[mashkovd]

Summary

• updates README positioning for the Apps SDK readiness track
• adds ChatGPT Apps connector setup guidance using the current Apps & Connectors developer-mode flow
• adds an Apps SDK readiness checklist to /docs covering public pages, OAuth discovery, MCP protocol health, safety defaults, user controls, and submission package prep

Validation

• git diff --check
• go test ./internal/web ./cmd/server
• live URL checks returned HTTP 200 for /, /docs, /security, /privacy, /.well-known/oauth-protected-resource, and /.well-known/oauth-authorization-server
• unauthenticated /mcp initialize probe returned HTTP 401 with authentication required, confirming the protected endpoint is reachable
• authenticated read-only MCP smoke: get_my_audit_log(limit=1) succeeded through the configured mctl-telegram connector

References

• https://developers.openai.com/apps-sdk/quickstart
• https://developers.openai.com/apps-sdk/deploy/connect-chatgpt
• https://developers.openai.com/apps-sdk/deploy/testing
• https://developers.openai.com/apps-sdk/deploy/submission
• https://developers.openai.com/apps-sdk/app-submission-guidelines

[claude]

Claude finished @mashkovd's task in 53s —— View job

---

Code Review

• Read changed files and diff
• Classify findings (docs-only)
• Submit review verdict — approved

Both changed files (README.md, internal/web/docs.html) are documentation only. The README addition and the HTML checklist are consistent with each other and with the existing /security and OAuth discovery story already in the codebase. No logic, security, concurrency, or test-coverage concerns.

[claude]

Docs-only change: README and docs.html additions are accurate and consistent with each other. No logic, security, or test-coverage concerns.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6297c6cea6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Resolve OAuth metadata URL from advertised auth server

Update this instruction to avoid hardcoding the authorization-server metadata on <your-host>. In shared-hmac / shared-hmac-legacy mode, the app intentionally does not mount /.well-known/oauth-authorization-server on the local host (cmd/server/main.go around the OAuth route wiring), and selectAuthServer points discovery to https://api.mctl.ai instead (cmd/server/main.go, selectAuthServer). As written, operators following this step can get a false failure (404 on <your-host>) even when OAuth discovery is correctly configured.

Useful? React with 👍 / 👎.