Merge origin/main + add gate markers for add-ai-webapi skill

Merge origin/main (93e22d3) into branch — two files conflicted:
  - create-webroles/SKILL.md: kept gate markers from branch, incorporated
    caller-suppress-mode text added in main (#144).
  - integrate-webapi/SKILL.md: same — kept 3 gate markers from branch,
    incorporated AI-only-read-mode conditionals added in main (#144).

New add-ai-webapi skill (#144) had 4 unmarked AskUserQuestion call sites
that failed GATE-must-have-marker. Added gate markers + 🚦 prose blocks
and §6.29 catalog rows for:
  - add-ai-webapi:iter.deploy-commit (Iteration mode)
  - add-ai-webapi:4.2.skip-webrole (Phase 4.2 skip confirmation)
  - add-ai-webapi:5.5.commit (Phase 5.5 offer to commit)
  - add-ai-webapi:6.4.commit (Phase 6.4 offer to commit)

Verified: alm-lint: 0 findings; 1108/1108 tests pass.

Author: Copilot

.github/workflows/validate-plugin-names.yml

@@ -0,0 +1,26 @@
+name: validate-repository-metadata
+
+on:
+    pull_request:
+        branches:
+            - main
+    workflow_dispatch:
+
+jobs:
+    validate-repository-metadata:
+        name: validate-repository-metadata
+        runs-on: ubuntu-latest
+        steps:
+            - name: checkout
+              uses: actions/checkout@v4
+
+            - name: setup-node
+              uses: actions/setup-node@v4
+              with:
+                  node-version: 20
+
+            - name: validate-kebab-case-plugin-names
+              run: node scripts/validate-plugin-names.js
+
+            - name: validate-skill-descriptions
+              run: node scripts/validate-skill-descriptions.js

.github/workflows/validate-repository-metadata.yml

@@ -48,3 +48,6 @@ ENV/
 Thumbs.db
 
 .playwright-mcp/
+
+# oh-my-claudecode scratch state
+.omc/

.gitignore

@@ -53,14 +53,23 @@ Skills are defined in `SKILL.md` files with YAML frontmatter (name, description,
 
 ## Cross-Plugin Shared Skills
 
-Skills that apply to all plugins live in `shared/skills/<skill-name>/`. The workflow logic is written once in a shared `.md` file, and each plugin has a thin `skills/<skill-name>/SKILL.md` that contains only the YAML frontmatter and a reference to the shared workflow file.
+Skills that apply to all plugins live in `shared/skills/<skill-name>/`. The workflow logic is written once in a shared `.md` file, and each plugin has a thin `skills/<skill-name>/SKILL.md` that contains only the YAML frontmatter and a reference to the workflow path bundled inside that plugin at install time.
 
 **Pattern:**
 - `shared/skills/<skill-name>/<workflow>.md` — Full workflow (phases, instructions, field definitions)
 - `shared/skills/<skill-name>/SKILL.template.md` — Template SKILL.md (frontmatter + reference to workflow); supports `{{PLUGIN_NAME}}` placeholder
 - `plugins/<plugin>/skills/<skill-name>/SKILL.md` — Per-plugin wrapper generated from the template above
+- `plugins/<plugin>/skills/<skill-name>/<workflow>.md` — Symlink to the shared workflow when the plugin must work after installing only its own plugin directory
 
-This keeps the skill discoverable in each plugin while avoiding content duplication. When updating a shared skill, edit the workflow file and/or `SKILL.template.md` in `shared/`, then update the per-plugin wrappers (frontmatter + reference pointing to the shared workflow, with `{{PLUGIN_NAME}}` substituted) and commit them alongside the shared change.
+This keeps the skill discoverable in each plugin while preserving install-time portability. Marketplace installs copy only the plugin directory, so per-plugin wrappers must not reference repo-root `shared/` paths at runtime. Instead, point the wrapper at `${CLAUDE_PLUGIN_ROOT}/skills/<skill-name>/<workflow>.md` and keep a symlink from that per-plugin path to the repo-root shared workflow; marketplace installers dereference same-marketplace symlinks into the installed plugin cache. When updating a shared skill, edit the workflow file and/or `SKILL.template.md` in `shared/`, then update the per-plugin wrappers (frontmatter + bundled workflow reference, with `{{PLUGIN_NAME}}` substituted) and ensure any per-plugin symlinks still resolve under `plugins/<plugin>/skills/<skill-name>/`. Commit the shared source and per-plugin symlinks together.
+
+## Shared Telemetry
+
+1DS telemetry code for all plugins lives at `shared/telemetry/`. Each adopting plugin **symlinks** the library into its own tree — `plugins/<plugin>/scripts/lib/telemetry/lib` is a symlink to `shared/telemetry/lib`. The marketplace installer dereferences that symlink into the installed plugin at install time, so the shared code ships without copying it into each plugin. Each plugin keeps its own real `ikey.json` next to the symlink.
+
+Edit `shared/telemetry/` directly — the symlink makes changes live for every adopting plugin immediately; there is nothing to re-sync.
+
+Current adopters: `power-pages`. Others adopt on demand.
 
 ## Code Conventions
 

AGENTS.md

@@ -211,3 +211,7 @@ trademarks or logos is subject to and must follow
 [Microsoft's Trademark & Brand Guidelines](https://www.microsoft.com/legal/intellectualproperty/trademarks/usage/general).
 Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship.
 Any use of third-party trademarks or logos are subject to those third-party's policies.
+
+## Telemetry
+
+Plugins that ship 1DS telemetry (currently: `power-pages`) gather anonymous usage signals. Telemetry is default-on; users opt out per-plugin via the `/<plugin>:telemetry off` command (e.g. `/power-pages:telemetry off`), stored in `~/.power-platform-skills/config.json`. See `shared/telemetry/README.md` for what is sent.

README.md

@@ -0,0 +1,27 @@
+{
+  "skill_name": "add-ai-webapi",
+  "notes": "Dry-run decision-trace evals: each prompt asks the subagent to analyse a Power Pages fixture project using the skill and output the decisions it would make (integration manifest, Phase 5 agent-invocation prompts, Phase 6 settings plan). Sub-skill/agent invocations are mocked — the subagent prints what it would send without actually spawning agents. This isolates the skill's classification and routing logic from the broader Power Pages environment.",
+  "evals": [
+    {
+      "id": 1,
+      "name": "list-only-workorders",
+      "prompt": "You have read access to a Power Pages Single Page Application (SPA) site fixture at <FIXTURE_PATH>. The site has a WorkOrderList.tsx page that fetches and iterates over a collection of cr363_workorder records (it's a list page). The user has just invoked the /add-ai-webapi skill on this project and wants to add an AI summary to this list page.\n\nLoad the skill from <SKILL_PATH>. Execute Phases 1-3 (site check, explore, plan review) and draft what Phase 5 and Phase 6 WOULD do — but DO NOT actually invoke any sub-skills, sub-agents, or run any scripts. Instead, produce a single output file at <OUTPUT_PATH>/decision-trace.md containing:\n\n1. ## Phase 2 integration manifest — the compiled manifest table, one row per target, with the new Target kind column.\n2. ## Phase 3 AskUserQuestion prompts — the exact question(s) you would ask the user (integration selection + per-target follow-ups), with the full option list per question.\n3. ## Phase 5 agent-invocation prompt — for every data/case target, the exact prompt string you would send to the ai-webapi-integration agent, with all placeholders filled in.\n4. ## Phase 6 settings-architect invocation — the exact prompt string you would send to the ai-webapi-settings-architect agent.\n5. ## Projected settings plan — the settings the architect would propose (name + value + write-path script-or-manual for each), based on the prompt-pattern and URL-form rules in the architect's Step 3/5.\n\nFor any AskUserQuestion, assume the user picks the first/Recommended option. Do not actually modify any files in the fixture. Do not invoke Task, Skill, or Bash to run scripts.",
+      "files": [],
+      "fixture": "list-only-workorders"
+    },
+    {
+      "id": 2,
+      "name": "single-record-case-regression",
+      "prompt": "You have read access to a Power Pages Single Page Application (SPA) site fixture at <FIXTURE_PATH>. The site has a CaseDetail.tsx page that reads a case id from the URL querystring and displays a single incident record. The user has just invoked the /add-ai-webapi skill on this project and wants to add the canonical case-page Copilot preset.\n\nLoad the skill from <SKILL_PATH>. Execute Phases 1-3 and draft what Phase 5 and Phase 6 WOULD do — but DO NOT actually invoke any sub-skills, sub-agents, or run any scripts. Produce <OUTPUT_PATH>/decision-trace.md with the same 5 sections as eval 1.\n\nFor any AskUserQuestion, assume the user picks the first/Recommended option. Do not actually modify any files in the fixture. Do not invoke Task, Skill, or Bash to run scripts.",
+      "files": [],
+      "fixture": "single-record-case"
+    },
+    {
+      "id": 3,
+      "name": "collision-search-vs-list-results",
+      "prompt": "You have read access to a Power Pages Single Page Application (SPA) site fixture at <FIXTURE_PATH>. The site has TWO pages: SearchResults.tsx (a pure search-results page that calls /_api/search/v1.0/query) AND WorkOrderResults.tsx (which iterates over a collection of cr363_workorder records — despite the `Results` suffix, it's a Dataverse list). The user wants to add AI summaries to both pages.\n\nLoad the skill from <SKILL_PATH>. Execute Phases 1-3 and draft what Phase 5 and Phase 6 WOULD do — but DO NOT actually invoke any sub-skills, sub-agents, or run any scripts. Produce <OUTPUT_PATH>/decision-trace.md with the same 5 sections as eval 1.\n\nFor any AskUserQuestion, assume the user picks the first/Recommended option. Do not actually modify any files in the fixture. Do not invoke Task, Skill, or Bash to run scripts.",
+      "files": [],
+      "fixture": "collision-search-vs-results"
+    }
+  ]
+}

evals/power-pages/add-ai-webapi/evals.json

@@ -1,6 +1,6 @@
 ---
 name: configure-canvas-mcp
-version: 2.0.0
+version: 2.1.0
 description: Configure the Canvas Authoring MCP server for the current coauthoring session. USE WHEN "configure MCP", "set up MCP server", "MCP not working", "connect Canvas Apps MCP", "canvas-authoring not available", "MCP not configured", "set up canvas apps". DO NOT USE WHEN prerequisites are missing — direct the user to install .NET 10 SDK first.
 author: Microsoft Corporation
 user-invocable: true
@@ -77,14 +77,24 @@ Call the `connect` MCP tool to connect the server to the user's coauthoring sess
 mcp__canvas-authoring__connect(
   environment_id: ENV_ID,
   app_id: APP_ID,
-  cluster_category: CLUSTER_CATEGORY
+  cluster_category: CLUSTER_CATEGORY,
+  // Optional — include only if the user has expressed a preference (see below):
+  auth_flow: "broker" | "browser",
+  login_hint: "user@contoso.com"
 )
 ```
 
+**Optional parameters — do NOT prompt the user for these.** Only include them if the user has already expressed a preference earlier in the conversation:
+
+- `login_hint`: Pass the user's UPN or email **only if** they have indicated they want to connect as a specific/different user (e.g. "log in as alice@contoso.com"). These values cannot be derived from the maker portal URL — never guess. Omit otherwise to use the first signed-in user.
+- `auth_flow`: Pass `"browser"` or `"broker"` **only if** the user has explicitly stated a preferred auth flow (e.g. "use browser sign-in"). Omit otherwise to use the default.
+
 If the call fails, report the error to the user and suggest checking that:
+
 1. The studio URL is correct and the browser tab is still open
 2. Coauthoring is enabled in the app settings
 3. .NET 10 SDK is correctly installed
+4. If sign-in failed, the user may need to specify `auth_flow` (`broker` vs. `browser`) or a `login_hint` (UPN/email) to authenticate as the correct account
 
 ### 4. Confirm
 

plugins/canvas-apps/skills/configure-canvas-mcp/SKILL.md

@@ -10,4 +10,4 @@ allowed-tools: Read, Bash, Glob, Grep, AskUserQuestion, TaskCreate, TaskUpdate,
 model: sonnet
 ---
 
-**Shared workflow: [report-issue-workflow.md](${CLAUDE_PLUGIN_ROOT}/../../shared/skills/report-issue/report-issue-workflow.md)** — Read and follow all phases defined in that file.
+**Workflow: [report-issue-workflow.md](${CLAUDE_PLUGIN_ROOT}/skills/report-issue/report-issue-workflow.md)** — Read and follow all phases defined in that bundled file.

plugins/canvas-apps/skills/report-issue/SKILL.md

@@ -0,0 +1 @@
+../../../../shared/skills/report-issue/report-issue-workflow.md

plugins/canvas-apps/skills/report-issue/report-issue-workflow.md

@@ -10,4 +10,4 @@ allowed-tools: Read, Bash, Glob, Grep, AskUserQuestion, TaskCreate, TaskUpdate,
 model: sonnet
 ---
 
-**Shared workflow: [report-issue-workflow.md](${CLAUDE_PLUGIN_ROOT}/../../shared/skills/report-issue/report-issue-workflow.md)** — Read and follow all phases defined in that file.
+**Workflow: [report-issue-workflow.md](${CLAUDE_PLUGIN_ROOT}/skills/report-issue/report-issue-workflow.md)** — Read and follow all phases defined in that bundled file.