External API integration brainstorm

Status: Implemented via _ExternalApis + ApiHttpClient (2026-07-19)
Ops docs: ExternalApis.md · VBulletin.md · GithubRestAPI.md
Pattern: libcurl + token/env + speech + Lua + SkillLibrary seed + EthicsGood/LegalShield on mutations

0. What you already integrate (do not reinvent)

Implication: prefer APIs that feed RAG, agents, discovery, gaming coach, or legal education — not another generic chat wrapper.

1. Design rules (all candidates)

1. Read-only first — list/get before POST/PATCH; mutations dry-run + human confirm.
2. Keys on desktop only — never Pixel companion; mask in status.
3. EthicsGood pre-call / LegalShield post-plan for anything that can post, buy, or actuate.
4. SkillLibrary seed — X skills install like github skills install.
5. Fallback — offline stub + local MySQL when cloud down.
6. One façade module per vendor (_XyzApi) + typed xyz … + Lua xyz_*.

2. High-leverage candidates (by product surface)

A. Knowledge / RAG substrate (pairs with Phase B semantic)

Stack hook: ai rag inject → Grok/local synthesize → discovery record draft.

B. Law / civics (pairs with LegalShield, courtroom sims)

Rule: always RAG + LegalShield disclaimer; no step-by-step crime; educational framing only.

C. Dev / project ops (extends GithubRestAPI)

D. Communication & collab

Prefer notify-out over full inbox automation initially.

E. Maps / weather / location (extends WindowsLocation + WeatherHazards)

F. Media library cloud (extends MediaCompute / MySQL libraries)

G. Gaming RL / coach (extends GamingRL + GameModBridge)

Ethics: dry-run default; no public multiplayer automation; Be Good reward shaping stays on.

H. Cloud AI beyond chat (extends Grok brainstorm)

I. Home / robotics / IoT (extends ROS)

Hard allowlist + never unlock doors without dual confirm.

J. Finance / commerce (mostly avoid or read-only)

K. Auth & identity (platform)

3. SkillLibrary packs (install bundles)

Mirror github skills install:

4. Priority tiers (if you implement later)

Tier 0 — free, high RAG value, low risk (~1–2 days each)

1. Wikipedia / MediaWiki
2. Open-Meteo + NWS (strengthen WeatherHazards)
3. arXiv
4. Open Library / MusicBrainz (MediaCompute quality)

Tier 1 — extends what you just built

5. GitHub Actions / checks API (same token as GithubRestAPI)
6. GitLab (copy façade)
7. xAI Grok wire-up (G0) from Grok brainstorm
8. Plex/Jellyfin local for media library sync

Tier 2 — agents & ops

9. Discord or Telegram notify (allowlist)
10. Sentry for Desktop Support
11. Linear or Jira for RSI task sync
12. CourtListener (education + LegalShield)

Tier 3 — heavier OAuth / ToS

13. Microsoft Graph deep
14. Steam / Riot (gaming metadata only)
15. Home Assistant allowlisted tools
16. Multimodal Imagine / STT vendors

5. Shared module sketch

class _VendorApi {
  Init / GetStatus / LastError
  Request(method, path, body)     // curl + Bearer/key
  TestConnection
  InstallSkills()                 // SkillLibrary
  HandleSpeechCommand
  RegisterLuaGlobals
};

Shared helpers worth extracting once 3+ vendors exist:

• HttpJsonClient (curl + headers + timeout + redact logs)
• SecretStore (env → DPAPI/cred manager → settings)
• ApiAuditLog → ai_features.ai_audit_log
• RateLimiter per host

6. Explicit non-goals (for now)

• Auto-trading, auto-buying, auto-social-posting without human confirm
• Multiplayer game automation via vendor APIs
• Putting any cloud key on Android companion
• Scraping sites that forbid bots when a public API exists

7. “Do this first” shortlist

1. Wikipedia + arXiv → RAG packs (max truth, min auth).
2. GitHub Actions under existing GithubRestAPI (one token, more skill value).
3. Open-Meteo/NWS under WeatherHazards.
4. Grok G0 completions path.
5. Telegram notify for agent completion (narrow, high UX).

8. Related docs

• GithubRestAPI.md
• GrokIntegrationBrainstorm.md
• SemanticEmbeddingsAIBrainstorm.md
• WeatherHazards.md
• GameModBridges.md
• LegalShield.md · EthicsGood.md

Living brainstorm — promote a row to an implementation checklist when you pick a vendor.