Keep offline model migrations independent of credentials

plugins/openai-developers/skills/openai-platform-api-key/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: openai-platform-api-key
-description: 'Use when Codex is asked to build, run, test, debug, or configure an OpenAI-backed or provider-unspecified AI app, UI, script, CLI, generator, or tool, especially requests phrased only as "using AI" or generators driven by forms/user input; also use for OPENAI_API_KEY or sk-proj setup. Treat this as the credential gate: inspect safely, ask reuse-vs-new before API work, and never expose plaintext.'
+description: 'Use when Codex is asked to build, run, test, debug, or configure an OpenAI-backed or provider-unspecified AI app, UI, script, CLI, generator, or tool, especially requests phrased only as "using AI" or generators driven by forms/user input; also use for OPENAI_API_KEY or sk-proj setup. Do not gate model or prompt migrations that can proceed with source edits and offline validation. Otherwise treat this as the credential gate: inspect safely, ask reuse-vs-new before API work, and never expose plaintext.'
 ---
 
 # OpenAI API Key
@@ -25,12 +25,13 @@ Do not use it when:
 - The user asks for a static frontend, visual mockup, design concept, or placeholder UI with no API-backed behavior.
 - The user only asks Codex to write a one-off output directly and no app, script, generator, or API-backed tool is being built or run.
 - The user names a different AI provider for the artifact.
+- The user asks to migrate or update an existing OpenAI model or prompts and the work can proceed through source or configuration edits plus offline, mocked, static, fixture-based, or syntax validation. Use this skill later only if a live API request is actually needed.
 
 If API access is needed and no usable key is found, offer secure key provisioning instead of leaving only placeholder docs or manual setup steps.
 
 ## Coordination With Implementation Skills
 
-When another implementation skill also applies, run this skill first only to inspect credentials safely and send the credential decision message. Until reuse-existing-key vs create-new-key is resolved, it outranks design-first and implementation-first flows, including `build-web-apps:frontend-app-builder`; do not design UI, choose architecture, inspect API examples, write code, or run smoke tests. After the user answers, hand off to the appropriate implementation, docs, or frontend skill.
+When another implementation skill also applies, run this skill first only to inspect credentials safely and send the credential decision message. Until reuse-existing-key vs create-new-key is resolved, it outranks design-first and implementation-first flows, including `build-web-apps:frontend-app-builder`; do not design UI, choose architecture, inspect API examples, write code, or run smoke tests. Model and prompt migrations are the narrow exception above: complete requested source/configuration edits and offline validation without a credential decision, then use this skill only before any live API request. After the user answers, hand off to the appropriate implementation, docs, or frontend skill.
 
 ## Safety Rules
 
@@ -49,7 +50,7 @@ When another implementation skill also applies, run this skill first only to ins
 
 ## Mandatory First Step
 
-Before editing, testing, running, debugging, or configuring any code that calls the OpenAI API:
+Before editing, testing, running, debugging, or configuring any code that calls the OpenAI API, except for the model/prompt migration source edits and offline validation explicitly allowed above:
 
 1. Inspect for a usable `OPENAI_API_KEY` without printing it.
 2. Unless the user explicitly asked for a new key, ask whether to reuse an existing key or create a new one. If none exists, ask whether to create one.
@@ -64,7 +65,7 @@ This applies even if:
 
 Finding an existing key is not permission to proceed. It only changes the question you ask.
 
-The credential decision is a hard stop. Before the user answers, do not create directories, scaffold files, draft implementation plans, wire API-dependent code, run smoke tests, or give placeholder/manual key setup instructions. The only allowed pre-gate work is safe repo convention discovery and credential presence checks that do not print secrets.
+The credential decision is a hard stop outside the model/prompt migration exception above. Before the user answers, do not create directories, scaffold files, draft implementation plans, wire API-dependent code, run smoke tests, or give placeholder/manual key setup instructions. The only allowed pre-gate work is safe repo convention discovery and credential presence checks that do not print secrets.
 
 ## Credential Decision Messages
 

plugins/openai-developers/skills/openai-platform-api-key/references/evals.md

@@ -22,6 +22,7 @@ Use this matrix to test implicit activation and the key-flow handoff for
 - "Write a poem about New York City." (no API access required)
 - "Build a script that uses Claude to summarize files." (different provider)
 - "Build a Gemini-powered UI for image prompts." (different provider)
+- "Migrate this existing app to the latest OpenAI model and update its prompts." (`openai-docs`; source edits and offline validation do not require credentials)
 
 ## 2. Routing tests
 

plugins/openai-developers/tests/openai-platform-api-key.test.mjs

@@ -329,7 +329,11 @@ test("skill asks before building API-backed apps when any usable key exists", ()
   );
   assert.match(
     description,
-    /Treat this as the credential gate: inspect safely, ask reuse-vs-new before API work/,
+    /Do not gate model or prompt migrations that can proceed with source edits and offline validation/,
+  );
+  assert.match(
+    description,
+    /Otherwise treat this as the credential gate: inspect safely, ask reuse-vs-new before API work/,
   );
   assert.match(
     skill,
@@ -432,7 +436,7 @@ test("skill makes the key-choice gate impossible to miss", () => {
   assert.match(skill, /## Mandatory First Step/);
   assert.match(
     skill,
-    /Before editing, testing, running, debugging, or configuring any code that calls\s+the OpenAI API:\s+1\. Inspect for a usable `OPENAI_API_KEY` without printing it\.\s+2\. Unless the user explicitly asked for a new key, ask whether to reuse an\s+existing key or create a new one\. If none exists, ask whether to create one\.\s+3\. Stop until the user answers\./,
+    /Before editing, testing, running, debugging, or configuring any code that calls\s+the OpenAI API, except for the model\/prompt migration source edits and offline\s+validation explicitly allowed above:\s+1\. Inspect for a usable `OPENAI_API_KEY` without printing it\.\s+2\. Unless the user explicitly asked for a new key, ask whether to reuse an\s+existing key or create a new one\. If none exists, ask whether to create one\.\s+3\. Stop until the user answers\./,
   );
   assert.match(
     skill,
@@ -444,7 +448,7 @@ test("skill makes the key-choice gate impossible to miss", () => {
   );
   assert.match(
     skill,
-    /The credential decision is a hard stop\. Before the user answers, do not create\s+directories, scaffold files, draft implementation plans, wire API-dependent\s+code, run smoke tests, or give placeholder\/manual key setup instructions\./,
+    /The credential decision is a hard stop outside the model\/prompt migration\s+exception above\. Before the user answers, do not create directories, scaffold\s+files, draft implementation plans, wire API-dependent code, run smoke tests, or\s+give placeholder\/manual key setup instructions\./,
   );
   assert.match(
     skill,
@@ -573,6 +577,10 @@ test("eval matrix includes local picker boundary and two-field joke app use case
     evals,
     /if the rollout proceeds after a confirmed key decision, the app plan or implementation\s+should collect two user input fields and send both fields into the AI joke-generation request/,
   );
+  assert.match(
+    evals,
+    /Migrate this existing app to the latest OpenAI model and update its prompts\./,
+  );
 });
 
 test("openai-docs defers to API key skill for implementation tasks", (t) => {