Dave's ruling on TASK-3345 #2. What Pad attaches to a ChatGPT response
(internal ids, account emails, an email-shaped display name) is stripped;
what users wrote (titles, bodies, comments, field values) passes through
unchanged. The stated invariant in chatgpt_project.go, the catalog doc
comment and the plugin's longDescription now say exactly that. No
behaviour change.
Dave's ruling: the legal entity is Perpetual Software LLC and there is
no dba, so "Perpetual Software" never names the entity without "LLC".
Fixed: the ChatGPT plugin's author and developerName, both Claude
plugin manifests' author/owner, the brand spec's copyright format, the
cloud email footers (HTML and plain), and the auth-page footer. The
guard test now pins the ChatGPT package's developerName and author to
the full name, and the email tests expect it. LICENSE already said
"Perpetual Software LLC"; goreleaser, the Dockerfiles and Nix carry no
entity name.
The self-hosted email test keeps asserting the bare substring is
ABSENT: the shorter string is the stricter check there.
Co-authored-by: Claude <noreply@anthropic.com>
OpenAI verifies a plugin's domain by fetching the token its dashboard
issued from /.well-known/openai-apps-challenge on the MCP host, and the
body must be the token alone.
PAD_OPENAI_APPS_CHALLENGE (toml openai_apps_challenge) resolves into
config.MCPEndpoints, so it reaches the server through the existing
SetMCPConfig binding. A value with inner whitespace or a control
character, or over 1024 bytes, is refused into Problems() and logged at
startup rather than served.
The route answers 200 text/plain with exactly the token only on cloud,
only with a token set, and only on the MCP URL's host. Every other case
is the U0a JSON 404, byte-identical to an unowned well-known path. It is
not behind the MCP or OAuth availability gates, because verification
happens before the plugin server is switched on.
Co-authored-by: Claude <noreply@anthropic.com>
scripts/chatgpt-review-seed.sh resets the Acme Launch workspace to the
state the plugin's review test cases expect (DOC-3328 section 4),
through the pad CLI as whichever account it is signed in as. It
creates no account. It archives live items outside Conventions and
Playbooks, creates the workspace and a Bugs collection if missing,
re-creates the seed items, links and comments, then checks every test
case's precondition; --verify-only runs just the check. It refuses
without --yes, and refuses any slug but acme-launch without
--allow-other-slug.
Running it against a throwaway server corrected two assumptions:
full-text search does not stem, so the login bug's body says "timing
out" (the query "login timing out" found nothing before), and
what_next recommends the in-progress onboarding task before the open
high-priority one, so P1's expected behaviour now names both, and the
Dark mode idea is seeded "new" (an exploring idea ranks as in
progress).
Co-authored-by: Claude <noreply@anthropic.com>
* feat(chatgpt): the Pad plugin package for OpenAI's plugin directory (TASK-3321 U4)
integrations/chatgpt holds the Agent Plugins 1.0.0 package OpenAI's
submission takes: plugin.json (listing metadata plus exactly 5
positive and 3 negative review test cases), mcp.json (the one MCP
server, the /mcp/chatgpt catalog), an MCP-only Pad skill naming only
the 21 ChatGPTCatalog tools, and icon assets. Local files only:
nothing is submitted or registered, and there is no challenge file.
internal/mcp/chatgpt_plugin_package_test.go keeps the package tied to
the catalog: every tool the skill or a test case names must be a
catalog tool, the skill must carry no CLI or filesystem marks, and
the documented submission limits must hold (field lengths, case
counts, square icons, brand contrast, one server, no apps or hooks).
The submission metadata draft, reviewer demo account seed and gap
list are DOC-3328.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(chatgpt): the plugin's MCP server is mcp.getpad.dev/mcp/chatgpt (TASK-3321 U4)
Ruled on TASK-3321: the ChatGPT catalog mounts on the MCP host, beside
the canonical /mcp resource. mcp.json, the guard test's URL and the
README follow; links to the Pad app stay on app.getpad.dev.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
xarmian