platform-engineering

---
name: platform-engineering
description: >
  Platform mechanisms and compatibility for browser, PWA, mobile, Electron and Tauri applications.
  TRIGGER WHEN: building or reviewing supported browsers/devices, native integration, offline lifecycle, packaging, or platform-specific trust boundaries.
---

<daodan_host_binding host="copilot">
This binding governs execution of this package and its loaded references. It takes
precedence over executable examples written for another host. Use only registered
tools and their actual input schema; an example never creates a tool, argument,
permission, model alias or nested worker capability. Preserve the generated worker
allowlist, dependency closure, scope and delivery contracts.

Copilot binding: repository reads use search, writes use edit, shell execution uses
runCommands and network fetch uses fetch in the adapter's tool allowlist. Custom
agent dispatch uses the agent allowlist alias; the current CLI documents a task
dispatch tool. Call the mechanism actually registered in this session, not an
allowlist alias assumed to be a callable tool.
Use each registered tool's input fields; Claude's subagent_type, role and
run_in_background fields are not a portable dispatch schema. Dispatch only the
custom agent named by the generated owner-qualified binding and agents allowlist.
An omitted tools restriction retains host defaults; an explicit list constrains
the worker and does not grant omitted shell, write or MCP tools.
Skills use their exact installed registry identity; workflows are prompt entries.
A dispatched workflow also has its generated <workflow>-coordinator custom agent.
Required foreign providers use Copilot's marketplace/install commands:
copilot plugin marketplace add <source>, then copilot plugin install <provider>@<marketplace>.
Register plugin-declared MCP server commands in this host's MCP configuration as
the generated note directs. Registration and a dependency declaration alone do
not demonstrate that browser/server tools are callable by the selected worker.
Inherit the active session's model and default variant. A source model alias such
as sonnet is not a portable override; request a different model only through an
explicit adapter mapping to a valid host identity and user authorization.
Coordinator MCP allowances use <declared-server>/* for only the package's named
servers. This requires actual server registration and tool discovery; it grants
no undeclared server and does not prove MCP is callable in an installed run.
Schema reference: https://docs.github.com/en/copilot/reference/custom-agents-configuration

The executing agent and its coordinator own continuation, recovery, verification
and delivery. Skills supply knowledge and method instructions; they are not
executors or a runtime persistence mechanism.

Resolve each component by kind and exact installed identity. A role is dispatched
as a worker, a skill loads instructions, and a workflow starts its declared method.
Kernel owner-qualified skill references are logical provider identities: resolve
them to the actual host registry name and verified installed provider path. Do not
invent a registry string by adding an owner's prefix when the host does not use it.
Do not load an agent identity as a skill or execute a workflow name as a shell
command. Declared required foreign providers remain mandatory. If a required
provider or capability (including required MCP access or isolation) is unavailable,
stop its dependent phase and report the missing capability. Optional external
providers follow the method's declared selection and absence behavior; their
absence alone does not block the base workflow. Report any explicitly requested
but unavailable provider contribution as unfulfilled and continue independent
work. Do not install a different host's plugin or
substitute unrelated skills to claim coverage.

Shell execution alone does not establish interactive stdin. Before a capture or
checkpoint, use an available session-control mechanism. When stdin is unavailable,
keep user-driven capture in a supported background process with bounded output and
an explicit stop signal controlled by the coordinator after the user's completion
message. Close owned browser/process resources on completion or cancellation.

Continue working within the current authorization while the requested result is
achievable. After a tool error, inspect its cause, correct the relevant input or
implementation, retry when justified and verify the outcome; never repeat a
failing action blindly. Do not close the turn with a promise or a partial result
when an authorized next step can still produce or verify the requested result.
Stop only for a documented real impediment, a missing required capability, an
unresolved human decision or the caller's stop request. At that boundary, report
completed results, remaining work and the concrete prerequisite for continuation;
continue any independent work that the blocker does not prevent.

A tool's successful exit, a worker stop or an idle session is not the deliverable.
Return final text naming observed findings, artifact paths, executed checks and
blockers. An empty worker result is missing delivery: inspect or resume that worker
when permitted, or record failure. Verify required artifacts and candidate gates
before marking the requested outcome complete.

This is an execution binding, not a rewrite of source examples. Preserve programming
language fences, domain code and host APIs that are the subject of marketplace-ops
or agent-sdk-builder. A host-as-subject API is not a tool provided to this session.
Compiled binding and static checks do not prove an installed host executed a run.
</daodan_host_binding>

# Platform engineering

Bind advice to the application's declared target platforms, versions, distribution
and required behavior. Read relevant source and effective configuration before
applying a rule. Historical reference examples, numeric budgets and preferred
technologies are leads; verify applicable version behavior and requirements before
treating them as obligations. Missing measurements remain unknown.

The autonomous `platform-reviewer` checks client platform compatibility and
mechanisms. It reports adjacent security, generic performance or backend
operability leads to the caller for routing through the existing review process.
It does not claim those separate dimensions were reviewed.

## Load references on demand

Choose only sections needed for the actual mechanism:

| Mechanism | References inside this skill |
|---|---|
| Browser/native identity and credential boundary | `auth-tokens.md`, `passkeys-webauthn.md`, `platform-security.md` |
| Browser execution and content boundaries | `xss-csp.md`, `server-validation.md`, `api-security.md`, `secrets-management.md` |
| Client/server and transport design | `client-server-architecture.md`, `api-design.md` |
| Offline synchronization and caches | `offline-first.md` |
| Platform delivery and configuration | `infrastructure.md`, `platform-security.md` |
| Platform-specific rendering, power and resource constraints | `frontend-performance.md`, `backend-and-platform-performance.md` |

References never grant execution or mutation. Audit is read-only and does not
run a profiling query, launch a device or exercise an application without the
caller's corresponding authorization. State verified target/version, mechanism,
requirement, counterevidence and coverage in findings; neither a checklist item
nor a preferred package establishes a defect.

For the targeted platform audit under `/daodan:check-health`, read
`references/audit.md`. Inside a senior-review run, use the prepared brief and
dispatch this plugin's reviewer once; do not start the standalone audit as well.

• SKILL.md 8 KB
• SKILL.toml 1 KB
• references/api-design.md 9 KB
• references/api-security.md 8 KB
• references/audit.md 8 KB
• references/auth-tokens.md 8 KB
• references/backend-and-platform-performance.md 12 KB
• references/client-server-architecture.md 6 KB
• references/frontend-performance.md 11 KB
• references/infrastructure.md 10 KB
• references/offline-first.md 8 KB
• references/passkeys-webauthn.md 11 KB
• references/platform-security.md 14 KB
• references/secrets-management.md 7 KB
• references/server-validation.md 7 KB
• references/xss-csp.md 8 KB