ki-agentic-harnessCAUTION

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: ki-acquire-chatgpt
ki-kind: governance
ki-applicability: declaration-only
ki-depends-on: [ki-housekeeping-chatgpt]
ki-runtime-binding: true
ki-supported-runtimes: [chatgpt-codex]
ki-shared-dependencies: [ki-skills:rubric]
ki-acquire-adapter: chatgpt
ki-acquire-actions: [import]
ki-acquire-repository-properties: [capture_path, output_path]
ki-acquire-invocation-properties: [capture, output]
ki-acquire-capabilities: [local-capture]
ki-acquire-omissions: [provider-network, project-enumeration, incremental-reads, source-retirement]
ki-acquire-mutation-boundary: read-only
ki-acquire-checkpoint: kep
ki-acquire-reset-scopes: []
description: >
  Govern incremental readable ChatGPT project and conversation acquisition, including stable project identity,
  prefixed routing, faithful versions, checkpoints, and later retirement evidence. Use for ChatGPT project import or
  routing design; `ki-housekeeping-chatgpt` owns opaque installed-store inventory.
argument-hint: 'audit <repo> | conform <repo> | educate <repo> | help | refresh'
---

# ChatGPT acquisition

Use the provider-neutral lifecycle **discover → acquire → stage → triage → optional source retirement**. Read [the ChatGPT acquisition standard](references/standards-chatgpt-acquisition.md) when designing or auditing project routing, incremental reads, fidelity, or checkpoints; read [the source record](references/sources.md) only during REFRESH or when current provider capability matters.

The current executable bridge accepts one user-prepared readable capture and emits a verified KEP. Its machine-readable `ki-acquire-*` metadata deliberately advertises only that proven surface. Project enumeration, incremental readable retrieval, receiver staging, reconciliation, reset, and source retirement remain required contract outcomes rather than falsely declared executable capabilities.

`ki-housekeeping-chatgpt` is a required source-evidence layer: it can identify opaque local records and changes without decoding them. This skill adds the readable acquisition and receiver-routing contract. Opaque bytes are never presented as conversation content, and acquisition never authorises source mutation.

## Operating modes

Invoked as `help`, `-h`, or `?`, explain the capability, current bridge, modes, and off-ramps, then stop. With no recognisable mode, provide the same explanation before offering an interactive mode choice.

### Mode AUDIT

Run `ki repo audit --skill ki-acquire-chatgpt --repo <repo>`, then review separately supplied runtime evidence against the generated rubric. Missing readable-source, project-binding, completeness, or checkpoint evidence remains a named gap; do not infer it from opaque local records or contact ChatGPT merely to make an audit pass.

### Mode CONFORM

Run AUDIT first, then `ki repo conform --skill ki-acquire-chatgpt --repo <repo> --dry-run`. CONFORM may publish generated rubric material but cannot invent project IDs, receiver bindings, readable content, source versions, or retirement authority. Apply authored configuration only after its owner confirms the exact mapping, then re-run AUDIT.

### Mode EDUCATE

Explain immutable project identity, `<Domain>: <Topic>` presentation, explicit receiver bindings, incremental content checkpoints, complete-conversation fidelity, local triage, and the separate retirement gate. Distinguish the current prepared-capture bridge from the intended incremental source.

### Mode REFRESH

Run only from the canonical `ki-agentic-harness` source. When invoked from an installed copy, stop and redirect there. Re-read [the tracked sources](references/sources.md), inspect only privacy-minimised source schemas and official capability documentation, update the standard and rubric when supported behaviour changes, then record the actual review date.

## Off-ramps

- `ki-housekeeping-chatgpt` owns opaque installed-store discovery, hashes, and read-only checkpoint evidence.
- `tools-ki` owns `ki acquire` execution, KEP construction, receiver writes, and persisted checkpoints.
- Arcadia owns provider-neutral knowledge-acquisition lifecycle and receiver-local triage semantics.
- ChatGPT account administration, project renaming, archiving, and deletion remain provider operations outside acquisition authority.

CAUTIONgrade C · trust 80/100 Install with care. The audit found things worth knowing before you trust its output.

What the source does

Filesystem

declared (3 observation(s))

Network

declared (1 observation(s))

Shell

none-observed

Dependencies

not all pinned

Secrets in source

none-found

Findings (25)

payload.ts

You are helping audit, conform, or scaffold a **`tools-*` repo** — a repo holding exactly **one** standalone command-line tool, distributed two ways: a `curl | bash` installer at the repo root, and a

.ki.toml

.rumdl.toml

const smuggled = `${env.plans}/../../../outside.md`

writeV1(env, 'traversal-plan', outside, { plan_file: `${env.plans}/../../../outside.md` })

import type { RubricContextOptions, RubricPublicationContext, RubricSession } from '../../shared/rubric.ts'

import { judgment, type RubricFamily } from '../../shared/rubric.ts'

import type { SkillRubricDefinition } from '../../shared/rubric.ts'

5. **SSRF discipline on any fetched URL.** Discovery/token/Graph endpoints are HTTPS and host-pinned to the known provider; never fetch an attacker-influenceable URL, and never follow redirects to int

Evidence scope: inspected local `main` at `0ad0377a0e7e14b1cd7314bce414d4871b062efc` on 2026-09-27. The read-only probe of `http://127.0.0.1:3100/api/health` could not connect; live tasks, current cla

'    - authority: http://127.0.0.1:3100',

`      url: http://127.0.0.1:3100/KIS/issues/KIS-${id}`,

- authority: http://127.0.0.1:3100

url: http://127.0.0.1:3100/KIS/issues/KIS-5

@commitlint/cli, @commitlint/config-conventional, @types/bun, @types/node, husky, knip, lint-staged, rumdl

- **`.env` parity.** Bun auto-loads `.env*`; Node does not, so a repo that loads `.env` files calls `process.loadEnvFile()` (wrapped in try/catch — Bun has no such API and throws `TypeError`). Resolve

Pull-request review, approval, merge, and auto-merge are separate capabilities. A repository may delegate any combination to a stable named agent through explicit current-user instruction or durable r

Its shape is the same `mcpServers` map as a project `.mcp.json` (`http`/`sse` with `url`, or `stdio` with `command`/`args`/`env`). Any user on the machine can read it, so **never put credentials in `e

- `loadConfig(env = process.env): Config` hydrates `process.env` from the package's `.env*` files via `process.loadEnvFile()` inside a try/catch (Bun has no such API and throws `TypeError`, which the

The full, quotable standard behind the `ki-repo-tools` skill. A `tools-*` repo holds **one** standalone command-line tool, distributed by a `curl | bash` installer and a companion Homebrew tap formula

├── install.sh              # curl installer (the `curl | bash` contract). Expected.

1. **`install.sh` at the repo root** — the `curl | bash` installer:

- POSIX-ish shell, runnable as `curl -fsSL <raw-url>/install.sh | bash`.

1. **No token passthrough.** The server uses tokens it obtained for _itself_ against the downstream API (Google / Microsoft Graph); it must never accept a caller- supplied token and forward it. (Spec:

Gates applied: no_behavioural_pass.