Three months for review on a fairly simple-sounding integration is rough. Curious — was most of that time waiting for OpenAI to assign someone, or was it back-and-forth iteration once review actually started? On the things I've shipped through similar reviews, the iteration loop was the painful part: every comment took ~10 days to come back, so even small clarifications stacked up.
The MCP UI Apps point is interesting. Tool-only feels like a step back once you've seen widgets, but the auth gap inside the iframe really is undocumented. Did you end up doing a one-time exchange to get a short-lived widget token, or polling from the iframe to your backend with the user's session?