# Packet W3 receipt — in-app OpenAI Responses operator

**Actor:** Helios (Cursor on Icarus, `centaur-macmini-1`)  
**Composer:** Mitchell Burns  
**Date:** 2026-09-13  
**Work order:** [`ASTRA_WORK_ORDERS.md`](ASTRA_WORK_ORDERS.md) W3  
**Contract:** [`ASTRA_INTERFACE_CONTRACT.md`](ASTRA_INTERFACE_CONTRACT.md) §1, §3, §4  
**Design:** [`ASTRA_DESIGN.md`](ASTRA_DESIGN.md) §5 (operator; shops remain shops)

This file is a chip receipt. It does not rewrite [`ASTRA_DESIGN.md`](ASTRA_DESIGN.md) or the freeze JSON zip identity.

---

## Context snapshot

| Field | Value |
|---|---|
| `plan_branch` | `cursor/w3-in-app-operator-0101` |
| `base` / `master_sha` | `af8fa14365c98ae4140a05608115e48e59e6f94c` (W2 tip `cursor/w2-identity-grants-0101`, includes W1 `48c8bd5`) |
| `freeze` | `4d355a5994467bbe64dc28b9b5817037e25a02ce` (W0; not the implementation base) |
| `tip` | branch `cursor/w3-in-app-operator-0101` HEAD (Helios handback names the live SHA) |
| `sync_method` | bootstrap (isolated worktree from W2 tip; no rebase onto W4/W5/W6) |
| `colliding_prs` | W4 canvas/marks, W5 audio (`cursor/w5-audio-import-0101`), W6 export (`cursor/w6-movie-export-0101`) — separate worktrees. This chip did not restyle Studio chrome, `wav.ts`, or `mux-webm-av.ts`. |
| `blocking_owner_items` | W4 keep/guide/correct marks + canvas-first chrome; W5/W6; W7 integration; release |
| `non_claims` | listed below |

Worktree: `/Users/icarus/.cursor/worktrees/korgi-w3-operator-20260913`  
Remote: **gdrive only**. No `origin` push. No FF `main`. No Railway. Freeze zip/tgz untouched. PixelLab $0. No paid Higgsfield/OpenAI still run. No `gpt-image-1` claimed as agentry.

Parent receipts: [`PACKET_W2_RECEIPT.md`](PACKET_W2_RECEIPT.md), [`PACKET_W1_RECEIPT.md`](PACKET_W1_RECEIPT.md).

---

## What landed

Application-controlled OpenAI **Responses** tool-calling loop. The model requests a granted `korgi.*` tool; KORGI executes through the Project Host envelope (`operationId`, `expectedRevision`, `destination`, `bindingId`); KORGI returns the result. Strict schemas come from the registry. Permissions and semantic validation stay inside KORGI. MCP and CLI adapt to the same host. There is not a second operator document.

1. **Catalog listed = grant.** After Packet A bind, operator tools length is **exactly 2** (`korgi.settings.setName`, `korgi.peg.setFollow`). Missing `grant.actions` lists **zero** tools, not the unbound 69.
2. **Loop.** Inspect bound project / selected destination / revision; read drawings, layers, exposures, cues, jobs as inspect (not as extra listed tools); request typed operations through `host.execute`; pause for spend and dest/creative approval; observe native host state; report what changed with receipt/undo refs.
3. **Dest writes are not auto-accepted.** `korgi.gen.accept` on a user grant is refused without human confirm (`prompt confirmation required`). keep/guide/correct marks are not in this document yet; the operator still does not auto-accept dest writes.
4. **Spend pause.** Paid `korgi.gen.request` (`openai.images` / Higgsfield) pauses without `spendAuthorized`. No shop dispatch. Operator tokens are server-side (`KORGI_OPERATOR_OPENAI_KEY` or `OPENAI_API_KEY`). A ChatGPT subscription does not pay API usage.
5. **Bounds.** Max 8 rounds / 16 tool calls per turn, cancellation, serialize/restore of the operator session (durable resumability). Not unrestricted shell.
6. **Reverse handoff fixture.** Agent `setName` → human `host.execute` on the same binding → operator inspects native `HumanEdit` revision → continues with `setFollow`.
7. **Minimal in-app seat.** Signed-in conversation UI in `OperatorPanel` (`data-korgi="operator-dock"`). W4 may move the dock. Drawing desk / X-sheet / canvas-first layout were not restyled.
8. **Operator model** is `gpt-4.1-mini`. `gpt-image-1` remains the Images shop model.

W1 pack/authority and W2 login/fail-closed/revoke/honest catalog were not undone.

---

## How the loop is bounded

| Bound | Mechanism |
|---|---|
| Grant catalog | `operatorToolsForGrant` uses `grant.actions` only |
| Envelope | `executeOperatorCall` → `ProjectHost.execute` (binding actor wins; model `confirmed` / `bindingId` are not authority) |
| Dest / confirm | Pause + host refuse unless the signed-in human confirms |
| Spend | Pause before paid `korgi.gen.request`; shops stay shops |
| Rounds | `OPERATOR_MAX_ROUNDS = 8`, `OPERATOR_MAX_TOOL_CALLS = 16` |
| Cancel | `OperatorRuntime.cancel` + `AbortSignal` |
| Resume | `serialize` / `restore` keeps `previousResponseId`, log, pending, binding |
| Image shop | Responses client throws if model is `gpt-image-1` |

---

## Files changed

| Path | Why |
|---|---|
| `src/lib/korgi/operator/types.ts` | Loop / tool / log / pause types |
| `src/lib/korgi/operator/catalog.ts` | Grant-filtered Responses tools; never 69 |
| `src/lib/korgi/operator/confirm.ts` | Dest-write / spend / prompt pauses |
| `src/lib/korgi/operator/host-adapter.ts` | Inspect + execute envelope; MCP/CLI share this |
| `src/lib/korgi/operator/responses.ts` | Responses client + scripted double |
| `src/lib/korgi/operator/credentials.ts` | Server-side operator key; ChatGPT sub is not billing |
| `src/lib/korgi/operator/session.ts` | Durable session, cancel, serialize/restore |
| `src/lib/korgi/operator/loop.ts` | Bounded Responses tool-calling loop |
| `src/lib/korgi/operator/cli-adapter.ts` | CLI lists/executes the same grant via the host |
| `src/lib/korgi/operator/http.server.ts` | Signed-in start/turn/confirm/cancel/status |
| `src/lib/korgi/operator/index.ts` | Public exports |
| `src/lib/korgi/operator/operator.test.ts` | W3 fixtures |
| `src/routes/api/korgi/operator.ts` | `/api/korgi/operator` (session required) |
| `src/routeTree.gen.ts` | Register the operator route |
| `src/components/korgi/OperatorPanel.tsx` | Minimal signed-in conversation dock |
| `src/components/korgi/Studio.tsx` | Mount the dock (W4 may move it) |
| `src/components/korgi/PhoneShell.tsx` | Same dock on phone, above workspace tabs |
| `docs/oss/PACKET_W3_RECEIPT.md` | This receipt |

Did not edit `wav.ts`, `mux-webm-av.ts`, `evaluate-frame.ts`, freeze docs, `ASTRA_DESIGN.md` verdict. Did not restore a fake 69-tool list. Did not touch W1 pack/authority or W2 auth/revoke except to call the existing host.

---

## Tests (this tip)

Commands (worktree tip; not a historical total):

```bash
./node_modules/.bin/tsc --noEmit
node --experimental-strip-types --test \
  src/lib/korgi/mcp/packet-a.test.ts \
  src/lib/korgi/mcp/mcp.test.ts \
  src/lib/korgi/host/project-host.w1.test.ts \
  src/lib/korgi/host/project-host.w2.test.ts \
  src/lib/auth/fail-closed.test.ts \
  src/lib/korgi/operator/operator.test.ts
```

| Gate | Result |
|---|---|
| `./node_modules/.bin/tsc --noEmit` | pass |
| `packet-a.test.ts` | pass |
| `mcp.test.ts` | pass |
| `project-host.w1.test.ts` | pass |
| `project-host.w2.test.ts` | pass |
| `fail-closed.test.ts` | pass |
| `operator.test.ts` | pass (catalog 2, setName via Responses, dest refuse, reverse handoff, cancel, restore, bound, spend pause, CLI/MCP adapters, HTTP start) |

SHA of the commit that contains these results is the branch tip after this receipt is committed.

---

## non_claims

- Not a creator product. Not a release. No `main` land. No KORGI Railway redeploy.
- W4 keep/guide/correct marks and canvas-first Studio chrome restyle are not done. This dock is a small panel W4 can move.
- Audio matrix (W5) and VP9/Opus export (W6) were not implemented here.
- Live OpenAI Responses HTTP is not a paid demonstration on this chip. Tests use a scripted client. Operator credentials missing → HTTP `turn` is 503.
- Unbound studio MCP `tools/list` is still the full registry (69). Honest catalog is the **bound grant**.
- Dest A2 Higgsfield stills are not approved art. PixelLab $0. No paid still run. `gpt-image-1` is not agentry.
- IndexedDB/OPFS remains a local replica. It is not the hosted document.

---

Helios, Icarus, 2026-09-13.