feat: add game-web-portal skill - #25
Conversation
Agentic onboarding for a PC/Steam Game Web Portal — the agent creates or resumes a verified portal and returns an evidence-backed partner handoff. - skills/game-web-portal/SKILL.md — 126 lines, with the When to use / Prerequisites / Steps / Common pitfalls sections, a `>-` description covering every trigger, and metadata owner/domain - skills/game-web-portal/references/agentic-onboarding.md — the specification: GIVEN/WHEN/THEN acceptance scenarios, state flow, status model, evidence contract, and handoff template Delegates to merchant-setup, shop-setup, catalog-design, login-setup, and headless-checkout-integration rather than duplicating their recipes. Additive only — no existing file is modified. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Thanks for this, Andrey — went through it in detail. Genuinely the most rigorous spec in the kit so far. The state flow, the evidence contract, and "nothing is One blocker before merge: The delegation targets don't exist yet. The skill routes "pages, blocks, theme, localization, preview" to Two ways forward, your call:
I'd lean toward (1) — the two failures you reported (preview 403, Small stuff, all quick:
Nice work on the eval harness too — 12/12 vs 6/12 baseline over 36 runs is the kind of evidence I want on every skill PR. Ping me once the delegation question is sorted and I'll merge. |
|
@apyanzin-xsolla really cool. Do you have an example of a portal that was set up with this skill? |
|
Closing in favor of #29, which supersedes this with the delegation blocker fixed (portal-api.md now documents the Shop Builder API directly instead of routing to non-existent shop-setup coverage). |
* chore: add validation CI and standard public-repo hygiene The repo had no content validation at all — the only workflows were a generated-file sync and a Copilot-review requester that has failed on every PR since it was added. Three defects found by hand on open PRs would each have been caught mechanically. CI - `.github/scripts/validate_skills.py` — runnable locally, checks skill frontmatter (name matches directory, kebab-case, description present and under the 1,536-char skill-listing cap, metadata.owner/domain), the four required sections, relative link resolution, JSON validity, registry presence in both `skills/README.md` and `AGENTS.md`, byte-level agreement between `skills/**` and `.cursor/skills/**`, `CLAUDE.md` vs `AGENTS.md`, and committed credentials. - Pre-existing violations are recorded in `.github/skills-baseline.json`, so the check is enforcing from day one without blocking unrelated work. 13 baselined (missing required sections in shop-setup, merchant-setup, production, headless-checkout-integration); new violations fail. - `.github/workflows/validate.yml` — runs the above on every PR and on main, plus a self-check that every workflow declares `permissions:` and pins actions to a SHA. Verified against the open PRs: #24 passes; #25 fails on exactly its five real problems (no registry rows, no `.cursor` mirror). Security - `permissions: contents: read` on validation; `contents: write` on sync. Neither inherited the default token scope before. - Actions pinned to commit SHAs instead of moving tags, with Dependabot to bump them. - `sync-providers.yml` no longer runs on every branch — it was committing to contributors' feature branches mid-work. Main only, with a concurrency group. - `SECURITY.md` with private reporting and a threat model that says what a vulnerability means in a repo whose content is an instruction payload. Fixes - `.github/CODEOWNERS` was invalid on **every line** — it used Xsolla LDAP names (`@j.manashti`) rather than GitHub handles, so `codeowners/errors` reported all five entries as "Invalid owner" and no review has ever been auto-requested. Mapped to real handles, verified each has write access. - Removed `request-copilot-review.yml`: `GITHUB_TOKEN` cannot add Copilot as a reviewer ("Resource not accessible by integration"), so it was red on every PR. Use the native automatic-review repo setting instead. - Added `LICENSE` — MIT was declared in three plugin manifests with no license file. Also: PR and issue templates, and a CONTRIBUTING section on external contributions. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: validate metadata.owner against a known-owners allowlist Copilot review on #28: the PR description claimed owner was validated against an allowlist, but the code only checked for non-empty. Add VALID_OWNERS (mirrors VALID_DOMAINS) so a typo in metadata.owner now fails CI instead of silently routing review nowhere. Also corrects the CODEOWNERS comment: internal owner ids aren't uniformly firstname.lastname (mix of ., _, - across existing skills) — don't let a contributor "fix" one into a format the repo doesn't use. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix: drop required-sections check, raise line limit to 500 Per @y-klochikhin's review on #28: the required-sections check was a plain substring match (matches inside code blocks, passes on empty headings) so it wasn't really enforcing structure — just four strings' presence — while pushing authors toward a rigid four-part shape that doesn't fit every skill. What CI does check (description + metadata) is what an agent actually reads to decide whether to invoke a skill; past that, structure is the author's call. 200 lines was also below what the repo's own existing skills need. Raised to 500, which still flags genuinely oversized files without warning on almost everything we have today. Baseline is empty now that the section check is gone — no other violation depended on it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Adds an agentic onboarding skill for a PC/Steam Game Web Portal: the agent creates or resumes a verified portal and returns an evidence-backed partner handoff.
Additive only — two new files, no existing file modified.
What the skill does
Covers the Home, News, Rewards, Web Shop, Community, and optional Launcher sections, plus catalog, Login, theme, localization, preview, and publication readiness. PC and Steam only — App Store and Google Play return
needs_input.The run is a state flow, with an existing-vs-desired-state check before every mutation and a read-back after:
The governing rule is that nothing is reported as
completeduntil its effect is verified. Statuses arecompleted,placeholder,needs_input,needs_access,needs_human,blocked_capability,failed. Honest partial completion is the intended outcome; a clean-looking unverified report is treated as failure.It delegates rather than duplicating recipes —
merchant-setupfor merchant/project/API key,shop-setupfor pages, blocks, theme, localization and preview,catalog-designfor catalog and pricing,login-setupfor Login,headless-checkout-integrationfor checkout. Useshop-setupfor a general zero-to-shop storefront; this is the PC/Steam portal path.Conforms to CONTRIBUTING-skills.md
SKILL.mdat its rootreferences/description: >-block, pushy, covering every trigger scenario and the out-of-scope casemetadata:withowner: apyanzin-xsollaanddomain: orchestrator(followingshop-setup, the existing orchestrator)When to use,Prerequisites,Steps,Common pitfallscurland no raw HTTP — the flow describes intent and delegatesAgent test
Prompt:
plus a Steam store URL, merchant ID, project ID, domain, and primary locale.
Result: 12/12 hard-case runs passed with this skill loaded, versus 6/12 with no context. Judge confidence 100%, first-try success 100%, pass@3 100%, zero safety errors. Mean token usage 1.41× the official-docs baseline against a ≤1.5× target. Evaluated across four hard PC onboarding scenarios, three variants, three repetitions each — 36 runs.
A live smoke check against an existing portal passed website discovery, structure read, preview enablement, and preview-link generation. Two failures were tooling-side rather than spec-side, and are worth a maintainer's eye:
verify-websitereturned HTTP 400 because the request omits the requireddraftPagesIdsNote for reviewers
skills/README.mdand theAGENTS.mdskill inventory are deliberately untouched, so this PR stays purely additive. Both list every skill, so a maintainer may want a row added forgame-web-portal— happy to include it here or leave it to a follow-up, whichever you prefer.Source, including the specification and the eval harness: https://github.com/apyanzin-xsolla/game-web-portal