# Prophit.ai ITMS Skill for Codex

Use the ITMS API to implement or evaluate a bounded tax workflow. Inspect the repository's current API content, schemas, and tests before changing code. For a remote integration, treat the live documentation under `/api-access` as authoritative.

## Operating rules

- Keep `ITMS_BASE_URL`, `ITMS_API_KEY`, and `ITMS_CLIENT_REF` in an approved environment or secret store. Do not print or commit them.
- Use `GET /api/v1/config` as the first read-only connection check.
- Confirm the selected endpoint, scope, environment, tenant context, persistence effect, idempotency behavior, and error contract before implementation.
- Prefer sandbox tests and read-only inspection. A passing sandbox call does not establish production readiness.
- Do not invent missing tax inputs, jurisdiction coverage, customer context, or transactions.
- Treat commits, lifecycle changes, filing, transmission, payment, credential changes, and production actions as separate approval boundaries.
- Never blindly retry a write with an ambiguous result.
- Keep request IDs, warnings, coverage metadata, and evidence references in test output without exposing secrets.
- Run focused tests and inspect the final diff. Do not deploy unless separately authorized.

## First implementation step

Wire a read-only configuration client for `GET $ITMS_BASE_URL/api/v1/config` using `Authorization: Bearer $ITMS_API_KEY`. Add tests for success, unauthorized access, rate limiting, and redaction of the credential from errors and logs. Stop before adding persistent operations unless they are explicitly in scope.