[maxonary]

Chime currently reaches a separate OpenClaw agent through GPT-Live. This draft adds a disabled-by-default, durable text bridge scaffold for messaging the user's existing ChatGPT dot through the documented MCP Events interface. It does not yet route the shipped Watch audio UI to the dot.

Implementation

• Authenticated MCP 2.0 endpoint with event discovery, signed callback verification, subscription refresh/unsubscribe, and narrow read_message / idempotent send_reply tools.
• Owner-bound device text routes and a persistent correlated message/reply queue: atomic fsynced writes, stable operation/event IDs, out-of-order reply handling, bounded retries, deadlines, cancellation, restart recovery, and fail-closed storage behavior.
• Disjoint device/plugin credentials; optional OAuth resource server validates signature, issuer, audience, immutable subject, access-token type, scope and a maximum five-minute token lifetime. An existing compatible OAuth 2.1 issuer is required for live setup. No credentials or authorization server are provisioned.
• HTTPS callback allowlist, DNS validation and address pinning per connection, no redirects, bounded responses, Standard Webhooks signatures, challenge verification and signing-key rotation.
• AgentBackend adapter for a future direct transcript path. Live rejects dot wiring/selection rather than allowing its voice model to answer as the dot. Existing OpenClaw mode remains unchanged.
• Plugin packaging template and detailed setup/recovery/limits guide, grounded in current official MCP Events, authentication and MCP 2.0 transport documentation.

Validation

• npm run typecheck — passed.
• npm test — 90 passed, 0 failed on Node 25.9.0.
• npx --yes --package=node@22 -- node --import tsx --test --test-timeout=5000 test/*.test.ts — 90 passed, 0 failed, matching the gateway Docker major version.
• git diff --check — passed; final diff inspected.
• Tests include simulated device → event → MCP read/reply → device round-trip; real JWT signature/claim checks; duplicate/out-of-order/replayed requests; access separation; callback SSRF/pinning; invalid/stale signatures; cancellation, expiry, rotation, disk failure and restart recovery; and no dot-to-other-model voice fallback.
• npm audit reports the existing moderate qs advisory (locked qs remains 6.15.3); no audit-clean claim or unrelated dependency upgrade is included.

Deliberate draft limits / live setup gates

• No deployment, credential creation, production change, plugin installation or actual ChatGPT/dot call was performed. OAuth linking, event subscription, same-dot delivery, batching and end-to-end latency require later authorized live setup. Webhook receipt is not a completed answer and conveys no owner authority or approval.
• No Watch UI, microphone transcription routing, TTS, push delivery or realtime latency guarantee. Those must use the direct correlated adapter, not optional model delegation.
• Single owner/process, local persistent journal, 16 pending/1,000 retained messages, no automatic pruning or protocol history replay. After an unclean crash, confirm the old writer is dead and remove only its lock before reopening the same journal. No automatic failover.
• Cancellation cannot retract an event already received by ChatGPT or prove remote work stopped. Existing dot permissions apply; approvals may still require ChatGPT. The plugin does not export dot memory.