docs: update submission checklist with current verified state

- 10 PRs merged (was 7)
- .well-known/oauth-protected-resource now 200 (was 'needs wrangler deploy')
- 16/16 production checks pass (added)
- 42/42 local MCP tests pass (added)
- chatgpt-app-submission.json: 5 positive + 3 negative (was 6 positive + 12 negative)
- Removed obsolete Cloudflare Worker deploy step
- Fixed step numbering (Steps 1-5)

Signed-off-by: Michael Kantor <6068672+kantorcodes@users.noreply.github.com>

Author: kantorcodes

SUBMISSION-CHECKLIST.md

@@ -3,14 +3,14 @@
 ## Prerequisites (verified)
 
 - [x] Production MCP endpoint live: `POST https://hol.org/api/guard/mcp` → 401 without Bearer
-- [x] OAuth metadata: `GET https://hol.org/api/guard/oauth` → 200 with correct scopes
-- [x] `.well-known/oauth-protected-resource` fix committed to Cloudflare Worker (needs `wrangler deploy`)
+- [x] OAuth metadata: `GET https://hol.org/api/guard/oauth` → 200 with correct scopes, PKCE S256, `resource_parameter_supported: true`
+- [x] `.well-known/oauth-protected-resource` → 200 (FIXED via registry-broker PR #159 + k8s ingress patch, no Cloudflare Worker deploy needed)
 - [x] hol-guard v2.0.1037 published to PyPI with MCP server and pagination fix
 - [x] Plugin `.mcp.json` merged in hol-guard-plugin PR #13
-- [x] All 7 PRs merged, 0 unresolved review threads
-- [x] Guard-test: 19/19 steps pass
+- [x] All 10 PRs merged across 4 repos (hol-guard #1404, #1431, #1433; portal #3942, #3950, #3963; plugin #13, #14, #15; registry-broker #159), 0 unresolved review threads
+- [x] Guard-test: 19/19 steps pass with teardown
 - [x] Local MCP: 3 tools (search, fetch, get_guard_status), all read-only
-- [x] `chatgpt-app-submission.json` generated (3 tools, 6 test cases, 12 negative tests)
+- [x] `chatgpt-app-submission.json` schema-compliant (3 tools with annotations + justifications, 5 positive + 3 negative test cases)
 - [x] Privacy policy URL: `https://hol.org/points/legal/privacy` → 200
 - [x] Terms URL: `https://hol.org/points/legal/terms` → 200
 - [x] App icon: `assets/icon.png` exists (non-zero size)
@@ -21,21 +21,11 @@
 - [x] Tool annotations: all readOnlyHint=true, destructiveHint=false, openWorldHint=false
 - [x] Sanitization verified: no UUIDs, paths, or secrets in tool output
 - [x] Fetch output ≤ 32 KiB, search results ≤ 20
-
+- [x] 16/16 production verification checks pass
+- [x] 42/42 local MCP contract + security tests pass
 ## Human Actions Required
 
-### Step 1: Deploy Cloudflare Worker
-
-```bash
-cd ~/CascadeProjects/hashgraph-online/cloudflare-workers/hol-registry-proxy
-npx wrangler deploy
-```
-
-Verify: `curl https://hol.org/.well-known/oauth-protected-resource` returns JSON with `resource`, `authorization_servers`, `scopes_supported`.
-
-Note: MCP clients can use `https://hol.org/api/guard/oauth` directly in the meantime.
-
-### Step 2: Create ChatGPT App
+### Step 1: Create ChatGPT App
 
 1. Go to ChatGPT developer settings (https://chatgpt.com/developers)
 2. Create a new app
@@ -47,7 +37,9 @@ Note: MCP clients can use `https://hol.org/api/guard/oauth` directly in the mean
    - **Callback URI**: (set to the ChatGPT-provided callback URL)
 4. Record the real `plugin_asdk_app...` app ID
 
-### Step 3: Add `.app.json`
+Note: `.well-known/oauth-protected-resource` is already live at `https://hol.org/.well-known/oauth-protected-resource` → 200. No Cloudflare Worker deploy needed.
+
+### Step 2: Add `.app.json`
 
 Create `hol-guard-plugin/.app.json` with the real app ID:
 
@@ -62,17 +54,17 @@ Add to `.codex-plugin/plugin.json`:
 "apps": "./.app.json"
 ```
 
-### Step 4: Upload `chatgpt-app-submission.json`
+### Step 3: Upload `chatgpt-app-submission.json`
 
 Upload `chatgpt-app-submission.json` to the ChatGPT Apps submission form. The file contains:
-- App info (name, developer, URLs, icon, descriptions)
+- App info (display_name, subtitle, category: DEVELOPER_TOOLS)
 - MCP server config (endpoint, OAuth, scopes, PKCE)
-- 3 tool definitions with annotation justifications
-- 6 positive test cases
-- 12 negative test cases (auth, isolation, sanitization)
+- 3 tool definitions with annotations + justifications
+- 5 positive test cases
+- 3 negative test cases (auth, isolation, sanitization)
 - Reviewer instructions (data access, security model, privacy)
 
-### Step 5: Verify in ChatGPT Developer Mode
+### Step 4: Verify in ChatGPT Developer Mode
 
 Test the following flows:
 - [ ] OAuth authorize flow succeeds
@@ -88,7 +80,7 @@ Test the following flows:
 - [ ] Stale data indicator when data is outdated
 - [ ] Result links open signed-in HOL Guard pages
 
-### Step 6: Submit
+### Step 5: Submit
 
 - [ ] Run platform pre-submission checks
 - [ ] Resolve every real issue