Add a credential-free read-only Sites route or bound-D1 connector operation

Summary

Codex orchestration for a ChatGPT Sites application can need a strictly read-only, authenticated view of application state before it is safe to allocate or reconcile work. The current Sites connector exposes project/version/environment/access operations and an internal source-write credential, but no safe way to read a bound D1 database or call an authenticated GET route.

Please expose one first-party, credential-free read operation:

• sites.read_bound_d1, or
• sites.fetch_site_route restricted to GET/HEAD.

Proposed contract

Example:

sites.fetch_site_route(
  project_id,
  route,
  method = GET,
  expected_sites_version?,
  ttl,
  idempotency_key?
) ->
  status,
  bounded_headers,
  body,
  etag?,
  sites_version_id,
  source_commit,
  audit_receipt_id

Required enforcement:

• caller authorization and project scope are derived by the trusted server;
• no owner secret, bearer token, session cookie, repository credential, or D1 credential is returned to the model, prompt, logs, browser, or tracker;
• only GET and HEAD; no mutation, redirects to write endpoints, method override, or arbitrary network fetch;
• route must be same-project and allowlisted;
• short lifetime, bounded response bytes, timeout, and sanitized errors;
• return response status/body plus ETag when present;
• bind results to the immutable Sites version/source commit used;
• append a non-sensitive immutable audit receipt;
• fail closed if the route requires authority the server cannot supply.

Equivalent D1 form should accept only a named bound database plus a server-approved read-only query/template. It must reject multiple statements, PRAGMA/DDL/DML, attachment, extensions, and unrestricted SQL.

Why this is needed

A bootstrap workflow may need to determine whether a canonical task already exists and obtain its current revision/ETag before creating the trusted task allocator itself. Without a read-only seam, the only available alternatives are unsafe or inaccurate: browser-session borrowing, owner-secret exposure, direct D1 access, write credentials used as read credentials, stale snapshots, or invented task state.

This read seam is complementary to, but distinct from, a Sites-to-Codex ephemeral workspace broker. It resolves canonical read/CAS preconditions without granting source or application write authority.

Acceptance criteria

• Read an allowlisted authenticated snapshot route and return status, bounded body, and exact ETag.
• Bind the receipt to project, Sites version, and source commit.
• Prove no credential material is exposed.
• Prove write methods, cross-project URLs, redirects to mutations, oversized bodies, timeouts, and stale version constraints fail closed.
• No application deployment or database mutation is required to perform the read.