docs/canonical-domain-source-check-2026-09-21.md

Rama main · réplica de lectura del repositorio original.

# Canonical-domain source check

Review date: 2026-09-21

**Dated source review:** its OAuth and hosted-chat observations describe the
implementation on 2026-09-21, not the current local SIWC path. The domain and
redirect observations are limited to that review date; the public website's
`/api/chat` now returns `410 Gone`. See the
[2026-10-04 source check](openai-source-check-2026-10-04.md) for current local
flow evidence.

This review covers the change from `relmio.vercel.app` to
`relmio.jpfusin.tech` as Relmio's canonical public website. The former Vercel
hostname remains attached to the same project and is configured to redirect to
the matching path on the new hostname after deployment. This is a URL and
routing change only; it is not a legal opinion and does not establish account
entitlement.

## Current official sources

- [Sign in with ChatGPT](https://help.openai.com/en/articles/20001410-sign-in-with-chatgpt)
- [Codex authentication](https://learn.chatgpt.com/docs/auth)
- [GPT-5.6 Luna model](https://developers.openai.com/api/docs/models/gpt-5.6-luna)
- [OpenAI API authentication](https://developers.openai.com/api/reference/overview#authentication)
- [OpenAI Terms of Use](https://openai.com/policies/row-terms-of-use/)
- [OpenAI Services Agreement](https://openai.com/policies/services-agreement/)
- [OpenAI Privacy Policy](https://openai.com/policies/privacy-policy/)

The authentication, model, and API pages were retrieved directly. The Help
Center and policy pages returned HTTP 403 to command-line retrieval and were
reviewed in Opera GX instead. At review time, the Help Center article said it
was updated two months earlier, the Terms were effective January 1, 2026, the
Services Agreement was effective January 1, 2026, and the Privacy Policy was
updated September 10, 2026.

## Findings

The Sign in with ChatGPT article continues to describe identity sign-in for
supported external applications. It says the application receives name, email
address, and profile picture, while additional access requires a separate
permission request. It separately identifies account, authorization, device,
network, and security information that OpenAI may process for the sign-in.
That identity-only description does not match or authorize Relmio's
third-party ChatGPT/Codex compatibility transport.

The Codex authentication documentation still separates ChatGPT subscription
sign-in from usage-based API-key access and ties the chosen method to the
applicable workspace and data policies. The API documentation still describes
bearer API keys for OpenAI Platform requests. Relmio does not create or convert
the browser session into a Platform API key.

The GPT-5.6 Luna page continues to list the exact `gpt-5.6-luna` model ID,
Responses API, streaming, and text input/output. This proves only published
capability; it does not prove entitlement for a particular ChatGPT account,
OAuth grant, hosting network, or compatibility transport.

The individual Terms continue to prohibit credential sharing, programmatic
extraction, circumvention of restrictions, and bypassing protective measures.
The Services Agreement permits API integration for covered customers while
requiring individual credentials and separately restricting unauthorized use.
Neither document specifically approves Relmio's compatibility transport. The
Privacy Policy continues to describe collection of content, account, usage,
device, location, and log data and disclosure to service providers and other
listed recipients.

## Relmio data flow for this release

- **Reads:** unchanged. The hosted browser reads the user's prompt and the
  connected OAuth client's request headers. The hosted route reads the prompt,
  authorization session, and account context for that request.
- **Stores:** unchanged. The browser keeps at most six prompt/answer exchanges
  in current-tab React state and encrypts its stored OAuth session. Disconnect
  removes that browser session. The server does not retain a reusable OAuth
  session or conversation history.
- **Transmits:** unchanged. The browser sends the prompt and authorization
  headers to Relmio's hosted route. The route sends the prompt, fixed system
  instructions, `gpt-5.6-luna`, low reasoning effort, and streaming settings
  through the pinned OpenAI OAuth transport.
- **Logs:** unchanged. Relmio logs only fixed failure categories or upstream
  HTTP status categories. It does not deliberately log prompts, response
  bodies, authorization headers, account IDs, or OAuth tokens.
- **OAuth scopes and permissions:** unchanged. This release requests no new
  scope or permission and does not inspect or broaden the user's actual grant.
- **Recipients:** unchanged. The receiving parties remain the Relmio web host
  and OpenAI's ChatGPT/Codex backend, with their applicable infrastructure and
  subprocessors. The new custom hostname resolves to the existing Vercel
  project; Cloudflare provides DNS only and does not proxy application traffic.

Installer downloads move to the new hostname but deliver the same reviewed
scripts from the same Vercel project. After this release is deployed, the old
hostname redirects before serving the matching path. Local and VPS OAuth
bridges, n8n configuration, credentials, models, endpoints, and default scopes
do not change.

## Unknowns and limits

- Whether OpenAI permits this exact compatibility transport for the account
  and use case remains unresolved.
- The actual consent screen, granted scopes, and account entitlement were not
  inspected during this URL-only change.
- OpenAI-side retention and logging for this exact transport still depend on
  the account plan, workspace settings, and applicable agreement.
- Source review does not prove a production redirect or deployment. Those are
  separate release and post-deployment verification gates.