Ship codex/chatgpt-delegate-mode

.gitignore

@@ -61,6 +61,7 @@ tasks/.current.md.tmp.*
 .ai/harness/chatgpt/oracle-home/
 .ai/harness/chatgpt/tmp/
 .ai/harness/chatgpt/sessions/
+.ai/harness/chatgpt/delegations/
 .ai/harness/handoff/gptpro/*
 !.ai/harness/handoff/gptpro/.gitkeep
 .ai/harness/mcp/*

assets/skills/repo-harness-chatgpt/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: repo-harness-chatgpt
 description: Canonical rule owner for repo-harness ChatGPT integration -- Oracle-first browser/GPT Pro consult and continuation, MCP Connector setup, MCP bridge planning handoff, and Connector invocation read-back evidence.
-when_to_use: "repo-harness-chatgpt, ChatGPT Web consult, GPT Pro consult, gptpro, browser GPT, ChatGPT MCP Connector, ChatGPT bridge, MCP read-back"
+when_to_use: "repo-harness-chatgpt, ChatGPT Web consult, GPT Pro consult, gptpro, browser GPT, ChatGPT MCP Connector, ChatGPT bridge, MCP read-back, GPT Pro delegate, delegate to ChatGPT, 外包给 GPT"
 ---
 
 # repo-harness-chatgpt
@@ -19,11 +19,13 @@ mode protocol lives under `references/`.
 - Continue, read, or clean up a saved browser session -> `references/continue.md`.
 - Verify or accept a ChatGPT MCP tool call as real evidence -> `references/read-back.md`.
 - Operate the MCP Connector bridge (planner/executor/orchestrator/coding) -> `references/bridge.md`.
+- Delegate a self-contained task to GPT Pro and independently accept the result -> `references/delegate.md`.
 
 ## Boundaries
 
 - Product planning never implies this package; ChatGPT discovery requires explicit setup.
 - Never request or handle ChatGPT passwords, 2FA codes, cookies, browser storage, or session tokens; login/captcha/SSO stop and hand back to the user.
 - Setup, consult, and bridge modes share these safety rules by reference; none shares secrets, auth state, or tokens with another mode.
+- Consult stays planning/review/critique only, never the code-edit executor; delegate is the sole approved path for code deliverables, and GPT Pro still never executes edits.
 - A missing or unreadable canonical reference fails the calling command closed; it never synthesizes replacement prose.
 - Do not enable remote CDP or an orchestrator dev runner unless the user explicitly asks and the boundary is documented.

assets/skills/repo-harness-chatgpt/references/setup.md

@@ -13,6 +13,40 @@ source.
 - ChatGPT Pro Web access is not OpenAI API quota or an API key substitute;
   never create API keys or billing projects from a ChatGPT Pro subscription.
 
+## Host Skill Projection
+
+The canonical package remains under
+`assets/skills/repo-harness-chatgpt/`; default minimal/full install profiles do
+not expose it. Project that one byte source explicitly into the host discovery
+roots:
+
+```bash
+repo-harness chatgpt install-skill --target both
+```
+
+Use `--target codex` or `--target claude` for one host. The command validates
+the complete canonical package and creates an owned symlink named
+`repo-harness-chatgpt` under each selected host's `~/.codex/skills/` or
+`~/.claude/skills/`. It is idempotent and refuses a directory, broken symlink,
+or symlink owned by another source instead of overwriting it. Remove only an
+owned projection with `repo-harness chatgpt uninstall-skill --target <target>`.
+Both commands support `--dry-run`; neither changes an install profile.
+
+Delegate mode also requires a trusted Gitleaks CLI >= 8.19. Install it through
+the operator's normal package-management policy and verify `gitleaks version`;
+repo-harness never downloads or upgrades it automatically. The delegate
+dry-run with `--secret-scan` is the authoritative readiness check.
+
+The projected symlink binds to the CLI checkout that ran `install-skill`,
+not a fixed install location. If that checkout is a contract worktree,
+merge-time worktree cleanup leaves the symlink dangling: the host silently
+loses skill discovery, and the installer's broken-symlink fail-closed check
+then refuses a direct reinstall. Recover by removing the two dangling
+symlinks under each host's skills root, then rerunning `install-skill` from
+a durable checkout (the primary clone or an already-installed package).
+Run the real projection only from a durable checkout; treat a worktree run
+as verification-only and re-project from the durable checkout afterward.
+
 ## Oracle Browser Provider
 
 1. Oracle's published CLI requires `node >=24`; satisfy that inside the pinned
@@ -76,13 +110,20 @@ source.
 - Any command that would print `.repo-harness/mcp.tokens.json`,
   `.repo-harness/mcp.oauth.json`, browser profile secrets, or cookies: redact
   the value and report only the file class.
+- `PROMPT_SECRET_SCAN_UNAVAILABLE`: Gitleaks is missing, explicitly
+  misconfigured, or older than 8.19; fix the selected binary and rerun the
+  delegate dry-run without sending the prior bundle.
+- Host projection finds an unowned or broken destination: preserve it and
+  stop; never overwrite or unlink a user-owned Skill to make setup pass.
 
 ## Boundaries
 
 - Does not create OpenAI API keys, billing projects, or credentials from a
   ChatGPT Pro subscription.
 - Does not install/upgrade Oracle from a default repo-harness install; Oracle
   bootstrap is explicit GPT Pro setup/repair only.
+- Does not install/upgrade Gitleaks or project the ChatGPT Skill from a default
+  install profile; both are explicit delegate setup operations.
 - Does not bypass ChatGPT Web rate limits, login checks, manual verification,
   or plan restrictions.
 - Does not expose a local MCP server to the public internet without explicit

docs/repo-harness-chatgpt-browser-engine.md

@@ -5,6 +5,8 @@
 ## What It Does
 
 - Builds a policy-checked prompt bundle from explicit repo files.
+- Can require a fail-closed Gitleaks scan over the exact rendered prompt and
+  follow-ups before any session/provider side effect.
 - Saves repo-local session records under `.ai/harness/chatgpt/sessions/<sessionId>/`.
 - Supports dry-run preview without opening a browser.
 - Supports an Oracle provider wrapper for `oracle --engine browser` (the default, recommended main path).
@@ -36,6 +38,24 @@ When Oracle is missing, too old, or selected through a broken explicit source, t
 
 ## First-Time Setup
 
+The canonical ChatGPT Skill is explicit-setup-only and is not part of the
+minimal or full install profiles. Project the canonical package into both host
+discovery roots with one owned symlink per host:
+
+```bash
+repo-harness chatgpt install-skill --target both
+```
+
+Use `--dry-run` to inspect the lifecycle or `--target codex|claude` to select
+one host. `repo-harness chatgpt uninstall-skill --target <target>` removes only
+an exact symlink to the canonical package. Existing directories, broken
+symlinks, and symlinks to another source fail closed and are never overwritten.
+These commands do not mutate either default install profile.
+
+Projections created from a contract worktree can leave the host symlink
+dangling after worktree cleanup; see "Host Skill Projection" in
+`assets/skills/repo-harness-chatgpt/references/setup.md` for the recovery steps.
+
 ```bash
 repo-harness chatgpt browser-setup --repo .
 repo-harness chatgpt browser-doctor --repo .
@@ -83,6 +103,45 @@ repo-harness chatgpt browser-consult \
 
 Dry run validates the prompt, file policy, inline size, and session write path. It saves a `dry_run` session and does not open ChatGPT.
 
+### Delegate Secret Gate
+
+Code-delivery delegations must add `--secret-scan` to both dry-run and real
+`browser-consult` calls:
+
+```bash
+repo-harness chatgpt browser-consult \
+  --repo . \
+  --dry-run \
+  --secret-scan \
+  --prompt "Review this bounded implementation brief." \
+  --file .ai/harness/chatgpt/delegations/example/bundle/src/example.ts
+```
+
+The gate resolves a trusted Gitleaks >= 8.19 in this order:
+`--gitleaks-bin`, `REPO_HARNESS_GITLEAKS_BIN`, then `PATH`. It scans the exact
+rendered `prompt.md` and every follow-up through `gitleaks stdin` before a
+session directory is allocated or a provider is invoked. The scan runs from an
+isolated temporary directory, clears inherited Gitleaks config overrides,
+ignores repo-controlled allow comments, and captures only a generic redacted
+failure. A missing/incompatible scanner, finding, timeout, or scanner error
+returns `PROMPT_SECRET_SCAN_UNAVAILABLE` or `PROMPT_SECRET_SCAN_FAILED` and
+creates no session.
+
+On the Oracle path, scan-bound attachments are rebuilt from the already
+captured PromptBundle bytes in a private per-run temporary directory and each
+staged file is rechecked against its original SHA-256. Oracle receives only
+those immutable staged paths, so a repository file changed after the scan
+cannot alter what is sent. The staging directory is removed when the provider
+run ends.
+
+Successful sessions persist `meta.security.promptSecretScan` and expose the
+same receipt in dry-run JSON. The receipt binds scanner version/source plus the
+byte count and SHA-256 for every scanned payload. Compare the prompt receipt to
+the saved `prompt.md` before transporting it through Codex's built-in browser.
+`--gitleaks-bin` is accepted only with `--secret-scan`. Ordinary planning and
+review consults retain the path gate without silently enabling this delegate
+contract.
+
 ## Oracle Provider
 
 ```bash
@@ -182,7 +241,7 @@ repo-harness chatgpt browser-followup \
   --prompt "Turn that review into a Codex-ready goal."
 ```
 
-Follow-up sessions are linked with `sourceSessionId` in `meta.json`. The Oracle provider receives `providerSessionId` from the source session as upstream provider context; it does not pass the repo-harness local `chgpt_...` session ID as an Oracle session. Dry-run follow-ups still write a linked local session without opening a browser.
+Follow-up sessions are linked with `sourceSessionId` in `meta.json`. The Oracle provider receives `providerSessionId` from the source session as upstream provider context; it does not pass the repo-harness local `chgpt_...` session ID as an Oracle session. Dry-run follow-ups still write a linked local session without opening a browser. A source session carrying `meta.security.promptSecretScan` makes every follow-up scan-bound automatically; Gitleaks must remain resolvable, and scan failure occurs before the linked session or provider call.
 
 ## Cleanup
 
@@ -240,12 +299,16 @@ Denied by default:
 
 The engine rejects denied files before browser/provider execution.
 Allowed-path symlinks that resolve outside the repository are rejected.
+For delegate mode, path policy is only the first gate: `--secret-scan` also
+scans the fully rendered allowed content. Path acceptance alone is not evidence
+that a file is safe to send.
 
 ## Security Notes
 
 - Keep browser profiles and local config uncommitted.
 - Prefer product-session binding over copying cookies or launching an unrelated fresh profile.
 - Do not expose Chrome remote debugging outside localhost without an explicit tunnel/security plan.
-- Use dry-run before sending large or sensitive context.
+- Use `--dry-run --secret-scan` before sending any delegate context; transport
+  the exact saved and hash-verified `prompt.md`, without later additions.
 - Prefer narrow files over whole-repo dumps.
 - Treat generated ChatGPT output as review input, not authoritative code truth.