Skip to content

feat: add game-web-portal skill - #25

Closed
apyanzin-xsolla wants to merge 1 commit into
xsolla:mainfrom
apyanzin-xsolla:feat/game-web-portal-skill
Closed

feat: add game-web-portal skill#25
apyanzin-xsolla wants to merge 1 commit into
xsolla:mainfrom
apyanzin-xsolla:feat/game-web-portal-skill

Conversation

@apyanzin-xsolla

@apyanzin-xsolla apyanzin-xsolla commented Aug 12, 2026

Copy link
Copy Markdown

Adds an agentic onboarding skill for a PC/Steam Game Web Portal: the agent creates or resumes a verified portal and returns an evidence-backed partner handoff.

Additive only — two new files, no existing file modified.

skills/game-web-portal/SKILL.md                          126 lines
skills/game-web-portal/references/agentic-onboarding.md   185 lines

What the skill does

Covers the Home, News, Rewards, Web Shop, Community, and optional Launcher sections, plus catalog, Login, theme, localization, preview, and publication readiness. PC and Steam only — App Store and Google Play return needs_input.

The run is a state flow, with an existing-vs-desired-state check before every mutation and a read-back after:

Intake → Preflight → Discover → Draft → Verify → Human review →
Publish → Live verification → Handoff

The governing rule is that nothing is reported as completed until its effect is verified. Statuses are completed, placeholder, needs_input, needs_access, needs_human, blocked_capability, failed. Honest partial completion is the intended outcome; a clean-looking unverified report is treated as failure.

It delegates rather than duplicating recipes — merchant-setup for merchant/project/API key, shop-setup for pages, blocks, theme, localization and preview, catalog-design for catalog and pricing, login-setup for Login, headless-checkout-integration for checkout. Use shop-setup for a general zero-to-shop storefront; this is the PC/Steam portal path.

Conforms to CONTRIBUTING-skills.md

  • One skill per directory, SKILL.md at its root
  • 126 lines, under the 200-line limit; the specification lives in references/
  • description: >- block, pushy, covering every trigger scenario and the out-of-scope case
  • metadata: with owner: apyanzin-xsolla and domain: orchestrator (following shop-setup, the existing orchestrator)
  • All four required sections: When to use, Prerequisites, Steps, Common pitfalls
  • No curl and no raw HTTP — the flow describes intent and delegates

Agent test

Prompt:

Use Xsolla CLI to set up my PC Game Portal.

plus a Steam store URL, merchant ID, project ID, domain, and primary locale.

Result: 12/12 hard-case runs passed with this skill loaded, versus 6/12 with no context. Judge confidence 100%, first-try success 100%, pass@3 100%, zero safety errors. Mean token usage 1.41× the official-docs baseline against a ≤1.5× target. Evaluated across four hard PC onboarding scenarios, three variants, three repetitions each — 36 runs.

A live smoke check against an existing portal passed website discovery, structure read, preview enablement, and preview-link generation. Two failures were tooling-side rather than spec-side, and are worth a maintainer's eye:

  • the public preview URL returned HTTP 403
  • verify-website returned HTTP 400 because the request omits the required draftPagesIds

Note for reviewers

skills/README.md and the AGENTS.md skill inventory are deliberately untouched, so this PR stays purely additive. Both list every skill, so a maintainer may want a row added for game-web-portal — happy to include it here or leave it to a follow-up, whichever you prefer.

Source, including the specification and the eval harness: https://github.com/apyanzin-xsolla/game-web-portal

Agentic onboarding for a PC/Steam Game Web Portal — the agent creates or resumes
a verified portal and returns an evidence-backed partner handoff.

- skills/game-web-portal/SKILL.md — 126 lines, with the When to use /
  Prerequisites / Steps / Common pitfalls sections, a `>-` description covering
  every trigger, and metadata owner/domain
- skills/game-web-portal/references/agentic-onboarding.md — the specification:
  GIVEN/WHEN/THEN acceptance scenarios, state flow, status model, evidence
  contract, and handoff template

Delegates to merchant-setup, shop-setup, catalog-design, login-setup, and
headless-checkout-integration rather than duplicating their recipes.

Additive only — no existing file is modified.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@JavadManashti

Copy link
Copy Markdown
Collaborator

Thanks for this, Andrey — went through it in detail.

Genuinely the most rigorous spec in the kit so far. The state flow, the evidence contract, and "nothing is completed until its effect is verified / simulated completion is failure" is the discipline I want across all our skills, not just this one. I'd like to lift that pattern into CONTRIBUTING-skills.md once this lands.

One blocker before merge:

The delegation targets don't exist yet. The skill routes "pages, blocks, theme, localization, preview" to shop-setup — but shop-setup has no Site Builder coverage at all (grepped for sitebuilder/site builder/portal/shop builder — zero hits). Nothing in the kit does; webhooks-impl even scopes itself explicitly to "headless web shop, without Site Builder." So Step 4 (Draft), where all the actual portal work happens, dead-ends for the agent.

Two ways forward, your call:

  1. Bring the portal/Site Builder API calls into references/ so the skill is self-sufficient, or
  2. Mark those operations blocked_capability and ship the governance layer now, wire up the APIs in a follow-up.

I'd lean toward (1) — the two failures you reported (preview 403, verify-website 400 on missing draftPagesIds) show you already have the real API knowledge, it just didn't make it into the skill. Right now the skill names no endpoints anywhere — SKILL.md or references — while the other skills put the concrete API calls in one or the other.

Small stuff, all quick:

  • Please add the registry rows in this PR rather than a follow-up — a row in skills/README.md, plus the table row + trigger block in AGENTS.md. Without them the skill is invisible in the inventory.
  • Add status: draft to the frontmatter to match the other draft skills.
  • Owner format: you used the GitHub handle per CONTRIBUTING-skills.md, but repo convention is firstname.lastname style (see other skills' metadata.owner). The guide and the repo disagree here — I'll fix the guide, just flagging it so it's not a surprise.
  • domain: orchestrator puts you next to shop-setup with overlapping trigger words (Web Shop, catalog, Login, checkout). I'll add a routing line to shop-setup pointing the other way so agents don't load both.

Nice work on the eval harness too — 12/12 vs 6/12 baseline over 36 runs is the kind of evidence I want on every skill PR. Ping me once the delegation question is sorted and I'll merge.

@aspringut-xsolla

Copy link
Copy Markdown
Collaborator

@apyanzin-xsolla really cool. Do you have an example of a portal that was set up with this skill?

@JavadManashti

Copy link
Copy Markdown
Collaborator

Closing in favor of #29, which supersedes this with the delegation blocker fixed (portal-api.md now documents the Shop Builder API directly instead of routing to non-existent shop-setup coverage).

JavadManashti added a commit that referenced this pull request Aug 19, 2026
* chore: add validation CI and standard public-repo hygiene

The repo had no content validation at all — the only workflows were a generated-file
sync and a Copilot-review requester that has failed on every PR since it was added.
Three defects found by hand on open PRs would each have been caught mechanically.

CI

- `.github/scripts/validate_skills.py` — runnable locally, checks skill frontmatter
  (name matches directory, kebab-case, description present and under the 1,536-char
  skill-listing cap, metadata.owner/domain), the four required sections, relative link
  resolution, JSON validity, registry presence in both `skills/README.md` and
  `AGENTS.md`, byte-level agreement between `skills/**` and `.cursor/skills/**`,
  `CLAUDE.md` vs `AGENTS.md`, and committed credentials.
- Pre-existing violations are recorded in `.github/skills-baseline.json`, so the check
  is enforcing from day one without blocking unrelated work. 13 baselined (missing
  required sections in shop-setup, merchant-setup, production,
  headless-checkout-integration); new violations fail.
- `.github/workflows/validate.yml` — runs the above on every PR and on main, plus a
  self-check that every workflow declares `permissions:` and pins actions to a SHA.

Verified against the open PRs: #24 passes; #25 fails on exactly its five real problems
(no registry rows, no `.cursor` mirror).

Security

- `permissions: contents: read` on validation; `contents: write` on sync. Neither
  inherited the default token scope before.
- Actions pinned to commit SHAs instead of moving tags, with Dependabot to bump them.
- `sync-providers.yml` no longer runs on every branch — it was committing to
  contributors' feature branches mid-work. Main only, with a concurrency group.
- `SECURITY.md` with private reporting and a threat model that says what a
  vulnerability means in a repo whose content is an instruction payload.

Fixes

- `.github/CODEOWNERS` was invalid on **every line** — it used Xsolla LDAP names
  (`@j.manashti`) rather than GitHub handles, so `codeowners/errors` reported all five
  entries as "Invalid owner" and no review has ever been auto-requested. Mapped to real
  handles, verified each has write access.
- Removed `request-copilot-review.yml`: `GITHUB_TOKEN` cannot add Copilot as a reviewer
  ("Resource not accessible by integration"), so it was red on every PR. Use the native
  automatic-review repo setting instead.
- Added `LICENSE` — MIT was declared in three plugin manifests with no license file.

Also: PR and issue templates, and a CONTRIBUTING section on external contributions.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: validate metadata.owner against a known-owners allowlist

Copilot review on #28: the PR description claimed owner was validated
against an allowlist, but the code only checked for non-empty. Add
VALID_OWNERS (mirrors VALID_DOMAINS) so a typo in metadata.owner now
fails CI instead of silently routing review nowhere.

Also corrects the CODEOWNERS comment: internal owner ids aren't
uniformly firstname.lastname (mix of ., _, - across existing skills) —
don't let a contributor "fix" one into a format the repo doesn't use.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix: drop required-sections check, raise line limit to 500

Per @y-klochikhin's review on #28: the required-sections check was a
plain substring match (matches inside code blocks, passes on empty
headings) so it wasn't really enforcing structure — just four strings'
presence — while pushing authors toward a rigid four-part shape that
doesn't fit every skill. What CI does check (description + metadata) is
what an agent actually reads to decide whether to invoke a skill;
past that, structure is the author's call.

200 lines was also below what the repo's own existing skills need.
Raised to 500, which still flags genuinely oversized files without
warning on almost everything we have today.

Baseline is empty now that the section check is gone — no other
violation depended on it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants