SUBMISSION.md

# GovPeak OpenAI Plugin Submission

This folder is the portable Agent Plugins package for the public GovPeak plugin in ChatGPT and Codex.

## Runtime

- Production MCP endpoint: `https://gov-peak.com/mcp`
- Transport: Streamable HTTP
- Authentication: GovPeak OAuth 2.1 with PKCE and dynamic client registration
- Default connection: Read-only
- Optional permission: Read & write for pursuits, pursuit notes, and action items
- Delete tools: none

## Public listing

- Name: GovPeak
- Publisher: Gov-Peak, LLC
- Category: Business & Operations
- Website: `https://gov-peak.com`
- Support: `https://gov-peak.com/support`
- Privacy: `https://gov-peak.com/privacy`
- Terms: `https://gov-peak.com/terms`

## Review package

- `review/test-cases.json` contains exactly five positive and three negative reviewer cases.
- `review/annotation-justifications.json` records the safety annotation rationale for every public MCP tool.
- `review/release-notes.md` contains initial-submission release notes.
- `skills/govpeak-workspace/SKILL.md` contains the uploaded GovPeak workspace workflow skill.

Use a dedicated reviewer account and tenant whose credentials can complete every test without MFA, SMS, email confirmation, or private-network access. Do not commit those credentials; enter them only in the OpenAI submission portal.

## Domain verification

For MCP-backed public plugins, the OpenAI submission portal generates a domain-verification token and checks:

`https://gov-peak.com/.well-known/openai-apps-challenge`

The endpoint must return only that exact token. Add the challenge only after the portal creates it; do not commit a placeholder token or invent one.

## Remaining submission gates

1. Complete business/developer verification in the OpenAI Platform organization that will publish GovPeak.
2. Confirm the submitter has Apps Management Write permission.
3. Create the reviewer/demo tenant and credentials.
4. Set `OPENAI_PLUGIN_CHALLENGE` in production to the exact token generated by the portal, then verify the well-known challenge URL returns only that token.
5. Run Scan Tools against the production MCP server and verify every tool annotation matches actual behavior.
6. Confirm OAuth discovery advertises `openid`/`email` and `/userinfo` returns `email` plus `email_verified=true` for the reviewer account.
7. Record the reviewer demo requested by the submission flow.
8. Submit the MCP server from scratch through With MCP; do not submit an existing integration ID.