# giip-agent skill -- OpenAI platform notes (ChatGPT / Codex)
#
# This file is GIIP's own document, not OpenAI's official material. It
# records what was actually checked against OpenAI's public docs on the
# date below, and marks everything else as unverified rather than guessed.
# Do not add UI steps (menu names, button labels) to this file unless they
# have been observed in a live session -- the sibling `giip-issue` skill
# had exactly this kind of guessed UI text removed from its human-facing
# guide pages (giip #1488), and this file must not reintroduce it.

platform: openai
verified_as_of: "2026-09-06"

# General, source-checked facts about the OpenAI ecosystem relevant to this
# skill. Each entry lists the reference page(s) consulted on verified_as_of.
# These are documentation summaries, not live product testing.
capabilities_reference:
  - claim: >
      GPT Actions (Custom GPTs) support exactly three authentication modes
      in the GPT editor: "None", "API Key", and "OAuth". OAuth tokens are
      sent as an `Authorization: [Bearer|Basic] <token>` header. The public
      docs do not describe a way to send an arbitrary custom header name
      for the "API Key" mode -- some third-party community reports
      describe a "Custom" header-name option in the GPT editor UI, but
      that was not independently confirmed against the official reference
      on verified_as_of. Not that it matters much for this specific
      skill -- `giip-agent`'s API sends its credential as a `token` form
      field, not a header, so this constraint is moot here either way.
    source_url: "https://developers.openai.com/api/docs/actions/authentication"
    checked_on: "2026-09-06"
  - claim: >
      OpenAI "Skills" are a versioned bundle of files plus a required
      SKILL.md manifest (front matter + instructions). Skills can include
      executable scripts (e.g. Python files) under a scripts/ directory.
      Two execution modes exist: hosted/container-based execution via the
      Responses API, and local execution via the local shell tool, where
      skill files are provided from local file paths in a runtime the
      caller controls. The docs describe scripts running in a shell/network
      environment but do not spell out whether outbound HTTP requests are
      permitted in the hosted mode -- that depends on the sandbox's network
      policy, which is not documented in the page reviewed.
    source_url: "https://developers.openai.com/api/docs/guides/tools-skills"
    checked_on: "2026-09-06"
  - claim: >
      In ChatGPT, a skill is activated by typing "@" to select it; in Codex
      CLI or its IDE extension, a skill is activated with "/skills" or by
      typing "$" to mention it.
    source_url: "https://simonwillison.net/2025/Dec/12/openai-skills/"
    checked_on: "2026-09-06"
    note: >
      Secondary source (a written summary of OpenAI's own skills rollout),
      not an OpenAI-owned page. Treated as corroborating, not authoritative.

# No UI walkthrough steps are verified. Every menu name, button label, or
# click sequence would require live interaction with a real ChatGPT/Codex
# session, which this skill's authoring process cannot perform. Do not
# populate this list from assumptions -- only from an actual human (or an
# agent with a live, observed session) confirming the steps and adding an
# entry with what was actually seen and when.
verified_ui_steps: []

known_limitations:
  - >
    Whether a given ChatGPT/Codex session can run this skill's Python
    script (network access, local file execution) depends on that
    session's specific mode/sandbox and is not knowable in advance from
    this file. The skill's own preflight (see SKILL.md) is the only
    reliable way to find out -- if the host cannot run scripts or reach
    the network, the skill must say so rather than claim success.
  - >
    This file does not know which specific ChatGPT plan, model, or Codex
    build the reader is using, and capabilities differ across them. Nothing
    here should be read as "this will work on any ChatGPT/Codex session."
  - >
    No end-to-end installation of this skill inside a live ChatGPT or Codex
    session has been performed as part of authoring it (2026-09-06). See
    `supported_agents` below.
  - >
    This skill registers a NEW logical machine (lssn) per (hostname, csn)
    the first time `register` runs. If the reader's AI tool is not one of
    the examples in SKILL.md, they still must pick a stable `--tool-slug`
    themselves and reuse it on every later invocation -- a different slug
    each run creates a new, orphaned lssn instead of heartbeating the
    existing one.

note: >
  This file is produced by the GIIP project, not by OpenAI. It is not
  official OpenAI documentation, and OpenAI's actual product behavior may
  have changed since verified_as_of. Re-check the source_url values above
  before relying on any capabilities_reference claim.

supported_agents:
  - name: chatgpt
    verified: false
    note: "미검증 (pending human test) -- no live installation attempt has been made."
  - name: codex
    verified: false
    note: "미검증 (pending human test) -- no live installation attempt has been made."