Code found ≠ service enabled. Reported complete ≠ independently verified.
What this review covers
Repository and public-policy review, plus a limited non-secret production-metadata check. That check did not establish effective models, customer entitlements, usage, invoices or private agreements. An implemented adapter is not proof that it is enabled or being used by a customer.
01
THE INVENTORY
The tools behind the work.
Inspect purpose, account ownership, data, permissions and cost boundaries for each integration.
AI integration inventory
AI-01OpenAIDot task delegationA user authorises Poko to send a bounded request to their connected Dot. The intended experience keeps the discussion in Companion.Prototype+
Account & ownership
Each user's own connected Dot and ChatGPT account.
Data flow
An explicit task, selected link and task-specific reports. A whole conversation is not required.
Permission boundary
Scoped Poko consent and an owner-authorised monitoring subscription. OpenAI review remains independent.
Cost & allowance
The customer's Dot/ChatGPT allowance is separate from Poko API usage; no API-token price is asserted for a Dot event.
Retention & deletion
Task-specific requests, questions, answers and findings are retained with stable message IDs and ordering. Poko exchange export and redaction are implemented; runtime receipts, conversation history and OpenAI-held copies have separate lifecycle controls. New request records have a 90-day storage TTL; a 24-hour redacted tombstone blocks delayed callbacks after deletion. The recent-history index is bounded.
Evidence inspected
Source implementation includes owner-scoped names, standing opt-in for automatic read-only public-link delegation, task-level context sharing, retained reports and local cancellation limits. See protected run/test evidence for validation; no real-Dot production acceptance is established.
Still to verify
Delegation is restricted to enabled internal Poko preview reviewers while the precise provider scope and launch review remain open. Named routing and the retained task exchange have local fixture evidence; real-Dot production acceptance and OpenAI approval are not established.
Review owner
Poko engineering · Dave accountable
AI-02OpenAIOpenAI API connectionBrain can make authorised text-model requests through an OpenAI provider adapter.Implementation found+
Account & ownership
A scoped provider connection. Credential ownership and the funding path must be checked for each offering.
Data flow
Selected model messages, tool context and generated output pass through the Poko gateway to the configured provider.
Permission boundary
Account-owned connections and execution profiles; permissions are checked at execution.
Cost & allowance
Provider usage and Poko customer charges are distinct records. Current spend and invoice reconciliation were not inspected.
Retention & deletion
Poko records and provider-side API data controls are separate. Effective account settings and end-to-end deletion need confirmation.
Evidence inspected
Provider probe, chat-completion and Responses paths exist in the inspected source. Current account use was not measured.
Still to verify
Reconcile enabled models, actual provider account, data controls and current usage evidence before making customer-specific claims.
Review owner
Poko engineering · Dave accountable
AI-03OpenAIChatGPT plan connectionA separately configured path for eligible ChatGPT-plan-backed requests.Conditional+
Account & ownership
User-owned plan connection; production client eligibility and permissions must be established.
Data flow
Authorised request context and output, using the selected plan connection.
Permission boundary
Conditional client enablement and account authorisation. A configured UI is not proof of provider eligibility.
Cost & allowance
Plan allowance and any Poko commercial offering require their own terms assessment; not assumed equivalent to API billing.
Retention & deletion
Plan-specific treatment must be confirmed. API retention assumptions are not applied automatically.
Evidence inspected
Eligibility checks and an authorisation/exchange path exist in source; current production approval was not reviewed.
Still to verify
Record the actual approved client scope and relevant terms before advertising availability.
Review owner
Poko integration review · Dave accountable
AI-04OpenAICodex executionLocal and paired-PC execution paths support explicitly configured coding work.Implementation found+
Account & ownership
The user's connected computer and its authorised Codex session.
Data flow
Selected task instructions, workspace context, approvals and task artifacts may reach the connected execution environment.
Permission boundary
PC pairing, account ownership, available workspace and per-action approvals remain applicable.
Cost & allowance
The relevant Codex account/allowance is distinct from Poko hosted-model usage.
Retention & deletion
Local files, Poko task records and provider-side task history have separate lifecycles; no blanket deletion claim is made.
Evidence inspected
Personal-PC connection and task/approval/artifact adapters are implemented. Limited startup checks on an owner-controlled device do not establish qualification of all customer devices or workflows.
Still to verify
Document supported task scope and the actual user/device data lifecycle for each enabled deployment.
Review owner
Poko engineering · Dave accountable
AI-05OpenAIAI-assisted developmentCodex is used to investigate, implement and review changes in this repository.Development use+
Account & ownership
An authorised development session; distinct from a customer's runtime model account.
Data flow
Task-relevant source and development evidence. Secrets and customer data are excluded from public audit material.
Permission boundary
Repository instructions, scoped tool access and shared validation/release controls.
Cost & allowance
Development tooling allowance is not represented as customer model usage.
Retention & deletion
Source-control, development-session and operational-evidence retention differ; no provider-wide claim is made.
Evidence inspected
This audit and the Dot prototype were developed through a Codex session. A bot's own output is not independent assurance.
Still to verify
Maintain reviewer attribution and distinguish implementation evidence from independent review.
Review owner
Dave · development owner
AI-06AnthropicAnthropic connectionBrain has a provider adapter for authorised Claude-family requests.Implementation found+
Account & ownership
User/account-scoped provider credentials; current funded accounts not inspected.
Data flow
Selected messages and tool context are sent to the provider; output returns through Poko.
Permission boundary
Configured connection, enabled model and account execution authority.
Cost & allowance
Provider usage and Poko charges must be disclosed separately; current rates/spend not reviewed.
Retention & deletion
Provider-specific data terms and settings require review; OpenAI data rules do not substitute for them.
Evidence inspected
Provider probe and message-generation branches exist in source. No live-use claim is made.
Still to verify
Confirm enabled models, effective terms, processing regions and deletion behaviour for the actual account.
Review owner
Poko provider review · Dave accountable
AI-07GoogleGemini connectionBrain has a provider adapter for authorised Gemini requests.Implementation found+
Account & ownership
User/account-scoped provider credentials; current deployment use not inspected.
Data flow
Selected messages and context go to the configured generation service.
Permission boundary
Connection ownership, model availability and task scope.
Cost & allowance
Actual account usage, quotas and Poko billing need reconciliation.
Retention & deletion
Effective Google account/service data terms must be assessed independently.
Evidence inspected
Provider probe and content-generation branches exist in source; live account evidence is absent from this review.
Still to verify
Verify exact account type, data treatment, enabled model identifiers and customer disclosures.
Review owner
Poko provider review · Dave accountable
AI-08OpenRouter + selected downstream providerOpenRouter connectionBrain can route authorised model requests through a model-routing provider.Implementation found+
Account & ownership
A scoped OpenRouter connection and the actual downstream route.
Data flow
Selected task context can pass through the router and a downstream provider.
Permission boundary
Account connection and selected routing policy; a provider alias does not identify every downstream destination.
Cost & allowance
Router/provider charges and Poko customer pricing are distinct; actual route/spend not inspected.
Retention & deletion
Assess both router and downstream provider terms, settings and processing locations.
Evidence inspected
Provider authentication probe, completion path and provider usage handling exist in source.
Still to verify
Capture the actual downstream model/provider for a run and make any routing/privacy constraints explicit.
Review owner
Poko provider review · Dave accountable
AI-09Configured inference backendPoko hosted-model gatewayPoko chat and task services use configured standard, deep and instant inference paths.Implementation found+
Account & ownership
Poko-operated backend configuration, separate from a user's external provider connection.
Data flow
Task instructions and authorised retrieved context are forwarded to the configured backend.
Permission boundary
Poko task/account controls and backend authentication.
Cost & allowance
Poko hosting/inference cost and customer pricing require separate measurement.
Retention & deletion
Poko task/storage controls and inference-host logs must be reconciled against the deployed configuration.
Evidence inspected
Source wires configured HTTP inference providers. On 30 October 2026, a scoped installed Brain startup check returned output from four selected Poko-hosted models, with matching requested/served identities, usage and execution records. This is not whole-product acceptance or licence approval.
Still to verify
Verify runtime model identity, licences, hosting location, retention and real usage before claiming a particular model powers a customer request.
Review owner
Poko platform engineering · Dave accountable
AI-10Configured backend; local Nomic adapter also presentEmbeddings & retrievalConvert selected text to vectors for retrieval/classification where configured.Implementation found+
Account & ownership
Poko backend configuration; local implementations have a separate lifecycle.
Data flow
Text selected for embedding and resulting vectors. Vectors are not assumed anonymous.
Permission boundary
Source-resource access and embedding endpoint authority.
Cost & allowance
Configured inference/hosting costs; not assumed to be an OpenAI embedding charge.
Retention & deletion
Source text, vectors, indexes and logs need linked deletion and retention rules.
Evidence inspected
A configured HTTP embedding service and a local Nomic implementation exist in source. Exact deployed provider/model not verified.
Still to verify
Verify index ownership, deployed model, processing location, vector retention and deletion propagation.
Configured Poko backend; not presumed to be OpenAI Realtime or an OpenAI API account.
Data flow
Selected audio and returned transcript, with different storage lifecycles.
Permission boundary
Audio collection authority, account/task scope and backend authentication.
Cost & allowance
Audio processing and hosting basis require deployment-specific confirmation.
Retention & deletion
Audio, transcripts, derived artifacts and worker logs must be assessed separately.
Evidence inspected
Speech proxy and Crowd transcription adapters are present. Scoped owner-authorised recorded private practice passed local transcription on 30 October 2026. Live-room and on-air acceptance remain open; a session token is not evidence of OpenAI Realtime use.
Still to verify
Verify the actual speech model/provider, consent, retention and resource ownership for each enabled workflow.
Review owner
Poko media engineering · Dave accountable
AI-12Coverage reviewImage, voice & additional AI servicesCheck for additional enabled AI generation, voice, moderation, model-hosting and third-party automation paths.Coverage gap+
Account & ownership
Not established by the initial inventory.
Data flow
Do not assume a data flow from a package name, stored image or realtime label.
Permission boundary
Must be assessed if an active service is identified.
Cost & allowance
No additional provider spend or price is asserted.
Retention & deletion
No service-specific conclusion is available yet.
Evidence inspected
The inspected paths do not establish a complete inventory of every runtime feature or customer account.
Still to verify
Finish the deployment/usage reconciliation and add any verified additional services with evidence.
Review owner
Poko inventory review · Dave accountable
No matching records. Try another provider or search term.
“Implementation found” describes inspected source. This register does not expose private accounts, credentials, customer content or operational endpoints.
02
THE OPENAI BOUNDARY
One conversation. Clear authority.
The intended experience: you speak to Poko; Poko delegates suitable, authorised work to your connected Dot.
You ask Poko→Poko checks scope→Your Dot works→Findings return
The interface can stay familiar. The agent's identity, permissions and approval boundaries must stay visible. Your Dot's name is an alias for your connected agent, not a new foundation model.
01
Authorised starting point
Documented pattern
The owner connects Poko, asks their Dot to monitor defined Poko requests, and specifies the permitted work. Connecting a plugin alone is not a monitoring instruction.
The intended design lets Poko propose Dot when it fits the task, within the owner's standing delegation policy. The server must check authority and connection state. This precise orchestration is not represented as OpenAI-approved.
Only the bounded instruction, selected resources and necessary task context. No full-history mirroring, unrelated workspace content, secrets or hidden reasoning.
Retain messages intentionally exchanged about that Poko task. A user answer can continue the same task; it is not a general Dot chat channel or an OpenAI platform approval.
OpenAI's checks remain effective. Poko permission is not a substitute for a platform approval. Disconnecting stops future Poko access/delivery; already received work may need to be stopped in ChatGPT.
Resolve the exact delegated scope, validate the actual connection and data lifecycle, and complete private live acceptance before describing the integrated experience as available.
No general-purpose Dot chat proxy. No full-history reconstruction. No substitute for OpenAI's own approvals. The exact Poko-model-initiated delegation design remains a review question, not an approved capability claim.
03
WHEN YOU USE OR PAY FOR POKO
Our responsibility stays with us.
Using another provider does not remove Poko’s responsibility for its own product, promises and customer experience.
01
Know who is doing the work
The audit separates Poko's configured agents, external providers and user-owned Dot accounts.
Review action
Show the actual provider/model or agent destination for a task. Customer nicknames must retain their underlying identity.
Provider guidance, Poko policies and existing registers have different evidential weight. A policy describes a commitment; it does not prove every control is operating.
01 · Published guidance02 · Source & test evidence03 · Production observation04 · Provider confirmation
Issues remain visible until evidence and an accountable review support their disposition. No completion percentage is substituted for that judgement.
AUD-01Release gateOpen
Confirm the exact Dot orchestration scope
Published guidance supports owner-authorised event monitoring. Provider confirmation of Poko-model-selected delegation and this specific follow-up design is not established. No clarification request has been sent by this audit task.
AUD-02Evidence neededOpen
Reconcile implemented adapters with actual deployment
Complete the enabled-model, account, entitlement, licence, effective region, retention and usage review. This initial inventory records implementation evidence without inventing live adoption or spend.
AUD-03Claim reviewOpen
Substantiate public affiliation language
The public OpenAI services page uses Partner language; older application collateral records an earlier unconfirmed status. This audit has not reviewed the current supporting agreement or programme evidence. Neither historical document alone determines today's relationship.
AUD-04Evidence neededOpen
Verify the complete customer data lifecycle
Check context sharing, task history, audio, vectors, exports, deletion, provider-held data and incident escalation against each current funding and deployment path.
AUD-05Operational gapOpen
Make recurring review observable
The recurring reviewer, protected run evidence, expired-lease/missed/failed-run flags and human disposition workflow are implemented using existing maintenance and storage. Production activation and observed scheduled success/failure remain to be verified after the shared deployment.
AUD-06Release gateOpen
Complete real-Dot acceptance
The direct-send prototype has dated fixture test evidence. Real two-account Dot acceptance, integrated follow-ups and production verification remain outstanding; this task does not implement the later routing stages.
06
THE REVIEW TRAIL
A date is not a guarantee.
How this stays current
Weekly Monday 09:00 Australia/Sydney review is implemented on the existing maintenance worker, with register-change and build-release triggers. Production activation is not verified: inspect the protected run evidence before claiming the schedule is active. Bots collect facts; accountable humans record dispositions.
Public audit baseline
Reviewed selected provider/runtime source, existing assurance collateral and public policy pages. Added the initial provider inventory, Dot boundary assessment, customer responsibilities and explicit open issues. No production account, invoice or private provider agreement inspection is claimed.
Dot prototype evidence
The earlier implementation handover records focused backend/UI/routing tests, a shared build and backend typecheck. Its full web check encountered unrelated shared-tree typing errors. Those are dated receipts, not evidence of current deployment or OpenAI approval.
Governance & assurance collateral
Technical and governance documents were prepared with supporting evidence and standards registers. They distinguish policy commitments, implementation, dated test evidence and outstanding assurance. Preparation does not establish independent certification.
Named delegation, retained task exchange and operational reviewer implementation
Implementation and validation in progress. No production activation or provider approval asserted.
HELP US KEEP THE RECORD HONEST
A question is a useful place to start.
Ask about an integration, a claim or a gap. Please reference the record ID, and keep private account information out of your message.
Contact Poko ↗Public register 2026.10.30.2 · No independent certification is asserted.