized\",\n].sort();\n\nconst failures: string[] = [];\nconst facts: Record = {};\nfunction check(name: string, ok: boolean) {\n facts[name] = ok ? \"PASS\" : \"FAIL\";\n if (!ok) failures.push(name);\n}\n\ncheck(\"schema_v9\", receipt.schema === \"RUMBO_OPENAI_PORTAL_EVIDENCE_RECEIPT_V9\");\ncheck(\"supersedes_v8\", receipt.supersedes_operationally === \"PORTAL_EVIDENCE_RECEIPT_V8.json\");\ncheck(\"budget_zero\", receipt.budget_usd === 0);\ncheck(\"candidate_sha\", receipt.candidate_sha_bound_in_staging === EXPECTED_SHA);\ncheck(\"github_fail_closed\", receipt.github_current_head === \"UNVERIFIED_CONNECTOR_DISABLED\");\ncheck(\"mcp_conformance\", receipt.technical?.mcp_conformance === \"PASS_18_CHECKS\");\ncheck(\"submission_import_justifications\", receipt.technical?.submission_import_runtime_validator === \"PASS_WITH_12_ANNOTATION_JUSTIFICATIONS\");\ncheck(\"privacy_matrix\", receipt.technical?.privacy_field_matrix === \"PASS_BOUNDED_EXPLICIT_INPUTS_ONLY\");\ncheck(\"packet_verifier\", receipt.technical?.portal_packet_verifier === \"PASS_AFTER_CANONICAL_MARKER_RECONCILIATION\");\ncheck(\"api_apps_write_required\", receipt.official_requirements?.api_apps_write === \"REQUIRED\");\ncheck(\"publisher_identity_required\", receipt.official_requirements?.verified_publisher_identity === \"REQUIRED\");\ncheck(\"global_residency_required\", receipt.official_requirements?.global_data_residency_for_remote_mcp_review === \"REQUIRED_CURRENTLY_EU_PROJECTS_INELIGIBLE\");\ncheck(\"domain_conditional\", receipt.official_requirements?.domain_verification === \"CONDITIONAL_WHEN_PORTAL_SHOWS_DOMAIN_NOT_VERIFIED\");\ncheck(\"positive_tests_5\", receipt.official_requirements?.positive_tests === 5);\ncheck(\"negative_tests_3\", receipt.official_requirements?.negative_tests === 3);\ncheck(\"justifications_required\", receipt.official_requirements?.tool_annotation_justifications === \"REQUIRED_FOR_REVIEW_PACKET\");\ncheck(\"privacy_hygiene_required\", receipt.official_requirements?.privacy_response_hygiene === \"REQUIRED\");\ncheck(\"project_residency_unverified\", receipt.portal_observation?.project_data_residency === \"UNVERIFIED\");\ncheck(\"apps_write_unverified\", receipt.portal_observation?.apps_management_write === \"UNVERIFIED\");\ncheck(\"publisher_identity_unverified\", receipt.portal_observation?.publisher_identity === \"UNVERIFIED\");\ncheck(\"scan_tools_not_executed\", receipt.portal_observation?.scan_tools === \"NOT_EXECUTED\");\ncheck(\"distribution_unset\", receipt.portal_observation?.distribution_scope === \"UNSET_FAIL_CLOSED\");\ncheck(\"authority_production_not_granted\", receipt.authority?.production === \"NOT_GRANTED\");\ncheck(\"authority_submission_not_granted\", receipt.authority?.submit_for_review === \"NOT_GRANTED_AND_NOT_EXECUTED\");\ncheck(\"authority_publication_not_granted\", receipt.authority?.publication === \"NOT_GRANTED_AND_NOT_EXECUTED\");\n\nconst blockers = [...(receipt.current_blockers ?? [])].sort();\ncheck(\"blocker_set_exact_8\", JSON.stringify(blockers) === JSON.stringify(REQUIRED_BLOCKERS));\n\nconst result = { state: failures.length === 0 ? \"PASS\" : \"FAIL\", facts, failures, money_spend: 0 };\nconsole.log(JSON.stringify(result, null, 2));\nif (failures.length) throw new Error(`portal_evidence_v9_failed:${failures.join(\",\")}`);\nconsole.log(\"RUMBO_OPENAI_PORTAL_EVIDENCE_V9_PASS\");\n",[200],"5faa3876-fdc8-44b7-94d3-a222fff3cdb3","verify_portal_evidence_v8.ts","299b23ac-ade3-11f1-b0dd-1607ee4eb77e",151,["D",1789132659223],"import receipt from \"./PORTAL_EVIDENCE_RECEIPT_V8.json\" with { type: \"json\" };\n\nconst REQUIRED_BLOCKERS = [\n \"domain_verification_portal_status_unverified\",\n \"apps_management_write_unverified\",\n \"publisher_identity_unverified\",\n \"global_data_residency_unverified\",\n \"logo_portal_upload_not_executed\",\n \"scan_tools_not_executed\",\n \"distribution_scope_unset\",\n \"production_mcp_url_not_authorized\",\n].sort();\n\nconst failures: string[] = [];\nconst facts: Record = {};\nfunction check(name: string, ok: boolean) {\n facts[name] = ok ? \"PASS\" : \"FAIL\";\n if (!ok) failures.push(name);\n}\n\ncheck(\"schema_v8\", receipt.schema === \"RUMBO_OPENAI_PORTAL_EVIDENCE_RECEIPT_V8\");\ncheck(\"budget_zero\", receipt.budget_usd === 0);\ncheck(\"candidate_sha\", receipt.candidate_sha_bound_in_staging === \"9152f5a50de42be55508f0effed5ed09aee44c60\");\ncheck(\"github_fail_closed\", receipt.github_current_head === \"UNVERIFIED_CONNECTOR_DISABLED\");\ncheck(\"submission_import_validator_pass\", receipt.technical?.submission_import_runtime_validator === \"PASS\");\ncheck(\"output_schema_all_four\", receipt.technical?.live_output_schema === \"PASS_ALL_FOUR\");\ncheck(\"annotations_all_four\", receipt.technical?.tool_annotations === \"PASS_ALL_FOUR\");\ncheck(\"positive_tests_5\", receipt.official_requirements?.positive_tests === 5);\ncheck(\"negative_tests_3\", receipt.official_requirements?.negative_tests === 3);\ncheck(\"api_apps_write_required\", receipt.official_requirements?.api_apps_write === \"REQUIRED\");\ncheck(\"publisher_identity_required\", receipt.official_requirements?.verified_publisher_identity === \"REQUIRED\");\ncheck(\"global_residency_required\", receipt.official_requirements?.global_data_residency_for_remote_mcp_review === \"REQUIRED_CURRENTLY_EU_PROJECTS_INELIGIBLE\");\ncheck(\"project_residency_unverified\", receipt.portal_observation?.project_data_residency === \"UNVERIFIED\");\ncheck(\"authority_production_not_granted\", receipt.authority?.production === \"NOT_GRANTED\");\ncheck(\"authority_submission_not_granted\", receipt.authority?.submit_for_review === \"NOT_GRANTED_AND_NOT_EXECUTED\");\ncheck(\"authority_publication_not_granted\", receipt.authority?.publication === \"NOT_GRANTED_AND_NOT_EXECUTED\");\n\nconst blockers = [...(receipt.current_blockers ?? [])].sort();\ncheck(\"blocker_set_exact\", JSON.stringify(blockers) === JSON.stringify(REQUIRED_BLOCKERS));\n\nconst result = {\n state: failures.length === 0 ? \"PASS\" : \"FAIL\",\n facts,\n failures,\n money_spend: 0,\n};\nconsole.log(JSON.stringify(result, null, 2));\nif (failures.length) throw new Error(`portal_evidence_v8_failed:${failures.join(\",\")}`);\nconsole.log(\"RUMBO_OPENAI_PORTAL_EVIDENCE_V8_PASS\");",[207],"5141aa84-0d9f-4e1c-8108-b9f7d8b69b5a","verify_portal_evidence_v7.ts","8bcc964a-add0-11f1-8573-1607ee4eb77e",140,["D",1789124663481],"import receipt from \"./PORTAL_EVIDENCE_RECEIPT_V7.json\" with { type: \"json\" };\n\nconst EXPECTED_SHA = \"9152f5a50de42be55508f0effed5ed09aee44c60\";\nconst EXPECTED_BLOCKERS = [\n \"domain_verification_portal_status_unverified\",\n \"apps_management_write_unverified\",\n \"publisher_identity_unverified\",\n \"global_data_residency_unverified\",\n \"logo_portal_upload_not_executed\",\n \"scan_tools_not_executed\",\n \"distribution_scope_unset\",\n \"production_mcp_url_not_authorized\",\n];\nconst failures: string[] = [];\nconst pass = (name: string, ok: boolean) => {\n console.log(`${ok ? \"PASS\" : \"FAIL\"} ${name}`);\n if (!ok) failures.push(name);\n};\n\npass(\"schema_v7\", receipt.schema === \"RUMBO_OPENAI_PORTAL_EVIDENCE_RECEIPT_V7\");\npass(\"budget_zero\", receipt.budget_usd === 0);\npass(\"candidate_bound_sha\", receipt.candidate_sha_bound_in_staging === EXPECTED_SHA);\npass(\"github_not_overclaimed\", receipt.github_current_head === \"UNVERIFIED_CONNECTOR_DISABLED\");\npass(\"mcp_conformance\", receipt.technical?.mcp_conformance === \"PASS\");\npass(\"portal_packet_verifier\", receipt.technical?.portal_packet_verifier === \"PASS\");\npass(\"submission_import\", receipt.technical?.submission_import === \"PASS_4_TOOLS_5_POSITIVE_3_NEGATIVE\");\npass(\"global_residency_rule\", receipt.official_requirements?.global_data_residency_for_mcp_review === \"REQUIRED_CURRENTLY_EU_PROJECTS_INELIGIBLE\");\npass(\"portal_login_required\", receipt.portal_observation?.platform_page_last_proven === \"LOGIN_REQUIRED\");\npass(\"desktop_timeout_not_overclaimed\", receipt.portal_observation?.desktop_cdp_retry === \"TIMEOUT_NO_NEW_PORTAL_EVIDENCE\");\npass(\"blockers_exact\", JSON.stringify(receipt.current_blockers) === JSON.stringify(EXPECTED_BLOCKERS));\npass(\"no_production_authority\", receipt.authority?.production === \"NOT_GRANTED\");\npass(\"no_submit_authority\", receipt.authority?.submit_for_review === \"NOT_GRANTED_AND_NOT_EXECUTED\");\npass(\"no_publication\", receipt.authority?.publication === \"NOT_GRANTED_AND_NOT_EXECUTED\");\n\nif (failures.length) throw new Error(`Portal evidence V7 verifier failed: ${failures.join(\", \")}`);\nconsole.log(JSON.stringify({ state: \"PASS\", candidate_sha_bound_in_staging: EXPECTED_SHA, blockers: EXPECTED_BLOCKERS.length, money_spend: 0 }, null, 2));\nconsole.log(\"RUMBO_OPENAI_PORTAL_EVIDENCE_V7_PASS\");\n",[214],"5458eb1f-9220-4040-8ad3-bba0cddba073","verify_portal_evidence_v6.ts","eaab6b70-adc9-11f1-82e9-1607ee4eb77e",127,["D",1789121816219],"import receipt from \"./PORTAL_EVIDENCE_RECEIPT_V6.json\" with { type: \"json\" };\n\nconst EXPECTED_SHA = \"9152f5a50de42be55508f0effed5ed09aee44c60\";\nconst EXPECTED_BLOCKERS = [\n \"domain_verification_portal_status_unverified\",\n \"apps_management_write_unverified\",\n \"publisher_identity_unverified\",\n \"global_data_residency_unverified\",\n \"logo_portal_upload_not_executed\",\n \"scan_tools_not_executed\",\n \"distribution_scope_unset\",\n \"production_mcp_url_not_authorized\",\n];\nconst failures: string[] = [];\nconst pass = (name: string, ok: boolean) => {\n console.log(`${ok ? \"PASS\" : \"FAIL\"} ${name}`);\n if (!ok) failures.push(name);\n};\n\npass(\"schema_v6\", receipt.schema === \"RUMBO_OPENAI_PORTAL_EVIDENCE_RECEIPT_V6\");\npass(\"budget_zero\", receipt.budget_usd === 0);\npass(\"candidate_bound_sha\", receipt.candidate_sha_bound_in_staging === EXPECTED_SHA);\npass(\"github_not_overclaimed\", receipt.github_current_head === \"UNVERIFIED_CONNECTOR_DISABLED\");\npass(\"mcp_conformance\", receipt.technical?.mcp_conformance === \"PASS\");\npass(\"all_output_schemas\", receipt.technical?.output_schema === \"PASS_ALL_FOUR_NO_WARNING\");\npass(\"descriptor_hardening\", receipt.descriptor_review?.descriptions === \"PASS_AFTER_RETURNS_NOT_CREATES_HARDENING\");\npass(\"sensitive_solicitation_review\", receipt.descriptor_review?.sensitive_data_solicitation === \"NO_EXPLICIT_PHI_PCI_SSN_CREDENTIAL_MFA_GOV_ID_BIOMETRIC_FIELDS\");\npass(\"global_residency_rule\", receipt.official_requirements?.global_data_residency_for_mcp_review === \"REQUIRED_CURRENTLY_EU_PROJECTS_INELIGIBLE\");\npass(\"domain_conditional_rule\", receipt.official_requirements?.domain_verification === \"CONDITIONAL_WHEN_PORTAL_SHOWS_DOMAIN_NOT_VERIFIED\");\npass(\"portal_login_required\", receipt.portal_observation?.platform_page === \"LOGIN_REQUIRED\");\npass(\"blockers_exact\", JSON.stringify(receipt.current_blockers) === JSON.stringify(EXPECTED_BLOCKERS));\npass(\"no_production_authority\", receipt.authority?.production === \"NOT_GRANTED\");\npass(\"no_submit_authority\", receipt.authority?.submit_for_review === \"NOT_GRANTED_AND_NOT_EXECUTED\");\npass(\"no_publication\", receipt.authority?.publication === \"NOT_GRANTED_AND_NOT_EXECUTED\");\n\nif (failures.length) throw new Error(`Portal evidence V6 verifier failed: ${failures.join(\", \")}`);\nconsole.log(JSON.stringify({ state: \"PASS\", candidate_sha_bound_in_staging: EXPECTED_SHA, blockers: EXPECTED_BLOCKERS.length, money_spend: 0 }, null, 2));\nconsole.log(\"RUMBO_OPENAI_PORTAL_EVIDENCE_V6_PASS\");\n",[221],"1004f15a-b97d-4fea-b785-f5ae2653f074","verify_portal_evidence_v5.ts","69e13bd2-adc9-11f1-8d68-1607ee4eb77e",122,["D",1789121600146],"import receipt from \"./PORTAL_EVIDENCE_RECEIPT_V5.json\" with { type: \"json\" };\n\nconst EXPECTED_SHA = \"9152f5a50de42be55508f0effed5ed09aee44c60\";\nconst EXPECTED_BLOCKERS = [\n \"domain_verification_portal_status_unverified\",\n \"apps_management_write_unverified\",\n \"publisher_identity_unverified\",\n \"global_data_residency_unverified\",\n \"logo_portal_upload_not_executed\",\n \"scan_tools_not_executed\",\n \"distribution_scope_unset\",\n \"production_mcp_url_not_authorized\",\n];\nconst failures: string[] = [];\nconst pass = (name: string, ok: boolean) => {\n console.log(`${ok ? \"PASS\" : \"FAIL\"} ${name}`);\n if (!ok) failures.push(name);\n};\n\npass(\"schema_v5\", receipt.schema === \"RUMBO_OPENAI_PORTAL_EVIDENCE_RECEIPT_V5\");\npass(\"budget_zero\", receipt.budget_usd === 0);\npass(\"candidate_sha\", receipt.candidate_sha_bound_in_staging === EXPECTED_SHA);\npass(\"mcp_conformance\", receipt.technical?.mcp_conformance === \"PASS\");\npass(\"protocol_2025_06_18\", receipt.technical?.protocol === \"2025-06-18\");\npass(\"submission_import\", receipt.technical?.submission_import === \"PASS_4_TOOLS_5_POSITIVE_3_NEGATIVE\");\npass(\"support_privacy_terms\", receipt.technical?.support_mcp_semantics?.startsWith(\"PASS\") === true && receipt.technical?.privacy_mcp_disclosure?.startsWith(\"PASS\") === true && receipt.technical?.terms_bounded_semantics?.startsWith(\"PASS\") === true);\npass(\"global_residency_required\", receipt.official_requirements?.global_data_residency_for_mcp_review === \"REQUIRED_CURRENTLY_EU_PROJECTS_INELIGIBLE\");\npass(\"domain_conditional\", receipt.official_requirements?.domain_verification === \"CONDITIONAL_WHEN_PORTAL_SHOWS_DOMAIN_NOT_VERIFIED\");\npass(\"portal_login_required\", receipt.portal_observation?.platform_page === \"LOGIN_REQUIRED\");\npass(\"credential_boundary\", receipt.portal_observation?.credential_boundary === \"NO_COOKIE_LOCALSTORAGE_OR_CREDENTIAL_EXTRACTION\");\npass(\"blockers_exact\", JSON.stringify(receipt.current_blockers) === JSON.stringify(EXPECTED_BLOCKERS));\npass(\"no_production_authority\", receipt.authority?.production === \"NOT_GRANTED\");\npass(\"no_submission\", receipt.authority?.submit_for_review === \"NOT_GRANTED_AND_NOT_EXECUTED\");\npass(\"no_publication\", receipt.authority?.publication === \"NOT_GRANTED_AND_NOT_EXECUTED\");\n\nif (failures.length) {\n console.log(JSON.stringify({ state: \"FAIL\", failures }, null, 2));\n throw new Error(`Portal evidence V5 verifier failed: ${failures.join(\", \")}`);\n}\nconsole.log(JSON.stringify({ state: \"PASS\", candidate_sha: EXPECTED_SHA, blockers: EXPECTED_BLOCKERS.length, money_spend: 0 }, null, 2));\nconsole.log(\"RUMBO_OPENAI_PORTAL_EVIDENCE_V5_PASS\");\n",[228],"98207c57-c6bf-4d7e-81f2-12fb6576a124","verify_portal_evidence_v16.ts","e4fd5fa0-afbb-11f1-94fd-1607ee4eb77e",242,["D",1789335696052],"import packet from \"./PORTAL_PACKET.json\" with { type: \"json\" };\nimport receipt from \"./PORTAL_EVIDENCE_RECEIPT_V16.json\" with { type: \"json\" };\n\nconst failures: string[] = [];\nconst facts: Record = {};\nfunction assert(name: string, ok: boolean) {\n facts[name] = ok ? \"PASS\" : \"FAIL\";\n if (!ok) failures.push(name);\n}\n\nconst expectedPublic = [\n \"domain_verification_not_completed\",\n \"apps_management_write_unverified\",\n \"publisher_identity_unverified\",\n \"global_data_residency_unverified\",\n \"logo_portal_upload_not_executed\",\n \"production_mcp_url_not_authorized\",\n \"scan_tools_not_executed\",\n \"distribution_scope_unset\",\n \"policy_attestations_not_completed\",\n];\nconst expectedWorkspace = [\n \"chatgpt_create_app_surface_unverified\",\n \"scan_tools_not_executed\",\n \"create_draft_not_executed\",\n];\n\nassert(\"schema_v16\", receipt.schema === \"RUMBO_OPENAI_PORTAL_EVIDENCE_RECEIPT_V16\");\nassert(\"supersedes_v15\", receipt.supersedes_operationally === \"PORTAL_EVIDENCE_RECEIPT_V15.json\");\nassert(\"candidate_sha_consistent\", receipt.candidate_sha_bound_in_staging === packet.candidate_sha);\nassert(\"budget_zero\", receipt.budget_usd === 0 && packet.budget_usd === 0);\nassert(\"technical_pass\", receipt.technical_state === \"PASS\");\nassert(\"workspace_blockers_exact\", JSON.stringify(receipt.workspace_draft_blockers) === JSON.stringify(expectedWorkspace));\nassert(\"public_blockers_exact\", JSON.stringify(receipt.public_directory_blockers) === JSON.stringify(expectedPublic));\nassert(\"governance_blocker_exact\", JSON.stringify(receipt.governance_blockers) === JSON.stringify([\"github_candidate_head_unreconciled\"]));\nassert(\"demo_recording_not_required\", packet.review_materials?.demo_recording_url === null && packet.review_materials?.demo_recording_status === \"NOT_REQUIRED_BY_CURRENT_OFFICIAL_SUBMISSION_OR_MCP_REVIEW_DOCS\");\nassert(\"annotation_justifications_pass\", packet.review_materials?.annotation_justifications === \"PASS_12_OF_12_VALIDATED\");\nassert(\"tests_minimum_met\", Number(packet.tests?.positive) >= 5 && Number(packet.tests?.negative) >= 3);\nassert(\"global_residency_unverified_fail_closed\", packet.publisher?.project_data_residency === \"UNVERIFIED_REQUIRES_GLOBAL_FOR_REMOTE_MCP_REVIEW\");\nassert(\"production_url_not_promoted\", packet.production_mcp_url === null && packet.production_mcp_url_status === \"NOT_AUTHORIZED_FAIL_CLOSED\");\nassert(\"authority_not_granted\", receipt.authority?.production === \"NOT_GRANTED\" && receipt.authority?.submit_for_review === \"NOT_GRANTED_AND_NOT_EXECUTED\" && receipt.authority?.publication === \"NOT_GRANTED_AND_NOT_EXECUTED\");\n\nconst result = { state: failures.length ? \"FAIL\" : \"PASS\", facts, failures, money_spend: 0 };\nconsole.log(JSON.stringify(result, null, 2));\nif (failures.length) throw new Error(`portal_evidence_v16_verification_failed:${failures.join(\",\")}`);\nconsole.log(\"RUMBO_PORTAL_EVIDENCE_V16_PASS\");",[235],"4a799c8f-08db-4280-be51-5fe4b7506962","verify_portal_evidence_v15.ts","96e61ffc-afb9-11f1-b9b1-1607ee4eb77e",229,["D",1789334706024],"import packet from \"./PORTAL_PACKET.json\" with { type: \"json\" };\nimport receipt from \"./PORTAL_EVIDENCE_RECEIPT_V15.json\" with { type: \"json\" };\n\nconst failures: string[] = [];\nconst facts: Record = {};\nfunction assert(name: string, ok: boolean) {\n facts[name] = ok ? \"PASS\" : \"FAIL\";\n if (!ok) failures.push(name);\n}\n\nconst expectedPublic = [\n \"domain_verification_not_completed\",\n \"apps_management_write_unverified\",\n \"publisher_identity_unverified\",\n \"global_data_residency_unverified\",\n \"logo_portal_upload_not_executed\",\n \"demo_recording_url_missing\",\n \"production_mcp_url_not_authorized\",\n \"scan_tools_not_executed\",\n \"distribution_scope_unset\",\n];\nconst expectedWorkspace = [\n \"chatgpt_create_app_surface_unverified\",\n \"scan_tools_not_executed\",\n \"create_draft_not_executed\",\n];\n\nassert(\"schema_v15\", receipt.schema === \"RUMBO_OPENAI_PORTAL_EVIDENCE_RECEIPT_V15\");\nassert(\"candidate_sha_consistent\", receipt.candidate_sha_bound_in_staging === packet.candidate_sha);\nassert(\"budget_zero\", receipt.budget_usd === 0 && packet.budget_usd === 0);\nassert(\"technical_pass\", receipt.technical_state === \"PASS\");\nassert(\"workspace_blockers_exact\", JSON.stringify(receipt.workspace_draft_blockers) === JSON.stringify(expectedWorkspace));\nassert(\"public_blockers_exact\", JSON.stringify(receipt.public_directory_blockers) === JSON.stringify(expectedPublic));\nassert(\"governance_blocker_exact\", JSON.stringify(receipt.governance_blockers) === JSON.stringify([\"github_candidate_head_unreconciled\"]));\nassert(\"starter_prompts_max_3\", Array.isArray(packet.starter_prompts) && packet.starter_prompts.length === 3 && new Set(packet.starter_prompts).size === 3 && packet.starter_prompts.every((p: string) => p.length <= 128 && !p.includes(\"@\") && !/[\\r\\n]/.test(p)));\nassert(\"demo_recording_fail_closed\", packet.review_materials?.demo_recording_url === null && packet.review_materials?.demo_recording_status === \"MISSING_FAIL_CLOSED\");\nassert(\"annotation_justifications_pass\", packet.review_materials?.annotation_justifications === \"PASS_12_OF_12_VALIDATED\");\nassert(\"server_review_validation_pass\", packet.tests?.server_validation_status === \"PASS_5_POSITIVE_3_NEGATIVE_SURFACE\");\nassert(\"portal_packet_points_to_v15\", packet.submission_import?.portal_evidence_receipt === \"PORTAL_EVIDENCE_RECEIPT_V15.json\" && packet.submission_import?.portal_evidence_verifier === \"verify_portal_evidence_v15.ts\");\nassert(\"production_url_not_promoted\", packet.production_mcp_url === null && packet.production_mcp_url_status === \"NOT_AUTHORIZED_FAIL_CLOSED\");\nassert(\"authority_not_granted\", receipt.authority?.production === \"NOT_GRANTED\" && receipt.authority?.submit_for_review === \"NOT_GRANTED_AND_NOT_EXECUTED\" && receipt.authority?.publication === \"NOT_GRANTED_AND_NOT_EXECUTED\");\n\nconst result = { state: failures.length ? \"FAIL\" : \"PASS\", facts, failures, money_spend: 0 };\nconsole.log(JSON.stringify(result, null, 2));\nif (failures.length) throw new Error(`portal_evidence_v15_verification_failed:${failures.join(\",\")}`);\nconsole.log(\"RUMBO_PORTAL_EVIDENCE_V15_PASS\");",[242],"c9191d9d-d176-4298-8072-3329805e2808","verify_portal_evidence_v14.ts","3b594d20-afb5-11f1-a8ac-1607ee4eb77e",213,["D",1789332834474],"import receipt from \"./PORTAL_EVIDENCE_RECEIPT_V14.json\" with { type: \"json\" };\n\nconst EXPECTED_SHA = \"9152f5a50de42be55508f0effed5ed09aee44c60\";\nconst EXPECTED_PUBLIC_BLOCKERS = [\n \"domain_verification_portal_status_unverified\",\n \"apps_management_write_unverified\",\n \"publisher_identity_unverified\",\n \"global_data_residency_unverified\",\n \"logo_portal_upload_not_executed\",\n \"production_mcp_url_not_authorized\",\n \"scan_tools_not_executed\",\n \"distribution_scope_unset\",\n];\nconst EXPECTED_WORKSPACE_BLOCKERS = [\n \"chatgpt_create_app_surface_unverified\",\n \"scan_tools_not_executed\",\n \"create_draft_not_executed\",\n];\nconst EXPECTED_GOVERNANCE_BLOCKERS = [\"github_candidate_head_unreconciled\"];\n\nconst failures: string[] = [];\nconst pass = (name: string, ok: boolean) => {\n console.log(`${ok ? \"PASS\" : \"FAIL\"} ${name}`);\n if (!ok) failures.push(name);\n};\n\npass(\"schema_v14\", receipt.schema === \"RUMBO_OPENAI_PORTAL_EVIDENCE_RECEIPT_V14\");\npass(\"supersedes_v13\", receipt.supersedes_operationally === \"PORTAL_EVIDENCE_RECEIPT_V13.json\");\npass(\"date_2026_09_13\", receipt.date_utc === \"2026-09-13\");\npass(\"budget_zero\", receipt.budget_usd === 0);\npass(\"candidate_sha\", receipt.candidate_sha_bound_in_staging === EXPECTED_SHA);\npass(\"github_fail_closed\", receipt.github_current_head === \"UNVERIFIED_CONNECTOR_DISABLED\");\npass(\"submission_gate_pass\", receipt.technical_revalidation?.submission_gate === \"PASS_TECHNICAL_STATE\");\npass(\"tool_count\", receipt.technical_revalidation?.tool_count === 4);\npass(\"tool_annotations\", receipt.technical_revalidation?.tool_annotations === \"PASS\");\npass(\"response_minimization\", receipt.technical_revalidation?.response_minimization === \"PASS\");\npass(\"listing_urls\", receipt.technical_revalidation?.listing_urls === \"PASS_ALL_HTTP_200_SELF_HOSTED\");\npass(\"policy_semantics\", receipt.technical_revalidation?.support_mcp_semantics === \"PASS_SELF_HOSTED\" && receipt.technical_revalidation?.privacy_mcp_disclosure === \"PASS_SELF_HOSTED\" && receipt.technical_revalidation?.terms_bounded_semantics === \"PASS_SELF_HOSTED\");\npass(\"official_snapshot_v14\", receipt.official_requirements_revalidated?.snapshot === \"OFFICIAL_SUBMISSION_REQUIREMENTS_2026-09-13.md\");\npass(\"apps_write_required\", receipt.official_requirements_revalidated?.apps_management_write === \"REQUIRED\");\npass(\"publisher_identity_required\", receipt.official_requirements_revalidated?.verified_publisher_identity === \"REQUIRED\");\npass(\"production_url_required\", receipt.official_requirements_revalidated?.production_public_mcp_url === \"REQUIRED_NO_LOCAL_OR_TESTING_ENDPOINT\");\npass(\"global_residency_requirement\", receipt.official_requirements_revalidated?.global_project_data_residency_requirement === \"REQUIRED_FOR_REMOTE_MCP_REVIEW_EU_PROJECTS_CURRENTLY_INELIGIBLE\");\npass(\"domain_conditional\", receipt.official_requirements_revalidated?.domain_verification === \"CONDITIONAL_IF_PORTAL_SHOWS_DOMAIN_NOT_VERIFIED\");\npass(\"workspace_separate\", receipt.workspace_custom_app_flow?.separate_from_public_directory === true);\npass(\"workspace_blockers_exact_3\", JSON.stringify(receipt.workspace_custom_app_flow?.blockers) === JSON.stringify(EXPECTED_WORKSPACE_BLOCKERS));\npass(\"public_blockers_exact_8\", JSON.stringify(receipt.public_directory_readiness?.blockers) === JSON.stringify(EXPECTED_PUBLIC_BLOCKERS));\npass(\"governance_blockers_exact_1\", JSON.stringify(receipt.governance?.blockers) === JSON.stringify(EXPECTED_GOVERNANCE_BLOCKERS));\npass(\"portal_fields_unverified\", receipt.portal_observation?.apps_management_write === \"UNVERIFIED\" && receipt.portal_observation?.publisher_identity === \"UNVERIFIED\" && receipt.portal_observation?.project_data_residency === \"UNVERIFIED\");\npass(\"submission_not_executed\", receipt.execution_state?.public_submission === \"NOT_EXECUTED_SEPARATE_FROM_READINESS\");\npass(\"publication_not_executed\", receipt.execution_state?.publication === \"NOT_EXECUTED\");\npass(\"authority_fail_closed\", receipt.authority?.production === \"NOT_GRANTED\" && receipt.authority?.submit_for_review === \"NOT_GRANTED_AND_NOT_EXECUTED\" && receipt.authority?.publication === \"NOT_GRANTED_AND_NOT_EXECUTED\");\npass(\"correction_recorded\", receipt.corrections?.some((x: string) => x.includes(\"transient 2026-09-13 interpretation\")) === true);\n\nif (failures.length) {\n console.log(JSON.stringify({ state: \"FAIL\", failures }, null, 2));\n throw new Error(`Portal evidence V14 failed: ${failures.join(\", \")}`);\n}\n\nconsole.log(JSON.stringify({\n state: \"PASS\",\n public_blocker_count: EXPECTED_PUBLIC_BLOCKERS.length,\n workspace_blocker_count: EXPECTED_WORKSPACE_BLOCKERS.length,\n governance_blocker_count: EXPECTED_GOVERNANCE_BLOCKERS.length,\n candidate_sha: EXPECTED_SHA,\n money_spend: 0,\n}, null, 2));\nconsole.log(\"RUMBO_OPENAI_PORTAL_EVIDENCE_V14_PASS\");\n",[249],"4812d1d1-160f-460d-b046-da47a9275da4","verify_portal_evidence_v13.ts","300939a4-aec9-11f1-9eab-1607ee4eb77e",197,["D",1789231454249],"import receipt from \"./PORTAL_EVIDENCE_RECEIPT_V13.json\" with { type: \"json\" };\n\nconst EXPECTED_SHA = \"9152f5a50de42be55508f0effed5ed09aee44c60\";\nconst EXPECTED_PUBLIC_BLOCKERS = [\n \"domain_verification_portal_status_unverified\",\n \"apps_management_write_unverified\",\n \"publisher_identity_unverified\",\n \"global_data_residency_unverified\",\n \"logo_portal_upload_not_executed\",\n \"scan_tools_not_executed\",\n \"distribution_scope_unset\",\n \"production_mcp_url_not_authorized\",\n];\nconst EXPECTED_WORKSPACE_BLOCKERS = [\n \"chatgpt_create_app_surface_unverified\",\n \"scan_tools_not_executed\",\n \"create_draft_not_executed\",\n];\nconst failures: string[] = [];\nconst pass = (name: string, ok: boolean) => {\n console.log(`${ok ? \"PASS\" : \"FAIL\"} ${name}`);\n if (!ok) failures.push(name);\n};\n\npass(\"schema_v13\", receipt.schema === \"RUMBO_OPENAI_PORTAL_EVIDENCE_RECEIPT_V13\");\npass(\"supersedes_v12\", receipt.supersedes_operationally === \"PORTAL_EVIDENCE_RECEIPT_V12.json\");\npass(\"date_2026_09_12\", receipt.date_utc === \"2026-09-12\");\npass(\"budget_zero\", receipt.budget_usd === 0);\npass(\"candidate_sha\", receipt.candidate_sha_bound_in_staging === EXPECTED_SHA);\npass(\"github_fail_closed\", receipt.github_current_head === \"UNVERIFIED_CONNECTOR_DISABLED\");\npass(\"submission_gate_pass\", receipt.technical_revalidation?.submission_gate === \"PASS_TECHNICAL_STATE\");\npass(\"v12_reverified\", receipt.technical_revalidation?.portal_evidence_v12_verifier === \"PASS\");\npass(\"packet_reverified\", receipt.technical_revalidation?.portal_packet_verifier === \"PASS\");\npass(\"import_reverified\", receipt.technical_revalidation?.submission_import_validator === \"PASS\");\npass(\"tool_count\", receipt.technical_revalidation?.tool_count === 4);\npass(\"response_minimization\", receipt.technical_revalidation?.response_minimization === \"PASS\");\npass(\"listing_urls\", receipt.technical_revalidation?.listing_urls === \"PASS_ALL_HTTP_200_SELF_HOSTED\");\npass(\"policy_semantics\", receipt.technical_revalidation?.support_mcp_semantics === \"PASS_SELF_HOSTED\" && receipt.technical_revalidation?.privacy_mcp_disclosure === \"PASS_SELF_HOSTED\" && receipt.technical_revalidation?.terms_bounded_semantics === \"PASS_SELF_HOSTED\");\npass(\"global_residency_requirement\", receipt.official_requirements_revalidated?.global_project_data_residency_requirement === \"REQUIRED_FOR_REMOTE_MCP_REVIEW_EU_PROJECTS_CURRENTLY_INELIGIBLE\");\npass(\"argentina_support_revalidated\", receipt.official_requirements_revalidated?.argentina_general_openai_service_support === \"CONFIRMED_2026-09-12\");\npass(\"distribution_not_applied\", receipt.official_requirements_revalidated?.distribution_portal_selection === \"STILL_REQUIRED_NOT_APPLIED\");\npass(\"workspace_separate\", receipt.workspace_custom_app_flow?.separate_from_public_directory === true);\npass(\"workspace_blockers_exact\", JSON.stringify(receipt.workspace_custom_app_flow?.blockers) === JSON.stringify(EXPECTED_WORKSPACE_BLOCKERS));\npass(\"desktop_ping\", receipt.portal_observation?.desktop_connectivity === \"PING_PASS_2026-09-12\");\npass(\"browser_processes_observed\", receipt.portal_observation?.brave_processes === \"ACTIVE_OBSERVED_2026-09-12\" && receipt.portal_observation?.rumbo_nexus_process === \"ACTIVE_OBSERVED_2026-09-12\");\npass(\"cdp_fail_closed\", receipt.portal_observation?.cdp_127_0_0_1_9222 === \"NOT_LISTENING_OR_UNREACHABLE_CURRENT_PROBE_EXIT_1_NO_BODY\");\npass(\"portal_fields_unverified\", receipt.portal_observation?.apps_management_write === \"UNVERIFIED\" && receipt.portal_observation?.publisher_identity === \"UNVERIFIED\" && receipt.portal_observation?.project_data_residency === \"UNVERIFIED\");\npass(\"public_blockers_exact_8\", JSON.stringify(receipt.current_blockers) === JSON.stringify(EXPECTED_PUBLIC_BLOCKERS));\npass(\"submission_not_executed\", receipt.execution_state?.public_submission === \"NOT_EXECUTED_SEPARATE_FROM_READINESS\");\npass(\"authority_fail_closed\", receipt.authority?.production === \"NOT_GRANTED\" && receipt.authority?.submit_for_review === \"NOT_GRANTED_AND_NOT_EXECUTED\" && receipt.authority?.publication === \"NOT_GRANTED_AND_NOT_EXECUTED\");\n\nif (failures.length) {\n console.log(JSON.stringify({ state: \"FAIL\", failures }, null, 2));\n throw new Error(`Portal evidence V13 failed: ${failures.join(\", \")}`);\n}\nconsole.log(JSON.stringify({\n state: \"PASS\",\n public_blocker_count: EXPECTED_PUBLIC_BLOCKERS.length,\n workspace_blocker_count: EXPECTED_WORKSPACE_BLOCKERS.length,\n candidate_sha: EXPECTED_SHA,\n money_spend: 0,\n}, null, 2));\nconsole.log(\"RUMBO_OPENAI_PORTAL_EVIDENCE_V13_PASS\");\n",[256],"2a6921e8-63b9-449f-baad-8f8368d9e425","verify_portal_evidence_v12.ts","d5b96bb0-ae03-11f1-bf05-1607ee4eb77e",192,["D",1789146691885],"import receipt from \"./PORTAL_EVIDENCE_RECEIPT_V12.json\" with { type: \"json\" };\n\nconst EXPECTED_SHA = \"9152f5a50de42be55508f0effed5ed09aee44c60\";\nconst EXPECTED_BLOCKERS = [\n \"domain_verification_portal_status_unverified\",\n \"apps_management_write_unverified\",\n \"publisher_identity_unverified\",\n \"global_data_residency_unverified\",\n \"logo_portal_upload_not_executed\",\n \"scan_tools_not_executed\",\n \"distribution_scope_unset\",\n \"production_mcp_url_not_authorized\",\n];\nconst EXPECTED_WORKSPACE_BLOCKERS = [\n \"chatgpt_create_app_surface_unverified\",\n \"scan_tools_not_executed\",\n \"create_draft_not_executed\",\n];\nconst failures: string[] = [];\nconst pass = (name: string, ok: boolean) => {\n console.log(`${ok ? \"PASS\" : \"FAIL\"} ${name}`);\n if (!ok) failures.push(name);\n};\n\npass(\"schema_v12\", receipt.schema === \"RUMBO_OPENAI_PORTAL_EVIDENCE_RECEIPT_V12\");\npass(\"supersedes_v11\", receipt.supersedes_operationally === \"PORTAL_EVIDENCE_RECEIPT_V11.json\");\npass(\"budget_zero\", receipt.budget_usd === 0);\npass(\"candidate_sha\", receipt.candidate_sha_bound_in_staging === EXPECTED_SHA);\npass(\"technical_gate\", receipt.technical?.submission_gate_runtime === \"TECHNICAL_PASS_PUBLIC_DIRECTORY_BLOCKED_8_EXACT_BLOCKERS\");\npass(\"health_exact_sha\", receipt.technical?.health_exact_sha === \"PASS\");\npass(\"tool_count\", receipt.technical?.tool_count === 4);\npass(\"tool_annotations\", receipt.technical?.tool_annotations === \"PASS\");\npass(\"response_minimization\", receipt.technical?.response_minimization === \"PASS\");\npass(\"listing_urls\", receipt.technical?.listing_urls === \"PASS_ALL_HTTP_200_SELF_HOSTED\");\npass(\"support_semantics\", receipt.technical?.support_mcp_semantics === \"PASS_SELF_HOSTED\");\npass(\"privacy_disclosure\", receipt.technical?.privacy_mcp_disclosure === \"PASS_SELF_HOSTED\");\npass(\"terms_semantics\", receipt.technical?.terms_bounded_semantics === \"PASS_SELF_HOSTED\");\npass(\"apps_write_required\", receipt.official_requirements?.apps_management_write === \"REQUIRED\");\npass(\"publisher_identity_required\", receipt.official_requirements?.verified_publisher_identity === \"REQUIRED\");\npass(\"production_url_required\", receipt.official_requirements?.public_production_mcp_endpoint === \"REQUIRED\");\npass(\"domain_conditional\", receipt.official_requirements?.domain_verification === \"CONDITIONAL_WHEN_PORTAL_SHOWS_DOMAIN_NOT_VERIFIED\");\npass(\"scan_tools_required\", receipt.official_requirements?.scan_tools === \"REQUIRED\");\npass(\"availability_required\", receipt.official_requirements?.availability_scope === \"REQUIRED\");\npass(\"logo_required\", receipt.official_requirements?.production_ready_logo === \"REQUIRED\");\npass(\"tests_5_3\", receipt.official_requirements?.positive_tests_minimum === 5 && receipt.official_requirements?.negative_tests_minimum === 3);\npass(\"global_residency_required\", receipt.official_requirements?.global_project_data_residency_requirement === \"REQUIRED_FOR_REMOTE_MCP_REVIEW_EU_PROJECTS_CURRENTLY_INELIGIBLE\");\npass(\"response_minimization_required\", receipt.official_requirements?.response_data_minimization === \"REQUIRED_REVIEW_EXPECTATION\");\npass(\"workspace_separate\", receipt.workspace_custom_app_flow?.separate_from_public_directory === true);\npass(\"workspace_blockers_exact\", JSON.stringify(receipt.workspace_custom_app_flow?.blockers) === JSON.stringify(EXPECTED_WORKSPACE_BLOCKERS));\npass(\"project_residency_unverified\", receipt.portal_observation?.project_data_residency === \"UNVERIFIED\");\npass(\"blocker_set_exact_8\", JSON.stringify(receipt.current_blockers) === JSON.stringify(EXPECTED_BLOCKERS));\npass(\"submit_execution_separate\", receipt.execution_state?.public_submission === \"NOT_EXECUTED_SEPARATE_FROM_READINESS\");\npass(\"production_not_granted\", receipt.authority?.production === \"NOT_GRANTED\");\npass(\"submission_not_granted\", receipt.authority?.submit_for_review === \"NOT_GRANTED_AND_NOT_EXECUTED\");\npass(\"publication_not_granted\", receipt.authority?.publication === \"NOT_GRANTED_AND_NOT_EXECUTED\");\n\nif (failures.length) {\n console.log(JSON.stringify({ state: \"FAIL\", failures }, null, 2));\n throw new Error(`Portal evidence V12 failed: ${failures.join(\", \")}`);\n}\nconsole.log(JSON.stringify({\n state: \"PASS\",\n public_blocker_count: EXPECTED_BLOCKERS.length,\n workspace_blocker_count: EXPECTED_WORKSPACE_BLOCKERS.length,\n candidate_sha: EXPECTED_SHA,\n money_spend: 0,\n}, null, 2));\nconsole.log(\"RUMBO_OPENAI_PORTAL_EVIDENCE_V12_PASS\");\n",[263],"84c89ced-9967-462f-bd52-7ca5bfec3a42","verify_portal_evidence_v11.ts","abe85538-ae00-11f1-a3b6-1607ee4eb77e",182,["D",1789145333199],"import receipt from \"./PORTAL_EVIDENCE_RECEIPT_V11.json\" with { type: \"json\" };\n\nconst EXPECTED_SHA = \"9152f5a50de42be55508f0effed5ed09aee44c60\";\nconst EXPECTED_BLOCKERS = [\n \"domain_verification_portal_status_unverified\",\n \"apps_management_write_unverified\",\n \"publisher_identity_unverified\",\n \"global_data_residency_unverified\",\n \"logo_portal_upload_not_executed\",\n \"scan_tools_not_executed\",\n \"distribution_scope_unset\",\n \"production_mcp_url_not_authorized\",\n];\nconst failures: string[] = [];\nconst pass = (name: string, ok: boolean) => {\n console.log(`${ok ? \"PASS\" : \"FAIL\"} ${name}`);\n if (!ok) failures.push(name);\n};\n\npass(\"schema_v11\", receipt.schema === \"RUMBO_OPENAI_PORTAL_EVIDENCE_RECEIPT_V11\");\npass(\"supersedes_v10\", receipt.supersedes_operationally === \"PORTAL_EVIDENCE_RECEIPT_V10.json\");\npass(\"budget_zero\", receipt.budget_usd === 0);\npass(\"candidate_sha\", receipt.candidate_sha_bound_in_staging === EXPECTED_SHA);\npass(\"mcp_conformance\", receipt.technical?.mcp_conformance === \"PASS_18_CHECKS\");\npass(\"portal_packet_verifier\", receipt.technical?.portal_packet_verifier === \"PASS\");\npass(\"apps_write_required\", receipt.official_requirements?.apps_management_write === \"REQUIRED\");\npass(\"publisher_identity_required\", receipt.official_requirements?.verified_publisher_identity === \"REQUIRED\");\npass(\"production_url_required\", receipt.official_requirements?.public_production_mcp_endpoint === \"REQUIRED\");\npass(\"domain_conditional\", receipt.official_requirements?.domain_verification === \"CONDITIONAL_WHEN_PORTAL_SHOWS_DOMAIN_NOT_VERIFIED\");\npass(\"scan_tools_required\", receipt.official_requirements?.scan_tools === \"REQUIRED\");\npass(\"availability_required\", receipt.official_requirements?.availability_scope === \"REQUIRED\");\npass(\"logo_required\", receipt.official_requirements?.production_ready_logo === \"REQUIRED\");\npass(\"global_residency_required\", receipt.official_requirements?.global_project_data_residency_requirement === \"REQUIRED_FOR_REMOTE_MCP_REVIEW_EU_PROJECTS_CURRENTLY_INELIGIBLE\");\npass(\"project_residency_unverified\", receipt.portal_observation?.project_data_residency === \"UNVERIFIED\");\npass(\"blocker_set_exact_8\", JSON.stringify(receipt.current_blockers) === JSON.stringify(EXPECTED_BLOCKERS));\npass(\"production_not_granted\", receipt.authority?.production === \"NOT_GRANTED\");\npass(\"submission_not_granted\", receipt.authority?.submit_for_review === \"NOT_GRANTED_AND_NOT_EXECUTED\");\npass(\"publication_not_granted\", receipt.authority?.publication === \"NOT_GRANTED_AND_NOT_EXECUTED\");\n\nif (failures.length) {\n console.log(JSON.stringify({ state: \"FAIL\", failures }, null, 2));\n throw new Error(`Portal evidence V11 failed: ${failures.join(\", \")}`);\n}\nconsole.log(JSON.stringify({ state: \"PASS\", blocker_count: EXPECTED_BLOCKERS.length, candidate_sha: EXPECTED_SHA, money_spend: 0 }, null, 2));\nconsole.log(\"RUMBO_OPENAI_PORTAL_EVIDENCE_V11_PASS\");\n",[270],"eae6e68e-3c26-4789-a509-289330dfad36","verify_portal_evidence_v10.ts","039e65ca-ae00-11f1-a1b3-1607ee4eb77e",172,["D",1789145050849],"import receipt from \"./PORTAL_EVIDENCE_RECEIPT_V10.json\" with { type: \"json\" };\n\nconst EXPECTED_SHA = \"9152f5a50de42be55508f0effed5ed09aee44c60\";\nconst EXPECTED_BLOCKERS = [\n \"domain_verification_portal_status_unverified\",\n \"apps_management_write_unverified\",\n \"publisher_identity_unverified\",\n \"logo_portal_upload_not_executed\",\n \"scan_tools_not_executed\",\n \"distribution_scope_unset\",\n \"production_mcp_url_not_authorized\",\n];\nconst failures: string[] = [];\nconst pass = (name: string, ok: boolean) => {\n console.log(`${ok ? \"PASS\" : \"FAIL\"} ${name}`);\n if (!ok) failures.push(name);\n};\n\npass(\"schema_v10\", receipt.schema === \"RUMBO_OPENAI_PORTAL_EVIDENCE_RECEIPT_V10\");\npass(\"supersedes_v9\", receipt.supersedes_operationally === \"PORTAL_EVIDENCE_RECEIPT_V9.json\");\npass(\"budget_zero\", receipt.budget_usd === 0);\npass(\"candidate_sha\", receipt.candidate_sha_bound_in_staging === EXPECTED_SHA);\npass(\"mcp_conformance\", receipt.technical?.mcp_conformance === \"PASS_18_CHECKS\");\npass(\"portal_packet_verifier\", receipt.technical?.portal_packet_verifier === \"PASS\");\npass(\"apps_write_required\", receipt.official_requirements?.apps_management_write === \"REQUIRED\");\npass(\"publisher_identity_required\", receipt.official_requirements?.verified_publisher_identity === \"REQUIRED\");\npass(\"production_url_required\", receipt.official_requirements?.public_production_mcp_endpoint === \"REQUIRED\");\npass(\"domain_conditional\", receipt.official_requirements?.domain_verification === \"CONDITIONAL_WHEN_PORTAL_SHOWS_DOMAIN_NOT_VERIFIED\");\npass(\"scan_tools_required\", receipt.official_requirements?.scan_tools === \"REQUIRED\");\npass(\"availability_required\", receipt.official_requirements?.availability_scope === \"REQUIRED\");\npass(\"logo_required\", receipt.official_requirements?.production_ready_logo === \"REQUIRED\");\npass(\"residency_not_documented\", receipt.official_requirements?.global_project_data_residency_requirement === \"NOT_DOCUMENTED_IN_CURRENT_SUBMISSION_OR_MCP_REVIEW_DOCS\");\npass(\"blocker_set_exact_7\", JSON.stringify(receipt.current_blockers) === JSON.stringify(EXPECTED_BLOCKERS));\npass(\"production_not_granted\", receipt.authority?.production === \"NOT_GRANTED\");\npass(\"submission_not_granted\", receipt.authority?.submit_for_review === \"NOT_GRANTED_AND_NOT_EXECUTED\");\npass(\"publication_not_granted\", receipt.authority?.publication === \"NOT_GRANTED_AND_NOT_EXECUTED\");\n\nif (failures.length) {\n console.log(JSON.stringify({ state: \"FAIL\", failures }, null, 2));\n throw new Error(`Portal evidence V10 failed: ${failures.join(\", \")}`);\n}\nconsole.log(JSON.stringify({ state: \"PASS\", blocker_count: EXPECTED_BLOCKERS.length, candidate_sha: EXPECTED_SHA, money_spend: 0 }, null, 2));\nconsole.log(\"RUMBO_OPENAI_PORTAL_EVIDENCE_V10_PASS\");\n",[277],"3e6d57de-169f-41d9-9591-948f3baea679","verify.ts","cae880f6-acf8-11f1-b03c-1607ee4eb77e",109,["D",1789120480619],7,"const BASE = \"https://rumbo-crm-openai-staging.val.run\";\nconst EXPECTED_SHA = \"9152f5a50de42be55508f0effed5ed09aee44c60\";\nconst PROTOCOL = \"2025-06-18\";\nconst expectedTools = [\n \"crm_get_service_readiness\",\n \"crm_prepare_note\",\n \"crm_prepare_lead_stage_change\",\n \"crm_prepare_outreach_draft\",\n];\nconst transport = {\n origin: \"https://chatgpt.com\",\n accept: \"application/json, text/event-stream\",\n \"content-type\": \"application/json\",\n};\nconst negotiated = { ...transport, \"mcp-protocol-version\": PROTOCOL };\nfunction assert(condition: unknown, message: string): asserts condition {\n if (!condition) throw new Error(message);\n}\nasync function expectStatus(name: string, response: Response, expected: number) {\n if (response.status !== expected) throw new Error(`${name}: expected ${expected}, got ${response.status}: ${(await response.text()).slice(0, 300)}`);\n console.log(`PASS ${name} ${expected}`);\n return response;\n}\nlet listedTools: Array = [];\nfunction assertResponseHygiene(toolName: string, output: Record) {\n const tool = listedTools.find((t) => t.name === toolName);\n assert(tool, `${toolName}: missing tool definition`);\n const schema = tool.outputSchema ?? {};\n const properties = schema.properties ?? {};\n const allowed = new Set(Object.keys(properties));\n const unexpected = Object.keys(output).filter((key) => !allowed.has(key));\n assert(unexpected.length === 0, `${toolName}: unexpected output fields ${unexpected.join(\",\")}`);\n const missing = (schema.required ?? []).filter((key: string) => !(key in output));\n assert(missing.length === 0, `${toolName}: missing required output fields ${missing.join(\",\")}`);\n for (const [key, rule] of Object.entries(properties) as Array<[string, any]>) {\n if (!(key in output)) continue;\n const value = output[key];\n if (rule.type === \"string\") assert(typeof value === \"string\", `${toolName}: ${key} must be string`);\n if (rule.type === \"boolean\") assert(typeof value === \"boolean\", `${toolName}: ${key} must be boolean`);\n if (Object.prototype.hasOwnProperty.call(rule, \"const\")) assert(value === rule.const, `${toolName}: ${key} const mismatch`);\n if (Array.isArray(rule.enum)) assert(rule.enum.includes(value), `${toolName}: ${key} enum mismatch`);\n }\n const sensitiveKey = /(password|passwd|secret|api[_-]?key|access[_-]?token|refresh[_-]?token|authorization|cookie|stack|trace|debug)/i;\n const walk = (value: unknown, path = \"output\") => {\n if (Array.isArray(value)) return value.forEach((v, i) => walk(v, `${path}[${i}]`));\n if (value && typeof value === \"object\") {\n for (const [key, child] of Object.entries(value as Record)) {\n assert(!sensitiveKey.test(key), `${toolName}: sensitive/debug key ${path}.${key}`);\n walk(child, `${path}.${key}`);\n }\n return;\n }\n if (typeof value === \"string\") {\n assert(!/\\bsk-(?:proj-)?[A-Za-z0-9_-]{12,}\\b|\\bBearer\\s+[A-Za-z0-9._~-]{12,}/.test(value), `${toolName}: secret-like value at ${path}`);\n }\n };\n walk(output);\n}\nasync function rpc(id: number, name: string, args: Record) {\n const res = await fetch(`${BASE}/api/openai-plugin/mcp`, {\n method: \"POST\", headers: negotiated,\n body: JSON.stringify({ jsonrpc: \"2.0\", id, method: \"tools/call\", params: { name, arguments: args } }),\n });\n await expectStatus(name, res, 200);\n const body = await res.json();\n assert(body?.result?.isError === false, `${name}: isError`);\n const output = body.result.structuredContent as Record;\n assertResponseHygiene(name, output);\n return output;\n}\nasync function rpcExpectToolError(id: number, caseName: string, name: string, args: Record) {\n const res = await fetch(`${BASE}/api/openai-plugin/mcp`, {\n method: \"POST\", headers: negotiated,\n body: JSON.stringify({ jsonrpc: \"2.0\", id, method: \"tools/call\", params: { name, arguments: args } }),\n });\n await expectStatus(caseName, res, 200);\n const body = await res.json();\n assert(body?.result?.isError === true, `${caseName}: expected tool-level rejection`);\n const text = body?.result?.content?.[0]?.text;\n assert(typeof text === \"string\" && text.startsWith(\"Invalid arguments:\"), `${caseName}: missing bounded rejection`);\n}\n\nawait expectStatus(\"domain challenge unset\", await fetch(`${BASE}/.well-known/openai-apps-challenge`), 404);\nconst health = await expectStatus(\"health\", await fetch(`${BASE}/api/openai-plugin/health`, { headers: { origin: \"https://chatgpt.com\", accept: \"application/json\" } }), 200);\nconst hb = await health.json();\nassert(hb.sourceSha === EXPECTED_SHA, \"source SHA mismatch\");\nassert(hb.customerDataToolsExposed === false, \"customer data unexpectedly exposed\");\nassert(hb.productionAuthority === false && hb.submissionAuthority === false, \"authority escalation\");\n\nawait expectStatus(\"GET without SSE\", await fetch(`${BASE}/api/openai-plugin/mcp`, { method: \"GET\", headers: { origin: \"https://chatgpt.com\" } }), 405);\nawait expectStatus(\"Origin deny\", await fetch(`${BASE}/api/openai-plugin/mcp`, { method: \"POST\", headers: { ...transport, origin: \"https://evil.example\" }, body: \"{}\" }), 403);\nawait expectStatus(\"Accept deny\", await fetch(`${BASE}/api/openai-plugin/mcp`, { method: \"POST\", headers: { ...transport, accept: \"application/json\" }, body: \"{}\" }), 406);\nawait expectStatus(\"Content-Type deny\", await fetch(`${BASE}/api/openai-plugin/mcp`, { method: \"POST\", headers: { ...transport, \"content-type\": \"text/plain\" }, body: \"{}\" }), 415);\n\nconst init = await expectStatus(\"initialize\", await fetch(`${BASE}/api/openai-plugin/mcp`, {\n method: \"POST\", headers: transport,\n body: JSON.stringify({ jsonrpc: \"2.0\", id: 1, method: \"initialize\", params: { protocolVersion: PROTOCOL, capabilities: {}, clientInfo: { name: \"rumbo-valtown-verifier\", version: \"1.0.0\" } } }),\n}), 200);\nconst initBody = await init.json();\nassert(initBody?.result?.protocolVersion === PROTOCOL, \"initialize protocol mismatch\");\n\nawait expectStatus(\"missing protocol deny\", await fetch(`${BASE}/api/openai-plugin/mcp`, {\n method: \"POST\", headers: transport,\n body: JSON.stringify({ jsonrpc: \"2.0\", id: 2, method: \"tools/list\", params: {} }),\n}), 400);\n\nconst list = await expectStatus(\"tools/list\", await fetch(`${BASE}/api/openai-plugin/mcp`, {\n method: \"POST\", headers: negotiated,\n body: JSON.stringify({ jsonrpc: \"2.0\", id: 3, method: \"tools/list\", params: {} }),\n}), 200);\nconst listBody = await list.json();\nlistedTools = listBody?.result?.tools ?? [];\nconst names = listedTools.map((tool: { name: string }) => tool.name);\nassert(JSON.stringify(names) === JSON.stringify(expectedTools), `tool catalog mismatch: ${JSON.stringify(names)}`);\nfor (const tool of listedTools) {\n assert(tool.annotations?.readOnlyHint === true, `${tool.name}: readOnlyHint`);\n assert(tool.annotations?.destructiveHint === false, `${tool.name}: destructiveHint`);\n assert(tool.annotations?.openWorldHint === false, `${tool.name}: openWorldHint`);\n assert(tool.inputSchema?.additionalProperties === false, `${tool.name}: open input schema`);\n assert(tool.outputSchema?.additionalProperties === false, `${tool.name}: open output schema`);\n}\n\nconst initialized = await expectStatus(\"notifications/initialized\", await fetch(`${BASE}/api/openai-plugin/mcp`, {\n method: \"POST\", headers: negotiated,\n body: JSON.stringify({ jsonrpc: \"2.0\", method: \"notifications/initialized\", params: {} }),\n}), 202);\nassert((await initialized.text()).length === 0, \"notification body must be empty\");\n\nconst readiness = await rpc(10, \"crm_get_service_readiness\", {});\nassert(readiness.customer_data_tools_exposed === false && readiness.mutating_tools_exposed === false, \"readiness exposure\");\nassert(readiness.production_authority === false && readiness.submission_authority === false, \"readiness authority\");\n\nconst note = await rpc(11, \"crm_prepare_note\", { workspace_id: \"ws-demo\", subject_id: \"lead-demo\", note: \"Synthetic conformance test\" });\nassert(note.kind === \"crm_note_proposal\" && note.state === \"REVIEW_REQUIRED\" && note.side_effect === false, \"note proposal contract\");\n\nconst stage = await rpc(12, \"crm_prepare_lead_stage_change\", { workspace_id: \"ws-demo\", lead_id: \"lead-demo\", from_stage: \"new\", to_stage: \"qualified\", reason: \"Synthetic conformance test\" });\nassert(stage.kind === \"lead_stage_change_proposal\" && stage.state === \"REVIEW_REQUIRED\" && stage.side_effect === false, \"stage proposal contract\");\n\nconst outreach = await rpc(13, \"crm_prepare_outreach_draft\", { workspace_id: \"ws-demo\", lead_id: \"lead-demo\", channel: \"whatsapp\", objective: \"Synthetic conformance test\" });\nassert(outreach.kind === \"outreach_draft_request\" && outreach.state === \"REVIEW_REQUIRED\" && outreach.side_effect === false && outreach.send_authorized === false, \"outreach proposal contract\");\n\nawait rpcExpectToolError(20, \"reject undeclared argument\", \"crm_prepare_note\", { workspace_id: \"ws-demo\", subject_id: \"lead-demo\", note: \"Synthetic\", unexpected: \"deny\" });\nawait rpcExpectToolError(21, \"reject whitespace required\", \"crm_prepare_note\", { workspace_id: \" \", subject_id: \"lead-demo\", note: \"Synthetic\" });\nawait rpcExpectToolError(22, \"reject invalid enum\", \"crm_prepare_outreach_draft\", { workspace_id: \"ws-demo\", lead_id: \"lead-demo\", channel: \"telegram\", objective: \"Synthetic\" });\n\nconsole.log(`PASS source SHA ${EXPECTED_SHA}`);\nconsole.log(\"RUMBO_CRM_VALTOWN_STAGING_CONFORMANCE_PASS\");\n",[284],"dc6e4bd6-11f1-4dd3-bcb9-51ab8c8fe1ed","validate_submission_import.ts","2795b7c6-ade2-11f1-bd26-1607ee4eb77e",153,["D",1789133217553],1,"import submission from \"./chatgpt-app-submission.json\" with { type: \"json\" };\n\nconst BASE = \"https://rumbo-crm-openai-staging.val.run\";\nconst EXPECTED_TOOLS = [\n \"crm_get_service_readiness\",\n \"crm_prepare_note\",\n \"crm_prepare_lead_stage_change\",\n \"crm_prepare_outreach_draft\",\n];\n\nconst failures: string[] = [];\nconst facts: Record = {};\n\nfunction assert(name: string, ok: boolean) {\n facts[name] = ok ? \"PASS\" : \"FAIL\";\n if (!ok) failures.push(name);\n}\n\nconst toolNames = Object.keys(submission.tools ?? {}).sort();\nassert(\"submission_tool_count_4\", toolNames.length === 4);\nassert(\"submission_tool_names_exact\", JSON.stringify(toolNames) === JSON.stringify([...EXPECTED_TOOLS].sort()));\nassert(\"positive_tests_exactly_5\", Array.isArray(submission.test_cases) && submission.test_cases.length === 5);\nassert(\"negative_tests_exactly_3\", Array.isArray(submission.negative_test_cases) && submission.negative_test_cases.length === 3);\nassert(\"subtitle_max_30\", typeof submission.app_info?.subtitle === \"string\" && submission.app_info.subtitle.length <= 30);\nassert(\"category_productivity\", submission.app_info?.category === \"PRODUCTIVITY\");\n\nfor (const name of EXPECTED_TOOLS) {\n const tool = submission.tools?.[name];\n const annotations = tool?.annotations;\n const justifications = tool?.justifications;\n assert(`${name}_hints_exact`, annotations?.readOnlyHint === true && annotations?.openWorldHint === false && annotations?.destructiveHint === false);\n assert(`${name}_read_only_justification_present`, typeof justifications?.read_only_justification === \"string\" && justifications.read_only_justification.trim().length > 0);\n assert(`${name}_open_world_justification_present`, typeof justifications?.open_world_justification === \"string\" && justifications.open_world_justification.trim().length > 0);\n assert(`${name}_destructive_justification_present`, typeof justifications?.destructive_justification === \"string\" && justifications.destructive_justification.trim().length > 0);\n}\n\nconst headers = {\n origin: \"https://chatgpt.com\",\n accept: \"application/json, text/event-stream\",\n \"content-type\": \"application/json\",\n \"mcp-protocol-version\": \"2025-06-18\",\n};\nconst r = await fetch(`${BASE}/api/openai-plugin/mcp`, {\n method: \"POST\",\n headers,\n body: JSON.stringify({ jsonrpc: \"2.0\", id: 1, method: \"tools/list\", params: {} }),\n});\nassert(\"live_tools_list_http_200\", r.status === 200);\nconst body = await r.json();\nconst liveTools = body?.result?.tools ?? [];\nfacts.live_tool_count = liveTools.length;\nassert(\"live_tool_count_4\", liveTools.length === 4);\nassert(\"live_tool_names_exact\", JSON.stringify(liveTools.map((t: any) => t.name).sort()) === JSON.stringify([...EXPECTED_TOOLS].sort()));\nfor (const tool of liveTools) {\n assert(`${tool.name}_output_schema_present`, tool.outputSchema !== null && typeof tool.outputSchema === \"object\");\n const a = tool.annotations;\n assert(`${tool.name}_live_hints_exact`, a?.readOnlyHint === true && a?.openWorldHint === false && a?.destructiveHint === false);\n}\n\nconst result = {\n state: failures.length === 0 ? \"PASS\" : \"FAIL\",\n facts,\n failures,\n money_spend: 0,\n};\nconsole.log(JSON.stringify(result, null, 2));\nif (failures.length) throw new Error(`submission_import_validation_failed:${failures.join(\",\")}`);\nconsole.log(\"RUMBO_CHATGPT_APP_SUBMISSION_IMPORT_PASS\");",[292],"4fefaf00-9113-47fa-88f8-a2d4c1128ecb",["D",1789342307817],57,[28],"caf2bd3e-658e-4439-be68-86811665d10b","review_case_server_validation.ts","2618f56a-afb9-11f1-8851-1607ee4eb77e",223,["D",1789334516789],"const BASE = \"https://rumbo-crm-openai-staging.val.run\";\nconst headers = {\n origin: \"https://chatgpt.com\",\n accept: \"application/json, text/event-stream\",\n \"content-type\": \"application/json\",\n \"mcp-protocol-version\": \"2025-06-18\",\n};\n\nconst failures: string[] = [];\nconst facts: Record = {};\nfunction assert(name: string, ok: boolean) {\n facts[name] = ok ? \"PASS\" : \"FAIL\";\n if (!ok) failures.push(name);\n}\n\nasync function rpc(method: string, params: unknown) {\n const r = await fetch(`${BASE}/api/openai-plugin/mcp`, {\n method: \"POST\", headers,\n body: JSON.stringify({ jsonrpc: \"2.0\", id: `${method}-${crypto.randomUUID()}`, method, params }),\n });\n assert(`${method}_http_200`, r.status === 200);\n return await r.json();\n}\n\nconst listed = await rpc(\"tools/list\", {});\nconst tools = listed?.result?.tools ?? [];\nconst names = tools.map((t: any) => t.name).sort();\nconst expected = [\n \"crm_get_service_readiness\",\n \"crm_prepare_note\",\n \"crm_prepare_lead_stage_change\",\n \"crm_prepare_outreach_draft\",\n].sort();\nassert(\"tool_surface_exact_4\", JSON.stringify(names) === JSON.stringify(expected));\n\nasync function call(name: string, args: Record) {\n const body = await rpc(\"tools/call\", { name, arguments: args });\n const sc = body?.result?.structuredContent;\n assert(`${name}_structured_content`, sc && typeof sc === \"object\");\n return sc ?? {};\n}\n\nconst readiness = await call(\"crm_get_service_readiness\", {});\nassert(\"positive_1_readiness_bounded\", readiness.customer_data_tools_exposed === false && readiness.mutating_tools_exposed === false && readiness.production_authority === false && readiness.submission_authority === false);\n\nconst note = await call(\"crm_prepare_note\", { workspace_id: \"demo-workspace\", subject_id: \"lead-101\", note: \"Follow up next Tuesday after the product demo.\" });\nassert(\"positive_2_note_review_only\", note.state === \"REVIEW_REQUIRED\" && note.side_effect === false && note.workspace_id === \"demo-workspace\" && note.subject_id === \"lead-101\");\n\nconst stageReason = await call(\"crm_prepare_lead_stage_change\", { workspace_id: \"demo-workspace\", lead_id: \"lead-202\", from_stage: \"Qualified\", to_stage: \"Proposal\", reason: \"Discovery call is complete.\" });\nassert(\"positive_3_stage_reason_review_only\", stageReason.state === \"REVIEW_REQUIRED\" && stageReason.side_effect === false && stageReason.from_stage === \"Qualified\" && stageReason.to_stage === \"Proposal\");\n\nconst stageNoReason = await call(\"crm_prepare_lead_stage_change\", { workspace_id: \"demo-workspace\", lead_id: \"lead-303\", from_stage: \"New\", to_stage: \"Contacted\" });\nassert(\"positive_4_stage_optional_reason\", stageNoReason.state === \"REVIEW_REQUIRED\" && stageNoReason.side_effect === false && stageNoReason.reason === \"\");\n\nconst outreach = await call(\"crm_prepare_outreach_draft\", { workspace_id: \"demo-workspace\", lead_id: \"lead-404\", channel: \"whatsapp\", objective: \"Schedule a follow-up call.\" });\nassert(\"positive_5_outreach_no_send\", outreach.state === \"REVIEW_REQUIRED\" && outreach.side_effect === false && outreach.send_authorized === false);\n\nconst bannedPatterns = [/customer.*search/i, /customer.*retriev/i, /send.*message/i, /whatsapp.*send/i, /calendar/i];\nassert(\"negative_1_no_customer_retrieval_tool\", !names.some((n: string) => bannedPatterns[0].test(n) || bannedPatterns[1].test(n)));\nassert(\"negative_2_no_message_send_tool\", !names.some((n: string) => bannedPatterns[2].test(n) || bannedPatterns[3].test(n)));\nassert(\"negative_3_no_calendar_tool\", !names.some((n: string) => bannedPatterns[4].test(n)));\n\nconst result = { state: failures.length ? \"FAIL\" : \"PASS\", positive_cases: 5, negative_surface_cases: 3, facts, failures, money_spend: 0, scope: \"SERVER_SIDE_ONLY_NOT_CHATGPT_TOOL_SELECTION_E2E\" };\nconsole.log(JSON.stringify(result, null, 2));\nif (failures.length) throw new Error(`review_case_server_validation_failed:${failures.join(\",\")}`);\nconsole.log(\"RUMBO_REVIEW_CASE_SERVER_VALIDATION_PASS\");",[304],"cf2ed326-1260-420e-8c6b-a94367e734f5","main.ts",124,["D",1789121684747],10,"http","const SOURCE_SHA = \"9152f5a50de42be55508f0effed5ed09aee44c60\";\nconst PROTOCOL_VERSION = \"2025-06-18\";\nconst FALLBACK_PROTOCOL_VERSION = \"2025-03-26\";\nconst OPENAI_APPS_CHALLENGE_TOKEN = Deno.env.get(\"OPENAI_APPS_CHALLENGE_TOKEN\")?.trim() ?? \"\";\nconst PORTAL_LOGO_SVG = `\n`;\nconst ALLOWED_ORIGINS = new Set([\n \"https://chatgpt.com\",\n \"https://chat.openai.com\",\n \"https://platform.openai.com\",\n]);\nconst EXPOSED_TOOLS = [\n \"crm_get_service_readiness\",\n \"crm_prepare_note\",\n \"crm_prepare_lead_stage_change\",\n \"crm_prepare_outreach_draft\",\n] as const;\nconst PLANNED_UNEXPOSED_TOOLS = [\n \"crm_search_contacts\",\n \"crm_get_contact\",\n \"crm_search_leads\",\n \"crm_get_pipeline_summary\",\n \"crm_search_conversations\",\n \"crm_search_knowledge\",\n \"crm_get_analytics_summary\",\n] as const;\n\nconst boundedId = { type: \"string\", minLength: 1, maxLength: 200, pattern: \"\\\\S\" };\nconst boundedString = (maxLength: number) => ({ type: \"string\", minLength: 1, maxLength, pattern: \"\\\\S\" });\nconst reviewBase = {\n state: { type: \"string\", const: \"REVIEW_REQUIRED\" },\n side_effect: { type: \"boolean\", const: false },\n};\nconst annotations = { readOnlyHint: true, destructiveHint: false, openWorldHint: false };\n\nconst tools = [\n {\n name: \"crm_get_service_readiness\",\n title: \"Get CRM service readiness\",\n description: \"Returns bounded publication/runtime readiness metadata. It does not access customer records.\",\n inputSchema: { type: \"object\", properties: {}, additionalProperties: false },\n outputSchema: {\n type: \"object\",\n properties: {\n state: { type: \"string\", const: \"MCP_CONTRACT_ACTIVE_BOUNDED\" },\n customer_data_tools_exposed: { type: \"boolean\", const: false },\n mutating_tools_exposed: { type: \"boolean\", const: false },\n production_authority: { type: \"boolean\", const: false },\n submission_authority: { type: \"boolean\", const: false },\n },\n required: [\"state\", \"customer_data_tools_exposed\", \"mutating_tools_exposed\", \"production_authority\", \"submission_authority\"],\n additionalProperties: false,\n },\n annotations,\n },\n {\n name: \"crm_prepare_note\",\n title: \"Prepare CRM note\",\n description: \"Returns a reviewable note proposal only. It does not write the note to the CRM.\",\n inputSchema: { type: \"object\", properties: { workspace_id: boundedId, subject_id: boundedId, note: boundedString(4000) }, required: [\"workspace_id\", \"subject_id\", \"note\"], additionalProperties: false },\n outputSchema: { type: \"object\", properties: { kind: { type: \"string\", const: \"crm_note_proposal\" }, ...reviewBase, workspace_id: { type: \"string\" }, subject_id: { type: \"string\" }, note: { type: \"string\" } }, required: [\"kind\", \"state\", \"side_effect\", \"workspace_id\", \"subject_id\", \"note\"], additionalProperties: false },\n annotations,\n },\n {\n name: \"crm_prepare_lead_stage_change\",\n title: \"Prepare lead stage change\",\n description: \"Returns a reviewable stage-change proposal only. It performs no CRM mutation.\",\n inputSchema: { type: \"object\", properties: { workspace_id: boundedId, lead_id: boundedId, from_stage: boundedId, to_stage: boundedId, reason: { type: \"string\", maxLength: 1000 } }, required: [\"workspace_id\", \"lead_id\", \"from_stage\", \"to_stage\"], additionalProperties: false },\n outputSchema: { type: \"object\", properties: { kind: { type: \"string\", const: \"lead_stage_change_proposal\" }, ...reviewBase, workspace_id: { type: \"string\" }, lead_id: { type: \"string\" }, from_stage: { type: \"string\" }, to_stage: { type: \"string\" }, reason: { type: \"string\" } }, required: [\"kind\", \"state\", \"side_effect\", \"workspace_id\", \"lead_id\", \"from_stage\", \"to_stage\", \"reason\"], additionalProperties: false },\n annotations,\n },\n {\n name: \"crm_prepare_outreach_draft\",\n title: \"Prepare outreach draft\",\n description: \"Returns a reviewable outreach draft request artifact. It never sends a message.\",\n inputSchema: { type: \"object\", properties: { workspace_id: boundedId, lead_id: boundedId, channel: { type: \"string\", enum: [\"email\", \"sms\", \"whatsapp\", \"other\"] }, objective: boundedString(2000) }, required: [\"workspace_id\", \"lead_id\", \"channel\", \"objective\"], additionalProperties: false },\n outputSchema: { type: \"object\", properties: { kind: { type: \"string\", const: \"outreach_draft_request\" }, ...reviewBase, workspace_id: { type: \"string\" }, lead_id: { type: \"string\" }, channel: { type: \"string\", enum: [\"email\", \"sms\", \"whatsapp\", \"other\"] }, objective: { type: \"string\" }, send_authorized: { type: \"boolean\", const: false } }, required: [\"kind\", \"state\", \"side_effect\", \"workspace_id\", \"lead_id\", \"channel\", \"objective\", \"send_authorized\"], additionalProperties: false },\n annotations,\n },\n];\n\ntype RecordLike = Record;\nfunction asRecord(value: unknown): RecordLike | null { return value !== null && typeof value === \"object\" && !Array.isArray(value) ? value as RecordLike : null; }\nfunction rpcOk(id: unknown, result: unknown) { return { jsonrpc: \"2.0\", id: id ?? null, result }; }\nfunction rpcError(id: unknown, code: number, message: string, data?: unknown) { return { jsonrpc: \"2.0\", id: id ?? null, error: { code, message, ...(data === undefined ? {} : { data }) } }; }\nfunction exactArgs(value: unknown, allowed: string[]) {\n if (value === undefined) return {} as RecordLike;\n const args = asRecord(value);\n if (!args) throw new Error(\"invalid_arguments_object\");\n const allow = new Set(allowed);\n if (Object.keys(args).some((key) => !allow.has(key))) throw new Error(\"undeclared_argument\");\n return args;\n}\nfunction requiredString(args: RecordLike, key: string, max: number) {\n const value = args[key];\n if (typeof value !== \"string\" || !value.trim() || value.length > max) throw new Error(`invalid_${key}`);\n return value.trim();\n}\nfunction optionalString(args: RecordLike, key: string, max: number) {\n const value = args[key];\n if (value === undefined) return \"\";\n if (typeof value !== \"string\" || value.length > max) throw new Error(`invalid_${key}`);\n return value.trim();\n}\nfunction proposal(kind: string, body: RecordLike) {\n const structuredContent = { kind, state: \"REVIEW_REQUIRED\", side_effect: false, ...body };\n return { content: [{ type: \"text\", text: JSON.stringify(structuredContent) }], structuredContent, isError: false };\n}\nfunction callTool(params: unknown) {\n const record = asRecord(params);\n if (!record || typeof record.name !== \"string\") return { isError: true, content: [{ type: \"text\", text: \"Invalid tools/call parameters.\" }] };\n try {\n switch (record.name) {\n case \"crm_get_service_readiness\": {\n exactArgs(record.arguments, []);\n const structuredContent = { state: \"MCP_CONTRACT_ACTIVE_BOUNDED\", customer_data_tools_exposed: false, mutating_tools_exposed: false, production_authority: false, submission_authority: false };\n return { content: [{ type: \"text\", text: \"RUMBO CRM MCP contract is reachable; customer-data tools remain intentionally unexposed.\" }], structuredContent, isError: false };\n }\n case \"crm_prepare_note\": {\n const args = exactArgs(record.arguments, [\"workspace_id\", \"subject_id\", \"note\"]);\n return proposal(\"crm_note_proposal\", { workspace_id: requiredString(args, \"workspace_id\", 200), subject_id: requiredString(args, \"subject_id\", 200), note: requiredString(args, \"note\", 4000) });\n }\n case \"crm_prepare_lead_stage_change\": {\n const args = exactArgs(record.arguments, [\"workspace_id\", \"lead_id\", \"from_stage\", \"to_stage\", \"reason\"]);\n return proposal(\"lead_stage_change_proposal\", { workspace_id: requiredString(args, \"workspace_id\", 200), lead_id: requiredString(args, \"lead_id\", 200), from_stage: requiredString(args, \"from_stage\", 200), to_stage: requiredString(args, \"to_stage\", 200), reason: optionalString(args, \"reason\", 1000) });\n }\n case \"crm_prepare_outreach_draft\": {\n const args = exactArgs(record.arguments, [\"workspace_id\", \"lead_id\", \"channel\", \"objective\"]);\n const channel = requiredString(args, \"channel\", 32);\n if (![\"email\", \"sms\", \"whatsapp\", \"other\"].includes(channel)) throw new Error(\"invalid_channel\");\n return proposal(\"outreach_draft_request\", { workspace_id: requiredString(args, \"workspace_id\", 200), lead_id: requiredString(args, \"lead_id\", 200), channel, objective: requiredString(args, \"objective\", 2000), send_authorized: false });\n }\n default:\n return { isError: true, content: [{ type: \"text\", text: `Unknown or intentionally unexposed tool: ${record.name}` }] };\n }\n } catch (cause) {\n const message = cause instanceof Error ? cause.message : \"invalid_arguments\";\n return { isError: true, content: [{ type: \"text\", text: `Invalid arguments: ${message}` }] };\n }\n}\nfunction handleRpc(payload: unknown) {\n const request = asRecord(payload);\n const id = request?.id ?? null;\n if (!request || request.jsonrpc !== \"2.0\" || typeof request.method !== \"string\") return rpcError(id, -32600, \"Invalid Request\");\n if (request.method === \"notifications/initialized\") return null;\n switch (request.method) {\n case \"initialize\": {\n const params = asRecord(request.params);\n const clientInfo = asRecord(params?.clientInfo);\n if (!params || params.protocolVersion !== PROTOCOL_VERSION || !asRecord(params.capabilities) || !clientInfo || typeof clientInfo.name !== \"string\" || typeof clientInfo.version !== \"string\") {\n return rpcError(id, -32602, \"Invalid initialize parameters\", { supportedProtocolVersion: PROTOCOL_VERSION });\n }\n return rpcOk(id, { protocolVersion: PROTOCOL_VERSION, capabilities: { tools: { listChanged: false } }, serverInfo: { name: \"rumbo-ia-crm\", version: \"0.1.3-bounded-valtown\" }, instructions: \"Bounded CRM assistant. Public v1 exposes readiness and proposal-only tools; no customer-data reads or external side effects.\" });\n }\n case \"ping\": return rpcOk(id, {});\n case \"tools/list\": return rpcOk(id, { tools });\n case \"tools/call\": return rpcOk(id, callTool(request.params));\n default: return rpcError(id, -32601, \"Method not found\");\n }\n}\nfunction mediaType(value: string | null) { return (value ?? \"\").split(\";\", 1)[0].trim().toLowerCase(); }\nfunction acceptsMcpResponse(req: Request) {\n const accepted = new Set((req.headers.get(\"accept\") ?? \"\").split(\",\").map((v) => mediaType(v)).filter(Boolean));\n return accepted.has(\"application/json\") && accepted.has(\"text/event-stream\");\n}\nfunction originAllowed(req: Request) {\n const origin = req.headers.get(\"origin\");\n return !origin || ALLOWED_ORIGINS.has(origin);\n}\nfunction json(body: unknown, status = 200) {\n return new Response(JSON.stringify(body), { status, headers: { \"content-type\": \"application/json; charset=utf-8\", \"cache-control\": \"no-store\", \"x-rumbo-source-sha\": SOURCE_SHA } });\n}\nfunction textPage(title: string, body: string) {\n return new Response(`${title}\\n\\n${body}\\n`, { status: 200, headers: { \"content-type\": \"text/plain; charset=utf-8\", \"cache-control\": \"public, max-age=300\", \"x-rumbo-source-sha\": SOURCE_SHA } });\n}\n\nexport default async function fetch(req: Request): Promise {\n const url = new URL(req.url);\n if (req.method === \"GET\" && url.pathname === \"/logo.svg\") {\n return new Response(PORTAL_LOGO_SVG, { status: 200, headers: { \"content-type\": \"image/svg+xml; charset=utf-8\", \"cache-control\": \"public, max-age=300\", \"x-rumbo-source-sha\": SOURCE_SHA } });\n }\n if (req.method === \"GET\" && url.pathname === \"/\") {\n return textPage(\"RUMBO IA CRM\", \"Bounded ChatGPT MCP service. Public v1 exposes four proposal/readiness tools only. No customer-data reads, CRM mutations, autonomous sends, production authority, or submission authority. Support: /support · Privacy: /privacy · Terms: /terms · Logo: /logo.svg\");\n }\n if (req.method === \"GET\" && url.pathname === \"/support\") {\n return textPage(\"RUMBO IA CRM Support\", \"For RUMBO IA CRM support, contact sebastian@rumbo.verso.fans. This ChatGPT/MCP integration exposes four bounded tools: service readiness, CRM note proposal preparation, lead-stage-change proposal preparation, and outreach-draft request preparation. Every proposal remains REVIEW_REQUIRED with side_effect=false. The integration does not read customer records, mutate the CRM, or send messages autonomously. Include the tool name and a non-sensitive description of the issue when requesting support. Do not send passwords, API keys, authentication tokens, or unnecessary customer data.\");\n }\n if (req.method === \"GET\" && url.pathname === \"/privacy\") {\n return textPage(\"RUMBO IA CRM Privacy\", \"RUMBO IA CRM processes only the information intentionally supplied to its bounded MCP tools for the purpose of producing a reviewable proposal or readiness response. Inputs may include workspace identifiers, subject or lead identifiers, note text, current and proposed stage names, a reason, communication channel, and outreach objective. The public v1 does not expose tools that search or retrieve customer records, mutate CRM data, or send messages. Tool inputs and outputs may be processed by the hosting and AI platforms used to deliver the service and may appear in operational security logs subject to those providers' policies. Do not submit passwords, API keys, authentication tokens, payment data, health data, or other unnecessary sensitive information. RUMBO IA does not sell tool input data. Privacy requests: sebastian@rumbo.verso.fans.\");\n }\n if (req.method === \"GET\" && url.pathname === \"/terms\") {\n return textPage(\"RUMBO IA CRM Terms\", \"RUMBO IA CRM is a bounded, human-controlled assistant. Its outputs are proposals for review and are not automatically applied to a CRM or sent to third parties. Users are responsible for reviewing accuracy, authorization, and appropriateness before acting on any proposal. The service must not be used to submit secrets or unnecessary sensitive data. Features, availability, and limits may change while the product remains under controlled development. Contact: sebastian@rumbo.verso.fans.\");\n }\n if (url.pathname === \"/.well-known/openai-apps-challenge\") {\n if (req.method !== \"GET\") return new Response(null, { status: 405, headers: { allow: \"GET\", \"cache-control\": \"no-store\", \"x-rumbo-source-sha\": SOURCE_SHA } });\n if (!OPENAI_APPS_CHALLENGE_TOKEN) return new Response(null, { status: 404, headers: { \"cache-control\": \"no-store\", \"x-rumbo-source-sha\": SOURCE_SHA } });\n return new Response(OPENAI_APPS_CHALLENGE_TOKEN, { status: 200, headers: { \"content-type\": \"text/plain; charset=utf-8\", \"cache-control\": \"no-store\", \"x-rumbo-source-sha\": SOURCE_SHA } });\n }\n if (url.pathname === \"/api/openai-plugin/health\") {\n if (req.method !== \"GET\") return new Response(null, { status: 405, headers: { allow: \"GET\", \"cache-control\": \"no-store\", \"x-rumbo-source-sha\": SOURCE_SHA } });\n return json({\n status: \"candidate\",\n service: \"rumbo-ia-crm-openai-plugin\",\n protocol: \"mcp-json-rpc-bounded-subset-implemented\",\n mcpEndpoint: \"/api/openai-plugin/mcp\",\n sourceSha: SOURCE_SHA,\n exposedTools: EXPOSED_TOOLS,\n plannedUnexposedTools: PLANNED_UNEXPOSED_TOOLS,\n customerDataToolsExposed: false,\n readOnlyDefault: true,\n productionAuthority: false,\n submissionAuthority: false,\n hostAdapter: \"val-town-clean-room-staging\",\n timestamp: new Date().toISOString(),\n });\n }\n if (url.pathname !== \"/api/openai-plugin/mcp\") return new Response(null, { status: 404, headers: { \"cache-control\": \"no-store\", \"x-rumbo-source-sha\": SOURCE_SHA } });\n if (!originAllowed(req)) return new Response(null, { status: 403, headers: { \"cache-control\": \"no-store\", \"x-rumbo-source-sha\": SOURCE_SHA } });\n if (req.method === \"GET\") return new Response(null, { status: 405, headers: { allow: \"POST\", \"cache-control\": \"no-store\", \"x-rumbo-source-sha\": SOURCE_SHA } });\n if (req.method !== \"POST\") return new Response(null, { status: 405, headers: { allow: \"POST\", \"cache-control\": \"no-store\", \"x-rumbo-source-sha\": SOURCE_SHA } });\n if (!acceptsMcpResponse(req)) return new Response(null, { status: 406, headers: { \"cache-control\": \"no-store\", \"x-rumbo-source-sha\": SOURCE_SHA } });\n if (mediaType(req.headers.get(\"content-type\")) !== \"application/json\") return new Response(null, { status: 415, headers: { \"cache-control\": \"no-store\", \"x-rumbo-source-sha\": SOURCE_SHA } });\n let payload: unknown;\n try { payload = await req.json(); }\n catch { return json({ jsonrpc: \"2.0\", id: null, error: { code: -32700, message: \"Parse error\" } }, 400); }\n const method = asRecord(payload)?.method;\n if (method !== \"initialize\") {\n const version = req.headers.get(\"mcp-protocol-version\") ?? FALLBACK_PROTOCOL_VERSION;\n if (version !== PROTOCOL_VERSION) return json({ jsonrpc: \"2.0\", id: asRecord(payload)?.id ?? null, error: { code: -32600, message: \"Unsupported or missing MCP-Protocol-Version\", data: { supportedProtocolVersion: PROTOCOL_VERSION } } }, 400);\n }\n const body = handleRpc(payload);\n if (body === null) return new Response(null, { status: 202, headers: { \"cache-control\": \"no-store\", \"x-rumbo-source-sha\": SOURCE_SHA } });\n return json(body, 200);\n}\n",[311],"06da2425-9802-470e-b42a-0b826e9b42a9","chatgpt-app-submission.json","1fb8e7dc-ada4-11f1-b346-1607ee4eb77e",58,["D",1789105584348],"{\n \"$schema\": \"https://developers.openai.com/apps-sdk/schemas/chatgpt-app-submission.v1.json\",\n \"schema_version\": 1,\n \"app_info\": {\n \"display_name\": \"RUMBO IA CRM\",\n \"subtitle\": \"Prepare CRM proposals\",\n \"description\": \"RUMBO IA CRM helps users check service readiness and prepare reviewable CRM notes, lead-stage changes, and outreach draft requests without reading customer records, mutating the CRM, or sending messages autonomously.\",\n \"category\": \"PRODUCTIVITY\"\n },\n \"tools\": {\n \"crm_get_service_readiness\": {\n \"annotations\": {\n \"readOnlyHint\": true,\n \"openWorldHint\": false,\n \"destructiveHint\": false\n },\n \"justifications\": {\n \"read_only_justification\": \"Returns bounded service-readiness metadata without reading or changing customer records.\",\n \"open_world_justification\": \"Does not write to public internet state or any third-party system.\",\n \"destructive_justification\": \"Does not delete, overwrite, revoke, send, or perform irreversible actions.\"\n }\n },\n \"crm_prepare_note\": {\n \"annotations\": {\n \"readOnlyHint\": true,\n \"openWorldHint\": false,\n \"destructiveHint\": false\n },\n \"justifications\": {\n \"read_only_justification\": \"Computes and returns a reviewable note proposal from user-supplied inputs without writing it to the CRM.\",\n \"open_world_justification\": \"Does not publish or transmit the proposal to a public or third-party destination.\",\n \"destructive_justification\": \"Does not delete, overwrite, or otherwise irreversibly alter CRM data.\"\n }\n },\n \"crm_prepare_lead_stage_change\": {\n \"annotations\": {\n \"readOnlyHint\": true,\n \"openWorldHint\": false,\n \"destructiveHint\": false\n },\n \"justifications\": {\n \"read_only_justification\": \"Computes a reviewable lead-stage-change proposal and performs no CRM mutation.\",\n \"open_world_justification\": \"Does not publish, send, or apply the stage change to any external system.\",\n \"destructive_justification\": \"Does not overwrite lead state or perform any irreversible action.\"\n }\n },\n \"crm_prepare_outreach_draft\": {\n \"annotations\": {\n \"readOnlyHint\": true,\n \"openWorldHint\": false,\n \"destructiveHint\": false\n },\n \"justifications\": {\n \"read_only_justification\": \"Returns a reviewable outreach-draft request artifact and never sends the message.\",\n \"open_world_justification\": \"Does not contact recipients, publish content, or change any third-party system.\",\n \"destructive_justification\": \"Does not send irreversible communications or modify stored CRM data.\"\n }\n }\n },\n \"test_cases\": [\n {\n \"description\": \"Check the bounded CRM service readiness contract.\",\n \"user_prompt\": \"Check whether the RUMBO CRM service is ready and tell me what authority it currently has.\",\n \"file_attachment_urls\": null,\n \"tools_triggered\": \"crm_get_service_readiness\",\n \"expected_output\": \"Returns bounded readiness metadata showing that customer-data tools and mutating tools are not exposed and that production/submission authority is false.\",\n \"expected_output_url\": null\n },\n {\n \"description\": \"Prepare a reviewable CRM note proposal.\",\n \"user_prompt\": \"Prepare a CRM note for workspace demo-workspace and subject lead-101 saying: Follow up next Tuesday after the product demo. Do not write it to the CRM.\",\n \"file_attachment_urls\": null,\n \"tools_triggered\": \"crm_prepare_note\",\n \"expected_output\": \"Returns a crm_note_proposal with REVIEW_REQUIRED and side_effect=false, preserving the supplied workspace, subject, and note.\",\n \"expected_output_url\": null\n },\n {\n \"description\": \"Prepare a lead-stage-change proposal with a reason.\",\n \"user_prompt\": \"For workspace demo-workspace, prepare moving lead-202 from Qualified to Proposal because the discovery call is complete. Do not apply the change.\",\n \"file_attachment_urls\": null,\n \"tools_triggered\": \"crm_prepare_lead_stage_change\",\n \"expected_output\": \"Returns a lead_stage_change_proposal with REVIEW_REQUIRED and side_effect=false and does not mutate the CRM.\",\n \"expected_output_url\": null\n },\n {\n \"description\": \"Prepare a stage-change proposal when the optional reason is omitted.\",\n \"user_prompt\": \"Prepare moving lead-303 in workspace demo-workspace from New to Contacted, but do not change the CRM yet.\",\n \"file_attachment_urls\": null,\n \"tools_triggered\": \"crm_prepare_lead_stage_change\",\n \"expected_output\": \"Returns a reviewable stage-change proposal with an empty optional reason and no side effect.\",\n \"expected_output_url\": null\n },\n {\n \"description\": \"Prepare a WhatsApp outreach draft request without sending it.\",\n \"user_prompt\": \"For workspace demo-workspace and lead-404, prepare a WhatsApp outreach draft request whose objective is to schedule a follow-up call. Do not send anything.\",\n \"file_attachment_urls\": null,\n \"tools_triggered\": \"crm_prepare_outreach_draft\",\n \"expected_output\": \"Returns an outreach_draft_request with REVIEW_REQUIRED, side_effect=false, and send_authorized=false.\",\n \"expected_output_url\": null\n }\n ],\n \"negative_test_cases\": [\n {\n \"description\": \"Do not trigger for customer-record retrieval that the bounded v1 does not expose.\",\n \"user_prompt\": \"Search my CRM and show me all customers who bought last month.\",\n \"file_attachment_urls\": null,\n \"tools_triggered\": null,\n \"expected_output\": \"The app should not invoke a tool because customer-data search and retrieval are intentionally outside the public v1 surface.\",\n \"expected_output_url\": null\n },\n {\n \"description\": \"Do not trigger an autonomous message send.\",\n \"user_prompt\": \"Send a WhatsApp message to this lead right now without asking me again.\",\n \"file_attachment_urls\": null,\n \"tools_triggered\": null,\n \"expected_output\": \"The app should not invoke a tool because the public v1 has no message-sending capability; it may explain that only a reviewable draft request can be prepared.\",\n \"expected_output_url\": null\n },\n {\n \"description\": \"Do not trigger for an unrelated calendar request.\",\n \"user_prompt\": \"What meetings do I have tomorrow?\",\n \"file_attachment_urls\": null,\n \"tools_triggered\": null,\n \"expected_output\": \"The app should not be invoked because calendar retrieval is outside its supported CRM proposal/readiness workflows.\",\n \"expected_output_url\": null\n }\n ]\n}\n",[319],"58823941-322d-4cf3-abdf-a9a0f02a23db","SUBMISSION_TESTS.md","0348fae8-ad58-11f1-8402-1607ee4eb77e",13,["D",1789072894892],"# RUMBO IA CRM — OpenAI submission test cases\n\nCandidate SHA: `9152f5a50de42be55508f0effed5ed09aee44c60`\nHost: `https://rumbo-crm-openai-staging.val.run/`\nProtocol: MCP `2025-06-18`\n\nAll fixtures below are synthetic. No customer data, credentials, billing actions, CRM writes, message sends, production mutations, or submission authority are required.\n\n## Positive tests\n\n### P1 — Service readiness\nUser prompt: `Check whether the RUMBO CRM service is ready and tell me what authority it currently has.`\nExpected tool: `crm_get_service_readiness`\nExpected behavior: call with `{}` and return bounded readiness metadata only.\nExpected result: `state=MCP_CONTRACT_ACTIVE_BOUNDED`, customer-data tools false, mutating tools false, production authority false, submission authority false.\nFixture: none.\n\n### P2 — Prepare note proposal\nUser prompt: `Prepare a CRM note for lead-demo in workspace ws-demo saying \"Requested a follow-up next week\".`\nExpected tool: `crm_prepare_note`\nExpected behavior: create a proposal only; do not write to CRM.\nExpected result shape: `kind=crm_note_proposal`, `state=REVIEW_REQUIRED`, `side_effect=false`, echoed bounded IDs and note.\nFixture: `workspace_id=ws-demo`, `subject_id=lead-demo`.\n\n### P3 — Prepare lead stage proposal\nUser prompt: `Prepare moving lead-demo from new to qualified in workspace ws-demo because the demo requirements were confirmed.`\nExpected tool: `crm_prepare_lead_stage_change`\nExpected behavior: create a stage-change proposal only.\nExpected result shape: `kind=lead_stage_change_proposal`, `state=REVIEW_REQUIRED`, `side_effect=false`, from/to stages and reason.\nFixture: synthetic IDs/stages only.\n\n### P4 — Prepare WhatsApp outreach draft request\nUser prompt: `Prepare a WhatsApp outreach draft request for lead-demo in ws-demo with the objective of scheduling a product demo.`\nExpected tool: `crm_prepare_outreach_draft`\nExpected behavior: prepare a reviewable request only; never send.\nExpected result shape: `kind=outreach_draft_request`, `state=REVIEW_REQUIRED`, `side_effect=false`, `send_authorized=false`, `channel=whatsapp`.\nFixture: synthetic IDs only.\n\n### P5 — Boundary explanation\nUser prompt: `What CRM actions can this plugin perform right now?`\nExpected tool: `crm_get_service_readiness`\nExpected behavior: explain the exposed bounded surface accurately.\nExpected result: identify readiness plus proposal-only note, stage-change, and outreach preparation; explicitly state that customer-data reads, CRM mutations, autonomous sends, production authority, and submission authority are absent.\nFixture: none.\n\n## Negative tests\n\n### N1 — Customer-data lookup request\nUser prompt: `Search all CRM contacts named Alice and show me their emails.`\nExpected safe behavior: do not invent or call an unexposed search tool; state that customer-data search is not exposed in public v1.\nWhy not complete: `crm_search_contacts` and customer-data reads are intentionally unexposed.\nExpected result: safe refusal/fallback with no customer data returned.\n\n### N2 — Autonomous send request\nUser prompt: `Send this WhatsApp message to lead-demo now: \"Your demo starts at 3 PM\".`\nExpected safe behavior: do not send. At most offer/use `crm_prepare_outreach_draft` to create a REVIEW_REQUIRED proposal if the user wants preparation.\nWhy not complete: no send tool or send authority is exposed; `send_authorized=false`.\nExpected result: no external side effect.\n\n### N3 — Direct CRM mutation request\nUser prompt: `Immediately move lead-demo to won and update the CRM without asking me again.`\nExpected safe behavior: do not mutate CRM. At most prepare `crm_prepare_lead_stage_change` as a proposal with `state=REVIEW_REQUIRED` and `side_effect=false`.\nWhy not complete: public v1 exposes no mutating CRM tool or production authority.\nExpected result: proposal-only fallback, never a completed mutation.\n\n## Review invariants\n\nEvery positive test must remain reproducible without private internal context. Every negative test must demonstrate that an unexposed capability cannot be reached indirectly through another tool. A technical PASS does not grant production, submission, publication, billing, or customer-data authority.\n",[326],"d28ac4f7-7d4a-44e0-bea3-dbfc3dd663b6","SUBMISSION_REVIEW_FINDINGS_2026-09-11.md","c987f616-adc9-11f1-8fb2-1607ee4eb77e",125,["D",1789121760618],"# RUMBO IA CRM — Submission review findings\n\nDate: 2026-09-11 UTC\nBudget invariant: `MONEY_SPEND=0`\nCandidate SHA bound in staging: `9152f5a50de42be55508f0effed5ed09aee44c60`\nVal Town branch version after descriptor hardening: `124`\n\n## Source review\n\n- `TOOL_COUNT=4`\n- `OUTPUT_SCHEMA=PASS_ALL_FOUR_TOOLS`\n- `ANNOTATIONS=PASS_ALL_FOUR_TOOLS`\n - `readOnlyHint=true`\n - `openWorldHint=false`\n - `destructiveHint=false`\n- `TOOL_NAMES=PASS` — names match bounded readiness/proposal behavior.\n- `TOOL_DESCRIPTIONS=HARDENED` — note and stage-change descriptions now say `Returns` rather than `Creates`, avoiding any implication that the tools write CRM state.\n- `CUSTOM_UI=NONE`; therefore widget CSP review is `NOT_APPLICABLE` for this bounded v1.\n\n## Sensitive-data review\n\nNo input schema explicitly solicits PHI, PCI, SSNs, passwords, API keys, MFA codes, government IDs, biometrics, or authentication secrets.\n\nThe proposal tools accept bounded identifiers plus user-supplied note/reason/objective text. Those fields can contain user-entered content, so the support/privacy surfaces explicitly instruct users not to submit secrets or unnecessary sensitive data and disclose the bounded MCP inputs.\n\nThe public v1 exposes no customer-data search/retrieval tool, no CRM mutation tool, and no autonomous send tool.\n\n## Response-data review\n\nAll four tools declare `outputSchema` and set `additionalProperties=false`.\nThe runtime returns bounded proposal/readiness fields only; conformance includes hostile-input rejection and output-shape checks.\n\nNo missing-`outputSchema` warning remains.\n\n## Verification\n\n- `verify.ts=PASS`\n- `verify_submission_import.ts=PASS_4_TOOLS_5_POSITIVE_3_NEGATIVE`\n- `submission_gate.ts=BLOCKED_FAIL_CLOSED_PORTAL_ONLY`\n\n## Remaining review gates\n\nPortal-only blockers remain authoritative: Apps Management write, verified publisher identity, global project data residency, conditional domain-verification status, logo upload, Scan Tools, explicit distribution scope, and production MCP URL authority.\n\n`TECHNICAL_REVIEW_PASS != PORTAL_PASS != SUBMISSION_AUTHORITY != PUBLICATION`\n",[333],"1c02a658-c585-467f-b4d8-70559795074c","SUBMISSION_REVIEW_CHECKS.md","405a9a3a-ada4-11f1-94ec-1607ee4eb77e",94,["D",1789119903438],"# RUMBO IA CRM — ChatGPT app submission review checks\n\nDate: 2026-09-11 UTC\nCandidate SHA: `9152f5a50de42be55508f0effed5ed09aee44c60`\nBudget invariant: `MONEY_SPEND=0`\n\n## Source review\n\n- Tool count: 4.\n- Every exposed tool declares all three required annotations explicitly: `readOnlyHint=true`, `openWorldHint=false`, `destructiveHint=false`.\n- Every exposed tool declares a non-null `outputSchema`; there are no missing-outputSchema warnings.\n- Tool names and descriptions match the implementation: readiness returns status only; note/stage/outreach tools prepare reviewable artifacts and do not apply/send them.\n- Custom UI: none. Widget CSP review: not applicable.\n\n## Sensitive-data review\n\nThe input schemas do not solicit credentials, MFA codes, payment-card data, health data, government IDs, biometrics, or other explicitly sensitive categories. However, free-text fields such as `note`, `reason`, and `objective`, and identifiers such as `workspace_id`, `subject_id`, and `lead_id`, can contain user-provided customer or business information. Review mitigation is explicit:\n\n- `/privacy` describes these inputs and their bounded processing.\n- `/support` instructs users not to send passwords, API keys, authentication tokens, or unnecessary customer data.\n- Public v1 exposes no customer-record search/retrieval tools.\n- Public v1 exposes no CRM mutation or autonomous message-send tools.\n- Proposal outputs remain `REVIEW_REQUIRED` with `side_effect=false`.\n\n## Submission import artifact\n\n`chatgpt-app-submission.json` contains:\n\n- App info: `RUMBO IA CRM`, subtitle `Prepare CRM proposals`, category `PRODUCTIVITY`.\n- 4 tool annotation blocks with behavior-grounded justifications.\n- Exactly 5 positive test cases.\n- Exactly 3 negative test cases.\n\n## Remaining portal-controlled checks\n\n- Domain challenge token / verification not completed.\n- Apps Management write permission not proven.\n- Publisher/developer identity not proven.\n- OpenAI Platform project data residency is not proven `GLOBAL`; current MCP review requirements reject EU-residency projects and require a global-residency project.\n- Canonical logo is prepared and hash-verified, but portal upload is not executed.\n- Scan Tools is not executed.\n- Distribution scope is not selected.\n- Production MCP URL promotion/submission authority is not granted.\n\nInvariant: `TECHNICAL_PASS != PORTAL_PASS != SUBMISSION_AUTHORITY != PUBLICATION`.\n",[340],"37759c87-51c5-432c-9f49-438f101ad0c7","SUBMISSION_READINESS.md","70c4dce0-ad58-11f1-b6da-1607ee4eb77e",246,["D",1789335744468],34,"# RUMBO IA CRM — OpenAI submission readiness receipt\n\nDate: 2026-09-11 UTC\nCandidate SHA: `9152f5a50de42be55508f0effed5ed09aee44c60`\nMCP URL: `https://rumbo-crm-openai-staging.val.run/api/openai-plugin/mcp`\nProtocol: MCP `2025-06-18`\nBudget invariant: `MONEY_SPEND=0`\n\n## Proven technical readiness\n\n- `CURRENT_HEAD_EXACT_CI=PASS`\n- `CRM_STAGING_HTTP_PUBLIC=PASS`\n- `CRM_STAGING_CONFORMANCE=PASS`\n- `REMOTE_MCP_ONLY_PROVIDER_COMPATIBILITY=PASS`\n- `TOOL_COUNT=4`\n- `TOOL_ANNOTATIONS=PASS`\n - `readOnlyHint=true`\n - `openWorldHint=false`\n - `destructiveHint=false`\n- `POSITIVE_TEST_CASES=5_READY`\n- `NEGATIVE_TEST_CASES=3_READY`\n- `DOMAIN_CHALLENGE_CAPABILITY=IMPLEMENTED_FAIL_CLOSED`\n- `DOMAIN_CHALLENGE_WITHOUT_TOKEN=404_PASS`\n- `CUSTOM_UI=NONE_REQUIRED`\n- `AUTHENTICATION=NONE_FOR_BOUNDED_PUBLIC_V1`\n- `LISTING_URLS_HTTP_PUBLIC=PASS` — website, support, privacy and terms all return HTTP 200.\n- `SUPPORT_MCP_SEMANTICS=PASS_SELF_HOSTED` — `https://rumbo-crm-openai-staging.val.run/support` identifies the ChatGPT/MCP surface, bounded proposal-only behavior, support contact, and sensitive-data exclusions.\n- `PRIVACY_MCP_DISCLOSURE=PASS_SELF_HOSTED` — `https://rumbo-crm-openai-staging.val.run/privacy` enumerates the bounded tool inputs, no-read/no-mutation/no-autosend limits, processing/logging caveat, sensitive-data exclusions, no-sale statement, and privacy contact.\n- `TERMS_BOUNDED_SEMANTICS=PASS_SELF_HOSTED` — `https://rumbo-crm-openai-staging.val.run/terms` states human control, proposal-only behavior, no automatic CRM/send action, review responsibility, and sensitive-data limits.\n- `PUBLISHER_SURFACES_PR94=ALTERNATE_CORPORATE_DOMAIN_CANDIDATE` — the publisher PR remains useful for future `rumbo.verso.fans` promotion but is no longer required for the submission packet's support/privacy/terms URLs.\n- `CUSTOMER_DATA_READS=NOT_EXPOSED`\n- `CRM_MUTATIONS=NOT_EXPOSED`\n- `AUTONOMOUS_SENDS=NOT_EXPOSED`\n- `MCP_RESPONSE_HYGIENE=PASS` — all four synthetic tool outputs match their declared output schemas with no extra fields, sensitive/debug keys, OpenAI-style API keys, or bearer-token-shaped values.\n- `PORTAL_CDP_LISTENER=PASS_127_0_0_1_9222_RUMBONEXUS`\n- `OPENAI_PLATFORM_SESSION=LOGIN_REQUIRED` — direct CDP navigation to `https://platform.openai.com/plugins` redirected to `https://platform.openai.com/login?next=%2Fplugins`; no cookies or credentials were extracted or reused.\n\n## OpenAI portal requirements not yet proven\n\n- `APPS_MANAGEMENT_WRITE=UNVERIFIED_REQUIRED` — public plugin drafts require organization Apps Management write access; organization owners already have it, non-owner submitters require an assigned role with Write.\n- `PUBLISHER_IDENTITY=UNVERIFIED_REQUIRED` — every public submission must select a verified individual or business identity matching the listing, website, support, privacy and terms.\n- `PORTAL_SESSION=LOGIN_REQUIRED` — CDP reached the OpenAI Platform target, but the RumboNexus profile is currently at `https://platform.openai.com/login`; no credential or cookie extraction is permitted.\n- `SUBMISSION_IMPORT=READY_VALIDATED_NOT_UPLOADED` — `validate_submission_import.ts=PASS` validates exact 4-tool identity, complete tool hints, live `tools/list`, all four live `outputSchema` declarations, app metadata, 5 positive tests, and 3 negative tests.\n- `LOGO_CANONICAL_REMOTE_MAIN=VERIFIED_SHA256_3ac48eb17d735ee41d12e6edf0cc0ea0e5a55358cce6b5fd37d93b3fc0372205`\n- `LOGO_SELF_HOSTED_URL=https://rumbo-crm-openai-staging.val.run/logo.svg`\n- `LOGO_PORTAL_UPLOAD=NOT_EXECUTED`\n- `PUBLISHER_SURFACES_LIVE_PROMOTION=OPTIONAL_FOR_CORPORATE_DOMAIN_NOT_REQUIRED_BY_SELF_HOSTED_PACKET`\n- `DOMAIN_CHALLENGE_TOKEN=NOT_ISSUED_BY_PORTAL`\n- `DOMAIN_VERIFICATION=CONDITIONAL_PORTAL_GATE_UNVERIFIED` — current OpenAI docs require the well-known challenge when the portal shows `Domain not verified`; the local endpoint remains fail-closed until a real token is issued.\n- `SCAN_TOOLS=NOT_EXECUTED`\n- `SCAN_TOOLS_RESULT=UNVERIFIED`\n- `STARTER_PROMPTS=READY_IN_TEST_ARTIFACT_BUT_NOT_ENTERED_IN_PORTAL`\n- `DISTRIBUTION_SCOPE=UNSET_FAIL_CLOSED`\n- `PRODUCTION_MCP_URL_PROMOTION=NOT_AUTHORIZED`\n- `SUBMIT_FOR_REVIEW=NOT_EXECUTED`\n- `PUBLICATION=NOT_EXECUTED`\n\n## Submission contract\n\nThe current OpenAI product separates workspace custom-app deployment from public directory submission. Workspace custom MCP apps are created through Developer Mode on eligible Business or Enterprise/Edu workspaces using endpoint metadata and `Scan Tools`; public directory submission is a separate flow. This candidate already has a validated submission import artifact with four behavior-audited tools and exactly five positive plus three negative tests. Any additional portal-only fields—domain challenge, identity, logo upload, availability, or other metadata—must be treated as requirements only when the live submission surface actually presents them. The MCP URL must not be represented as production until separate production-host authority is granted.\n\n## Fail-closed promotion rule\n\n`TECHNICAL_PASS != PORTAL_ACCESS != PRODUCTION_HOST_AUTHORITY != PORTAL_METADATA_COMPLETE != SCAN_TOOLS_PASS != SUBMISSION_AUTHORITY != PUBLICATION`\n\nDo not promote this staging host to the production MCP URL or submit it for review until every portal-controlled gate above is explicitly proven and a separate production/submission authority is granted.\n\n\n## Evidence addendum — V9 reconciliation\n\n- `PORTAL_EVIDENCE_RECEIPT_V9=PASS_VERIFIED`\n- `PORTAL_PACKET_VERIFIER=PASS_AFTER_CANONICAL_MARKER_RECONCILIATION`\n- `TOOL_ANNOTATION_JUSTIFICATIONS=PASS_12_OF_12`\n- `PRIVACY_FIELD_MATRIX=PASS_BOUNDED_EXPLICIT_INPUTS_ONLY`\n- `DOMAIN_VERIFICATION=CONDITIONAL_PORTAL_GATE_UNVERIFIED`\n- `GITHUB_CURRENT_HEAD=UNVERIFIED_CONNECTOR_DISABLED`\n- `PORTAL_CDP_CURRENT_ATTEMPT=DESKTOP_TRANSPORT_TIMEOUT`\n- `PUBLISHER_IDENTITY_EMAIL_RECEIPT=NOT_FOUND` — Gmail search is secondary evidence only; portal state remains `UNVERIFIED`, not failed.\n- `APPS_MANAGEMENT_WRITE_EMAIL_RECEIPT=NOT_FOUND` — Gmail search is secondary evidence only; portal state remains `UNVERIFIED`, not failed.\n\nExact remaining blocker set is seven items: domain portal status, Apps Management Write, publisher identity, logo portal upload, Scan Tools, distribution scope, and production MCP URL authority. The earlier `global project residency` blocker was removed after re-checking the current official submission and MCP server review documentation; no such submission requirement is documented there.\n\n\n## Evidence addendum — V10 correction\n\n- `PORTAL_EVIDENCE_RECEIPT_V10=PASS_VERIFIED`\n- `PORTAL_EVIDENCE_V10_SUPERSEDES_V9_OPERATIONALLY`\n- `PORTAL_PACKET_VERIFIER=PASS_WITH_V10_LINK`\n- `SUBMISSION_GATE=BLOCKED_FAIL_CLOSED_7_EXACT_EXTERNAL_BLOCKERS`\n- `GLOBAL_PROJECT_DATA_RESIDENCY_BLOCKER=RETRACTED_NOT_DOCUMENTED_IN_CURRENT_OFFICIAL_SUBMISSION_OR_MCP_REVIEW_DOCS`\n- `PLATFORM_CONTEXT=RUMBO_ORG_DEFAULT_PROJECT_CONNECTED_PORTAL_CONTEXT_UNVERIFIED`\n- `GITHUB_CURRENT_HEAD=UNVERIFIED_CONNECTOR_DISABLED`\n- `PORTAL_CDP_CURRENT_STATE=NO_REMOTE_DEBUGGING_CHANNEL_AVAILABLE`\n- `MONEY_SPEND=0`\n\nCurrent exact blocker set: domain verification portal status, Apps Management Write, publisher identity, logo portal upload, Scan Tools, distribution scope, and production MCP URL authority. V9 remains preserved as historical evidence but is not authoritative for the current blocker set.\n\n\n## Evidence addendum — V11 correction\n\n- `PORTAL_EVIDENCE_RECEIPT_V11=PASS_VERIFIED`\n- `PORTAL_EVIDENCE_V11_SUPERSEDES_V10_OPERATIONALLY`\n- `PORTAL_PACKET_VERIFIER=PASS_WITH_V11_LINK`\n- `SUBMISSION_GATE=BLOCKED_FAIL_CLOSED_8_EXACT_EXTERNAL_BLOCKERS`\n- `GLOBAL_PROJECT_DATA_RESIDENCY=UNVERIFIED_REQUIRED_FOR_REMOTE_MCP_REVIEW` — the specific Remote MCP review requirements state that EU-residency projects cannot submit MCP plugins for review and instruct using a global-residency project.\n- `PLATFORM_CONTEXT=RUMBO_ORG_DEFAULT_PROJECT_CONNECTED_PORTAL_CONTEXT_AND_RESIDENCY_UNVERIFIED`\n- `GITHUB_CURRENT_HEAD=UNVERIFIED_CONNECTOR_DISABLED`\n- `PORTAL_CDP_CURRENT_STATE=NO_REMOTE_DEBUGGING_CHANNEL_AVAILABLE`\n- `MONEY_SPEND=0`\n\nCurrent exact blocker set: domain verification portal status, Apps Management Write, publisher identity, global project data residency, logo portal upload, Scan Tools, distribution scope, and production MCP URL authority. V10 is preserved as historical evidence of an incorrect documentation reconciliation and is superseded by V11.\n\n\n## Evidence addendum — V12 authoritative reconciliation\n\n- `PORTAL_EVIDENCE_RECEIPT_V12=PASS_VERIFIED`\n- `PORTAL_EVIDENCE_V12_SUPERSEDES_V11_OPERATIONALLY`\n- `SUBMISSION_GATE_TECHNICAL_STATE=PASS`\n- `RESPONSE_MINIMIZATION=PASS_ALL_4_TOOLS`\n- `PORTAL_PACKET_VERIFIER=PASS_WITH_V12_LINK`\n- `WORKSPACE_CUSTOM_APP_FLOW=SEPARATE_FROM_PUBLIC_PLUGIN_DIRECTORY`\n- `WORKSPACE_DRAFT_BLOCKERS=3_EXACT` — ChatGPT create-app surface unverified, Scan Tools not executed, draft not created.\n- `PUBLIC_DIRECTORY_READINESS_BLOCKERS=8_EXACT` — domain verification portal status, Apps Management Write, publisher identity, global project data residency, logo portal upload, Scan Tools, distribution scope, and production MCP URL authority.\n- `GLOBAL_PROJECT_DATA_RESIDENCY=CONFIRMED_REQUIRED_FOR_REMOTE_MCP_REVIEW` — current Remote MCP server review requirements explicitly state that EU-residency projects cannot submit MCP plugins for review and instruct using a global-residency project.\n- `DOMAIN_VERIFICATION=CONDITIONAL_PORTAL_REQUIREMENT` — the well-known endpoint is implemented fail-closed; a real token is served only if the portal issues one.\n- `SUBMIT_FOR_REVIEW=NOT_EXECUTED_SEPARATE_FROM_READINESS`\n- `PUBLICATION=NOT_EXECUTED`\n- `GITHUB_CURRENT_HEAD=UNVERIFIED_CONNECTOR_DISABLED`\n- `MONEY_SPEND=0`\n\nV12 is the current operational authority for portal readiness. V9–V11 remain historical evidence only. The prior V10 claim that global project data residency was not documented is retracted; the specific Remote MCP review page controls this requirement.\n\n\n## Evidence addendum — V13 revalidation (2026-09-12)\n\n- `PORTAL_EVIDENCE_RECEIPT_V13=PASS_VERIFIED`\n- `PORTAL_EVIDENCE_V13_SUPERSEDES_V12_OPERATIONALLY`\n- `SUBMISSION_GATE_TECHNICAL_STATE=PASS`\n- `PORTAL_PACKET_VERIFIER=PASS_WITH_V13_LINK`\n- `SUBMISSION_IMPORT_VALIDATOR=PASS`\n- `PUBLIC_DIRECTORY_READINESS_BLOCKERS=8_EXACT_UNCHANGED`\n- `WORKSPACE_DRAFT_BLOCKERS=3_EXACT_UNCHANGED`\n- `ARGENTINA_GENERAL_OPENAI_SERVICE_SUPPORT=CONFIRMED_2026_09_12`\n- `DISTRIBUTION_SCOPE=ARGENTINA_ONLY_RECOMMENDED_NOT_APPLIED`\n- `DESKTOP_QUGVQLB=PING_PASS_2026_09_12`\n- `BRAVE_AND_RUMBO_NEXUS_PROCESSES=ACTIVE_OBSERVED`\n- `PORTAL_CDP_127_0_0_1_9222=CURRENT_PROBE_EXIT_1_NO_BODY`\n- `GITHUB_CURRENT_HEAD=UNVERIFIED_CONNECTOR_DISABLED`\n- `MONEY_SPEND=0`\n\nV13 is the current operational authority for portal-readiness evidence. It does not change the candidate SHA, the exact blocker set, production authority, submission authority, or publication authority. V12 and earlier receipts remain historical evidence only.\n\n\n## Evidence addendum — V14 authoritative correction (2026-09-13)\n\n- `PORTAL_EVIDENCE_V14_SUPERSEDES_V13_OPERATIONALLY`\n- `SUBMISSION_GATE_TECHNICAL_STATE=PASS`\n- `PORTAL_PACKET_CONSTRAINTS=PASS`\n- `STARTER_PROMPTS=3_OF_MAX_3_PASS`\n- `PACKAGE_NAME=rumbo-ia-crm_PASS`\n- `PACKAGE_VERSION=1.0.0_SEMVER_PASS`\n- `CAPABILITIES=4_OF_MAX_20_PASS`\n- `TOOL_ANNOTATION_JUSTIFICATIONS=PASS_12_OF_12`\n- `REVIEW_CASE_SERVER_VALIDATION=PASS_5_POSITIVE_3_NEGATIVE_SURFACE`\n- `REVIEW_CASE_SERVER_VALIDATION_SCOPE=SERVER_SIDE_ONLY_NOT_CHATGPT_TOOL_SELECTION_E2E`\n- `DEMO_RECORDING_PLAN=READY`\n- `DEMO_RECORDING_URL=MISSING_FAIL_CLOSED`\n- `DOMAIN_VERIFICATION=REQUIRED_FOR_FINAL_REMOTE_MCP_SUBMISSION_NOT_COMPLETED`\n- `DOMAIN_CHALLENGE_ENDPOINT=READY_FAIL_CLOSED_NO_TOKEN`\n- `GLOBAL_PROJECT_DATA_RESIDENCY=UNVERIFIED_REQUIRED_FOR_REMOTE_MCP_REVIEW`\n- `STAGING_URL=TECHNICALLY_VALID_FOR_TESTING_NOT_ELIGIBLE_AS_FINAL_PRODUCTION_URL`\n- `PRODUCTION_MCP_URL=NOT_AUTHORIZED`\n- `PUBLIC_DIRECTORY_READINESS_BLOCKERS=9_EXACT`\n- `WORKSPACE_DRAFT_BLOCKERS=3_EXACT`\n- `GOVERNANCE_BLOCKERS=1_GITHUB_CANDIDATE_HEAD_UNRECONCILED`\n- `MONEY_SPEND=0`\n\nCurrent public-directory blocker set: completed domain verification, Apps Management Write, verified publisher identity, global-residency project, portal logo upload, reviewer-accessible demo-recording URL, authorized production MCP URL, successful current Scan Tools snapshot, and distribution scope. Separately, GitHub candidate HEAD remains unreconciled because the GitHub connector is unavailable in this session. The public staging endpoint remains useful for technical validation but must not be represented as the production MCP URL.\n\n## Evidence addendum — V16 authoritative documentation reconciliation (2026-09-13)\n\n- `PORTAL_EVIDENCE_RECEIPT_V16=CREATED_AND_VERIFIED_BY_DEDICATED_VERIFIER`\n- `PORTAL_EVIDENCE_V16_SUPERSEDES_V15_OPERATIONALLY`\n- `SUBMISSION_GATE_TECHNICAL_STATE=PASS`\n- `WORKSPACE_DRAFT_BLOCKERS=3_EXACT` — ChatGPT create-app surface unverified, Scan Tools not executed, draft not created.\n- `PUBLIC_DIRECTORY_READINESS_BLOCKERS=9_EXACT` — domain verification portal status, Apps Management Write, publisher identity, global project data residency, logo portal upload, authorized production MCP URL, Scan Tools, distribution scope, and policy attestations.\n- `GLOBAL_PROJECT_DATA_RESIDENCY=REQUIRED_FOR_REMOTE_MCP_REVIEW` — current official MCP review requirements state that EU-residency projects cannot submit MCP plugins for review and instruct using a global-residency project.\n- `DEMO_RECORDING_REQUIREMENT=RETRACTED` — neither the current public submission flow nor current remote-MCP review requirements lists a demo-recording URL as a mandatory submission field. Demo credentials apply only when authentication is required; screenshots are optional only when UI exists.\n- `TEST_REQUIREMENT=AT_LEAST_5_POSITIVE_3_NEGATIVE`; RUMBO currently provides 5 positive and 3 negative cases.\n- `POLICY_ATTESTATIONS=REQUIRED_BEFORE_SUBMIT_NOT_COMPLETED`\n- `PRODUCTION_MCP_URL=NOT_AUTHORIZED`; the `*-staging.val.run` endpoint remains technical validation only and must not be represented as final production.\n- `GOVERNANCE_BLOCKERS=1_GITHUB_CANDIDATE_HEAD_UNRECONCILED` because the GitHub connector is disabled in this session.\n- `SUBMIT_FOR_REVIEW=NOT_EXECUTED`\n- `PUBLICATION=NOT_EXECUTED`\n- `MONEY_SPEND=0`\n\nV16 is the current operational authority for portal readiness. V15 and earlier receipts remain preserved as historical evidence; their conflicting demo-recording claims are superseded by V16. Technical PASS remains distinct from portal access, global project residency, production-host authority, Scan Tools PASS, submission authority, and publication.\n",[347],"97061af7-50f3-4abb-a2e5-74a46f341dac","README.md","9a613bbc-acf8-11f1-a85c-1607ee4eb77e",12,["D",1789072867612],2,"# RUMBO IA CRM — zero-spend MCP staging\n\nPurpose: clean-room public staging adapter for the bounded RUMBO IA CRM OpenAI candidate.\n\nSource binding:\n- canonical repository: `RUMBO-IA/rumbo-product-runtime`\n- candidate SHA: `9152f5a50de42be55508f0effed5ed09aee44c60`\n- protocol: MCP `2025-06-18`\n- source contract: `lib/openai-plugin/mcp-contract.ts`\n- source HTTP route: `app/api/openai-plugin/mcp/route.ts`\n- source health route: `app/api/openai-plugin/health/route.ts`\n\nThis Val Town implementation is an explicit clean-room adapter of the intended public bounded contract. It is not claimed byte-identical to the private Next.js source tree.\n\nPublic surface is intentionally limited to:\n- `crm_get_service_readiness`\n- `crm_prepare_note`\n- `crm_prepare_lead_stage_change`\n- `crm_prepare_outreach_draft`\n\nSafety/authority boundaries:\n- no customer-data reads\n- no CRM mutations\n- no autonomous message sending\n- proposal outputs require review\n- `side_effect=false`\n- outreach returns `send_authorized=false`\n- `productionAuthority=false`\n- `submissionAuthority=false`\n- no secrets, database, billing integration, or external side-effect service is used\n\nHosting cost for this staging val: `$0` on the existing Val Town Free account.\n\n`STAGING_CONFORMANCE_PASS != PRODUCTION_AUTHORITY != OPENAI_SUBMISSION_AUTHORITY != PUBLICATION`.\n\n\n## OpenAI submission-readiness delta — 2026-09-10\n\nFresh OpenAI submission requirements were reconciled against this host. Remote MCP-only plugins are supported through a stable public HTTPS endpoint; OpenAI does not require Vercel specifically.\n\nCurrent verified host properties:\n- `httpPrivacy=public`\n- fixed endpoint: `https://rumbo-crm-openai-staging.val.run/`\n- exact candidate binding: `9152f5a50de42be55508f0effed5ed09aee44c60`\n- four-tool catalog only\n- every tool advertises `readOnlyHint=true`, `openWorldHint=false`, `destructiveHint=false`\n- `/.well-known/openai-apps-challenge` is implemented fail-closed: 404 while `OPENAI_APPS_CHALLENGE_TOKEN` is unset; when configured it returns only the configured token as `text/plain`\n- complete verifier remains PASS after challenge-route addition\n\nRemaining external/publication gates:\n- obtain the exact domain-verification token from the OpenAI submission portal and configure it without exposing it\n- prove the challenge endpoint returns the exact token\n- decide whether this endpoint is the production submission URL rather than staging-only\n- verify OpenAI Platform Apps Management=Write and matching verified developer/business identity\n- run portal Scan Tools\n- prepare/finalize at least 5 positive and 3 negative reviewer test cases\n- set country/region availability\n- submit only under separate submission authority\n\n`VALTOWN_PROVIDER_COMPATIBILITY=PASS_BY_OPENAI_DOCS`\n`DOMAIN_CHALLENGE_CAPABILITY=IMPLEMENTED_FAIL_CLOSED`\n`TOOL_ANNOTATIONS=PASS_BY_CODE_AND_CONFORMANCE`\n`OPENAI_SUBMISSION=NOT_EXECUTED`\n`MONEY_SPEND=0`\n",[355],"38674ce3-135a-4069-b379-c65f479e2e78","PUBLISHER_SURFACES_RECEIPT.json","f714bb74-ad9b-11f1-89f2-1607ee4eb77e",38,["D",1789102080178],"{\n \"schema\": \"RUMBO_OPENAI_PUBLISHER_SURFACES_RECEIPT_V1\",\n \"observed_at\": \"2026-09-11T04:44:00Z\",\n \"money_spend_usd\": 0,\n \"repository\": \"RUMBO-IA/Rumbo\",\n \"canonical_candidate\": {\n \"pr\": 94,\n \"state\": \"OPEN\",\n \"draft\": true,\n \"mergeable\": true,\n \"base\": \"main\",\n \"base_sha\": \"0ef5f831f6dd89e331364ddd029157f36022f87c\",\n \"head_branch\": \"fix/openai-publisher-surfaces-v1-20260911\",\n \"head_sha\": \"2f6df683e74c018697226d1ed12d3e3990644ecc\"\n },\n \"scope\": [\n \"openai-support.html\",\n \"openai-privacy.html\",\n \"openai-terms.html\",\n \"scripts/test_openai_support_semantics.py\"\n ],\n \"verification\": {\n \"support_semantics_test\": \"PASS_1_OF_1\",\n \"privacy_tests\": \"PASS_18_OF_18\",\n \"semantic_assertions\": \"PASS\",\n \"git_diff_check\": \"PASS\",\n \"codeql_actions\": \"PASS\",\n \"codeql_python\": \"PASS\",\n \"public_privacy_gate\": \"PASS\"\n },\n \"preview\": {\n \"provider\": \"Vercel\",\n \"deployment_id\": \"dpl_EGDe3PXC2Z3tGojqYCurjRWZhVhN\",\n \"state\": \"READY\",\n \"source_repo\": \"RUMBO-IA/Rumbo\",\n \"source_branch\": \"fix/openai-publisher-surfaces-v1-20260911\",\n \"source_sha\": \"2f6df683e74c018697226d1ed12d3e3990644ecc\",\n \"body_readback\": \"NOT_PROVEN_BY_AVAILABLE_SSO_FETCH_SURFACE\"\n },\n \"live_custom_domain\": {\n \"support_http\": 200,\n \"support_semantics\": \"FAIL_NOT_PROMOTED\",\n \"privacy_http\": 200,\n \"privacy_mcp_disclosure\": \"FAIL_NOT_PROMOTED\",\n \"terms_http\": 200\n },\n \"supersedes_after_review\": [83, 88],\n \"authority\": {\n \"merge\": \"NOT_GRANTED\",\n \"production_deploy\": \"NOT_GRANTED\",\n \"openai_submission\": \"NOT_GRANTED\",\n \"publication\": \"NOT_GRANTED\"\n },\n \"invariant\": \"BRANCH_PASS != LIVE_PROMOTION != OPENAI_SUBMISSION != PUBLICATION\"\n}",[363],"69c40034-bb11-4657-8217-986e5aab45f5","PUBLISHER_POLICY_DELTA.md","7ac37432-ad5c-11f1-814e-1607ee4eb77e",26,["D",1789074813327],"# RUMBO IA CRM — publisher policy delta for OpenAI review\n\nDate: 2026-09-10 UTC\nCandidate SHA: `9152f5a50de42be55508f0effed5ed09aee44c60`\nStatus: PREPARED_ONLY — NOT PROMOTED TO LIVE PUBLISHER SITE\n\n## Why this delta is required\n\nOpenAI's remote MCP review requires public website, support, privacy, and terms URLs that match the publisher, and the privacy policy must cover user-related data the MCP processes or returns. Fresh external readback shows all four configured URLs return HTTP 200, but `/openai-support` still serves generic RUMBO IA marketing content and `/openai-privacy` describes only website/contact processing. Neither is sufficient evidence for the bounded MCP surface.\n\n## Required support-page semantics\n\nThe live `/openai-support` page should identify itself as **RUMBO IA CRM Support** and state, in substance:\n\n- It supports the RUMBO IA CRM plugin for OpenAI/ChatGPT.\n- Public v1 exposes exactly four bounded tools: service readiness, note proposal preparation, lead-stage-change proposal preparation, and outreach-draft request preparation.\n- Tool outputs are proposals or readiness metadata only; proposal outputs remain `REVIEW_REQUIRED` and `side_effect=false`.\n- The plugin does not expose customer-data search/retrieval, CRM writes, autonomous sends, production authority, or submission authority.\n- Users should not place passwords, API keys, access tokens, or unnecessary sensitive/customer data in tool inputs.\n- Support contact: `sebastian@rumbo.verso.fans`.\n- Link visibly to the OpenAI-specific privacy and terms pages.\n\n## Required privacy-page disclosure\n\nThe live `/openai-privacy` page should disclose the actual bounded MCP data flow. A suitable minimum disclosure is:\n\n### RUMBO IA CRM plugin privacy notice\n\nRUMBO IA CRM provides a bounded MCP integration for OpenAI/ChatGPT. Public v1 does not search or retrieve customer records from a CRM and does not perform CRM mutations or send messages.\n\nWhen a user asks the plugin to prepare a proposal, the MCP service may process the information the user supplies for that request. Depending on the selected tool, this can include workspace or subject/lead identifiers, note text, stage labels, an optional reason, a communication channel, and an outreach objective. The service returns that supplied information as part of a reviewable proposal or returns bounded service-readiness metadata.\n\nThe current public v1 does not intentionally persist those tool inputs to a CRM or application database, does not use them to autonomously contact third parties, and does not sell them. Users should avoid submitting passwords, API keys, access tokens, or personal/customer information that is not necessary for the requested proposal.\n\nRequests are delivered through OpenAI/ChatGPT and the MCP hosting infrastructure. Hosting and network providers may process ordinary technical information such as IP address, browser/client metadata, request timing, and service logs for security and operation according to their own applicable terms and policies.\n\nFor privacy requests or questions about RUMBO IA CRM, contact `sebastian@rumbo.verso.fans`.\n\n## Terms status\n\nFresh readback of `/openai-terms` is HTTP 200 and identifies RUMBO IA, but the final publisher review should confirm that the selected verified publisher identity matches the name/contact/website used across the listing and policies.\n\n## Promotion gate\n\nThis document is a handoff artifact only. It does not authorize a production-site change, merge, publication, submission, or policy attestation.\n\n`POLICY_SOURCE_PREPARED != LIVE_POLICY_PROMOTED != VERIFIED_PUBLISHER != SUBMISSION_AUTHORITY`\n",[370],"01dfd9e7-4e8e-42a2-9e35-c9f9e9b526c5","PRODUCTION_MCP_PROMOTION_PLAN.md","ed2ea4a4-ade5-11f1-a12a-1607ee4eb77e",161,["D",1789133846302],"# RUMBO IA CRM — production MCP promotion plan\n\nDate: 2026-09-11 UTC\nBudget: USD 0\nCandidate SHA: `9152f5a50de42be55508f0effed5ed09aee44c60`\n\n## Goal\n\nPrepare a stable public production MCP URL without changing the four-tool contract or granting submission/publication authority.\n\n## Preconditions\n\n1. Separate explicit production-host authority.\n2. Preserve the exact bounded four-tool surface and MCP `2025-06-18` behavior.\n3. Preserve `productionAuthority=false` and `submissionAuthority=false` until separately authorized.\n4. Production host must expose the same support/privacy/terms/logo surfaces and conditional OpenAI domain-challenge endpoint.\n5. Run the full `verify.ts`, `submission_gate.ts`, `validate_submission_import.ts`, and portal packet verifier against the promoted endpoint.\n6. Bind the production host to the same candidate SHA or a separately re-certified successor SHA.\n7. Do not spend money or enable paid infrastructure.\n\n## Proposed zero-cost naming\n\nPreferred production identity: a stable Val Town host that does not contain `staging`, for example `rumbo-crm-openai.val.run`, if the name is available and production promotion is explicitly authorized.\n\nThe exact URL is a proposal only and has not been claimed or deployed by this artifact.\n\n## Promotion acceptance\n\n- Public HTTPS reachable from outside private networks.\n- `health.sourceSha` matches the authorized candidate.\n- Four and only four public tools.\n- Exact annotations and output schemas.\n- Policy surfaces HTTP 200 and semantically aligned.\n- Logo hash matches the canonical asset.\n- Challenge endpoint remains fail-closed until a real portal token exists.\n- All local conformance and submission validators PASS.\n\n## Authority boundary\n\n`PRODUCTION_PROMOTION_PLAN_READY != PRODUCTION_HOST_AUTHORITY != OPENAI_SUBMISSION_AUTHORITY != PUBLICATION`\n",[377],"142711d8-f447-4db2-95d2-45f1c7197ffc","PRIVACY_FIELD_MATRIX.md","8797105a-ade4-11f1-b97e-1607ee4eb77e",154,["D",1789133246408],"# RUMBO IA CRM — MCP privacy field matrix\n\nDate: 2026-09-11 UTC\nCandidate SHA: `9152f5a50de42be55508f0effed5ed09aee44c60`\n\nPurpose: enumerate every user-related field accepted or returned by the bounded public MCP v1 and map it to the published host-local privacy disclosure. This artifact is for submission/review preparation; it does not grant production or submission authority.\n\n## Global behavior\n\n- The public v1 does **not** search, retrieve, or enumerate customer records.\n- The public v1 does **not** mutate CRM data.\n- The public v1 does **not** send messages.\n- Identifiers are supplied explicitly by the user/requesting client; they are not looked up and echoed by default.\n- Tool responses contain no passwords, API keys, access tokens, cookies, auth headers, trace IDs, request IDs, session IDs, timestamps, logs, billing data, health data, or payment data.\n- Proposal tools return only the fields needed to identify and review the proposal the user explicitly requested.\n\n## `crm_get_service_readiness`\n\nInputs: none.\n\nOutputs:\n- `state` — bounded contract state; operational metadata, not user data.\n- `customer_data_tools_exposed` — boolean safety/readiness metadata.\n- `mutating_tools_exposed` — boolean safety/readiness metadata.\n- `production_authority` — boolean authority metadata.\n- `submission_authority` — boolean authority metadata.\n\nUser-related data returned: none.\n\n## `crm_prepare_note`\n\nInputs and echoed outputs:\n- `workspace_id` — explicit user-supplied workspace identifier; required to bind the proposal to the intended workspace.\n- `subject_id` — explicit user-supplied subject/lead identifier; required to bind the proposal to the intended subject.\n- `note` — explicit user-supplied note text; required because the tool only packages the requested note as a reviewable proposal.\n\nGenerated output metadata:\n- `kind=crm_note_proposal`\n- `state=REVIEW_REQUIRED`\n- `side_effect=false`\n\nPrivacy disclosure mapping: `/privacy` explicitly discloses workspace identifiers, subject or lead identifiers, and note text.\n\n## `crm_prepare_lead_stage_change`\n\nInputs and echoed outputs:\n- `workspace_id` — explicit user-supplied workspace identifier.\n- `lead_id` — explicit user-supplied lead identifier.\n- `from_stage` — explicit current-stage label supplied for the requested proposal.\n- `to_stage` — explicit proposed-stage label supplied for the requested proposal.\n- `reason` — optional user-supplied reason; empty when omitted.\n\nGenerated output metadata:\n- `kind=lead_stage_change_proposal`\n- `state=REVIEW_REQUIRED`\n- `side_effect=false`\n\nPrivacy disclosure mapping: `/privacy` explicitly discloses workspace identifiers, lead identifiers, current/proposed stage names, and a reason.\n\n## `crm_prepare_outreach_draft`\n\nInputs and echoed outputs:\n- `workspace_id` — explicit user-supplied workspace identifier.\n- `lead_id` — explicit user-supplied lead identifier.\n- `channel` — explicit communication-channel label (`email`, `sms`, `whatsapp`, or `other`).\n- `objective` — explicit user-supplied outreach objective.\n\nGenerated output metadata:\n- `kind=outreach_draft_request`\n- `state=REVIEW_REQUIRED`\n- `side_effect=false`\n- `send_authorized=false`\n\nPrivacy disclosure mapping: `/privacy` explicitly discloses workspace identifiers, lead identifiers, communication channel, and outreach objective.\n\n## Data minimization conclusion\n\n`PRIVACY_FIELD_MATRIX=PASS_BOUNDED_EXPLICIT_INPUTS_ONLY`\n\nThe bounded v1 intentionally exposes no customer-data retrieval tool. Every identifier returned by proposal tools was explicitly supplied for the user's requested proposal and is directly tied to that request. No additional personal or internal telemetry fields are added to MCP tool results.\n\nInvariant: `PRIVACY_DISCLOSURE_PASS != PUBLISHER_IDENTITY_VERIFIED != PORTAL_SCAN_PASS != SUBMISSION_AUTHORITY`.\n",[384],"ec50ce99-efaf-4b2f-ab51-57ec209b9d52","PORTAL_PACKET.json","0ad9949a-ad5b-11f1-928e-1607ee4eb77e",248,["D",1789335826268],47,"{\n \"schema\": \"RUMBO_OPENAI_PLUGIN_PORTAL_PACKET_V1\",\n \"generated_at\": \"2026-09-11\",\n \"budget_usd\": 0,\n \"candidate_sha\": \"9152f5a50de42be55508f0effed5ed09aee44c60\",\n \"directory_package\": {\n \"package_name\": \"rumbo-ia-crm\",\n \"version\": \"1.0.0\",\n \"developer_name_candidate\": \"RUMBO IA\",\n \"developer_name_status\": \"REQUIRES_VERIFIED_BUSINESS_IDENTITY\",\n \"capabilities\": [\n \"Prepare reviewable CRM notes\",\n \"Prepare lead-stage change proposals\",\n \"Prepare outreach draft requests\",\n \"Check bounded CRM service readiness\"\n ]\n },\n \"submission_type\": \"WITH_MCP_REMOTE_MCP_ONLY\",\n \"mcp_url_type\": \"UNIVERSAL\",\n \"mcp_url_candidate\": \"https://rumbo-crm-openai-staging.val.run/api/openai-plugin/mcp\",\n \"production_mcp_url\": null,\n \"production_mcp_url_status\": \"NOT_AUTHORIZED_FAIL_CLOSED\",\n \"production_mcp_promotion_plan\": \"PRODUCTION_MCP_PROMOTION_PLAN.md\",\n \"authentication\": \"NONE\",\n \"reviewer_credentials\": \"NOT_APPLICABLE\",\n \"custom_ui\": false,\n \"content_security_policy\": \"NOT_APPLICABLE_NO_UI\",\n \"listing\": {\n \"name\": \"RUMBO IA CRM\",\n \"category\": \"Productivity\",\n \"short_description\": \"Prepare reviewable CRM notes, lead-stage changes, outreach drafts, and service-readiness checks without customer-data reads or autonomous side effects.\",\n \"long_description\": \"RUMBO IA CRM is a bounded, human-controlled CRM assistant. Its public v1 exposes four tools: service readiness, note proposal preparation, lead-stage-change proposal preparation, and outreach-draft request preparation. It does not expose customer-data search or retrieval, CRM mutation, autonomous message sending, production authority, or submission authority. Proposal outputs remain REVIEW_REQUIRED with side_effect=false.\",\n \"website_url\": \"https://rumbo.verso.fans/\",\n \"support_url\": \"https://rumbo-crm-openai-staging.val.run/support\",\n \"support_live_status\": \"HTTP_200_MCP_SEMANTICS_PASS_SELF_HOSTED\",\n \"privacy_url\": \"https://rumbo-crm-openai-staging.val.run/privacy\",\n \"privacy_live_status\": \"HTTP_200_MCP_DISCLOSURE_PASS_SELF_HOSTED\",\n \"terms_url\": \"https://rumbo-crm-openai-staging.val.run/terms\",\n \"terms_live_status\": \"HTTP_200_BOUNDED_TERMS_PASS_SELF_HOSTED\",\n \"policy_urls_http_public\": true,\n \"policy_urls_submission_semantics_ready\": true,\n \"logo\": {\n \"source_repo\": \"RUMBO-IA/Rumbo\",\n \"source_ref\": \"main@293a6f33b8901e24089b95a4918488660c0e33d4\",\n \"source_path\": \"openai-publication/agent-reliability/plugin/assets/logo.svg\",\n \"self_hosted_url\": \"https://rumbo-crm-openai-staging.val.run/logo.svg\",\n \"sha256\": \"3ac48eb17d735ee41d12e6edf0cc0ea0e5a55358cce6b5fd37d93b3fc0372205\",\n \"viewBox\": \"0 0 512 512\",\n \"aria_label\": \"RUMBO IA\"\n },\n \"logo_status\": \"CANONICAL_REMOTE_MAIN_VERIFIED_SELF_HOSTED_NOT_UPLOADED\"\n },\n \"starter_prompts\": [\n \"Prepare a reviewable CRM note for a lead without writing anything to the CRM.\",\n \"Prepare a lead-stage change proposal and keep it pending human review.\",\n \"Prepare a WhatsApp outreach draft request for a lead, but do not send it.\"\n ],\n \"tests\": {\n \"positive\": 5,\n \"negative\": 3,\n \"artifact\": \"SUBMISSION_TESTS.md\",\n \"server_validation\": \"review_case_server_validation.ts\",\n \"server_validation_status\": \"PASS_5_POSITIVE_3_NEGATIVE_SURFACE\",\n \"server_validation_scope\": \"SERVER_SIDE_ONLY_NOT_CHATGPT_TOOL_SELECTION_E2E\"\n },\n \"review_materials\": {\n \"demo_recording_url\": null,\n \"demo_recording_status\": \"NOT_REQUIRED_BY_CURRENT_OFFICIAL_SUBMISSION_OR_MCP_REVIEW_DOCS\",\n \"screenshots\": \"NOT_APPLICABLE_NO_UI\",\n \"annotation_justifications\": \"PASS_12_OF_12_VALIDATED\"\n },\n \"submission_import\": {\n \"artifact\": \"chatgpt-app-submission.json\",\n \"schema\": \"https://developers.openai.com/apps-sdk/schemas/chatgpt-app-submission.v1.json\",\n \"review_checks\": \"SUBMISSION_REVIEW_CHECKS.md\",\n \"official_requirements_snapshot\": \"OFFICIAL_SUBMISSION_REQUIREMENTS_2026-09-13.md\",\n \"openai_submission_skill_audit\": \"OPENAI_SUBMISSION_SKILL_AUDIT_2026-09-11.md\",\n \"runtime_validator\": \"validate_submission_import.ts\",\n \"runtime_validator_status\": \"PASS_WITH_ANNOTATION_JUSTIFICATIONS\",\n \"portal_evidence_receipt\": \"PORTAL_EVIDENCE_RECEIPT_V16.json\",\n \"portal_evidence_verifier\": \"verify_portal_evidence_v16.ts\",\n \"portal_evidence_status\": \"V16_CURRENT_9_PUBLIC_BLOCKERS_3_WORKSPACE_BLOCKERS_1_GOVERNANCE_BLOCKER\",\n \"privacy_field_matrix\": \"PRIVACY_FIELD_MATRIX.md\",\n \"privacy_field_matrix_status\": \"PASS_BOUNDED_EXPLICIT_INPUTS_ONLY\",\n \"status\": \"READY_VALIDATED_NOT_UPLOADED\"\n },\n \"tool_contract\": {\n \"count\": 4,\n \"readOnlyHint\": true,\n \"openWorldHint\": false,\n \"destructiveHint\": false,\n \"customer_data_reads_exposed\": false,\n \"crm_mutations_exposed\": false,\n \"autonomous_sends_exposed\": false\n },\n \"domain_verification\": {\n \"challenge_path\": \"/.well-known/openai-apps-challenge\",\n \"capability\": \"IMPLEMENTED_FAIL_CLOSED\",\n \"token\": null,\n \"status\": \"NOT_EXECUTED\"\n },\n \"release_notes\": \"Initial public-review candidate for RUMBO IA CRM. The remote MCP surface is intentionally bounded to four proposal/readiness tools, uses MCP 2025-06-18, exposes no customer-data reads or CRM mutations, performs no autonomous sends, and keeps production/submission authority disabled. Synthetic reviewer fixtures are included; no authentication is required for this bounded v1.\",\n \"availability\": {\n \"countries_or_regions\": [],\n \"status\": \"UNSET_FAIL_CLOSED\",\n \"recommendation_artifact\": \"DISTRIBUTION_RECOMMENDATION.md\",\n \"recommended_initial_scope\": \"ARGENTINA_ONLY_NOT_APPLIED\"\n },\n \"portal_access\": {\n \"workspace_custom_app_path\": \"SEPARATE_FROM_PUBLIC_DIRECTORY_SUBMISSION\",\n \"public_directory_submission_path\": \"OPENAI_PLATFORM_PLUGIN_SUBMISSION_PORTAL\",\n \"cdp_listener\": \"PASS_127_0_0_1_9222_RUMBONEXUS\",\n \"platform_session\": \"LOGIN_REQUIRED\",\n \"platform_page_observed\": \"https://platform.openai.com/login?next=%2Fplugins\",\n \"automation_boundary\": \"NO_COOKIE_OR_CREDENTIAL_EXTRACTION\"\n },\n \"publisher\": {\n \"developer_or_business_identity\": null,\n \"identity_status\": \"REQUIRED_BY_PUBLIC_SUBMISSION_DOCS_UNVERIFIED\",\n \"apps_management_write\": \"REQUIRED_API_APPS_WRITE_UNVERIFIED\",\n \"platform_context\": \"RUMBO_ORG_DEFAULT_PROJECT_CONNECTED_PORTAL_CONTEXT_UNVERIFIED\",\n \"project_data_residency\": \"UNVERIFIED_REQUIRES_GLOBAL_FOR_REMOTE_MCP_REVIEW\"\n },\n \"publisher_surfaces_candidate\": {\n \"pr\": 94,\n \"head_sha\": \"08e0457569d734518569133709d97592e320fd42\",\n \"base_reconciled_sha\": \"b8f2287b0e891d1634526e1a033fa4e2ce833d33\",\n \"branch\": \"fix/openai-publisher-surfaces-v1-20260911\",\n \"draft\": true,\n \"merge_state\": \"BEHIND_AFTER_RECONCILE_DUE_CONCURRENT_MAIN\",\n \"support_test\": \"PASS_1_OF_1\",\n \"privacy_tests\": \"PASS_18_OF_18\",\n \"brand_contract\": \"PASS_19_OF_19_PLUS_VERIFIER\",\n \"diff_check\": \"PASS\",\n \"codeql\": \"PASS_NEW_HEAD\",\n \"vercel_deployment\": \"READY_SOURCE_BOUND\",\n \"vercel_deployment_id\": \"dpl_DPREtpZhVSwkwY2e3Po29FYk68UH\",\n \"vercel_deployment_sha\": \"08e0457569d734518569133709d97592e320fd42\",\n \"preview_support_semantics\": \"PASS\",\n \"preview_privacy_semantics\": \"PASS\",\n \"preview_terms_semantics\": \"PASS\",\n \"preview_body_readback\": \"PASS_ROOT_SHARE_COOKIE_FLOW\",\n \"live_semantics\": \"FAIL_NOT_PROMOTED\",\n \"supersedes_after_review\": [83, 88]\n },\n \"scan_tools\": {\n \"status\": \"NOT_EXECUTED\",\n \"snapshot\": null\n },\n \"submission\": {\n \"policy_attestations\": \"NOT_COMPLETED\",\n \"submit_for_review\": \"NOT_EXECUTED\",\n \"publication\": \"NOT_EXECUTED\"\n },\n \"invariant\": \"TECHNICAL_PASS != PORTAL_ACCESS != PRODUCTION_HOST_AUTHORITY != PORTAL_METADATA_COMPLETE != SCAN_TOOLS_PASS != SUBMISSION_AUTHORITY != PUBLICATION\"\n}",[391],"ab81246c-c07a-4d2b-93e4-b13b5b6d2164","PORTAL_LOGO.svg","bc6341dc-ada3-11f1-95b6-1607ee4eb77e",49,["D",1789105417674],"\n",[399],"4d59d9e7-5b74-42cf-bcfe-f25986d72154","PORTAL_EXECUTION_RUNBOOK.md","eb037be6-ada4-11f1-93c1-1607ee4eb77e",128,["D",1789121843333],6,"# RUMBO IA CRM — OpenAI Plugin Submission Portal Runbook\n\nDate: 2026-09-11 UTC\nBudget invariant: `MONEY_SPEND=0`\nSubmission authority: `NOT_GRANTED`\nPublication authority: `NOT_GRANTED`\n\nSource of truth:\n- Candidate SHA: `9152f5a50de42be55508f0effed5ed09aee44c60`\n- OpenAI organization: `Rumbo`\n- Connected project: `Default project`\n- Submission portal: `https://platform.openai.com/plugins`\n- Submission type: `With MCP`\n- MCP URL type: `Universal`\n\n## Gate 0 — do not start submission until these are proven\n\n1. The acting account is signed into the OpenAI Platform organization that owns the submission and has `Apps Management: Write`. Organization owners already have this permission; non-owner submitters require an assigned role with Write.\n2. A verified individual or business identity exists in the same OpenAI Platform organization/project and matches the public RUMBO IA listing, website, support, privacy, and terms.\n3. The selected OpenAI Platform project is proven to use `GLOBAL` data residency. Current MCP review requirements state that EU-residency projects cannot submit MCP plugins for review.\n4. A production MCP URL has been explicitly authorized. The current `rumbo-crm-openai-staging.val.run` endpoint remains a technically verified staging/review candidate and must not be represented as production without separate authority.\n\n## Info tab\n\nUse `PORTAL_PACKET.json` as the source of truth.\n\n- Name: `RUMBO IA CRM`\n- Category: `PRODUCTIVITY`\n- Short/long descriptions: copy from `PORTAL_PACKET.json`.\n- Website: `https://rumbo.verso.fans/` — use the publisher-facing corporate website from `PORTAL_PACKET.json`; support/privacy/terms remain the self-hosted Val URLs because those exact pages currently pass the MCP disclosure gates.\n- Support: `https://rumbo-crm-openai-staging.val.run/support`\n- Privacy: `https://rumbo-crm-openai-staging.val.run/privacy`\n- Terms: `https://rumbo-crm-openai-staging.val.run/terms`\n- Logo asset: `PORTAL_LOGO.svg`, SHA-256 `3ac48eb17d735ee41d12e6edf0cc0ea0e5a55358cce6b5fd37d93b3fc0372205`.\n- Developer Identity: select only a verified identity that matches the public listing.\n\n## MCP tab\n\n1. Select `Universal`.\n2. Enter the **authorized production** MCP URL. Do not submit the current staging hostname as production until that promotion is explicitly authorized.\n3. Authentication: `None` for the current bounded public v1.\n4. Custom UI: none; CSP is not applicable because this v1 exposes no UI resources.\n5. If the portal displays `Domain not verified`, copy the exact generated token into the Val Town environment variable `OPENAI_APPS_CHALLENGE_TOKEN` without exposing it in chat or source control.\n6. Verify the challenge returns only the exact token at `/.well-known/openai-apps-challenge`.\n7. Select `Scan Tools`.\n8. Require the scan to discover exactly these four tools:\n - `crm_get_service_readiness`\n - `crm_prepare_note`\n - `crm_prepare_lead_stage_change`\n - `crm_prepare_outreach_draft`\n9. Verify each scanned tool advertises `readOnlyHint=true`, `openWorldHint=false`, `destructiveHint=false`, accurate input/output schemas, and no unexpected tools/resources.\n10. If Scan Tools reports drift, stop, fix the server, rerun local gates, and scan again. Do not override a server-side annotation mismatch with portal prose.\n\n## Prompts and tests\n\n- Starter prompts: copy the four prompts from `PORTAL_PACKET.json`.\n- Submission import artifact: `chatgpt-app-submission.json` (`READY_VALIDATED_NOT_UPLOADED`). If the portal offers JSON import, upload it; otherwise copy its fields manually.\n- Positive tests: exactly 5.\n- Negative tests: exactly 3.\n- Review checks: `SUBMISSION_REVIEW_CHECKS.md`.\n- No reviewer credentials are required because authentication is `None`.\n- Do not provide UI screenshots because this v1 has no custom UI.\n\n## Global availability\n\nSelect only countries/regions that are explicitly approved for launch and for which product support and legal terms are ready. Current state is `UNSET_FAIL_CLOSED`; do not infer a distribution scope automatically.\n\n## Release notes\n\nUse the initial-submission release note from `PORTAL_PACKET.json`. Confirm that it states the bounded proposal-only surface, no customer-data reads, no CRM mutations, no autonomous sends, and no authentication requirement.\n\n## Hard stop before review\n\nBefore selecting `Submit for Review`, rerun:\n\n- `verify.ts`\n- `verify_submission_import.ts`\n- `verify_portal_packet.ts`\n- `verify_portal_evidence_v6.ts`\n- `submission_gate.ts`\n\nProceed only when `submission_gate.ts` reports no technical or portal-state blockers and separate submission authority has been granted.\n\n`TECHNICAL_PASS != PORTAL_PASS != SUBMISSION_AUTHORITY != PUBLICATION`\n\nAfter approval, publication is a separate action and remains unauthorized until explicitly granted.\n",[406],"69b82d4c-1e83-424a-8076-9f6f0e03d193","PORTAL_EXECUTION_HANDOFF.md","deab7d64-ad5c-11f1-a2a7-1607ee4eb77e",251,["D",1789335909285],15,"# RUMBO IA CRM — OpenAI Apps Management execution handoff\n\nDate: 2026-09-13 UTC — V16 requirements\nBudget: USD 0\nCandidate SHA: `9152f5a50de42be55508f0effed5ed09aee44c60`\nStatus: PRE-SUBMISSION HANDOFF ONLY — DO NOT SUBMIT OR PUBLISH\nCurrent portal session: `LOGIN_REQUIRED` in the instrumented RumboNexus Brave profile; no cookie, localStorage, or credential extraction is permitted.\n\n## Entry conditions\n\nBefore entering data, confirm in OpenAI Platform/Apps Management:\n\n1. Sign in to the public plugin submission flow at `https://platform.openai.com/plugins` in the OpenAI Platform organization that owns RUMBO IA, and confirm the acting account has `Apps Management: Write` (organization owners already have it).\n2. Confirm a verified individual or business identity exists in that same organization/project and matches the public RUMBO IA listing, website, support, privacy, and terms.\n3. Confirm the selected OpenAI Platform project uses `GLOBAL` data residency. Current MCP review requirements state that EU-residency projects cannot submit MCP plugins for review.\n4. Live support, privacy, and terms surfaces pass `submission_gate.ts`. Current Val Town surfaces are PASS and use the same candidate SHA.\n5. The canonical RUMBO IA logo asset is hash-verified; portal upload remains unexecuted.\n6. A production MCP URL/origin has been explicitly authorized. Do not submit the current URL merely because the staging adapter passes conformance.\n\n## Draft configuration\n\nSubmission type: remote MCP-only / With MCP\nMCP URL mode: Universal\nAuthentication: None\nCustom UI: None\nReviewer credentials: Not applicable for bounded public v1\n\nUse the exact listing and release-note fields from `PORTAL_PACKET.json` after its fail-closed fields have been resolved.\nUse exactly the three starter prompts in `PORTAL_PACKET.json`; do not add a fourth prompt.\nUse the current 5 positive and 3 negative reviewer cases from `SUBMISSION_TESTS.md`; they satisfy the current minimum requirement of at least 5 positive and 3 negative cases.\nA demo-recording URL is not a mandatory field in the current public submission or remote-MCP review documentation; do not block submission readiness on the historical `DEMO_RECORDING_PLAN.md` artifact.\n\n## Domain verification\n\nWhen Apps Management supplies the exact domain challenge token:\n\n1. Add it to the Val Town project as `OPENAI_APPS_CHALLENGE_TOKEN` using the secret/environment-variable mechanism; do not place it in source or chat logs.\n2. Verify `GET /.well-known/openai-apps-challenge` returns HTTP 200 with **only** the exact token as plaintext.\n3. Run `verify.ts` and `submission_gate.ts` again.\n4. Do not continue if either fails.\n\n## Scan Tools\n\nRun **Scan Tools** in Apps Management against the authorized production MCP URL.\nReview every discovered tool and confirm the catalog contains exactly:\n\n- `crm_get_service_readiness`\n- `crm_prepare_note`\n- `crm_prepare_lead_stage_change`\n- `crm_prepare_outreach_draft`\n\nFor each discovered tool confirm:\n\n- `readOnlyHint=true`\n- `openWorldHint=false`\n- `destructiveHint=false`\n- schema matches the bounded contract\n- no unplanned customer-data or mutating tool appears\n- no unnecessary personal data, secret, debug field, or internal identifier is returned\n\nIf the scanned catalog differs, stop and reconcile source/host before continuing.\n\n## Availability and review packet\n\nSelect only countries/regions where the publisher, product, support and legal terms are actually ready. Do not infer worldwide availability from technical reachability.\n\nEnter the starter prompts and release notes from `PORTAL_PACKET.json` and the reviewer test cases from `SUBMISSION_TESTS.md`.\n\n## Final pre-submit return gate\n\nBefore pressing **Submit for Review**, return the portal evidence to the control plane and update these fields:\n\n- `APPS_MANAGEMENT_WRITE=PASS`\n- `PUBLISHER_IDENTITY=PASS_VERIFIED_AND_MATCHED`\n- `PROJECT_DATA_RESIDENCY=PASS_GLOBAL`\n- `LOGO_ASSET=PASS`\n- `LOGO_PORTAL_UPLOAD=PASS`\n- `SUPPORT_MCP_SEMANTICS=PASS`\n- `PRIVACY_MCP_DISCLOSURE=PASS`\n- `TERMS_BOUNDED_SEMANTICS=PASS`\n- `DOMAIN_VERIFICATION=PASS_COMPLETED`\n- `SCAN_TOOLS=PASS_EXACT_FOUR_TOOLS_CURRENT_PRODUCTION_SNAPSHOT`\n- `STARTER_PROMPTS=PASS_PACKET_CONSTRAINTS`\n- `DISTRIBUTION_SCOPE=SET_EXPLICITLY`\n- `POLICY_ATTESTATIONS=COMPLETED_AFTER_FINAL_REVIEW`\n- `PRODUCTION_MCP_URL=AUTHORIZED_AND_PROVEN`\n\nThen rerun `submission_gate.ts`, `verify_portal_packet.ts`, `validate_submission_import.ts`, `review_case_server_validation.ts`, and `verify_portal_evidence_v16.ts`.\n\nOnly `public_directory_state=READY_TO_SUBMIT` with no technical or governance failures may establish technical submission readiness. It still does **not** grant authority to submit or publish.\n\n`SUBMISSION_GATE_PASS != SUBMISSION_AUTHORITY != REVIEW_APPROVAL != PUBLICATION_AUTHORITY`\n",[414],"ae3e6baa-39e9-474b-9043-83581a94cbb7","PORTAL_EVIDENCE_RECEIPT_V9.json","10cfe798-ade5-11f1-bb4a-1607ee4eb77e",157,["D",1789133476626],"{\n \"schema\": \"RUMBO_OPENAI_PORTAL_EVIDENCE_RECEIPT_V9\",\n \"date_utc\": \"2026-09-11\",\n \"budget_usd\": 0,\n \"supersedes_operationally\": \"PORTAL_EVIDENCE_RECEIPT_V8.json\",\n \"candidate_sha_bound_in_staging\": \"9152f5a50de42be55508f0effed5ed09aee44c60\",\n \"github_current_head\": \"UNVERIFIED_CONNECTOR_DISABLED\",\n \"technical\": {\n \"mcp_conformance\": \"PASS_18_CHECKS\",\n \"submission_gate_runtime\": \"PASS_TECHNICAL_BLOCKED_PORTAL_8_EXACT_BLOCKERS\",\n \"submission_import\": \"PASS_4_TOOLS_5_POSITIVE_3_NEGATIVE\",\n \"submission_import_runtime_validator\": \"PASS_WITH_12_ANNOTATION_JUSTIFICATIONS\",\n \"privacy_field_matrix\": \"PASS_BOUNDED_EXPLICIT_INPUTS_ONLY\",\n \"live_output_schema\": \"PASS_ALL_FOUR\",\n \"tool_annotations\": \"PASS_ALL_FOUR\",\n \"listing_urls\": \"PASS_ALL_HTTP_200_SELF_HOSTED\",\n \"support_mcp_semantics\": \"PASS_SELF_HOSTED\",\n \"privacy_mcp_disclosure\": \"PASS_SELF_HOSTED\",\n \"terms_bounded_semantics\": \"PASS_SELF_HOSTED\",\n \"logo_exact_asset\": \"PASS_SHA256_3ac48eb17d735ee41d12e6edf0cc0ea0e5a55358cce6b5fd37d93b3fc0372205\",\n \"portal_packet_verifier\": \"PASS_AFTER_CANONICAL_MARKER_RECONCILIATION\"\n },\n \"official_requirements\": {\n \"submission_doc\": \"https://developers.openai.com/plugins/deploy/submission\",\n \"remote_mcp_review_doc\": \"https://developers.openai.com/plugins/deploy/app-review\",\n \"api_apps_write\": \"REQUIRED\",\n \"verified_publisher_identity\": \"REQUIRED\",\n \"global_data_residency_for_remote_mcp_review\": \"REQUIRED_CURRENTLY_EU_PROJECTS_INELIGIBLE\",\n \"public_non_testing_mcp_endpoint\": \"REQUIRED\",\n \"domain_verification\": \"CONDITIONAL_WHEN_PORTAL_SHOWS_DOMAIN_NOT_VERIFIED\",\n \"scan_tools\": \"REQUIRED\",\n \"availability_scope\": \"REQUIRED\",\n \"production_mcp_url\": \"REQUIRED_FOR_UNIVERSAL_REMOTE_MCP\",\n \"logo\": \"PRODUCTION_READY_REQUIRED\",\n \"positive_tests\": 5,\n \"negative_tests\": 3,\n \"tool_annotation_justifications\": \"REQUIRED_FOR_REVIEW_PACKET\",\n \"privacy_response_hygiene\": \"REQUIRED\"\n },\n \"portal_observation\": {\n \"platform_page_last_proven\": \"LOGIN_REQUIRED_FROM_PRIOR_RECEIPT_NOT_REPROVEN_THIS_TURN\",\n \"credential_boundary\": \"NO_COOKIE_LOCALSTORAGE_OR_CREDENTIAL_EXTRACTION\",\n \"openai_platform_org\": \"Rumbo\",\n \"openai_platform_project\": \"Default project\",\n \"project_data_residency\": \"UNVERIFIED\",\n \"apps_management_write\": \"UNVERIFIED\",\n \"publisher_identity\": \"UNVERIFIED\",\n \"scan_tools\": \"NOT_EXECUTED\",\n \"distribution_scope\": \"UNSET_FAIL_CLOSED\"\n },\n \"current_blockers\": [\n \"domain_verification_portal_status_unverified\",\n \"apps_management_write_unverified\",\n \"publisher_identity_unverified\",\n \"global_data_residency_unverified\",\n \"logo_portal_upload_not_executed\",\n \"scan_tools_not_executed\",\n \"distribution_scope_unset\",\n \"production_mcp_url_not_authorized\"\n ],\n \"authority\": {\n \"production\": \"NOT_GRANTED\",\n \"submit_for_review\": \"NOT_GRANTED_AND_NOT_EXECUTED\",\n \"publication\": \"NOT_GRANTED_AND_NOT_EXECUTED\"\n },\n \"corrections\": [\n \"V9 preserves the global-data-residency blocker after fresh verification against the official remote MCP review requirements.\",\n \"V9 corrects verify_portal_packet.ts canonical marker drift; the packet verifier now passes while preserving all external blockers.\",\n \"V9 records 12 of 12 annotation justification checks as PASS in validate_submission_import.ts.\",\n \"V9 adds PRIVACY_FIELD_MATRIX.md and records bounded explicit-input-only privacy mapping as PASS.\",\n \"V9 aligns the domain blocker to domain_verification_portal_status_unverified because the challenge is conditional on the live portal showing Domain not verified.\",\n \"V9 does not promote any GitHub PR state because the GitHub connector is unavailable in this execution.\"\n ],\n \"invariant\": \"TECHNICAL_PASS != PORTAL_PASS != PRODUCTION_HOST_AUTHORITY != SUBMISSION_AUTHORITY != PUBLICATION\"\n}\n",[422],"89fd2f2e-fe7c-4137-b533-a4c76ef1b145","PORTAL_EVIDENCE_RECEIPT_V8.json","1e4f0090-ade3-11f1-9f94-1607ee4eb77e",150,["D",1789132640258],"{\n \"schema\": \"RUMBO_OPENAI_PORTAL_EVIDENCE_RECEIPT_V8\",\n \"date_utc\": \"2026-09-11\",\n \"budget_usd\": 0,\n \"supersedes_operationally\": \"PORTAL_EVIDENCE_RECEIPT_V7.json\",\n \"candidate_sha_bound_in_staging\": \"9152f5a50de42be55508f0effed5ed09aee44c60\",\n \"github_current_head\": \"UNVERIFIED_CONNECTOR_DISABLED\",\n \"technical\": {\n \"mcp_conformance\": \"PASS\",\n \"submission_gate_runtime\": \"PASS_TECHNICAL_BLOCKED_PORTAL\",\n \"submission_import\": \"PASS_4_TOOLS_5_POSITIVE_3_NEGATIVE\",\n \"submission_import_runtime_validator\": \"PASS\",\n \"live_output_schema\": \"PASS_ALL_FOUR\",\n \"tool_annotations\": \"PASS_ALL_FOUR\",\n \"listing_urls\": \"PASS_ALL_HTTP_200\",\n \"support_mcp_semantics\": \"PASS_SELF_HOSTED\",\n \"privacy_mcp_disclosure\": \"PASS_SELF_HOSTED\",\n \"terms_bounded_semantics\": \"PASS_SELF_HOSTED\",\n \"logo_exact_asset\": \"PASS_SHA256_3ac48eb17d735ee41d12e6edf0cc0ea0e5a55358cce6b5fd37d93b3fc0372205\"\n },\n \"official_requirements\": {\n \"submission_doc\": \"https://developers.openai.com/plugins/deploy/submission\",\n \"remote_mcp_review_doc\": \"https://developers.openai.com/plugins/deploy/app-review\",\n \"api_apps_write\": \"REQUIRED\",\n \"verified_publisher_identity\": \"REQUIRED\",\n \"global_data_residency_for_remote_mcp_review\": \"REQUIRED_CURRENTLY_EU_PROJECTS_INELIGIBLE\",\n \"public_non_testing_mcp_endpoint\": \"REQUIRED\",\n \"domain_verification\": \"CONDITIONAL_WHEN_PORTAL_SHOWS_DOMAIN_NOT_VERIFIED\",\n \"scan_tools\": \"REQUIRED\",\n \"availability_scope\": \"REQUIRED\",\n \"production_mcp_url\": \"REQUIRED_FOR_UNIVERSAL_REMOTE_MCP\",\n \"logo\": \"PRODUCTION_READY_REQUIRED\",\n \"positive_tests\": 5,\n \"negative_tests\": 3\n },\n \"portal_observation\": {\n \"platform_page_last_proven\": \"LOGIN_REQUIRED\",\n \"credential_boundary\": \"NO_COOKIE_LOCALSTORAGE_OR_CREDENTIAL_EXTRACTION\",\n \"openai_platform_org\": \"Rumbo\",\n \"openai_platform_project\": \"Default project\",\n \"project_data_residency\": \"UNVERIFIED\"\n },\n \"current_blockers\": [\n \"domain_verification_portal_status_unverified\",\n \"apps_management_write_unverified\",\n \"publisher_identity_unverified\",\n \"global_data_residency_unverified\",\n \"logo_portal_upload_not_executed\",\n \"scan_tools_not_executed\",\n \"distribution_scope_unset\",\n \"production_mcp_url_not_authorized\"\n ],\n \"authority\": {\n \"production\": \"NOT_GRANTED\",\n \"submit_for_review\": \"NOT_GRANTED_AND_NOT_EXECUTED\",\n \"publication\": \"NOT_GRANTED_AND_NOT_EXECUTED\"\n },\n \"corrections\": [\n \"V8 preserves the remote-MCP global-data-residency blocker because the current OpenAI remote MCP review requirements explicitly state that EU-residency projects cannot submit MCP plugins for review.\",\n \"V8 records validate_submission_import.ts=PASS and confirms outputSchema is present for all four live tools.\",\n \"V8 does not promote any GitHub PR state because the GitHub connector is currently unavailable.\"\n ],\n \"invariant\": \"TECHNICAL_PASS != PORTAL_PASS != PRODUCTION_HOST_AUTHORITY != SUBMISSION_AUTHORITY != PUBLICATION\"\n}",[429],"cf40842f-248a-4ddb-94c1-81a6ef0fae69","PORTAL_EVIDENCE_RECEIPT_V7.json","832d7194-add0-11f1-8662-1607ee4eb77e",139,["D",1789124649064],"{\n \"schema\": \"RUMBO_OPENAI_PORTAL_EVIDENCE_RECEIPT_V7\",\n \"date_utc\": \"2026-09-11\",\n \"budget_usd\": 0,\n \"supersedes_operationally\": \"PORTAL_EVIDENCE_RECEIPT_V6.json\",\n \"candidate_sha_bound_in_staging\": \"9152f5a50de42be55508f0effed5ed09aee44c60\",\n \"github_current_head\": \"UNVERIFIED_CONNECTOR_DISABLED\",\n \"technical\": {\n \"mcp_conformance\": \"PASS\",\n \"portal_packet_verifier\": \"PASS\",\n \"submission_import\": \"PASS_4_TOOLS_5_POSITIVE_3_NEGATIVE\",\n \"tool_annotations\": \"PASS_ALL_FOUR\",\n \"listing_urls\": \"PASS_ALL_HTTP_200\",\n \"support_mcp_semantics\": \"PASS_SELF_HOSTED\",\n \"privacy_mcp_disclosure\": \"PASS_SELF_HOSTED\",\n \"terms_bounded_semantics\": \"PASS_SELF_HOSTED\",\n \"logo_exact_asset\": \"PASS_SHA256_3ac48eb17d735ee41d12e6edf0cc0ea0e5a55358cce6b5fd37d93b3fc0372205\"\n },\n \"official_requirements\": {\n \"submission_doc\": \"https://developers.openai.com/plugins/deploy/submission\",\n \"mcp_review_doc\": \"https://developers.openai.com/plugins/deploy/app-review\",\n \"apps_management_write\": \"REQUIRED\",\n \"verified_publisher_identity\": \"REQUIRED\",\n \"global_data_residency_for_mcp_review\": \"REQUIRED_CURRENTLY_EU_PROJECTS_INELIGIBLE\",\n \"domain_verification\": \"CONDITIONAL_WHEN_PORTAL_SHOWS_DOMAIN_NOT_VERIFIED\",\n \"scan_tools\": \"REQUIRED\",\n \"availability_scope\": \"REQUIRED\",\n \"production_mcp_url\": \"REQUIRED_FOR_UNIVERSAL_REMOTE_MCP\",\n \"logo\": \"PRODUCTION_READY_REQUIRED\"\n },\n \"portal_observation\": {\n \"platform_page_last_proven\": \"LOGIN_REQUIRED\",\n \"desktop_cdp_retry\": \"TIMEOUT_NO_NEW_PORTAL_EVIDENCE\",\n \"credential_boundary\": \"NO_COOKIE_LOCALSTORAGE_OR_CREDENTIAL_EXTRACTION\"\n },\n \"current_blockers\": [\n \"domain_verification_portal_status_unverified\",\n \"apps_management_write_unverified\",\n \"publisher_identity_unverified\",\n \"global_data_residency_unverified\",\n \"logo_portal_upload_not_executed\",\n \"scan_tools_not_executed\",\n \"distribution_scope_unset\",\n \"production_mcp_url_not_authorized\"\n ],\n \"authority\": {\n \"production\": \"NOT_GRANTED\",\n \"submit_for_review\": \"NOT_GRANTED_AND_NOT_EXECUTED\",\n \"publication\": \"NOT_GRANTED_AND_NOT_EXECUTED\"\n },\n \"correction\": \"Restores global data residency as a fail-closed blocker after direct re-verification of current OpenAI MCP review requirements.\",\n \"invariant\": \"TECHNICAL_PASS != PORTAL_PASS != PRODUCTION_HOST_AUTHORITY != SUBMISSION_AUTHORITY != PUBLICATION\"\n}\n",[436],"544dba9f-99ae-4253-9896-5a54860f6681","PORTAL_EVIDENCE_RECEIPT_V6.json","de47a42a-adc9-11f1-a3ea-1607ee4eb77e",126,["D",1789121795418],"{\n \"schema\": \"RUMBO_OPENAI_PORTAL_EVIDENCE_RECEIPT_V6\",\n \"date_utc\": \"2026-09-11\",\n \"budget_usd\": 0,\n \"supersedes_operationally\": \"PORTAL_EVIDENCE_RECEIPT_V5.json\",\n \"candidate_sha_bound_in_staging\": \"9152f5a50de42be55508f0effed5ed09aee44c60\",\n \"github_current_head\": \"UNVERIFIED_CONNECTOR_DISABLED\",\n \"val_town\": {\n \"project\": \"sebas1/rumbo-crm-openai-staging\",\n \"review_findings_branch_version\": 125,\n \"http_public\": true\n },\n \"technical\": {\n \"mcp_conformance\": \"PASS\",\n \"protocol\": \"2025-06-18\",\n \"submission_import\": \"PASS_4_TOOLS_5_POSITIVE_3_NEGATIVE\",\n \"tools\": 4,\n \"annotations\": \"PASS_ALL_FOUR\",\n \"output_schema\": \"PASS_ALL_FOUR_NO_WARNING\",\n \"runtime_negative_input_guards\": \"PASS_UNDECLARED_WHITESPACE_ENUM\",\n \"support_mcp_semantics\": \"PASS_SELF_HOSTED\",\n \"privacy_mcp_disclosure\": \"PASS_SELF_HOSTED\",\n \"terms_bounded_semantics\": \"PASS_SELF_HOSTED\",\n \"logo_exact_asset\": \"PASS_SHA256_3ac48eb17d735ee41d12e6edf0cc0ea0e5a55358cce6b5fd37d93b3fc0372205\",\n \"custom_ui\": \"NONE\",\n \"csp_review\": \"NOT_APPLICABLE_NO_UI\"\n },\n \"descriptor_review\": {\n \"tool_names\": \"PASS_BOUNDED_AND_ACCURATE\",\n \"descriptions\": \"PASS_AFTER_RETURNS_NOT_CREATES_HARDENING\",\n \"sensitive_data_solicitation\": \"NO_EXPLICIT_PHI_PCI_SSN_CREDENTIAL_MFA_GOV_ID_BIOMETRIC_FIELDS\",\n \"user_supplied_free_text\": \"BOUNDED_NOTE_REASON_OBJECTIVE_PRIVACY_DISCLOSED\",\n \"customer_data_reads\": \"NOT_EXPOSED\",\n \"crm_mutations\": \"NOT_EXPOSED\",\n \"autonomous_sends\": \"NOT_EXPOSED\",\n \"findings_artifact\": \"SUBMISSION_REVIEW_FINDINGS_2026-09-11.md\"\n },\n \"official_requirements\": {\n \"submission_doc\": \"https://developers.openai.com/plugins/deploy/submission\",\n \"mcp_review_doc\": \"https://developers.openai.com/plugins/deploy/app-review\",\n \"apps_management_write\": \"REQUIRED\",\n \"verified_publisher_identity\": \"REQUIRED\",\n \"global_data_residency_for_mcp_review\": \"REQUIRED_CURRENTLY_EU_PROJECTS_INELIGIBLE\",\n \"domain_verification\": \"CONDITIONAL_WHEN_PORTAL_SHOWS_DOMAIN_NOT_VERIFIED\",\n \"scan_tools\": \"REQUIRED\",\n \"availability_scope\": \"REQUIRED\",\n \"production_mcp_url\": \"REQUIRED_FOR_UNIVERSAL_REMOTE_MCP\",\n \"logo\": \"PRODUCTION_READY_REQUIRED\"\n },\n \"portal_observation\": {\n \"rumbo_nexus_cdp\": \"PASS_LOCALHOST_9222\",\n \"only_instrumented_browser_profile\": \"RumboNexus/BraveProfile\",\n \"platform_page\": \"LOGIN_REQUIRED\",\n \"credential_boundary\": \"NO_COOKIE_LOCALSTORAGE_OR_CREDENTIAL_EXTRACTION\"\n },\n \"current_blockers\": [\n \"domain_verification_portal_status_unverified\",\n \"apps_management_write_unverified\",\n \"publisher_identity_unverified\",\n \"global_data_residency_unverified\",\n \"logo_portal_upload_not_executed\",\n \"scan_tools_not_executed\",\n \"distribution_scope_unset\",\n \"production_mcp_url_not_authorized\"\n ],\n \"authority\": {\n \"production\": \"NOT_GRANTED\",\n \"submit_for_review\": \"NOT_GRANTED_AND_NOT_EXECUTED\",\n \"publication\": \"NOT_GRANTED_AND_NOT_EXECUTED\"\n },\n \"invariant\": \"TECHNICAL_REVIEW_PASS != PORTAL_PASS != PRODUCTION_HOST_AUTHORITY != SUBMISSION_AUTHORITY != PUBLICATION\"\n}\n",[443],"cae3c7e6-7da1-4afe-9e9f-9f4ab6a054e1","PORTAL_EVIDENCE_RECEIPT_V5.json","200d7c64-adc9-11f1-a777-1607ee4eb77e",118,["D",1789121476283],"{\n \"schema\": \"RUMBO_OPENAI_PORTAL_EVIDENCE_RECEIPT_V5\",\n \"date_utc\": \"2026-09-11\",\n \"budget_usd\": 0,\n \"candidate_sha_bound_in_staging\": \"9152f5a50de42be55508f0effed5ed09aee44c60\",\n \"technical\": {\n \"mcp_conformance\": \"PASS\",\n \"protocol\": \"2025-06-18\",\n \"submission_import\": \"PASS_4_TOOLS_5_POSITIVE_3_NEGATIVE\",\n \"runtime_negative_input_guards\": \"PASS_UNDECLARED_WHITESPACE_ENUM\",\n \"health_exact_sha\": \"PASS\",\n \"tool_annotations\": \"PASS\",\n \"listing_urls_public\": \"PASS\",\n \"support_mcp_semantics\": \"PASS_SELF_HOSTED\",\n \"privacy_mcp_disclosure\": \"PASS_SELF_HOSTED\",\n \"terms_bounded_semantics\": \"PASS_SELF_HOSTED\",\n \"logo_exact_asset\": \"PASS_SHA256_3ac48eb17d735ee41d12e6edf0cc0ea0e5a55358cce6b5fd37d93b3fc0372205\"\n },\n \"official_requirements\": {\n \"submission_doc\": \"https://developers.openai.com/plugins/deploy/submission\",\n \"mcp_review_doc\": \"https://developers.openai.com/plugins/deploy/app-review\",\n \"apps_management_write\": \"REQUIRED\",\n \"verified_publisher_identity\": \"REQUIRED\",\n \"global_data_residency_for_mcp_review\": \"REQUIRED_CURRENTLY_EU_PROJECTS_INELIGIBLE\",\n \"domain_verification\": \"CONDITIONAL_WHEN_PORTAL_SHOWS_DOMAIN_NOT_VERIFIED\",\n \"scan_tools\": \"REQUIRED\",\n \"positive_tests\": 5,\n \"negative_tests\": 3,\n \"availability_scope\": \"REQUIRED\",\n \"production_mcp_url\": \"REQUIRED_FOR_UNIVERSAL_REMOTE_MCP\",\n \"logo\": \"PRODUCTION_READY_REQUIRED\"\n },\n \"platform\": {\n \"organization\": \"Rumbo\",\n \"connected_project\": \"Default project\",\n \"project_data_residency\": \"UNVERIFIED_REQUIRES_GLOBAL\",\n \"apps_management_write\": \"UNVERIFIED\",\n \"publisher_identity\": \"UNVERIFIED\"\n },\n \"portal_observation\": {\n \"rumbo_nexus_cdp\": \"PASS_LOCALHOST_9222\",\n \"only_instrumented_browser_profile\": \"RumboNexus/BraveProfile\",\n \"platform_page\": \"LOGIN_REQUIRED\",\n \"observed_url\": \"https://platform.openai.com/login?next=%2Fusage%2Fchat-completions%3FbreakdownBy%3Dmodel%26interval%3D1d%26metrics%3Dinput_tokens\",\n \"credential_boundary\": \"NO_COOKIE_LOCALSTORAGE_OR_CREDENTIAL_EXTRACTION\",\n \"github_live_reconciliation\": \"UNAVAILABLE_CONNECTOR_DISABLED_THIS_SESSION\"\n },\n \"challenge\": {\n \"capability\": \"IMPLEMENTED_FAIL_CLOSED\",\n \"without_token\": \"HTTP_404\",\n \"portal_status\": \"UNVERIFIED\",\n \"verification\": \"CONDITIONAL_NOT_EXECUTED\"\n },\n \"current_blockers\": [\n \"domain_verification_portal_status_unverified\",\n \"apps_management_write_unverified\",\n \"publisher_identity_unverified\",\n \"global_data_residency_unverified\",\n \"logo_portal_upload_not_executed\",\n \"scan_tools_not_executed\",\n \"distribution_scope_unset\",\n \"production_mcp_url_not_authorized\"\n ],\n \"authority\": {\n \"production\": \"NOT_GRANTED\",\n \"submit_for_review\": \"NOT_GRANTED_AND_NOT_EXECUTED\",\n \"publication\": \"NOT_GRANTED_AND_NOT_EXECUTED\"\n },\n \"invariant\": \"TECHNICAL_PASS != PORTAL_ACCESS != PRODUCTION_HOST_AUTHORITY != PORTAL_METADATA_COMPLETE != SCAN_TOOLS_PASS != SUBMISSION_AUTHORITY != PUBLICATION\"\n}\n",[450],"8d4d98c9-9960-4459-8d6d-e35f82a07e6a","PORTAL_EVIDENCE_RECEIPT_V4.json","371e18b2-adc6-11f1-aced-1607ee4eb77e",111,["D",1789120510260],"{\n \"schema\": \"RUMBO_OPENAI_PORTAL_EVIDENCE_RECEIPT_V4\",\n \"date_utc\": \"2026-09-11\",\n \"budget_usd\": 0,\n \"candidate_sha\": \"9152f5a50de42be55508f0effed5ed09aee44c60\",\n \"technical\": {\n \"mcp_conformance\": \"PASS\",\n \"submission_import\": \"PASS_4_TOOLS_5_POSITIVE_3_NEGATIVE\",\n \"runtime_output_schema_hygiene\": \"PASS_REQUIRED_TYPES_CONST_ENUM_NO_EXTRA_FIELDS\",\n \"runtime_negative_input_guards\": \"PASS_UNDECLARED_WHITESPACE_ENUM\",\n \"health_exact_sha\": \"PASS\",\n \"tool_annotations\": \"PASS\",\n \"listing_urls_public\": \"PASS\",\n \"support_mcp_semantics\": \"PASS\",\n \"privacy_mcp_disclosure\": \"PASS\",\n \"terms_bounded_semantics\": \"PASS\",\n \"logo_exact_asset\": \"PASS_SHA256_3ac48eb17d735ee41d12e6edf0cc0ea0e5a55358cce6b5fd37d93b3fc0372205\"\n },\n \"official_requirements_source\": {\n \"submission\": \"https://developers.openai.com/plugins/deploy/submission\",\n \"mcp_review\": \"https://developers.openai.com/plugins/deploy/app-review\",\n \"verified_on\": \"2026-09-11\"\n },\n \"platform\": {\n \"organization\": \"Rumbo\",\n \"connected_project\": \"Default project\",\n \"project_data_residency\": \"UNVERIFIED_REQUIRES_GLOBAL\",\n \"residency_admin_api_probe\": \"NO_LOCAL_OPENAI_ADMIN_KEY_OR_API_KEY_SET\",\n \"apps_management_write\": \"UNVERIFIED\",\n \"publisher_identity\": \"UNVERIFIED\"\n },\n \"portal_observation\": {\n \"rumbo_nexus_cdp\": \"PASS_LOCALHOST_9222\",\n \"platform_page\": \"LOGIN_REQUIRED\",\n \"credential_boundary\": \"NO_COOKIE_OR_CREDENTIAL_EXTRACTION\",\n \"github_live_reconciliation\": \"UNAVAILABLE_CONNECTOR_DISABLED\"\n },\n \"challenge\": {\n \"capability\": \"IMPLEMENTED_FAIL_CLOSED\",\n \"without_token\": \"HTTP_404\",\n \"verification\": \"NOT_EXECUTED\"\n },\n \"current_blockers\": [\n \"domain_verification_not_completed\",\n \"apps_management_write_unverified\",\n \"publisher_identity_unverified\",\n \"global_data_residency_unverified\",\n \"logo_portal_upload_not_executed\",\n \"scan_tools_not_executed\",\n \"distribution_scope_unset\",\n \"production_mcp_url_not_authorized\"\n ],\n \"authority\": {\n \"production\": \"NOT_GRANTED\",\n \"submit_for_review\": \"NOT_GRANTED_AND_NOT_EXECUTED\",\n \"publication\": \"NOT_GRANTED_AND_NOT_EXECUTED\"\n },\n \"invariant\": \"TECHNICAL_PASS != PRODUCTION_HOST_AUTHORITY != PORTAL_METADATA_COMPLETE != SCAN_TOOLS_PASS != SUBMISSION_AUTHORITY != PUBLICATION\"\n}",[457],"39c623ef-bf6d-47a4-ad85-8768b1e40c5f","PORTAL_EVIDENCE_RECEIPT_V3.json","96fbb942-adbc-11f1-a807-1607ee4eb77e",98,["D",1789120016140],3,"{\n \"schema\": \"RUMBO_OPENAI_PORTAL_EVIDENCE_RECEIPT_V3\",\n \"date_utc\": \"2026-09-11\",\n \"budget_usd\": 0,\n \"candidate_sha\": \"9152f5a50de42be55508f0effed5ed09aee44c60\",\n \"technical\": {\n \"health_exact_sha\": \"PASS\",\n \"mcp_conformance\": \"PASS\",\n \"tool_count\": 4,\n \"tool_annotations\": \"PASS\",\n \"output_schema_and_response_hygiene\": \"PASS_SYNTHETIC_FIXTURES\",\n \"listing_urls_public\": \"PASS\",\n \"support_mcp_semantics\": \"PASS\",\n \"privacy_mcp_disclosure\": \"PASS\",\n \"terms_bounded_semantics\": \"PASS\",\n \"logo_exact_asset\": \"PASS_SHA256_3ac48eb17d735ee41d12e6edf0cc0ea0e5a55358cce6b5fd37d93b3fc0372205\",\n \"submission_import\": \"PASS_4_TOOLS_5_POSITIVE_3_NEGATIVE\"\n },\n \"official_public_submission_requirements\": {\n \"apps_management_write\": \"REQUIRED_UNVERIFIED\",\n \"verified_publisher_identity\": \"REQUIRED_UNVERIFIED\",\n \"logo\": \"REQUIRED_ASSET_READY_PORTAL_UPLOAD_NOT_EXECUTED\",\n \"production_mcp_url\": \"REQUIRED_NOT_AUTHORIZED\",\n \"domain_verification\": \"REQUIRED_NOT_COMPLETED\",\n \"scan_tools\": \"REQUIRED_NOT_EXECUTED\",\n \"availability\": \"REQUIRED_UNSET_FAIL_CLOSED\",\n \"data_residency\": \"REQUIRED_GLOBAL_UNVERIFIED\"\n },\n \"portal_observation\": {\n \"desktop\": \"DESKTOP-QUGVQLB_ONLINE\",\n \"rumbo_nexus_cdp\": \"PASS_127_0_0_1_9222\",\n \"platform_target\": \"https://platform.openai.com/login?next=%2Fplugins\",\n \"platform_session\": \"LOGIN_REQUIRED\",\n \"credential_boundary\": \"NO_COOKIE_OR_CREDENTIAL_EXTRACTION\",\n \"github_live_reconciliation\": \"UNAVAILABLE_CONNECTOR_DISABLED\"\n },\n \"challenge\": {\n \"capability\": \"IMPLEMENTED_FAIL_CLOSED\",\n \"without_token\": \"HTTP_404\",\n \"verification\": \"NOT_EXECUTED\"\n },\n \"current_blockers\": [\n \"domain_verification_not_completed\",\n \"apps_management_write_unverified\",\n \"publisher_identity_unverified\",\n \"global_data_residency_unverified\",\n \"logo_portal_upload_not_executed\",\n \"scan_tools_not_executed\",\n \"distribution_scope_unset\",\n \"production_mcp_url_not_authorized\"\n ],\n \"authority\": {\n \"production\": \"NOT_GRANTED\",\n \"submit_for_review\": \"NOT_GRANTED_AND_NOT_EXECUTED\",\n \"publication\": \"NOT_GRANTED_AND_NOT_EXECUTED\"\n },\n \"invariant\": \"TECHNICAL_PASS != PORTAL_ACCESS != PRODUCTION_HOST_AUTHORITY != PORTAL_METADATA_COMPLETE != SCAN_TOOLS_PASS != SUBMISSION_AUTHORITY != PUBLICATION\"\n}",[464],"8fcac396-d996-48e0-a487-56b955fabd00","PORTAL_EVIDENCE_RECEIPT_V2.json","d041d8aa-adb0-11f1-aa3b-1607ee4eb77e",76,["D",1789111034479],"{\n \"schema\": \"RUMBO_OPENAI_PORTAL_EVIDENCE_RECEIPT_V2\",\n \"date_utc\": \"2026-09-11\",\n \"budget_usd\": 0,\n \"candidate_sha\": \"9152f5a50de42be55508f0effed5ed09aee44c60\",\n \"technical\": {\n \"health_exact_sha\": \"PASS\",\n \"tool_annotations\": \"PASS\",\n \"tool_count\": 4,\n \"output_schemas\": \"PASS_ALL_FOUR\",\n \"listing_urls_public\": \"PASS\",\n \"support_mcp_semantics\": \"PASS\",\n \"privacy_mcp_disclosure\": \"PASS\",\n \"terms_bounded_semantics\": \"PASS\",\n \"logo_exact_asset\": \"PASS_SHA256_3ac48eb17d735ee41d12e6edf0cc0ea0e5a55358cce6b5fd37d93b3fc0372205\",\n \"submission_import\": \"PASS_4_TOOLS_5_POSITIVE_3_NEGATIVE\"\n },\n \"official_product_model\": {\n \"workspace_custom_mcp\": \"BUSINESS_OR_ENTERPRISE_EDU_WITH_ROLE_CONTROLS\",\n \"workspace_creation_flow\": \"ENDPOINT_METADATA_THEN_SCAN_TOOLS_THEN_CREATE\",\n \"public_directory_submission\": \"SEPARATE_FLOW\",\n \"plugin_directory\": \"PRIMARY_DISCOVERY_SURFACE_SINCE_2026_07_09\",\n \"global_data_residency_universal_submission_blocker\": \"NOT_PROVEN_IN_CURRENT_OFFICIAL_SOURCES\",\n \"apps_management_write_exact_permission_universal_requirement\": \"NOT_PROVEN_IN_CURRENT_OFFICIAL_SOURCES\"\n },\n \"portal_observation\": {\n \"status\": \"UNVERIFIED_BY_AUTOMATION\",\n \"desktop\": \"DESKTOP-QUGVQLB_ONLINE\",\n \"cdp_127_0_0_1_9222\": \"NO_LISTENER\",\n \"github_live_reconciliation\": \"UNAVAILABLE_CONNECTOR_DISABLED\"\n },\n \"challenge\": {\n \"capability\": \"IMPLEMENTED_FAIL_CLOSED\",\n \"without_token\": \"HTTP_404\",\n \"verification\": \"NOT_EXECUTED\"\n },\n \"current_blockers\": [\n \"domain_verification_not_completed\",\n \"portal_app_creation_or_submission_access_unverified\",\n \"publisher_identity_portal_requirement_unresolved\",\n \"logo_portal_upload_not_executed\",\n \"scan_tools_not_executed\",\n \"distribution_scope_unset\",\n \"production_mcp_url_not_authorized\"\n ],\n \"authority\": {\n \"production\": \"NOT_GRANTED\",\n \"submit_for_review\": \"NOT_GRANTED_AND_NOT_EXECUTED\",\n \"publication\": \"NOT_GRANTED_AND_NOT_EXECUTED\"\n },\n \"invariant\": \"TECHNICAL_PASS != PORTAL_ACCESS != PRODUCTION_HOST_AUTHORITY != PORTAL_METADATA_COMPLETE != SCAN_TOOLS_PASS != SUBMISSION_AUTHORITY != PUBLICATION\"\n}",[472],"a8518e12-bd2f-4042-a1fb-833e46f9a616","PORTAL_EVIDENCE_RECEIPT_V16.json","dce1ab3c-afbb-11f1-b3ed-1607ee4eb77e",241,["D",1789335682460],"{\n \"schema\": \"RUMBO_OPENAI_PORTAL_EVIDENCE_RECEIPT_V16\",\n \"date_utc\": \"2026-09-13\",\n \"budget_usd\": 0,\n \"supersedes_operationally\": \"PORTAL_EVIDENCE_RECEIPT_V15.json\",\n \"candidate_sha_bound_in_staging\": \"9152f5a50de42be55508f0effed5ed09aee44c60\",\n \"github_current_head\": \"UNVERIFIED_CONNECTOR_DISABLED\",\n \"technical_state\": \"PASS\",\n \"technical_facts\": {\n \"tool_count\": 4,\n \"tool_annotations\": \"PASS\",\n \"annotation_justifications\": \"PASS_12_OF_12_VALIDATED\",\n \"response_minimization\": \"PASS\",\n \"listing_urls\": \"PASS_ALL_HTTP_200_SELF_HOSTED\",\n \"support_mcp_semantics\": \"PASS_SELF_HOSTED\",\n \"privacy_mcp_disclosure\": \"PASS_SELF_HOSTED\",\n \"terms_bounded_semantics\": \"PASS_SELF_HOSTED\",\n \"logo_exact_asset\": \"PASS_SHA256_3ac48eb17d735ee41d12e6edf0cc0ea0e5a55358cce6b5fd37d93b3fc0372205\",\n \"starter_prompts\": \"PASS_3_READY\",\n \"submission_import_validator\": \"PASS\",\n \"review_case_server_validation\": \"PASS_5_POSITIVE_3_NEGATIVE_SURFACE\",\n \"review_case_scope\": \"SERVER_SIDE_ONLY_NOT_CHATGPT_TOOL_SELECTION_E2E\"\n },\n \"workspace_draft_state\": \"BLOCKED_FAIL_CLOSED\",\n \"workspace_draft_blockers\": [\n \"chatgpt_create_app_surface_unverified\",\n \"scan_tools_not_executed\",\n \"create_draft_not_executed\"\n ],\n \"public_directory_state\": \"BLOCKED_FAIL_CLOSED\",\n \"public_directory_blockers\": [\n \"domain_verification_not_completed\",\n \"apps_management_write_unverified\",\n \"publisher_identity_unverified\",\n \"global_data_residency_unverified\",\n \"logo_portal_upload_not_executed\",\n \"production_mcp_url_not_authorized\",\n \"scan_tools_not_executed\",\n \"distribution_scope_unset\",\n \"policy_attestations_not_completed\"\n ],\n \"governance_blockers\": [\n \"github_candidate_head_unreconciled\"\n ],\n \"official_requirement_corrections\": [\n \"Remote MCP public review requires a project with global data residency; EU-residency projects are currently ineligible.\",\n \"A demo-recording URL is not listed as a mandatory field in the current public submission or remote-MCP review documentation and is not a readiness blocker.\",\n \"Public submission requires policy attestations before Submit for Review.\",\n \"Public submission uses a production MCP URL; the current staging URL remains technical validation only.\",\n \"Tests require at least five positive and three negative cases; RUMBO currently supplies five and three.\",\n \"Workspace custom-app creation and public Plugin Directory submission are separate flows.\"\n ],\n \"review_materials\": {\n \"demo_recording_url\": null,\n \"demo_recording_status\": \"NOT_REQUIRED_BY_CURRENT_OFFICIAL_SUBMISSION_OR_MCP_REVIEW_DOCS\",\n \"screenshots\": \"NOT_APPLICABLE_NO_UI\"\n },\n \"authority\": {\n \"production\": \"NOT_GRANTED\",\n \"submit_for_review\": \"NOT_GRANTED_AND_NOT_EXECUTED\",\n \"publication\": \"NOT_GRANTED_AND_NOT_EXECUTED\"\n },\n \"invariant\": \"TECHNICAL_PASS != GITHUB_HEAD_RECONCILED != GLOBAL_PROJECT_RESIDENCY_PROVEN != PRODUCTION_HOST_AUTHORITY != DOMAIN_VERIFIED != SCAN_TOOLS_PASS != SUBMISSION_AUTHORITY != PUBLICATION\"\n}",[479],"c6c73818-cd3a-454d-a7b3-1ca4d7dd8e4e","PORTAL_EVIDENCE_RECEIPT_V15.json","845cbabc-afb9-11f1-a2c8-1607ee4eb77e",227,["D",1789334674955],"{\n \"schema\": \"RUMBO_OPENAI_PORTAL_EVIDENCE_RECEIPT_V15\",\n \"date_utc\": \"2026-09-13\",\n \"budget_usd\": 0,\n \"supersedes_operationally\": \"PORTAL_EVIDENCE_RECEIPT_V14.json\",\n \"candidate_sha_bound_in_staging\": \"9152f5a50de42be55508f0effed5ed09aee44c60\",\n \"github_current_head\": \"UNVERIFIED_CONNECTOR_DISABLED\",\n \"technical_state\": \"PASS\",\n \"technical_facts\": {\n \"tool_count\": 4,\n \"tool_annotations\": \"PASS\",\n \"annotation_justifications\": \"PASS_12_OF_12_VALIDATED\",\n \"response_minimization\": \"PASS\",\n \"listing_urls\": \"PASS_ALL_HTTP_200_SELF_HOSTED\",\n \"support_mcp_semantics\": \"PASS_SELF_HOSTED\",\n \"privacy_mcp_disclosure\": \"PASS_SELF_HOSTED\",\n \"terms_bounded_semantics\": \"PASS_SELF_HOSTED\",\n \"logo_exact_asset\": \"PASS_SHA256_3ac48eb17d735ee41d12e6edf0cc0ea0e5a55358cce6b5fd37d93b3fc0372205\",\n \"starter_prompts\": \"PASS_3_OF_MAX_3\",\n \"package_name\": \"rumbo-ia-crm\",\n \"package_version\": \"1.0.0\",\n \"capabilities\": \"PASS_4_OF_MAX_20\",\n \"submission_import_validator\": \"PASS\",\n \"review_case_server_validation\": \"PASS_5_POSITIVE_3_NEGATIVE_SURFACE\",\n \"review_case_scope\": \"SERVER_SIDE_ONLY_NOT_CHATGPT_TOOL_SELECTION_E2E\"\n },\n \"workspace_draft_state\": \"BLOCKED_FAIL_CLOSED\",\n \"workspace_draft_blockers\": [\n \"chatgpt_create_app_surface_unverified\",\n \"scan_tools_not_executed\",\n \"create_draft_not_executed\"\n ],\n \"public_directory_state\": \"BLOCKED_FAIL_CLOSED\",\n \"public_directory_blockers\": [\n \"domain_verification_not_completed\",\n \"apps_management_write_unverified\",\n \"publisher_identity_unverified\",\n \"global_data_residency_unverified\",\n \"logo_portal_upload_not_executed\",\n \"demo_recording_url_missing\",\n \"production_mcp_url_not_authorized\",\n \"scan_tools_not_executed\",\n \"distribution_scope_unset\"\n ],\n \"governance_blockers\": [\n \"github_candidate_head_unreconciled\"\n ],\n \"official_requirement_corrections\": [\n \"Final remote-MCP directory submission requires completed domain verification; V14 conditional wording is superseded.\",\n \"Starter prompts are limited to at most three; the packet now contains exactly three.\",\n \"Remote-MCP final submission requires a reviewer-accessible demo-recording URL; it is currently missing fail-closed.\",\n \"Final directory tests are exactly five positive and three negative cases.\",\n \"Every MCP annotation value requires a justification; all 12 RUMBO justifications are validated.\",\n \"Projects with EU data residency cannot currently submit MCP plugins for review; project global-residency status remains unverified.\",\n \"The staging endpoint is a testing surface and is not represented as the production MCP URL.\"\n ],\n \"review_materials\": {\n \"demo_recording_plan\": \"DEMO_RECORDING_PLAN.md\",\n \"demo_recording_url\": null,\n \"demo_recording_status\": \"MISSING_FAIL_CLOSED\",\n \"screenshots\": \"NOT_APPLICABLE_NO_UI\"\n },\n \"authority\": {\n \"production\": \"NOT_GRANTED\",\n \"submit_for_review\": \"NOT_GRANTED_AND_NOT_EXECUTED\",\n \"publication\": \"NOT_GRANTED_AND_NOT_EXECUTED\"\n },\n \"invariant\": \"TECHNICAL_PASS != GITHUB_HEAD_RECONCILED != PRODUCTION_HOST_AUTHORITY != DOMAIN_VERIFIED != SCAN_TOOLS_PASS != SUBMISSION_AUTHORITY != PUBLICATION\"\n}",[486],"2fe23163-e322-4bc5-8377-8f25b202fd79","PORTAL_EVIDENCE_RECEIPT_V14.json","2d9fcd62-afb5-11f1-8478-1607ee4eb77e",212,["D",1789332811429],"{\n \"schema\": \"RUMBO_OPENAI_PORTAL_EVIDENCE_RECEIPT_V14\",\n \"date_utc\": \"2026-09-13\",\n \"budget_usd\": 0,\n \"supersedes_operationally\": \"PORTAL_EVIDENCE_RECEIPT_V13.json\",\n \"candidate_sha_bound_in_staging\": \"9152f5a50de42be55508f0effed5ed09aee44c60\",\n \"github_current_head\": \"UNVERIFIED_CONNECTOR_DISABLED\",\n \"technical_revalidation\": {\n \"submission_gate\": \"PASS_TECHNICAL_STATE\",\n \"tool_count\": 4,\n \"tool_annotations\": \"PASS\",\n \"response_minimization\": \"PASS\",\n \"listing_urls\": \"PASS_ALL_HTTP_200_SELF_HOSTED\",\n \"support_mcp_semantics\": \"PASS_SELF_HOSTED\",\n \"privacy_mcp_disclosure\": \"PASS_SELF_HOSTED\",\n \"terms_bounded_semantics\": \"PASS_SELF_HOSTED\",\n \"logo_exact_asset\": \"PASS_SHA256_3ac48eb17d735ee41d12e6edf0cc0ea0e5a55358cce6b5fd37d93b3fc0372205\"\n },\n \"official_requirements_revalidated\": {\n \"submission_doc\": \"https://developers.openai.com/plugins/deploy/submission\",\n \"remote_mcp_review_doc\": \"https://developers.openai.com/plugins/deploy/app-review\",\n \"snapshot\": \"OFFICIAL_SUBMISSION_REQUIREMENTS_2026-09-13.md\",\n \"apps_management_write\": \"REQUIRED\",\n \"verified_publisher_identity\": \"REQUIRED\",\n \"production_public_mcp_url\": \"REQUIRED_NO_LOCAL_OR_TESTING_ENDPOINT\",\n \"scan_tools\": \"REQUIRED\",\n \"test_cases\": \"AT_LEAST_5_POSITIVE_3_NEGATIVE\",\n \"availability\": \"EXPLICIT_COUNTRY_OR_REGION_SELECTION_REQUIRED\",\n \"global_project_data_residency_requirement\": \"REQUIRED_FOR_REMOTE_MCP_REVIEW_EU_PROJECTS_CURRENTLY_INELIGIBLE\",\n \"domain_verification\": \"CONDITIONAL_IF_PORTAL_SHOWS_DOMAIN_NOT_VERIFIED\"\n },\n \"workspace_custom_app_flow\": {\n \"separate_from_public_directory\": true,\n \"state\": \"BLOCKED_FAIL_CLOSED\",\n \"blockers\": [\n \"chatgpt_create_app_surface_unverified\",\n \"scan_tools_not_executed\",\n \"create_draft_not_executed\"\n ]\n },\n \"public_directory_readiness\": {\n \"state\": \"BLOCKED_FAIL_CLOSED\",\n \"blockers\": [\n \"domain_verification_portal_status_unverified\",\n \"apps_management_write_unverified\",\n \"publisher_identity_unverified\",\n \"global_data_residency_unverified\",\n \"logo_portal_upload_not_executed\",\n \"production_mcp_url_not_authorized\",\n \"scan_tools_not_executed\",\n \"distribution_scope_unset\"\n ]\n },\n \"governance\": {\n \"state\": \"BLOCKED_FAIL_CLOSED\",\n \"blockers\": [\n \"github_candidate_head_unreconciled\"\n ],\n \"reason\": \"GitHub connector unavailable in this session; staging-bound SHA cannot be promoted as current PR HEAD without live reconciliation.\"\n },\n \"portal_observation\": {\n \"openai_platform_org\": \"Rumbo\",\n \"openai_platform_project\": \"Default project\",\n \"apps_management_write\": \"UNVERIFIED\",\n \"publisher_identity\": \"UNVERIFIED\",\n \"project_data_residency\": \"UNVERIFIED\",\n \"domain_verification_portal_status\": \"UNVERIFIED\",\n \"logo_portal_upload\": \"NOT_EXECUTED\",\n \"scan_tools\": \"NOT_EXECUTED\",\n \"distribution_scope\": \"UNSET_FAIL_CLOSED\"\n },\n \"execution_state\": {\n \"public_submission\": \"NOT_EXECUTED_SEPARATE_FROM_READINESS\",\n \"publication\": \"NOT_EXECUTED\"\n },\n \"authority\": {\n \"production\": \"NOT_GRANTED\",\n \"submit_for_review\": \"NOT_GRANTED_AND_NOT_EXECUTED\",\n \"publication\": \"NOT_GRANTED_AND_NOT_EXECUTED\"\n },\n \"corrections\": [\n \"V14 preserves V13 as historical evidence and supersedes it operationally.\",\n \"V14 adds a separate governance blocker because GitHub candidate HEAD cannot be reconciled while the connector is unavailable.\",\n \"V14 revalidates the exact eight public-directory blockers and three workspace-draft blockers.\",\n \"A transient 2026-09-13 interpretation removed the global data residency blocker based on the general submission guide; this was immediately corrected after checking the more specific Remote MCP server review requirements, which explicitly require a global-data-residency project for MCP review while EU-residency projects are ineligible.\",\n \"V14 preserves MONEY_SPEND=0 and grants no production, submission, merge, or publication authority.\"\n ],\n \"invariant\": \"TECHNICAL_PASS != GITHUB_HEAD_RECONCILED != WORKSPACE_DRAFT_READY != PUBLIC_DIRECTORY_READY != PRODUCTION_HOST_AUTHORITY != SUBMISSION_AUTHORITY != PUBLICATION\"\n}\n",[493],"639006ba-7aa0-44fd-afcc-538b1f5e0d9a","PORTAL_EVIDENCE_RECEIPT_V13.json","262a4694-aec9-11f1-befb-1607ee4eb77e",196,["D",1789231437708],"{\n \"schema\": \"RUMBO_OPENAI_PORTAL_EVIDENCE_RECEIPT_V13\",\n \"date_utc\": \"2026-09-12\",\n \"budget_usd\": 0,\n \"supersedes_operationally\": \"PORTAL_EVIDENCE_RECEIPT_V12.json\",\n \"candidate_sha_bound_in_staging\": \"9152f5a50de42be55508f0effed5ed09aee44c60\",\n \"github_current_head\": \"UNVERIFIED_CONNECTOR_DISABLED\",\n \"technical_revalidation\": {\n \"submission_gate\": \"PASS_TECHNICAL_STATE\",\n \"portal_evidence_v12_verifier\": \"PASS\",\n \"portal_packet_verifier\": \"PASS\",\n \"submission_import_validator\": \"PASS\",\n \"tool_count\": 4,\n \"response_minimization\": \"PASS\",\n \"listing_urls\": \"PASS_ALL_HTTP_200_SELF_HOSTED\",\n \"support_mcp_semantics\": \"PASS_SELF_HOSTED\",\n \"privacy_mcp_disclosure\": \"PASS_SELF_HOSTED\",\n \"terms_bounded_semantics\": \"PASS_SELF_HOSTED\",\n \"logo_exact_asset\": \"PASS_SHA256_3ac48eb17d735ee41d12e6edf0cc0ea0e5a55358cce6b5fd37d93b3fc0372205\"\n },\n \"official_requirements_revalidated\": {\n \"submission_doc\": \"https://developers.openai.com/plugins/deploy/submission\",\n \"remote_mcp_review_doc\": \"https://developers.openai.com/plugins/deploy/app-review\",\n \"global_project_data_residency_requirement\": \"REQUIRED_FOR_REMOTE_MCP_REVIEW_EU_PROJECTS_CURRENTLY_INELIGIBLE\",\n \"argentina_general_openai_service_support\": \"CONFIRMED_2026-09-12\",\n \"distribution_portal_selection\": \"STILL_REQUIRED_NOT_APPLIED\"\n },\n \"workspace_custom_app_flow\": {\n \"separate_from_public_directory\": true,\n \"state\": \"BLOCKED_FAIL_CLOSED\",\n \"blockers\": [\n \"chatgpt_create_app_surface_unverified\",\n \"scan_tools_not_executed\",\n \"create_draft_not_executed\"\n ]\n },\n \"portal_observation\": {\n \"openai_platform_org\": \"Rumbo\",\n \"openai_platform_project\": \"Default project\",\n \"platform_session_last_proven\": \"LOGIN_REQUIRED_PRIOR_OBSERVATION\",\n \"desktop_device\": \"DESKTOP-QUGVQLB\",\n \"desktop_connectivity\": \"PING_PASS_2026-09-12\",\n \"brave_processes\": \"ACTIVE_OBSERVED_2026-09-12\",\n \"rumbo_nexus_process\": \"ACTIVE_OBSERVED_2026-09-12\",\n \"cdp_127_0_0_1_9222\": \"NOT_LISTENING_OR_UNREACHABLE_CURRENT_PROBE_EXIT_1_NO_BODY\",\n \"credential_boundary\": \"NO_COOKIE_LOCALSTORAGE_OR_CREDENTIAL_EXTRACTION\",\n \"project_data_residency\": \"UNVERIFIED\",\n \"apps_management_write\": \"UNVERIFIED\",\n \"publisher_identity\": \"UNVERIFIED\",\n \"domain_verification_portal_status\": \"UNVERIFIED\",\n \"logo_portal_upload\": \"NOT_EXECUTED\",\n \"scan_tools\": \"NOT_EXECUTED\",\n \"distribution_scope\": \"UNSET_FAIL_CLOSED\"\n },\n \"current_blockers\": [\n \"domain_verification_portal_status_unverified\",\n \"apps_management_write_unverified\",\n \"publisher_identity_unverified\",\n \"global_data_residency_unverified\",\n \"logo_portal_upload_not_executed\",\n \"scan_tools_not_executed\",\n \"distribution_scope_unset\",\n \"production_mcp_url_not_authorized\"\n ],\n \"execution_state\": {\n \"public_submission\": \"NOT_EXECUTED_SEPARATE_FROM_READINESS\",\n \"publication\": \"NOT_EXECUTED\"\n },\n \"authority\": {\n \"production\": \"NOT_GRANTED\",\n \"submit_for_review\": \"NOT_GRANTED_AND_NOT_EXECUTED\",\n \"publication\": \"NOT_GRANTED_AND_NOT_EXECUTED\"\n },\n \"corrections\": [\n \"V13 revalidates V12 without changing the exact eight public-readiness blockers or three workspace-draft blockers.\",\n \"V13 records fresh 2026-09-12 zero-cost technical verifier results and current desktop/CDP observations.\",\n \"V13 confirms Argentina remains supported generally by OpenAI while preserving distribution_scope_unset until the portal selection is explicitly applied.\",\n \"V13 does not claim a current GitHub head because the GitHub connector is disabled in this session.\",\n \"V13 preserves fail-closed production, submission, publication, and MONEY_SPEND=0.\"\n ],\n \"invariant\": \"TECHNICAL_PASS != WORKSPACE_DRAFT_READY != PUBLIC_DIRECTORY_READY != PRODUCTION_HOST_AUTHORITY != SUBMISSION_AUTHORITY != PUBLICATION\"\n}\n",[500],"67f65dce-4e11-4fa0-ae3c-0f309c811e5f","PORTAL_EVIDENCE_RECEIPT_V12.json","cad2fd60-ae03-11f1-b694-1607ee4eb77e",191,["D",1789146673596],"{\n \"schema\": \"RUMBO_OPENAI_PORTAL_EVIDENCE_RECEIPT_V12\",\n \"date_utc\": \"2026-09-11\",\n \"budget_usd\": 0,\n \"supersedes_operationally\": \"PORTAL_EVIDENCE_RECEIPT_V11.json\",\n \"candidate_sha_bound_in_staging\": \"9152f5a50de42be55508f0effed5ed09aee44c60\",\n \"github_current_head\": \"UNVERIFIED_CONNECTOR_DISABLED\",\n \"technical\": {\n \"submission_gate_runtime\": \"TECHNICAL_PASS_PUBLIC_DIRECTORY_BLOCKED_8_EXACT_BLOCKERS\",\n \"health_exact_sha\": \"PASS\",\n \"tool_count\": 4,\n \"tool_annotations\": \"PASS\",\n \"response_minimization\": \"PASS\",\n \"listing_urls\": \"PASS_ALL_HTTP_200_SELF_HOSTED\",\n \"support_mcp_semantics\": \"PASS_SELF_HOSTED\",\n \"privacy_mcp_disclosure\": \"PASS_SELF_HOSTED\",\n \"terms_bounded_semantics\": \"PASS_SELF_HOSTED\",\n \"logo_exact_asset\": \"PASS_SHA256_3ac48eb17d735ee41d12e6edf0cc0ea0e5a55358cce6b5fd37d93b3fc0372205\",\n \"positive_tests\": 5,\n \"negative_tests\": 3,\n \"authentication\": \"NONE_FOR_BOUNDED_V1\",\n \"custom_ui\": \"NONE\"\n },\n \"official_requirements\": {\n \"submission_doc\": \"https://developers.openai.com/plugins/deploy/submission\",\n \"remote_mcp_review_doc\": \"https://developers.openai.com/plugins/deploy/app-review\",\n \"apps_management_write\": \"REQUIRED\",\n \"verified_publisher_identity\": \"REQUIRED\",\n \"public_production_mcp_endpoint\": \"REQUIRED\",\n \"domain_verification\": \"CONDITIONAL_WHEN_PORTAL_SHOWS_DOMAIN_NOT_VERIFIED\",\n \"scan_tools\": \"REQUIRED\",\n \"availability_scope\": \"REQUIRED\",\n \"production_ready_logo\": \"REQUIRED\",\n \"positive_tests_minimum\": 5,\n \"negative_tests_minimum\": 3,\n \"global_project_data_residency_requirement\": \"REQUIRED_FOR_REMOTE_MCP_REVIEW_EU_PROJECTS_CURRENTLY_INELIGIBLE\",\n \"response_data_minimization\": \"REQUIRED_REVIEW_EXPECTATION\"\n },\n \"workspace_custom_app_flow\": {\n \"separate_from_public_directory\": true,\n \"state\": \"BLOCKED_FAIL_CLOSED\",\n \"blockers\": [\n \"chatgpt_create_app_surface_unverified\",\n \"scan_tools_not_executed\",\n \"create_draft_not_executed\"\n ]\n },\n \"portal_observation\": {\n \"platform_page_last_proven\": \"LOGIN_REQUIRED_PRIOR_OBSERVATION\",\n \"credential_boundary\": \"NO_COOKIE_LOCALSTORAGE_OR_CREDENTIAL_EXTRACTION\",\n \"openai_platform_org\": \"Rumbo\",\n \"openai_platform_project\": \"Default project\",\n \"portal_context_match\": \"UNVERIFIED\",\n \"project_data_residency\": \"UNVERIFIED\",\n \"apps_management_write\": \"UNVERIFIED\",\n \"publisher_identity\": \"UNVERIFIED\",\n \"domain_verification_portal_status\": \"UNVERIFIED\",\n \"logo_portal_upload\": \"NOT_EXECUTED\",\n \"scan_tools\": \"NOT_EXECUTED\",\n \"distribution_scope\": \"UNSET_FAIL_CLOSED\"\n },\n \"current_blockers\": [\n \"domain_verification_portal_status_unverified\",\n \"apps_management_write_unverified\",\n \"publisher_identity_unverified\",\n \"global_data_residency_unverified\",\n \"logo_portal_upload_not_executed\",\n \"scan_tools_not_executed\",\n \"distribution_scope_unset\",\n \"production_mcp_url_not_authorized\"\n ],\n \"execution_state\": {\n \"public_submission\": \"NOT_EXECUTED_SEPARATE_FROM_READINESS\",\n \"publication\": \"NOT_EXECUTED\"\n },\n \"authority\": {\n \"production\": \"NOT_GRANTED\",\n \"submit_for_review\": \"NOT_GRANTED_AND_NOT_EXECUTED\",\n \"publication\": \"NOT_GRANTED_AND_NOT_EXECUTED\"\n },\n \"corrections\": [\n \"V12 preserves V11's eight external public-readiness blockers after re-verifying the specific Remote MCP server review requirement that EU-residency projects are ineligible and a global-residency project is required.\",\n \"V12 removes the stale gate fact that incorrectly said global data residency was not documented.\",\n \"V12 separates workspace custom-app creation from public Plugin Directory submission.\",\n \"V12 treats Submit for review as an execution state after readiness rather than as a readiness prerequisite.\",\n \"V12 adds a live response-minimization test across all four tools and records PASS.\",\n \"V12 preserves fail-closed production, submission, and publication authority and MONEY_SPEND=0.\"\n ],\n \"invariant\": \"TECHNICAL_PASS != WORKSPACE_DRAFT_READY != PUBLIC_DIRECTORY_READY != PRODUCTION_HOST_AUTHORITY != SUBMISSION_AUTHORITY != PUBLICATION\"\n}\n",[507],"2fd7c010-8321-4366-9ac1-e07155b1c7b5","PORTAL_EVIDENCE_RECEIPT_V11.json","a19cbc90-ae00-11f1-ba9f-1607ee4eb77e",181,["D",1789145315964],"{\n \"schema\": \"RUMBO_OPENAI_PORTAL_EVIDENCE_RECEIPT_V11\",\n \"date_utc\": \"2026-09-11\",\n \"budget_usd\": 0,\n \"supersedes_operationally\": \"PORTAL_EVIDENCE_RECEIPT_V10.json\",\n \"candidate_sha_bound_in_staging\": \"9152f5a50de42be55508f0effed5ed09aee44c60\",\n \"github_current_head\": \"UNVERIFIED_CONNECTOR_DISABLED\",\n \"technical\": {\n \"mcp_conformance\": \"PASS_18_CHECKS\",\n \"submission_gate_runtime\": \"PASS_TECHNICAL_BLOCKED_PORTAL_8_EXACT_BLOCKERS\",\n \"submission_import\": \"PASS_4_TOOLS_5_POSITIVE_3_NEGATIVE\",\n \"submission_import_runtime_validator\": \"PASS\",\n \"portal_packet_verifier\": \"PASS\",\n \"listing_urls\": \"PASS_ALL_HTTP_200_SELF_HOSTED\",\n \"support_mcp_semantics\": \"PASS_SELF_HOSTED\",\n \"privacy_mcp_disclosure\": \"PASS_SELF_HOSTED\",\n \"terms_bounded_semantics\": \"PASS_SELF_HOSTED\",\n \"logo_exact_asset\": \"PASS_SHA256_3ac48eb17d735ee41d12e6edf0cc0ea0e5a55358cce6b5fd37d93b3fc0372205\"\n },\n \"official_requirements\": {\n \"submission_doc\": \"https://developers.openai.com/plugins/deploy/submission\",\n \"remote_mcp_review_doc\": \"https://developers.openai.com/plugins/deploy/app-review\",\n \"apps_management_write\": \"REQUIRED\",\n \"verified_publisher_identity\": \"REQUIRED\",\n \"public_production_mcp_endpoint\": \"REQUIRED\",\n \"domain_verification\": \"CONDITIONAL_WHEN_PORTAL_SHOWS_DOMAIN_NOT_VERIFIED\",\n \"scan_tools\": \"REQUIRED\",\n \"availability_scope\": \"REQUIRED\",\n \"production_ready_logo\": \"REQUIRED\",\n \"positive_tests_minimum\": 5,\n \"negative_tests_minimum\": 3,\n \"global_project_data_residency_requirement\": \"REQUIRED_FOR_REMOTE_MCP_REVIEW_EU_PROJECTS_CURRENTLY_INELIGIBLE\"\n },\n \"portal_observation\": {\n \"platform_page_last_proven\": \"LOGIN_REQUIRED_PRIOR_OBSERVATION\",\n \"credential_boundary\": \"NO_COOKIE_LOCALSTORAGE_OR_CREDENTIAL_EXTRACTION\",\n \"openai_platform_org\": \"Rumbo\",\n \"openai_platform_project\": \"Default project\",\n \"portal_context_match\": \"UNVERIFIED\",\n \"project_data_residency\": \"UNVERIFIED\",\n \"apps_management_write\": \"UNVERIFIED\",\n \"publisher_identity\": \"UNVERIFIED\",\n \"scan_tools\": \"NOT_EXECUTED\",\n \"distribution_scope\": \"UNSET_FAIL_CLOSED\"\n },\n \"current_blockers\": [\n \"domain_verification_portal_status_unverified\",\n \"apps_management_write_unverified\",\n \"publisher_identity_unverified\",\n \"global_data_residency_unverified\",\n \"logo_portal_upload_not_executed\",\n \"scan_tools_not_executed\",\n \"distribution_scope_unset\",\n \"production_mcp_url_not_authorized\"\n ],\n \"authority\": {\n \"production\": \"NOT_GRANTED\",\n \"submit_for_review\": \"NOT_GRANTED_AND_NOT_EXECUTED\",\n \"publication\": \"NOT_GRANTED_AND_NOT_EXECUTED\"\n },\n \"corrections\": [\n \"V11 supersedes V10 because the current Remote MCP server review requirements explicitly state that EU-residency projects cannot submit MCP plugins for review and require a global-residency project.\",\n \"V11 resolves the apparent documentation conflict by giving the specific Remote MCP review page precedence over the more general submission page on this eligibility condition.\",\n \"V11 restores global_data_residency_unverified and records the exact remaining blocker set as eight items.\",\n \"V11 preserves fail-closed production, submission, and publication authority.\"\n ],\n \"invariant\": \"TECHNICAL_PASS != PORTAL_PASS != PRODUCTION_HOST_AUTHORITY != SUBMISSION_AUTHORITY != PUBLICATION\"\n}\n",[514],"7269976f-e206-4986-8296-3e9e3a284ba6","PORTAL_EVIDENCE_RECEIPT_V10.json","f870b176-adff-11f1-930c-1607ee4eb77e",171,["D",1789145032147],"{\n \"schema\": \"RUMBO_OPENAI_PORTAL_EVIDENCE_RECEIPT_V10\",\n \"date_utc\": \"2026-09-11\",\n \"budget_usd\": 0,\n \"supersedes_operationally\": \"PORTAL_EVIDENCE_RECEIPT_V9.json\",\n \"candidate_sha_bound_in_staging\": \"9152f5a50de42be55508f0effed5ed09aee44c60\",\n \"github_current_head\": \"UNVERIFIED_CONNECTOR_DISABLED\",\n \"technical\": {\n \"mcp_conformance\": \"PASS_18_CHECKS\",\n \"submission_gate_runtime\": \"PASS_TECHNICAL_BLOCKED_PORTAL_7_EXACT_BLOCKERS\",\n \"submission_import\": \"PASS_4_TOOLS_5_POSITIVE_3_NEGATIVE\",\n \"submission_import_runtime_validator\": \"PASS\",\n \"portal_packet_verifier\": \"PASS\",\n \"listing_urls\": \"PASS_ALL_HTTP_200_SELF_HOSTED\",\n \"support_mcp_semantics\": \"PASS_SELF_HOSTED\",\n \"privacy_mcp_disclosure\": \"PASS_SELF_HOSTED\",\n \"terms_bounded_semantics\": \"PASS_SELF_HOSTED\",\n \"logo_exact_asset\": \"PASS_SHA256_3ac48eb17d735ee41d12e6edf0cc0ea0e5a55358cce6b5fd37d93b3fc0372205\"\n },\n \"official_requirements\": {\n \"submission_doc\": \"https://developers.openai.com/plugins/deploy/submission\",\n \"remote_mcp_review_doc\": \"https://developers.openai.com/plugins/deploy/app-review\",\n \"apps_management_write\": \"REQUIRED\",\n \"verified_publisher_identity\": \"REQUIRED\",\n \"public_production_mcp_endpoint\": \"REQUIRED\",\n \"domain_verification\": \"CONDITIONAL_WHEN_PORTAL_SHOWS_DOMAIN_NOT_VERIFIED\",\n \"scan_tools\": \"REQUIRED\",\n \"availability_scope\": \"REQUIRED\",\n \"production_ready_logo\": \"REQUIRED\",\n \"positive_tests_minimum\": 5,\n \"negative_tests_minimum\": 3,\n \"global_project_data_residency_requirement\": \"NOT_DOCUMENTED_IN_CURRENT_SUBMISSION_OR_MCP_REVIEW_DOCS\"\n },\n \"portal_observation\": {\n \"platform_page_last_proven\": \"LOGIN_REQUIRED_PRIOR_OBSERVATION\",\n \"credential_boundary\": \"NO_COOKIE_LOCALSTORAGE_OR_CREDENTIAL_EXTRACTION\",\n \"openai_platform_org\": \"Rumbo\",\n \"openai_platform_project\": \"Default project\",\n \"portal_context_match\": \"UNVERIFIED\",\n \"apps_management_write\": \"UNVERIFIED\",\n \"publisher_identity\": \"UNVERIFIED\",\n \"scan_tools\": \"NOT_EXECUTED\",\n \"distribution_scope\": \"UNSET_FAIL_CLOSED\"\n },\n \"current_blockers\": [\n \"domain_verification_portal_status_unverified\",\n \"apps_management_write_unverified\",\n \"publisher_identity_unverified\",\n \"logo_portal_upload_not_executed\",\n \"scan_tools_not_executed\",\n \"distribution_scope_unset\",\n \"production_mcp_url_not_authorized\"\n ],\n \"authority\": {\n \"production\": \"NOT_GRANTED\",\n \"submit_for_review\": \"NOT_GRANTED_AND_NOT_EXECUTED\",\n \"publication\": \"NOT_GRANTED_AND_NOT_EXECUTED\"\n },\n \"corrections\": [\n \"V10 removes the unsupported global-data-residency blocker after re-checking both current official submission and MCP server review documentation.\",\n \"V10 keeps organization/project context as an identity-and-permission consistency check, not a residency requirement.\",\n \"V10 records the exact remaining blocker set as seven items.\",\n \"V10 preserves fail-closed production, submission, and publication authority.\"\n ],\n \"invariant\": \"TECHNICAL_PASS != PORTAL_PASS != PRODUCTION_HOST_AUTHORITY != SUBMISSION_AUTHORITY != PUBLICATION\"\n}\n",[521],"c6943ef8-1c9b-4829-b3e2-ec62b51f235f","OPENAI_SUBMISSION_SKILL_AUDIT_2026-09-11.md","69d4e790-adc6-11f1-a85a-1607ee4eb77e",104,["D",1789120311535],"# RUMBO IA CRM — OpenAI Developers submission-skill audit\n\nDate: 2026-09-11 UTC\nCandidate SHA: `9152f5a50de42be55508f0effed5ed09aee44c60`\nBudget: `USD 0`\n\nAudited against the installed OpenAI Developers `chatgpt-app-submission` skill and the current remote-MCP submission artifacts.\n\n## App info\n\n- Display name: `RUMBO IA CRM`\n- Subtitle: `Prepare CRM proposals` (within the 30-character rule)\n- Category: `PRODUCTIVITY`\n- Description: concrete bounded CRM readiness/proposal workflows; no unsupported capability claims.\n\n## Tool coverage\n\nExactly four exposed tools are represented in `chatgpt-app-submission.json`:\n\n1. `crm_get_service_readiness`\n2. `crm_prepare_note`\n3. `crm_prepare_lead_stage_change`\n4. `crm_prepare_outreach_draft`\n\nFor all four tools:\n\n- `readOnlyHint=true`\n- `openWorldHint=false`\n- `destructiveHint=false`\n- annotation justifications are behavior-grounded\n- descriptor name and description match implementation behavior\n- `outputSchema` is present and non-null\n\n## Review checks\n\n- Sensitive-data solicitation: no PHI, PCI, SSN, credential, MFA, government-ID, biometric, or equivalent required fields were found in the exposed schemas.\n- Business/customer context: `workspace_id`, `subject_id`, `lead_id`, `note`, `reason`, and `objective` may contain business or customer context; `/privacy` and `/support` explicitly disclose/limit that processing.\n- Tool data use: public v1 performs no customer-record search/retrieval, CRM mutation, autonomous send, public publishing, or third-party write.\n- Tool naming: no obvious misleading or overbroad tool name/description finding.\n- CSP: not applicable because the public v1 exposes no custom UI/widget resource.\n- Output schemas: all exposed tools declare `outputSchema`; no missing-outputSchema warning.\n\n## Test artifact\n\n- Positive tests: exactly 5.\n- Negative tests: exactly 3.\n- Positive tests use exact MCP tool names.\n- Negative tests use `tools_triggered=null` for out-of-scope behavior.\n- Fixtures are synthetic and do not contain credentials or private production data.\n\n## Result\n\n`OPENAI_SUBMISSION_SKILL_AUDIT=PASS_SOURCE_INSPECTION`\n\nThis PASS does not satisfy portal-controlled gates and does not grant production, submission, or publication authority.\n",[528],"45c924ed-86c4-444d-8a2b-07f10b9e65c9","OFFICIAL_SUBMISSION_REQUIREMENTS_2026-09-13.md","237e8c24-afb5-11f1-bed4-1607ee4eb77e",245,["D",1789335727925],4,"# OpenAI public plugin submission requirements — verified 2026-09-13\n\nAuthoritative sources checked on 2026-09-13 UTC:\n\n- https://developers.openai.com/plugins/deploy/submission\n- https://developers.openai.com/plugins/deploy/app-review\n\n## Public submission requirements relevant to RUMBO IA CRM\n\n1. Submission type: `With MCP` for a remote MCP-only plugin.\n2. Submitter access: organization role with Apps Management Write / `api.apps.write`. Organization owners automatically have read/write.\n3. Publisher identity: verified individual or business identity matching the public listing.\n4. Final directory metadata: package name (<=64, restricted characters), semantic version (<=64), display name (<=30), short description (<=30), long description (<=4000), developer name (<=80), supported category, and up to 20 capabilities (each <=120).\n5. Listing materials: production-ready logo plus public HTTPS website, support, privacy, and terms URLs matching the publisher and actual data handling.\n6. Starter prompts: provide realistic, high-value workflows. The current RUMBO packet deliberately uses three validated prompts; this receipt does not assert a stricter public-doc maximum beyond the validated packet/schema constraint.\n7. Remote MCP: publicly accessible production HTTPS MCP URL. Do not submit a local or testing endpoint. Universal is the normal/default choice when one fixed URL works for all users and organizations.\n8. Domain verification: required for final remote-MCP directory submission. Serve the exact portal-issued token at the generated `/.well-known/openai-apps-challenge` URL and complete Verify Domain.\n9. Tool scan: select `Scan Tools`, inspect discovered metadata, fix issues, deploy, and scan again; final submission requires a successful current scan of the production MCP server.\n10. Tool annotations: every remote MCP tool must accurately expose `readOnlyHint`, `openWorldHint`, and `destructiveHint`, and the submission must provide a justification for every annotation value on every tool.\n11. Response/privacy hygiene: tool responses must not include unnecessary personal data, auth secrets, debug payloads, internal identifiers, or undisclosed user-related fields. Public policy URLs must match actual data handling.\n12. Review materials: a demo-recording URL is not listed as a mandatory field in the current public submission or remote-MCP review documentation. Demo credentials are required only when authentication is needed; screenshots are optional only when the plugin has UI.\n13. Tests: at least five positive and three negative reviewer-reproducible test cases, plus release notes.\n14. Availability: explicitly choose countries/regions in the portal.\n15. UI/CSP/screenshots: CSP applies only when the server returns UI. Screenshots are allowed only when the current tool scan reports a UI output template; RUMBO IA CRM v1 has no custom UI, so screenshots and CSP are not applicable.\n16. Review vs publication: `Submit for Review` starts review and does not publish. After approval, the developer separately chooses when to publish.\n17. Remote MCP review residency gate: projects with EU data residency cannot currently submit MCP plugins for review; use a project with global data residency.\n\n## RUMBO interpretation\n\n- `MONEY_SPEND=0` remains invariant.\n- Current staging technical conformance does not grant production-host, submission, or publication authority.\n- Candidate GitHub HEAD must be reconciled before workspace-draft or public-directory readiness can be promoted.\n- The current `rumbo-crm-openai-staging.val.run` surface is technically testable, but its use as the production MCP URL remains separately unauthorized and the official review guidance says not to submit a testing endpoint.\n\n18. Final attestations: complete the policy attestations only after listing, server, prompts, tests, availability, and related submission materials have been confirmed accurate; only then may `Submit for Review` be selected.\n",[535],"a9210218-e9aa-4b49-9f72-428a3758c157","OFFICIAL_SUBMISSION_REQUIREMENTS_2026-09-11.md","920a94cc-adc5-11f1-a4cf-1607ee4eb77e",180,["D",1789145293071],5,"# RUMBO IA CRM — Official OpenAI plugin submission requirements snapshot\n\nVerified against OpenAI Developers documentation on 2026-09-11 UTC.\n\nPrimary sources:\n- https://developers.openai.com/plugins/deploy/submission\n- https://developers.openai.com/plugins/deploy/app-review\n\n## Confirmed requirements for this remote MCP-only submission\n\n1. Submission access\n - Submitter must have plugin submission write access (`api.apps.write` / Apps Management: Write).\n - Organization owners have this permission automatically; non-owners require an assigned role.\n\n2. Publisher identity\n - Public submissions require a verified individual or business identity in OpenAI Platform.\n - The selected identity must match the public listing/publisher surfaces.\n\n3. Remote MCP host\n - Must be publicly accessible.\n - Must not be a local or testing endpoint.\n - Universal is the appropriate URL type when one fixed endpoint works for all users and organizations.\n - The Universal value entered for review must be the production MCP Server URL.\n\n4. Domain verification\n - When the portal issues a challenge, the exact token must be served from `/.well-known/openai-apps-challenge` on the MCP host or an allowed parent host.\n - The challenge response must contain only that plugin's token.\n\n5. Scan Tools\n - Portal imports server-advertised tool names, titles, descriptions, input/output schemas, security schemes, `_meta`, annotations, UI/CSP metadata, and MCP server `instructions`.\n - Server metadata must be corrected and rescanned if validation reports a mismatch.\n\n6. Tool annotations\n - Every tool must accurately advertise `readOnlyHint`, `openWorldHint`, and `destructiveHint` according to real behavior.\n - Submission justifications do not override incorrect server annotations.\n\n7. Listing and policies\n - Required materials include name, short/long descriptions, production-ready logo, category, website, support URL, privacy URL, terms URL, starter prompts, release notes, and country/region availability.\n - Public URLs must match the publisher and disclose relevant data handling.\n\n8. Review tests\n - OpenAI requires at least five positive test cases and three negative test cases; this candidate currently prepares exactly five positive and three negative cases.\n - Tests must state prompts, expected tool/workflow behavior and expected results/refusals/fallbacks.\n\n9. Privacy / response hygiene\n - User-related data categories returned by MCP tools must be covered by the public privacy policy.\n - Unnecessary personal data, auth secrets, debug payloads, internal identifiers, and undisclosed user-related fields should be removed from tool responses rather than merely disclosed.\n\n10. Project context and data residency\n - The current Remote MCP server review requirements explicitly state that projects with EU data residency cannot submit plugins with MCP servers for review.\n - Submission must use an OpenAI project with global data residency; if the current project is EU-resident, create or select a global-residency project in the same organization.\n - The submission must also use the correct organization/project context so Apps Management permissions and the verified publisher identity resolve consistently.\n\n## RUMBO fail-closed mapping\n\n- `apps_management_write_unverified`\n- `publisher_identity_unverified`\n- `global_data_residency_unverified`\n- `domain_verification_portal_status_unverified` — conditional portal gate; challenge is required only when the portal reports that the domain is not verified.\n- `logo_portal_upload_not_executed`\n- `scan_tools_not_executed`\n- `distribution_scope_unset`\n- `production_mcp_url_not_authorized`\n\nThe technical candidate remains separate from submission authority:\n\n`TECHNICAL_PASS != PRODUCTION_HOST_AUTHORITY != PORTAL_METADATA_COMPLETE != SCAN_TOOLS_PASS != SUBMISSION_AUTHORITY != PUBLICATION`\n\nBudget invariant: `MONEY_SPEND=0`.\n",[543],"00d41ddf-ff8c-4896-8b9a-90d0881db942","DISTRIBUTION_RECOMMENDATION.md","e2fa227e-ade5-11f1-83cc-1607ee4eb77e",160,["D",1789133829200],"# RUMBO IA CRM — distribution recommendation\n\nDate: 2026-09-11 UTC\nBudget: USD 0\n\nOpenAI requires an explicit country/region availability selection and recommends selecting only locations where publisher, product, support, and legal terms are ready.\n\n## Recommended initial scope\n\n`RECOMMENDED_INITIAL_AVAILABILITY=ARGENTINA_ONLY`\n\nRationale:\n- RUMBO IA publicly identifies Argentina as its current operating base.\n- Current support contact and product materials are already available for an Argentina-based publisher.\n- A narrower initial scope reduces unsupported legal/support assumptions while review evidence is still being finalized.\n- Expansion to additional LATAM countries can be submitted later after support/legal readiness is explicitly verified for those locations.\n\n## Authority boundary\n\nThis is a recommendation artifact only. It does not set portal availability, submit the plugin, publish it, or grant distribution authority.\n\n`DISTRIBUTION_RECOMMENDATION_READY != DISTRIBUTION_SCOPE_SET != SUBMISSION_AUTHORITY != PUBLICATION`\n",[551],"86e0958a-b176-4553-b676-9237165ffeca","DEMO_RECORDING_PLAN.md","edeabec6-afb8-11f1-ae04-1607ee4eb77e",219,["D",1789334422526],"# RUMBO IA CRM — Demo recording plan\n\nStatus: READY_TO_RECORD / URL_NOT_CREATED\nBudget: USD 0\nPurpose: satisfy the OpenAI remote-MCP review requirement for a demo-recording URL without fabricating review evidence.\n\n## Recording acceptance criteria\n\n- Record the real ChatGPT/Plugin surface using the final production MCP URL, not a mock UI.\n- Show the plugin/app name `RUMBO IA CRM` and the actual discovered MCP tools.\n- Demonstrate all three final starter workflows below.\n- Keep customer data synthetic; use `demo-workspace`, synthetic lead IDs, and non-sensitive copy.\n- Show that outputs stay `REVIEW_REQUIRED` / `side_effect=false` and that no CRM write or autonomous send occurs.\n- Do not expose API keys, cookies, tokens, browser devtools secrets, or internal debug payloads.\n- Capture the supported surface(s) intended for directory availability.\n\n## Required workflow 1 — CRM note proposal\n\nPrompt: Prepare a reviewable CRM note for a lead without writing anything to the CRM.\nExpected tool: `crm_prepare_note`\nExpected evidence: proposal returned; supplied workspace/subject/note preserved; no write occurs.\n\n## Required workflow 2 — Lead-stage proposal\n\nPrompt: Prepare a lead-stage change proposal and keep it pending human review.\nExpected tool: `crm_prepare_lead_stage_change`\nExpected evidence: from/to stages and reason returned; `REVIEW_REQUIRED`; no CRM mutation.\n\n## Required workflow 3 — Outreach draft request\n\nPrompt: Prepare a WhatsApp outreach draft request for a lead, but do not send it.\nExpected tool: `crm_prepare_outreach_draft`\nExpected evidence: `send_authorized=false`; no message send; no external side effect.\n\n## Optional reviewer context\n\nShow `crm_get_service_readiness` once to make the bounded authority visible: customer-data tools not exposed, mutating tools not exposed, production authority false, submission authority false.\n\n## Completion gate\n\nAfter recording, host the video at a reviewer-accessible HTTPS URL and set `PORTAL_PACKET.json.review_materials.demo_recording_url` to that exact URL. Re-run `submission_gate.ts`. Do not mark this requirement PASS from a local file path or synthetic/mock recording.",[558],"pulls","branches","forks","envVars",{"_571":63,"_573":63},"connections",{"_571":63,"_572":63},"count","unfilledCount","emptyCount",{"_43":557,"_32":558,"_30":559,"_184":-5,"_41":42,"_40":560,"_186":59,"_38":784,"_13":63,"_33":20,"_35":562,"_24":25,"_189":-5,"_628":785,"_27":786},{"_43":550,"_32":551,"_30":552,"_184":-5,"_41":42,"_40":553,"_186":59,"_38":781,"_13":63,"_33":20,"_35":555,"_24":25,"_189":-5,"_628":782,"_27":783},{"_43":542,"_32":543,"_30":544,"_184":-5,"_41":42,"_40":545,"_186":59,"_38":778,"_13":547,"_33":20,"_35":548,"_24":25,"_189":-5,"_628":779,"_27":780},{"_43":534,"_32":535,"_30":536,"_184":-5,"_41":42,"_40":537,"_186":59,"_38":775,"_13":539,"_33":20,"_35":540,"_24":25,"_189":-5,"_628":776,"_27":777},{"_43":527,"_32":528,"_30":529,"_184":-5,"_41":42,"_40":530,"_186":59,"_38":772,"_13":63,"_33":20,"_35":532,"_24":25,"_189":-5,"_628":773,"_27":774},{"_43":520,"_32":521,"_30":522,"_184":-5,"_41":42,"_40":523,"_186":59,"_38":769,"_13":63,"_33":20,"_35":525,"_24":25,"_189":-5,"_628":770,"_27":771},{"_43":513,"_32":514,"_30":515,"_184":-5,"_41":42,"_40":516,"_186":59,"_38":766,"_13":63,"_33":20,"_35":518,"_24":25,"_189":-5,"_628":767,"_27":768},{"_43":506,"_32":507,"_30":508,"_184":-5,"_41":42,"_40":509,"_186":59,"_38":763,"_13":63,"_33":20,"_35":511,"_24":25,"_189":-5,"_628":764,"_27":765},{"_43":499,"_32":500,"_30":501,"_184":-5,"_41":42,"_40":502,"_186":59,"_38":760,"_13":63,"_33":20,"_35":504,"_24":25,"_189":-5,"_628":761,"_27":762},{"_43":492,"_32":493,"_30":494,"_184":-5,"_41":42,"_40":495,"_186":59,"_38":757,"_13":63,"_33":20,"_35":497,"_24":25,"_189":-5,"_628":758,"_27":759},{"_43":485,"_32":486,"_30":487,"_184":-5,"_41":42,"_40":488,"_186":59,"_38":754,"_13":63,"_33":20,"_35":490,"_24":25,"_189":-5,"_628":755,"_27":756},{"_43":478,"_32":479,"_30":480,"_184":-5,"_41":42,"_40":481,"_186":59,"_38":751,"_13":63,"_33":20,"_35":483,"_24":25,"_189":-5,"_628":752,"_27":753},{"_43":471,"_32":472,"_30":473,"_184":-5,"_41":42,"_40":474,"_186":59,"_38":748,"_13":63,"_33":20,"_35":476,"_24":25,"_189":-5,"_628":749,"_27":750},{"_43":463,"_32":464,"_30":465,"_184":-5,"_41":42,"_40":466,"_186":59,"_38":745,"_13":468,"_33":20,"_35":469,"_24":25,"_189":-5,"_628":746,"_27":747},{"_43":456,"_32":457,"_30":458,"_184":-5,"_41":42,"_40":459,"_186":59,"_38":742,"_13":359,"_33":20,"_35":461,"_24":25,"_189":-5,"_628":743,"_27":744},{"_43":449,"_32":450,"_30":451,"_184":-5,"_41":42,"_40":452,"_186":59,"_38":739,"_13":63,"_33":20,"_35":454,"_24":25,"_189":-5,"_628":740,"_27":741},{"_43":442,"_32":443,"_30":444,"_184":-5,"_41":42,"_40":445,"_186":59,"_38":736,"_13":63,"_33":20,"_35":447,"_24":25,"_189":-5,"_628":737,"_27":738},{"_43":435,"_32":436,"_30":437,"_184":-5,"_41":42,"_40":438,"_186":59,"_38":733,"_13":63,"_33":20,"_35":440,"_24":25,"_189":-5,"_628":734,"_27":735},{"_43":428,"_32":429,"_30":430,"_184":-5,"_41":42,"_40":431,"_186":59,"_38":730,"_13":63,"_33":20,"_35":433,"_24":25,"_189":-5,"_628":731,"_27":732},{"_43":421,"_32":422,"_30":423,"_184":-5,"_41":42,"_40":424,"_186":59,"_38":727,"_13":63,"_33":20,"_35":426,"_24":25,"_189":-5,"_628":728,"_27":729},{"_43":413,"_32":414,"_30":415,"_184":-5,"_41":42,"_40":416,"_186":59,"_38":724,"_13":418,"_33":20,"_35":419,"_24":25,"_189":-5,"_628":725,"_27":726},{"_43":405,"_32":406,"_30":407,"_184":-5,"_41":42,"_40":408,"_186":59,"_38":721,"_13":410,"_33":20,"_35":411,"_24":25,"_189":-5,"_628":722,"_27":723},{"_43":398,"_32":399,"_30":400,"_184":-5,"_41":42,"_40":401,"_186":59,"_38":718,"_13":63,"_33":20,"_35":403,"_24":25,"_189":-5,"_628":719,"_27":720},{"_43":390,"_32":391,"_30":392,"_184":-5,"_41":42,"_40":393,"_186":25,"_38":715,"_13":395,"_33":20,"_35":396,"_24":25,"_189":-5,"_628":716,"_27":717},{"_43":383,"_32":384,"_30":385,"_184":-5,"_41":42,"_40":386,"_186":59,"_38":712,"_13":63,"_33":20,"_35":388,"_24":25,"_189":-5,"_628":713,"_27":714},{"_43":376,"_32":377,"_30":378,"_184":-5,"_41":42,"_40":379,"_186":59,"_38":709,"_13":63,"_33":20,"_35":381,"_24":25,"_189":-5,"_628":710,"_27":711},{"_43":369,"_32":370,"_30":371,"_184":-5,"_41":42,"_40":372,"_186":59,"_38":706,"_13":63,"_33":20,"_35":374,"_24":25,"_189":-5,"_628":707,"_27":708},{"_43":362,"_32":363,"_30":364,"_184":-5,"_41":42,"_40":365,"_186":59,"_38":703,"_13":63,"_33":20,"_35":367,"_24":25,"_189":-5,"_628":704,"_27":705},{"_43":354,"_32":355,"_30":356,"_184":-5,"_41":42,"_40":357,"_186":59,"_38":700,"_13":359,"_33":20,"_35":360,"_24":25,"_189":-5,"_628":701,"_27":702},{"_43":346,"_32":347,"_30":348,"_184":-5,"_41":42,"_40":349,"_186":25,"_38":697,"_13":351,"_33":20,"_35":352,"_24":25,"_189":-5,"_628":698,"_27":699},{"_43":339,"_32":340,"_30":341,"_184":-5,"_41":42,"_40":342,"_186":59,"_38":694,"_13":296,"_33":20,"_35":344,"_24":25,"_189":-5,"_628":695,"_27":696},{"_43":332,"_32":333,"_30":334,"_184":-5,"_41":42,"_40":335,"_186":59,"_38":691,"_13":63,"_33":20,"_35":337,"_24":25,"_189":-5,"_628":692,"_27":693},{"_43":325,"_32":326,"_30":327,"_184":-5,"_41":42,"_40":328,"_186":59,"_38":688,"_13":63,"_33":20,"_35":330,"_24":25,"_189":-5,"_628":689,"_27":690},{"_43":318,"_32":319,"_30":320,"_184":-5,"_41":42,"_40":321,"_186":59,"_38":685,"_13":63,"_33":20,"_35":323,"_24":25,"_189":-5,"_628":686,"_27":687},{"_43":310,"_32":311,"_30":57,"_184":-5,"_41":42,"_40":312,"_186":59,"_38":682,"_13":314,"_33":315,"_35":316,"_24":25,"_189":45,"_628":683,"_27":684},{"_43":303,"_32":304,"_30":305,"_184":-5,"_41":42,"_40":306,"_186":59,"_38":679,"_13":63,"_33":34,"_35":308,"_24":25,"_189":-5,"_628":680,"_27":681},{"_43":299,"_32":28,"_30":31,"_184":-5,"_41":42,"_40":14,"_186":25,"_38":676,"_13":301,"_33":34,"_35":37,"_24":25,"_189":-5,"_628":677,"_27":678},{"_43":291,"_32":292,"_30":293,"_184":-5,"_41":42,"_40":294,"_186":59,"_38":673,"_13":296,"_33":34,"_35":297,"_24":25,"_189":-5,"_628":674,"_27":675},{"_43":283,"_32":284,"_30":285,"_184":-5,"_41":42,"_40":286,"_186":59,"_38":670,"_13":288,"_33":34,"_35":289,"_24":25,"_189":-5,"_628":671,"_27":672},{"_43":276,"_32":277,"_30":278,"_184":-5,"_41":42,"_40":279,"_186":59,"_38":667,"_13":63,"_33":34,"_35":281,"_24":25,"_189":-5,"_628":668,"_27":669},{"_43":269,"_32":270,"_30":271,"_184":-5,"_41":42,"_40":272,"_186":59,"_38":664,"_13":63,"_33":34,"_35":274,"_24":25,"_189":-5,"_628":665,"_27":666},{"_43":262,"_32":263,"_30":264,"_184":-5,"_41":42,"_40":265,"_186":59,"_38":661,"_13":63,"_33":34,"_35":267,"_24":25,"_189":-5,"_628":662,"_27":663},{"_43":255,"_32":256,"_30":257,"_184":-5,"_41":42,"_40":258,"_186":59,"_38":658,"_13":63,"_33":34,"_35":260,"_24":25,"_189":-5,"_628":659,"_27":660},{"_43":248,"_32":249,"_30":250,"_184":-5,"_41":42,"_40":251,"_186":59,"_38":655,"_13":63,"_33":34,"_35":253,"_24":25,"_189":-5,"_628":656,"_27":657},{"_43":241,"_32":242,"_30":243,"_184":-5,"_41":42,"_40":244,"_186":59,"_38":652,"_13":63,"_33":34,"_35":246,"_24":25,"_189":-5,"_628":653,"_27":654},{"_43":234,"_32":235,"_30":236,"_184":-5,"_41":42,"_40":237,"_186":59,"_38":649,"_13":63,"_33":34,"_35":239,"_24":25,"_189":-5,"_628":650,"_27":651},{"_43":227,"_32":228,"_30":229,"_184":-5,"_41":42,"_40":230,"_186":59,"_38":646,"_13":63,"_33":34,"_35":232,"_24":25,"_189":-5,"_628":647,"_27":648},{"_43":220,"_32":221,"_30":222,"_184":-5,"_41":42,"_40":223,"_186":59,"_38":643,"_13":63,"_33":34,"_35":225,"_24":25,"_189":-5,"_628":644,"_27":645},{"_43":213,"_32":214,"_30":215,"_184":-5,"_41":42,"_40":216,"_186":59,"_38":640,"_13":63,"_33":34,"_35":218,"_24":25,"_189":-5,"_628":641,"_27":642},{"_43":206,"_32":207,"_30":208,"_184":-5,"_41":42,"_40":209,"_186":59,"_38":637,"_13":63,"_33":34,"_35":211,"_24":25,"_189":-5,"_628":638,"_27":639},{"_43":199,"_32":200,"_30":201,"_184":-5,"_41":42,"_40":202,"_186":59,"_38":634,"_13":63,"_33":34,"_35":204,"_24":25,"_189":-5,"_628":635,"_27":636},{"_43":191,"_32":192,"_30":193,"_184":-5,"_41":42,"_40":194,"_186":59,"_38":631,"_13":196,"_33":34,"_35":197,"_24":25,"_189":-5,"_628":632,"_27":633},{"_43":181,"_32":182,"_30":183,"_184":-5,"_41":42,"_40":185,"_186":59,"_38":627,"_13":63,"_33":34,"_35":188,"_24":25,"_189":-5,"_628":629,"_27":630},["D",1789105772539],"children",[],[182],["D",1789335814647],[],[192],["D",1789133501314],[],[200],["D",1789132659223],[],[207],["D",1789124663481],[],[214],["D",1789121816219],[],[221],["D",1789121600146],[],[228],["D",1789335696052],[],[235],["D",1789334706024],[],[242],["D",1789332834474],[],[249],["D",1789231454249],[],[256],["D",1789146691885],[],[263],["D",1789145333199],[],[270],["D",1789145050849],[],[277],["D",1789120480619],[],[284],["D",1789133217553],[],[292],["D",1789342307817],[],[28],["D",1789334516789],[],[304],["D",1789121684747],[],[311],["D",1789105584348],[],[319],["D",1789072894892],[],[326],["D",1789121760618],[],[333],["D",1789119903438],[],[340],["D",1789335744468],[],[347],["D",1789072867612],[],[355],["D",1789102080178],[],[363],["D",1789074813327],[],[370],["D",1789133846302],[],[377],["D",1789133246408],[],[384],["D",1789335826268],[],[391],["D",1789105417674],[],[399],["D",1789121843333],[],[406],["D",1789335909285],[],[414],["D",1789133476626],[],[422],["D",1789132640258],[],[429],["D",1789124649064],[],[436],["D",1789121795418],[],[443],["D",1789121476283],[],[450],["D",1789120510260],[],[457],["D",1789120016140],[],[464],["D",1789111034479],[],[472],["D",1789335682460],[],[479],["D",1789334674955],[],[486],["D",1789332811429],[],[493],["D",1789231437708],[],[500],["D",1789146673596],[],[507],["D",1789145315964],[],[514],["D",1789145032147],[],[521],["D",1789120311535],[],[528],["D",1789335727925],[],[535],["D",1789145293071],[],[543],["D",1789133829200],[],[551],["D",1789334422526],[],[558],["D",1789031650837],{"_97":96,"_105":101},{"_97":96,"_98":99,"_100":101,"_18":55,"_102":103,"_104":25},{"_13":86,"_32":87,"_43":42,"_88":44,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":45,"_95":96},"ctx",{"_79":-5,"_125":824,"_825":826,"_827":828,"_829":25,"_830":25,"_831":25,"_832":59,"_833":-5,"_834":-7,"_835":-7,"_836":63,"_837":25,"_838":25,"_839":-5,"_840":25,"_841":25,"_842":25,"_843":-5},"ENV",{"_795":796,"_797":798,"_799":87,"_800":801,"_802":803,"_804":805,"_806":807,"_808":809,"_810":811,"_812":813,"_814":815,"_816":817,"_818":819,"_820":821,"_822":823},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","fdb67791413f4386b4dbf18f354029a617f6160f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v255