GoodQA plugin delivery plan

Status: proposed implementation contract, not a submission or live-authentication receipt. Baseline: 3de5507154a219067bd0093daa8adf11ea5c6575.

Deliver GoodQA-authored integrations for the universal ChatGPT/Codex directory, Claude, Cursor, Grok Build and Grok Bot. Vendor review or listing approval remains separate from engineering readiness. Do not publish the private product repository, credentials, reviewer data or internal evidence.

Existing source and ownership

The public-bot generator already builds three credential-free MCP packages, deterministic ZIPs, listing assets and an evidence ledger. Its unchanged baseline offline check passed on November 1; this establishes package consistency, not vendor authentication. Draft PR 1107 contains the existing Claude callback and authenticated catalog-verifier work and must be reconciled rather than duplicated. PR 1095 owns pairing/notification work; this lane does not edit those files.

The OAuth service already provides PKCE, resource/audience binding, rotating refresh tokens, revocation, identity step-up and organization-bound grants. Ordinary members can currently consent only to the three base scopes in explicitly opted-in organizations. The public plugin package requests only goodqa:read, goodqa:write and goodqa:issues.

Current distribution contracts

The following official sources were opened on November 1, 2026. Their pages are evidence, not permission to publish or approve access.

Client	Source and resulting contract
ChatGPT/Codex	Plugin submission: one portable package and universal public directory. Server-wide OAuth is valid; optional per-tool declarations are not a substitute for actual connection proof.
Claude	Plugin submission, connector submission, authentication: a GitHub-hosted plugin and a separately submitted remote connector, with real client testing. Local CLI validation does not replace portal validation.
Cursor	Plugin reference, MCP authentication: public Git repository and marketplace review; Agent Plugins or Cursor manifests are supported. Dynamic registration may use the exact hosted callback as well as loopback.
Grok Build	Official marketplace: a catalog pull request, full commit pin for remote source, generated index and catalog validation. This does not publish a Grok Bot template.
Grok Bot	Bot templates, connected apps: templates are created and published through the app. Supply reviewed setup instructions and public configuration, never invent an import ZIP schema or include the publisher's accounts.

Packaging implementation

1. Add a distinct Cursor package and archive using its documented manifest/MCP format. Keep the fixed HTTPS server, no embedded headers, commands, secrets or client-secret configuration.
2. Add a separate Grok Bot template handoff: job/instructions, safe connection steps, recipient-owned OAuth, privacy, approval boundaries, verification cases and a final publish checklist. State that app creation/connection/publishing has not been performed. No fictitious machine-import format.
3. Produce a small repository-ready source layout containing the complete client package files, license, logo, documentation and pinned checksums. It must be safe to publish independently of this monorepo and satisfy the stricter vendor path/file/size rules. Keep deployment archives distinct from source/review handoffs. Do not claim a non-standalone generator archive is a complete standalone build checkout.
4. Retain one ChatGPT/Codex package. If Custom GPT Actions is an intended separate deliverable, provide its OpenAPI/instructions and exact callback handoff separately; MCP is not Actions.
5. Correct the ledger: server-wide OAuth, real-client connection and live scope/revocation checks are mandatory; explicit per-tool OAuth metadata is recommended for the uniform protected-server mode, and tool-level challenges apply when that linking path is used. Do not mark protected tools as unauthenticated or remove a genuine observed failure.

Existing consent policy and required authentication work

First submission uses a populated reviewer account in an existing explicitly eligible QA organization. A new global member-admission switch is not a prerequisite. Preserve the current organization opt-in, explicit denials, three base scopes, live membership, session-bound identity step-up and transaction checks. Availability requirements must be accurate in the public listing: an arbitrary member of an ineligible organization cannot connect merely because a plugin exists.

Preserve exact resource, registered redirect, PKCE S256, one-use code, refresh rotation, absolute expiry and revocation. Scope or organization changes require fresh consent. Agents cannot consent, approve their own access, or replay someone else's proof. Existing platform-admin scope behavior is not expanded.

Reconcile the already-written exact Claude callback guard and authenticated catalog verifier in PR 1107. Add another callback only where current official documentation establishes its exact surface and path. Host allowlisting must not accidentally authorize arbitrary vendor paths or subdomains. Source changes require independent review and focused causal controls. Production configuration, actual consent/access grants and publication are root-owned final steps.

A future general-member rollout may need a separately reviewed default-off policy switch and preserved organization opt-outs. It is explicitly deferred and cannot block the controlled reviewer flow or packaging work in this plan. No new UI button or native coordinator/Hive-continuity work is part of this lane.

Failure-first controls and acceptance

Package controls first prove that the current generator lacks the requested Cursor package and separate Grok Bot handoff. Retain the baseline offline-check pass to distinguish a missing contract from a broken fixture. Strengthen checks for exact file lists, credential absence, manifest paths, URL/redirect precision, deterministic archive bytes and immutable evidence status.

For required auth repairs, use the real route and token pipeline with only the database/network boundaries faked where appropriate, plus owning pooled-database tests on DEV2. Controls must discriminate the existing eligible-organization member flow, organization opt-out, non-members, scope escalation, agent credentials, missing/stale/wrong-session step-up, altered redirect/PKCE/resource, concurrent policy revocation, refresh reuse and revoked access. Refusal must mint nothing and must not spend the step-up proof. Include positive cases for the unchanged organization pilot and normal base grants.

An offline pass, public discovery response, local install or API mock never satisfies a client gate. For each actual client, use a sample-data reviewer account, observe consent and exact scopes, read the authorized identity/organization, exercise permitted issue work and denied foreign access, then revoke and prove that the old connection is refused. Record exact source/deployment, client version, artifact digest and receipts, without credentials. Root owns interactive clients.

Delivery increments and remaining external gates

1. Tests-first contract and this plan; independent review.
2. Cursor/Grok Bot/source handoffs and corrected ledger; offline negative controls.
3. Reconciled callback/catalog and demonstrated auth repairs; owning tests and fresh review.
4. Reviewed release and bounded consent canary; actual client proof in parallel where access exists.
5. Repository-ready and portal-ready inputs, precise final approvals, submission receipts.

Publisher identity, portal role/domain checks, account access, required legal acknowledgments and vendor review queues are external gates. Engineering work continues on independent pieces when one gate waits. Never present a conditional engineering estimate as a guaranteed listing date.

Finite follow-on: documented ChatGPT callback and evidence precision

Baseline 46ed9c9367284c5dce52e032fdc690806cec6f9d has exact Claude and Cursor hosted callback pins, but inherits generic HTTPS host grants for other configured hosts. The selected production configuration reported by the release owner contains www.cursor.com, chatgpt.com and grok.com. This report is configuration evidence, not a live sign-in or authorization grant.

Narrow only the established ChatGPT callback to exactly https://chatgpt.com/connector_platform_oauth_redirect, and only when its host is explicitly enabled. Keep registration and stored-client revalidation using the same policy. Reject alternate paths, suffixes, queries, fragments, credentials, ports, schemes and lookalike hosts. Preserve exact registered redirect matching and the existing HTTP loopback port behavior. Controls first must show the generic ChatGPT path is currently admitted and the intended exact pin is absent.

Do not invent a Grok callback or silently remove its live host configuration. Other explicitly configured HTTPS hosts, including the legacy grok.com grant, retain generic path/port behavior. This is a residual policy limitation for the release owner to assess; three known URI pins do not establish a global exact-URI policy. The unknown Grok callback and unobserved client proof remain open. Unlisted hosts remain refused. No protocol, consent, global eligibility or rollout change belongs to this follow-on.

The same finite patch corrects stale offline-checker wording: a live scan verifier exists, but its bracketed public probes cannot prove each MCP response's serving backend or a vendor portal scan. Keep the conservative evidence gate. Strengthen scan refusal tests to assert exact error messages and exercise each existing guard, so an unrelated TypeError cannot satisfy them. Correct design claims that a private cursor:// scheme/config switch is implemented: it is deferred, unsupported by the current runtime, and cannot be enabled by editing an imaginary configuration field.

The five distributable ZIPs must remain byte-identical. Only the engineering snapshot changes when its embedded scripts, tests or evidence docs change. Obtain independent plan review before the ChatGPT runtime edit, run focused source/bundle controls through the normal DEV2 broker, and request review of the final commit before any root-owned activation. Existing source and SDK results keep their original commit attribution; they are not vendor or field success proof.

Owning SDK positive write control

Extend the existing pooled PostgreSQL SDK flow without changing runtime authorization. Seed one disposable project in the granted organization and one in the ungranted organization, both owned by the synthetic actor. Before the write-capable grant, the existing read-only grant must refuse create_issue on the same allowed project and an independent DB query must find no issue. Then explicitly consent only the three base scopes, create exactly one synthetic issue through the real SDK/MCP route, fetch that issue through the SDK and compare its ID/project/title with the independent DB row. Attempt the same operation on the ungranted project and verify refusal plus zero foreign rows and no extra allowed rows. Explicitly revoke this write grant and prove its old access cannot read the created issue. Do not bypass approval-required results or broaden granted scopes. No model/vendor calls or persistent production fixture writes are involved. Optional commenting is omitted to keep the fixture finite. The positive and same-operation refusal/no-write controls address integration coverage, not real vendor-client or ordinary-member consent proof; the test retains a synthetic admin and stubbed session.

Existing Cursor public release reconciliation

The root release audit found the existing public repository ericmacdougall/goodqa-cursor-plugin at commit cfefcaf7ef8e4b8047e1f7842c6bd188da8774b2, version 0.1.2, using manual-token configuration. Preserve that repository and history; do not create a competing official repository or overwrite its main branch. The new OAuth package must advance Cursor alone to 0.2.0, with an explicit generator version override and archive name. Other four distributable ZIPs remain identical.

First add a failing package contract requiring Cursor 0.2.0 to be newer than the known published 0.1.2. Then add a precise checker mutation refusing a regression to that old version, not merely a stale-archive warning. Document migration from the manual-token package: remove the old manual credential configuration, install the reviewed upgrade through the existing source, authorize through the normal GoodQA OAuth flow, verify identity/organization, and revoke the old credential in normal settings after the new connection works. Do not copy credentials or claim the old token was revoked. Existing user/org eligibility still applies. No runtime authorization or production configuration changes.

Regenerate only Cursor's distributable and the private engineering snapshot/manifest, verify the other four ZIP hashes are unchanged, run affected bundle controls and obtain independent review. Root owns the exact local/public source handoff and any draft PR based on the existing public commit; this owner does not publish or force-update that repository. Prior source/SDK and Claude/Codex artifact receipts retain their exact commit/digest attribution. Cursor client OAuth and revocation proof remain unobserved.

Preserve the published trademark exception

Direct readback of the existing public Cursor README at cfefcaf7ef8e4b8047e1f7842c6bd188da8774b2 confirms the code is MIT except for the GoodQA name and Sentinel logo trademark notice. Preserve that existing exception in the shared generated README and Grok Bot handoff that ship the same logo. This is preservation of an existing notice, not a new licensing decision. A package-content control must first fail on the missing notice. Retain Cursor's existing official repository URL as optional manifest metadata, validating that exact URL and allowing its public host only for Cursor content checks.

This necessary correction changes all five distributable ZIPs. Move old local Claude/Codex receipts to historical attribution, regenerate final bytes and rerun the installed Claude strict validator with invalid-name control. Root repeats its isolated Codex marketplace install once against the final OpenAI archive. Do not relabel old receipts as current or rerun earlier exact-once directories. Current client/OAuth/store proof stays unobserved. Recheck offline/package mutations on the final source and obtain final independent packaging review; no API/SDK repeats are needed because their source/test trees remain unchanged. Root refreshes its local/public delivery copies.