# ChatGPT operations R0 canary — request

audience: AI coding agents first.

**Goal:** Ship smallest safe ChatGPT Web vertical slice: authenticated read-only context, registered-project listing, and caller-scoped audit receipt retrieval through complete gateway path.

**Context:** R0 landed on `main` at `babf6afdbde3e595dc766bffb1f56540b94bd955` after package gates and final Sol review passed. The local deployment reached the Actions Gateway safety check and correctly failed closed: `/home/user/.config/overdeck/actions-gateway.env` does not exist. The candidate was rolled back; no Actions Gateway endpoint is installed or running. This configuration must be created through the approved owner-managed secret provisioning path, with real edge issuer/audience/JWKS, application credential records, audit key, and safe context/project metadata. Do not synthesize credentials or bypass the check. **Status: BLOCKED.** Next executable action: provision the approved runtime configuration, then rerun canonical local deployment and the installed authenticated three-operation smoke. Factory remains forbidden.

**2026-08-14 blast-radius scoping (owner-authorized):** the missing-config failure was blocking every unrelated `packaging/deploy-local.sh` deploy on this workstation, not just the Actions Gateway. On owner authority, `packaging/deploy-local.sh` (commit `c19f6d0a8`, "Deploy continues dark when Actions Gateway owner config is absent") now skips ONLY the Actions Gateway component (no build, no unit render/install, no enable, no smoke) when its config is missing/unreadable; every other component still deploys and the deploy reaches `deployed`, with a distinct `actions-gateway-skipped` status line printed to stderr. The safety check itself is unchanged: with config present, behavior (build, install, enable, smoke, `fail_actions_gateway` rollback) is unchanged. The Actions Gateway remains BLOCKED on owner secret provisioning exactly as above; this change only narrows what one dark, unprovisioned feature can hold hostage.

**Files:**

- Modify `modules/actions-gateway/src/contracts.ts` — intrinsic raw-byte measurement and exact R0 envelope contract.
- Modify `modules/actions-gateway/src/routes.ts` — admission-wrapped R0 route registry; no direct adapter dispatch.
- Modify `modules/actions-gateway/src/admission.ts` — retryable same-outcome durable settlement.
- Modify `modules/actions-gateway/src/auth.ts` only if required for R0 dual authentication integration.
- Modify `modules/actions-gateway/src/audit.ts` only for integration defects; preserve authenticated global/per-operation chains and terminal uniqueness.
- Modify `modules/actions-gateway/src/index.ts` — export R0 public seams only.
- Create or modify `modules/actions-gateway/src/server.ts` — deterministic HTTP boundary for R0 routes.
- Create or modify `modules/actions-gateway/openapi.yaml` — expose only R0 operations.
- Modify gateway tests under `modules/actions-gateway/test/` for R0 unit/integration/adversarial coverage.
- Modify `modules/actions-gateway/package.json`, `modules/actions-gateway/tsconfig.json`, and `pnpm-lock.yaml` only for package-scoped Node test typings and required R0 scripts.
- Modify packaging/service/deploy files only when needed to install and invoke R0 gateway through canonical Overdeck deployment.
- Modify `docs/plans/2026-08-13-chatgpt-web-operations.md` and `docs/plans/INDEX.md` to link this replacement incremental plan and preserve deferred releases.

**Contract:**

- Public boundary: `dispatch(identity: CallerIdentity, rawBody: Uint8Array): Promise<OpaqueResponse>`.
- Intrinsic byte measurement MUST use typed-array internal slots; an own `byteLength` property MUST NOT affect the measured size.
- Public runtime routes: `getOperatorContext`, `listProjects`, `getAuditReceipt` only.
- Every route MUST pass raw-body validation, dual authentication, expiry, caller-wide nonce, caller-wide payload-bound idempotency, operation-scoped rate/concurrency, typed payload validation, adapter dispatch, retryable settlement, and authenticated audit.
- Adapter receives validated payload and opaque operation context only. NEVER pass credentials, raw body, host path, environment, or admission stores.
- Accepted settlement selects one terminal action. Same chosen action MUST retry after transient durable-store or lease-release failure. Conflicting action MUST fail. Release MUST be idempotent.
- Audit retrieval MUST be caller-scoped, bounded, signature-verified, root/continuity-verified, and opaque.
- Stable public failures: `unauthenticated`, `identity_mismatch`, `credential_revoked`, `request_expired`, `replay_detected`, `idempotency_conflict`, `invalid_request`, `operation_forbidden`, `rate_limited`, `capacity_exhausted`, `service_unavailable`, `operation_not_found`.

**Behavior:**

- Reject oversize raw body before decode or parse.
- Reject non-`Uint8Array`, detached/invalid view, parsed-object lookalike, extra/missing envelope fields, invalid payload, expired/future request, replay, changed request under same idempotency key, rate excess, and concurrency excess before adapter side effect.
- Record accepted/rejected and exactly one terminal receipt without leaking raw backend errors.
- Return registered project metadata only: opaque ID and explicitly safe display fields. No repository path, remote URL with credentials, environment, secret, ignored-file metadata, workspace content, Git operation, job operation, deployment operation, cluster operation, or break-glass operation.
- Deferred operation names MUST be absent from runtime and OpenAPI and return `operation_not_found`.
- Install R0 into actual local runtime, invoke real authenticated entrypoint, and prove all three operations. Roll back atomically on failed install/smoke.

**Out of scope:**

- Project file read/search/mutation.
- k3s build/test jobs.
- Git commit/push/landing.
- Workstation deployment requested by ChatGPT.
- Cluster visibility or mutation.
- Break glass.
- General `exec`, arbitrary command, arbitrary path, arbitrary environment, reusable broad credential, SSH, Kubernetes API, host filesystem mount, or local AI.
- Fixing rejected legacy `operator/**` or ZIP files.

**Acceptance:**

- Run `pnpm --filter @overdeck/actions-gateway test`; expected PASS with no warnings.
- Run `pnpm --filter @overdeck/actions-gateway typecheck`; expected PASS with no diagnostics.
- Adversarial coverage MUST prove intrinsic-byte spoof rejection, parsed-object rejection, pre-parse size rejection, exact schema, expired/future rejection, cross-operation nonce replay, cross-operation idempotency conflict, canonical retry replay, rate/concurrency denial before adapter, no direct adapter bypass, same-outcome settlement retry, conflicting settlement rejection, one audit terminal, caller isolation, and no secret/path leakage.
- OpenAPI/runtime parity test MUST prove exactly three R0 operations.
- Installed smoke MUST authenticate through edge and application checks and invoke all three operations through real local endpoint.
- Required `gpt-5.6-sol/low` review MUST approve current diff.
- Land through project shipping workflow and deploy installed R0. Owner-visible receipt MUST include landed commit, installed revision, endpoint health, operation smoke results, and explicit deferred capability list.