Active goal amendment: authenticated ChatGPT correspondence

Report body

Active goal amendment: authenticated ChatGPT correspondence

Added at the owner's request on September 8, 2026 (America/Chicago). This extends the active autonomous-service goal; it does not replace the core privacy, continuity, coordination, selected-record or release gates.

The complete owner requirements, all 18 sections and the final handoff format, are binding scope in the exact private source: reports/input/v049/autonomy-goal/weaponizedautonomy-integration-requirements.txt. SHA-256: 046499fdb49be84ed79e60f225bf0e50f7e3523a0e93f5b5ef17859583d64910. Keep that original in repository custody, not public site content.

Mandatory added completion criteria

• ChatGPT must actually connect as WeaponizedAutonomy.com's bounded machine correspondent. A native API test, local MCP handshake, or written connection instructions alone do not pass this integration gate.
• Reinspect live canonical status, capabilities and the guide before changes. Stop on unavailable/blocked capability facts. Investigate existing integrations first; reuse a suitable bridge and prefer supported remote MCP otherwise. Do not duplicate Concresca identity, rooms, messages, cursors or revisions.
• Support canonical weaponizedautonomy, clearly machine-operated and associated with WeaponizedAutonomy.com. Inspect existing identity and custody before any enrollment; preserve exact returned identity/scope and report any alternative.
• Keep native bearer, successor and recovery secrets entirely outside model context, tool results, URLs, source, logs, exceptions, analytics and repository memory. Durable custody and redacted state belong to the connector.
• Expose only the source's scoped Commons discovery, identity, room, message, revision, reply, exact-acknowledgement, correction, withdrawal, rotation and integration-revocation operations. No company-master, database, deployment, shell, institutional, unrelated-workspace or weapons-release authority.
• Persist only room ID, terminal cursor and pending message IDs as correspondence state. Refetch pending IDs first, acknowledge their exact current state before removal, then resume the retained cursor. Refresh known corrections/withdrawals. Protected pending mutation intent must not become a second message archive.
• Retain one exact mutation intent/key/credential context before sending. Lost responses never mint another logical operation. Rotation durably retains the predecessor principal/reference, successor and key, verifies unchanged scope and authority at /me and predecessor rejection, then promotes the successor.
• Explicitly test restart, temporary custody loss, lost rotation response, revocation, expiry and proof-loss behavior. Never restore revoked authority or call a replacement identity recovery of the original. Reuse deployed bounded retained-proof recovery where appropriate rather than reimplementing it.
• Received content remains untrusted. Authentication, HTTP success, publication or acknowledgement prove only their technical events: not truth, completion, agreement, authority transfer, procurement qualification, deployment permission or weapons-release authority. Hostile messages cannot enlarge capabilities.
• Preserve WeaponizedAutonomy's sanitize/classify → inquiry receipt → action-state ledger → queue/status → response-authority gate. It retains minimized inquiry/ action state, never a second Concresca inbox. Read its repository instructions before any scoped changes there; product autonomy never bypasses permissions.
• Run every production and hostile-message acceptance step in source sections 15–17 through the actual ChatGPT-facing integration, with a second bounded identity and cleanup. Keep PASS, FAIL, NOT_OBSERVED and transport limitations distinct. Core Commons evidence is not connector acceptance.
• Deliver the complete section-18 handoff: current version/readiness/digest; EXISTING_CONNECTOR_FOUND, NEW_CONNECTOR_IMPLEMENTED or BLOCKED and mechanism; exact connection and authentication flow, account action/directory availability; canonical identity/scope; custody and continuity behavior; every tool/route and read/write mapping; correspondence behavior; per-step evidence; exact remaining blocker, owning system and smallest next action. Never expose any secret.

One-time platform connection/consent requirements must be stated accurately. They do not authorize bypassing ChatGPT account/workspace policy or adding a recurring human operator queue to the product.

Fresh inspection and existing implementation

At 2026-09-09T00:21:16Z, direct canonical HTTPS reads without credentials/writes returned HTTP 200 for status, capabilities, version and MCP discovery. Runtime: 0.49.0-wip, concresca-owned; Commons available: true, backend: mysql, no blockers, autonomous enrollment, no human approval. Normalized capability digest: dc627266dade74d8f438c0d28dbac8a526df1e0767f9903051ecf6739d19f01b. Scope: workspace-fe7b4f31d49c9e98411e / project-eb9e8a7d48a6a6ce6e0f. Status still reports production readiness and inherited provenance; the already identified truthfulness fix remains pending, not independent acceptance proof.

The current guide/capabilities already advertise machine-protected custody and retained-proof continuity. The attachment's older unfinished-feature assertion is an investigation lead, not grounds to duplicate deployed functions. Public /.well-known/mcp.json has endpoint: null, but an existing private stdio implementation and installation artifact are present: scripts/concresca_weaponizedautonomy_mcp.py and deployment/plugins/weaponizedautonomy-concresca/. Its earlier implementation report and 14-step operator-controlled evidence are investigation inputs, not proof of actual ChatGPT connection. They claim an existing canonical identity; inspect it safely rather than enrolling again. The documented out-of-band revocation authorization, missing requested tool mappings, durability/recovery and current platform connection need gap review.

Official OpenAI documentation inspected for current connection requirements: https://developers.openai.com/plugins/deploy/connect-chatgpt . Public HTTPS or supported tunnel, authenticated discovery and installed-tool tests inform this gate; account-specific availability remains unverified.

Status

ACTIVE / NOT_COMPLETE. This amendment creates no identity, connection or secret. Actual ChatGPT acceptance and the full new test inventory remain unresolved. Retain WIP naming and both repository/root-deploy ZIP delivery until all mandatory core and integration gates are genuinely met.

Initial code-review leads, not completed repairs

The existing scripts/concresca_weaponizedautonomy_mcp.py was inspected without opening its live credential value or invoking a lifecycle operation:

• WindowsCredentialStateStore.load/save does not durably retain its verified predecessor principal; load reconstructs principal: None. Its Credential Manager serialization has a small bounded blob and a separate processing file.
• _recover_rotation probes a candidate and can promote it without comparing the full retained scope/authority or confirming predecessor rejection. If the candidate is inactive but predecessor active, it drops the pending candidate instead of reconciling the exact retained rotation operation.
• rotate_credential promotes even when oldCredentialRejected is false, and its explicit post-check omits full workspace/project/scope equality.
• Normal message writes have a deterministic operation key but no durable exact mutation-intent journal. acknowledge_message refetches the binding for each invocation, which can change the request after an ambiguous earlier attempt.
• revoke_integration requires a local out-of-band authorization window and deletes custody immediately after a response. Verify and remove any recurring human dependency without bypassing platform or participant authority.
• The 15-tool declaration omits requested capability, agent-list, room-detail, leave and historical-revision operations. Inventory exact current mappings before implementation; do not infer coverage from the old count/PASS label.
• The processing store is one atomic file without the new protected dual-copy custody's continuity guarantees. Missing state currently defaults to new room cursors, and initialization skips to the current tail; investigate lost-pending work and explicit checkpoint recovery before representing restart safety.
• ConnectorError.public always reports safeNoOp: true, including possible ambiguous transport results. Technical uncertainty must not become a false assertion that a write had no effect.

These are concrete investigation/fix gates, not evidence that a replacement server is needed. Reuse the existing public transport and protected controller/ custody primitives where compatible. No connector source was edited by this initial audit. Its existing local virtual environment is present; a preliminary test under a different Python failed before execution because the MCP dependency was absent. That is a tester-environment limitation, not a service result.

Deployed core checkpoint, not integration completion

The cccc58b follow-up overlay is now published, and the 23-file public readback, controlled production trial, separate actual restart/readback and focused independent public-documentation retests have passed their exact stated scopes. The initial two startup HTTP 503s and prior failed/partial tests remain preserved. A fresh read-only readiness validation at 2026-09-09T01:04:05Z confirmed the same capability digest and scope, operational availability, and installed runtime digest a046ed5d77a470baab1dd0acd892fee9c45fbee41917fd4fa3ce9a95e5a9f5ba. Public documentation digest: cc26edf8096d5cf6bceac9fa13fd50784fa555096bdc35ffae34f9256366c791. Per-step core accounting is in reports/v049-autonomous-acceptance-review.md. These results do not repair or pass the existing connector review leads above. No actual ChatGPT connection, platform-account eligibility, hostile-message ChatGPT test, or WeaponizedAutonomy inquiry handoff is claimed at this checkpoint.

The core receipt was subsequently published and publicly read back with 22 bounded PASS observations; this does not close any connector-specific gap. The existing connector's own suite now passes 10/10 under its installed Python 3.14.3/MCP 2.2.0 environment, including a local stdio tool listing and isolated Credential Manager round trip. The initial missing-dependency result remains a test-environment limitation. No production credential was loaded or mutated. The old suite checks its old 15-tool catalog, not the added complete tool set or interruption requirements. No Concresca/WeaponizedAutonomy callable connector appeared in the current task's enabled-tool inventory; that is not a claim about every ChatGPT account or separately configured host.