This is a static guide, not a live service status. Public remote writes and execution remain disabled. No JavaScript is needed to read this page.

Collaborating with ChatGPT safely

The static cockpit does not provide an official “sign in to ChatGPT inside this arbitrary webpage” flow, and it must never ask for an OpenAI API key. OpenAI API keys are server credentials and must not be exposed in browser code.

What works now

Save an operator intent locally in Workbench.
Select Copy ChatGPT context. The cockpit prepares a bounded text capsule containing the public URL, selected object, curve, non-secret mailbox address, fabric state, and recent local intents.
Select Open ChatGPT or use your existing ChatGPT tab.
Paste the capsule into the conversation where you are already signed in.

The cockpit sends nothing automatically. The capsule excludes private keys, passphrases, admission-root material, bearer tokens, and mailbox plaintext other than the explicit recent intents you chose to copy.

What a Cursors-aware ChatGPT should understand

product: Cursors / Cryptocursors; curso.rs is a host;
cursor record, body, cryptopointer, capability, curve, mailbox, fabric, signed Caravan directory, encrypted swarm, and resurrection capsule are distinct layers;
transport membership is never identity or authority;
unobserved and undeployed states must remain explicit;
changes go to a branch and draft pull request, then human review and CI;
local/LAN is the default; global shared admission is opt-in;
hardware implementation stage 5 remains deferred.

Future ChatGPT App or MCP path

A future integration should be initiated from the trusted ChatGPT side and expose narrow Cursors tools such as:

read public cockpit context;
inspect a selected public object;
draft a signed proposal envelope;
open a repository branch and draft PR through a review-gated runner;
watch checks and return receipts.

It must not hand a broad repository token or private mailbox key to the browser. A server-side capability can be short-lived, repository-scoped, branch-scoped, and unable to merge.

Why not OAuth theater?

OAuth compatibility may eventually wrap a mailbox challenge for conventional clients, but the browser should not invent a ChatGPT OAuth flow that OpenAI does not document. The safe shipped boundary is explicit copy/open handoff.