Platform code generation

The platform-code-generation platform skill gives Trace AI and configured Autonomic Agent specialists explicit runtime contracts and read-only validation for Tealfabric code artifacts.

Supported artifacts

The first version covers:

• ProcessFlow process-step snippets;
• WebApp HTML, CSS, JavaScript, and HTTP headers.

It does not provide general repository code generation, arbitrary shell commands, package installation, compilation pipelines, or Git operations.

Delegated runs should use catalog slug platform-code-specialist (Platform specialists). That child turn already unlocks this skill.

Required workflow

1. Load load_platform_skill with skill_id: platform-code-generation.
2. Read the matching code contract.
3. Generate the smallest artifact that satisfies the specification.
4. Run the matching read-only validator.
5. Correct every validation error and validate again.
6. Use the existing skill_id: processes or skill_id: webapps mutation tools only when authorized.
7. Treat WebApp publication and ProcessFlow execution as separate actions.

Validation does not create, update, publish, or execute resources.

Readability is part of validation: validate_process_step_code and validate_webapp_content reject tab characters, minified single-line JavaScript/TypeScript over 160 characters, and long snippets without blank lines or // section comments. Match the layout rules in the platform-code-generation skill (SKILL.md, Code style and structure).

ProcessFlow process-step code

Tools:

• describe_process_step_code_contract
• validate_process_step_code

Supported source:

JavaScript and TypeScript are snippet bodies and may use top-level await and return. The validator applies the platform sandbox/security contract and performs transpilation and syntax checks without executing the snippet.

PHP remains an existing generated process-step language. The validator applies platform security checks without executing PHP. This does not permit changes to the legacy Tealfabric PHP application.

After validation, use create_process_step or update_process_step. Save-time validation remains authoritative.

WebApp content

Tools:

• describe_webapp_code_contract
• validate_webapp_content

Use load_platform_skill with skill_id: webapp-library for document structure and component-library guidance. Keep platform fields separated into HTML, CSS, JavaScript, and HTTP headers.

The validator reports dangerous content such as:

• iframe, object, or embed elements;
• CSS expressions and script/data protocols;
• dynamic JavaScript evaluation, string timers, document.write, direct innerHTML/outerHTML assignment, location assignment, or window.open;
• restricted headers such as Authorization, Set-Cookie, and X-Forwarded-For.

After validation, use skill_id: webapps to create or update an unpublished draft. Publishing remains a separate confirmed action.

WebApp POST response (Trace and code generation)

Process-backed WebApps expose two response contracts:

Step return is nested at result.output_data. Generated custom_js and fetch handlers must unwrap that path before reading data or error. Call describe_webapp_code_contract for examples; describe_webapp includes post_response_contract. See WebApp–ProcessFlow integration — Outbound response envelopes.

Specialist results

A delegated platform-code-specialist run should report:

• a concise result;
• artifact paths and structured artifacts (process step code and/or WebApp fields);
• platform_resource_ids left null (Trace creates unpublished records in Phase 2);
• validators performed;
• whether validation passed;
• explicit notes about operations that were not run.

Trace AI verifies validation and applies artifacts with create_process / create_webapp before presenting the final result. Do not publish or execute unless separately authorized.

See also

• Trace AI subagents
• Platform specialists
• Platform skills quick reference
• Platform actions