feat(factory): add fixture-only ChatGPT Skills handoff

[groupthinking]

Canonical issue

Closes #1640

Outcome

Adds a fixture-only Agent Factory handoff for the ChatGPT MCP Skills distribution path. The contract validates the official MCP Skills wire data and emits a machine-readable receipt without contacting ChatGPT, importing a skill, dispatching a tool, or granting authority.

Scope

• Requires Resources plus io.modelcontextprotocol/skills capability negotiation.
• Validates direct skills/get complete responses with required cache metadata.
• Binds identity to {server_identity, skill_uri}.
• Verifies static resource SHA-256 and UTF-8 byte size.
• Fails closed on origin/path escape, duplicate URIs, missing SKILL.md, digest/size drift, invalid cache metadata, dynamic resources, and name mismatches.
• Invalidates approval when the verified manifest changes.
• Records exact MCP spec and client-matrix evidence commits.
• Updates the stale SEP watch note to the accepted specification state.

Evidence boundary

• MCP Skills contract, d866efd
• MCP client matrix, 2997f33

The matrix lists ChatGPT support as Partial. This PR makes no live-client compatibility or conformance claim.

Verification

Current head: f99f6501d87701dce876b89b8493c5d0dfa6b8e1

• 7 new fixture-contract tests passed
• 13 combined Skills/Factory handoff tests passed
• TypeScript type-check passed
• ESLint passed for both new files
• Full local web suite: 1,204 passed, 27 skipped, 2 unrelated Studio deploy-route tests failed because sandbox DNS lookup for www.youtube.com returned EAI_AGAIN; required repository CI is the authoritative broader check

Safety boundary

• Fixture-only
• Zero network, import, tool, or external effects
• Untrusted skill content and GO-style text have no authority effect
• No deployment, paid provider invocation, remote skill execution, or production change

Agent handoff

• One canonical issue linked
• No competing implementation found
• Focused tests, type-check, and lint passed
• Required CI, coverage, security, CodeQL, dependency review, and secret scan passed on the exact head
• Preview-dependent E2E did not execute; human merge decision remains

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Canceled		Sep 16, 2026 7:42am UTC

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 77e30824-401b-481f-836c-52ad57a76e84

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔍 PR Validation

⚠️ Large PR detected (692 lines changed)

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 6ebbf7a.

Ensure that dependencies are being submitted on PR branches. Re-running this action after a short time may resolve the issue. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package	Version	Score	Details
npm/yaml	^2.9.1	Unknown	Unknown
npm/yaml	2.9.1	🟢 7.4	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review ⚠️ 2 Found 5/22 approved changesets -- score normalized to 2 Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 2 dependency not pinned by hash detected -- score normalized to 2 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches SAST 🟢 9 SAST tool detected but not run on all commits

Scanned Files

• apps/web/package.json
• package-lock.json

[groupthinking]

Execution receipt — 2026-09-15

Decision: TEST
Verified head: f99f6501d87701dce876b89b8493c5d0dfa6b8e1

Mutation

• Added the fixture-only ChatGPT MCP Skills handoff and seven focused tests.
• Corrected the stale SEP watch note.
• Addressed the initial gitleaks false positive by splitting the public client-matrix Git object ID; no allowlist or scanner bypass was added.

Verification

• CI 4256: passed, including web type-check, ESLint, production build, frontend tests, Python tests, and retained test evidence.
• Coverage 3699: passed.
• Security 4285: passed.
• CodeQL 4319: passed.
• Dependency review 3648: passed.
• Secret scan 3669: passed on the repaired head.
• E2E 3763: failed before test installation because the Vercel preview URL extraction step failed; E2E tests did not execute. No preview or deployment claim is made.

Evidence boundary

This fixture verifies the MCP Skills package contract only. ChatGPT is marked Partial in the official MCP matrix; no live ChatGPT import or conformance was observed.

Current state

Open, draft, mergeable, and unmerged. No live import, remote-skill execution, deployment, provider spend, or external effect occurred.

Neon receipt: concept_tracker.actions.action_id = 39.

[Copilot]

🟡 Changes recommended

The wire model is incompatible with the pinned specification, and approval identity and URI confinement are not securely enforced.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds a fixture-only MCP Skills handoff receipt for ChatGPT without external execution.

Changes:

• Validates skill manifests, resources, capabilities, and cache metadata.
• Adds handoff receipt tests.
• Updates SEP-2640 documentation.

File summaries

File	Description
docs/mcp-skills-sep-2640-watch.md	Updates adoption status and trust boundaries.
apps/web/src/lib/chatgpt-mcp-skill-import.ts	Implements fixture validation and receipts.
apps/web/src/lib/__tests__/chatgpt-mcp-skill-import.test.ts	Tests validation and authorization behavior.

Review details

Suppressed comments (1)

apps/web/src/lib/tests/chatgpt-mcp-skill-import.test.ts:154

• The official dynamic form is skill.resources === "dynamic"; individual resource digests and sizes are never "dynamic". This test therefore covers an invented payload and misses the actual input, which currently reaches .map on a string and throws an incidental TypeError instead of the contract's deliberate hold. Exercise the top-level dynamic form after modeling it in SkillGetResult.

    const dynamic = fixture();
    dynamic.result.skill.resources[1] = {
      uri: GUIDE_URI,
      digest: 'dynamic',
      size: 'dynamic',
    };
    expect(() => createFixtureChatGptSkillImport(dynamic)).toThrow(/dynamic resources/i);

• Files reviewed: 3/3 changed files
• Comments generated: 4
• Review effort level: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[groupthinking]

@copilot review

Re-review exact head 861e7fbdda3419eeb3e2c0cb393be38723890764. The prior wire-shape, compound-approval, frontmatter, dynamic-resource, and URI-canonicalization findings have been repaired and their threads resolved with focused test evidence.

[Copilot]

@copilot review

Re-review exact head 861e7fbdda3419eeb3e2c0cb393be38723890764. The prior wire-shape, compound-approval, frontmatter, dynamic-resource, and URI-canonicalization findings have been re...

Re-reviewed 861e7fb and confirmed the prior wire-shape, compound-approval, frontmatter, dynamic-resource, and URI-canonicalization fixes are in place with passing focused tests (chatgpt-mcp-skill-import.test.ts) and web type-check. I also investigated the current CI failure and found the trivy job was failing at npm ci due to an invalid package-lock.json; that has been repaired on branch head in 82510f2.

[linear-code]

GRV-573

[groupthinking]

Merge execution receipt — 2026-09-16

Decision: ADOPT + TEST
Approved exact head: 6ebbf7a0aa6c4ff0521d476c790a804ee1606011
Merge commit: 33d5b743

Corrections before merge

The earlier acceptance of head f99f650 was not sufficient. A fresh review found four material defects: the fixture did not model the pinned Skills wire contract, approval was not bound to compound identity, URI confinement accepted encoded traversal, and dynamic resources were modeled incorrectly.

The final head fixes all four findings, resolves all review threads, validates complete YAML frontmatter, binds approval to {server_identity, skill_uri, manifest_digest}, canonicalizes URI containment, and deliberately holds top-level dynamic resources.

A connector publication error also temporarily corrupted package-lock.json; that commit was repaired, the dependency was advanced to non-vulnerable yaml@2.9.1, and the final exact head was rechecked.

Exact-head verification

• CI 4259: passed
• Coverage 3702: passed
• Security 4288: passed
• CodeQL 4322: passed
• Dependency Review 3652: passed
• Secret Scan 3672: passed
• Focused fixture tests: 9/9 passed; TypeScript and ESLint passed

E2E 3766 did not execute: preview discovery failed because the Vercel deployment was canceled, then dependency installation and E2E steps were skipped. No preview, deployment, live ChatGPT import, or production-execution claim is made.

Merge guard

The merge used GitHub expected-head protection for 6ebbf7a0aa6c4ff0521d476c790a804ee1606011. The fetched merge commit is signed and is now the fetched main head.