TealfabricLibrary

Platform code generation

The platform-code-generation platform skill gives Trace AI and configured Autonomic Agent specialists explicit runtime contracts and read-only validation for Tealfabric code artifacts.

Document information
FieldValue
Canonical URL/docs/07_ai-agents-and-mcp/24_platform_code_generation
Version (published date)2026-08-21
Tagsai, code-generation, processflow, webapps, validation

Supported artifacts

The first version covers:

  • ProcessFlow process-step snippets;
  • WebApp HTML, CSS, JavaScript, and HTTP headers.

It does not provide general repository code generation, arbitrary shell commands, package installation, compilation pipelines, or Git operations.

Required workflow

  1. Load load_platform_skill with skill_id: platform-code-generation.
  2. Read the matching code contract.
  3. Generate the smallest artifact that satisfies the specification.
  4. Run the matching read-only validator.
  5. Correct every validation error and validate again.
  6. Use the existing skill_id: processes or skill_id: webapps mutation tools only when authorized.
  7. Treat WebApp publication and ProcessFlow execution as separate actions.

Validation does not create, update, publish, or execute resources.

ProcessFlow process-step code

Tools:

  • describe_process_step_code_contract
  • validate_process_step_code

Supported source:

LanguageExecution contract
TypeScriptRecommended for new code; transpiles to JavaScript and runs in new-sandbox.
JavaScriptRuns in new-sandbox.
PHPExisting process-step compatibility mode through execute-step-cli.

JavaScript and TypeScript are snippet bodies and may use top-level await and return. The validator applies the platform sandbox/security contract and performs transpilation and syntax checks without executing the snippet.

PHP remains an existing generated process-step language. The validator applies platform security checks without executing PHP. This does not permit changes to the legacy Tealfabric PHP application.

After validation, use create_process_step or update_process_step. Save-time validation remains authoritative.

WebApp content

Tools:

  • describe_webapp_code_contract
  • validate_webapp_content

Use load_platform_skill with skill_id: webapp-library for document structure and component-library guidance. Keep platform fields separated into HTML, CSS, JavaScript, and HTTP headers.

The validator reports dangerous content such as:

  • iframe, object, or embed elements;
  • CSS expressions and script/data protocols;
  • dynamic JavaScript evaluation, string timers, document.write, direct innerHTML/outerHTML assignment, location assignment, or window.open;
  • restricted headers such as Authorization, Set-Cookie, and X-Forwarded-For.

After validation, use skill_id: webapps to create or update an unpublished draft. Publishing remains a separate confirmed action.

Specialist results

A delegated code specialist should report:

  • a concise result;
  • artifact paths, if any;
  • created or updated platform resource IDs;
  • validators performed;
  • whether validation passed;
  • explicit notes about operations that were not run.

Trace AI verifies these claims before presenting the final result.

See also