---
name: timeback-platform-1edtech
description: Use when an agent needs to build an app, report, QA probe, integration deliverable, or operational workflow against the TimeBack Platform 1EdTech admin surface. This skill covers the live platform3 module registry, tenant creation/readback, audit-log inspection, idempotency-key inspection, JWT setup, RFC 7807 errors, and documentation provenance. It is for surface calls only and must not reimplement platform business rules.
---

# TimeBack Platform 1EdTech

Use this skill when the task is to produce something against the live TimeBack Platform 1EdTech surface: a platform-admin app, release-state report, audit/idempotency probe, customer-doc verification, or integration artifact.

This is the Platform Admin/shared-conventions module pack. It is not the global Platform3 router pack. For all-Platform3 orientation across Results, Analytics, People & Orgs, Curriculum, Content, Events, standards packs, and producer surfaces, start at `https://platform3-andymontgomery-9773s-projects.vercel.app/skill_pack/`.

## Contract Sources

Load these hosted docs before making claims:

- Global Platform3 router pack: https://platform3-andymontgomery-9773s-projects.vercel.app/skill_pack/
- Customer website: https://platform3-andymontgomery-9773s-projects.vercel.app/platform/1edtech/customer_website/
- Data dictionary: https://platform3-andymontgomery-9773s-projects.vercel.app/platform/1edtech/data_dictionary/
- Architecture: https://platform3-andymontgomery-9773s-projects.vercel.app/platform/1edtech/architecture/
- Surface QC: https://platform3-andymontgomery-9773s-projects.vercel.app/platform/1edtech/surface_qc/
- Live API base: `https://platform3-andymontgomery-9773s-projects.vercel.app/platform/1edtech/implementation/api`

Manifest: https://platform3-andymontgomery-9773s-projects.vercel.app/platform/1edtech/skill_pack/skill-pack.json

For endpoint-to-doc links, read [references/contract-map.md](/platform/1edtech/skill_pack/pack/references/contract-map.md). For runnable workflows, read [references/workflows.md](/platform/1edtech/skill_pack/pack/references/workflows.md).
For runtime-specific installation, read [references/agent-install.md](/platform/1edtech/skill_pack/pack/references/agent-install.md).

## Install Targets

Install the complete skill folder, preserving `references/` and `agents/`:

- Codex: `$CODEX_HOME/skills/timeback-platform-1edtech/` or the runtime's configured skills directory.
- Claude Code: a project or user skill folder named `timeback-platform-1edtech` such as `.claude/skills/timeback-platform-1edtech/`.
- Perplexity Comet: pin the canonical skill-pack URL and load `SKILL.md`, `references/workflows.md`, `references/contract-map.md`, and `references/agent-install.md` as project instructions.
- Agent UIs that read OpenAI-style metadata: load `agents/openai.yaml` after `SKILL.md`; it is descriptive metadata, not the contract.

Cold Codex install from the hosted pack:

```sh
export SKILL_PACK_URL="https://platform3-andymontgomery-9773s-projects.vercel.app/platform/1edtech/skill_pack"
export SKILL_DIR="${CODEX_HOME:-$HOME/.codex}/skills/timeback-platform-1edtech"
mkdir -p "$SKILL_DIR/references" "$SKILL_DIR/agents" "$SKILL_DIR/checks"
curl -fsSL "$SKILL_PACK_URL/pack/SKILL.md" -o "$SKILL_DIR/SKILL.md"
curl -fsSL "$SKILL_PACK_URL/pack/references/workflows.md" -o "$SKILL_DIR/references/workflows.md"
curl -fsSL "$SKILL_PACK_URL/pack/references/contract-map.md" -o "$SKILL_DIR/references/contract-map.md"
curl -fsSL "$SKILL_PACK_URL/pack/references/agent-install.md" -o "$SKILL_DIR/references/agent-install.md"
curl -fsSL "$SKILL_PACK_URL/pack/agents/openai.yaml" -o "$SKILL_DIR/agents/openai.yaml"
curl -fsSL "$SKILL_PACK_URL/pack/checks/verify-skill-pack.mjs" -o "$SKILL_DIR/checks/verify-skill-pack.mjs"
curl -fsSL "$SKILL_PACK_URL/skill-pack.json" -o "$SKILL_DIR/skill-pack.json"
```

## Non-Negotiable Leak Check

This skill is instructions plus the release-gate proof check. Do not add or carry:

- Copied enum tables, schema parsers, release-state switch statements, idempotency logic, audit redaction logic, tenant-scope logic, JWT verification logic, or hidden business rules.
- Local databases for platform domain data.
- Workarounds for missing surface behavior.

If the task needs behavior that is not exposed by the live surface or documented in the canonical docs, stop and report a surface leak. Name the missing capability, the job it blocks, and the earliest upstream deliverable that should own it: architecture for missing commitments, data dictionary for missing field/meaning contracts, customer website for missing public instructions, implementation for documented behavior that does not work.

The runnable check at `/platform/1edtech/skill_pack/pack/checks/verify-skill-pack.mjs` is allowed because it only calls the surface and compares one live surface response to another. It must not become a library, parser, lookup table, or rules engine.

## Credential Setup

Prefer caller-provided values, then environment variables:

```sh
export PLATFORM_BASE_URL="${PLATFORM_BASE_URL:-https://platform3-andymontgomery-9773s-projects.vercel.app/platform/1edtech/implementation/api}"
```

For demo work, mint a short-lived token:

```sh
TOKEN="$(curl -fsS -X POST "$PLATFORM_BASE_URL/dev/mint?tenantId=demo" | jq -r .token)"
```

For real-tenant work, use an operator-minted token such as `PLATFORM_REVIEWER_JWT`. Never call `/dev/mint` for a non-demo tenant and never print, persist, or embed a real token in a public artifact.

External integrators receive the real-tenant token out-of-band from TimeBack onboarding after a tenant is created. Set it as `PLATFORM_JWT` or `PLATFORM_REVIEWER_JWT`, set the tenant id as `PLATFORM_TENANT_ID`, and keep both out of generated public artifacts. Internal loop reviewers get the same credential shape from the driver, which mints `PLATFORM_REVIEWER_JWT` with `loop/scripts/mint_jwt.mjs` and stores it in `.env.local`.

## Standard Workflow

1. Fetch the customer website and data dictionary links above.
2. Set `PLATFORM_BASE_URL`.
3. Obtain a demo token or real operator token.
4. Call the live endpoints for the requested job.
5. Build output only from response fields and documented links returned by the surface.
6. Cite the source docs next to every claim about auth, tenant fields, audit fields, idempotency fields, errors, or module release state.

The common end-to-end proof is:

- `POST /dev/mint?tenantId=demo`
- `GET /platform/modules`
- `GET /platform/modules/{moduleKey}`
- `POST /platform/tenants` with `Idempotency-Key` and body `{"tenantKey":"<lowercase-slug>","displayName":"<visible name>","metadata":{"source":"<optional redacted facts>"}}`
- `GET /platform/tenants/{tenantId}`
- `GET /platform/tenants/{tenantId}/audit-log`
- `GET /platform/tenants/{tenantId}/idempotency-keys/{idempotencyKey}`
- `node checks/verify-skill-pack.mjs`

The common proof intentionally omits `status` and creates a provisioning/demo tenant. Only the exact `platform-operator` tenant principal with the `service` role and `platform:tenant:create` or `platform:*` scope, whose authentication and operational setup are already complete, may add `"status":"active"` to the same idempotent request; every tenant-bound service credential and other create authority is denied.

The workflow references also include two additional output shapes: an admin-console data feed and a QC evidence bundle. Use those when the task asks for a real app or deliverable rather than a prose readiness report.

## Incept Producer Surface

Use the global Platform3 router pack for all-Platform orientation, then this Platform pack for the governed producer-surface calls:

- Handoff acceptance contract: [references/contract-map.md#incept-producer-to-platform-acceptance-envelope](/platform/1edtech/skill_pack/pack/references/contract-map.md#incept-producer-to-platform-acceptance-envelope)

- `GET /platform/producer-surfaces/incept`
- `GET /platform/producer-surfaces/incept/progress`
- `GET /platform/producer-surfaces/incept/projection-checkpoints`

Read the acceptance contract before submitting Content or Curriculum work. The three Platform endpoints report operational provenance/status only; they do not accept source bytes, Platform Content identities, KC tags, Curriculum targets, Content QC receipts, trust, or release verdicts.

The Incept progress response exposes governed `trafficClass` values: `customer`, `goal-run`, and `self-test`. Headline Accuracy counts only `customer`; owner-directed materialization/repair traffic writes `goal-run`; loop, reviewer, CI, and smoke-test traffic writes `self-test`. Missing legacy rows default to `customer` only for backward compatibility. Do not compute or rename this in a consumer app.

## Output Rules

- Use exact values returned by the API for `status`, `releaseNote`, `tenantId`, `operationId`, `audit outcome`, and `idempotency status`.
- Treat `demo_...` tenant ids as opaque. Store and URL-encode the whole value; do not decode it.
- Keep created platform domain data in the platform surface. Browser/local state may hold UI preferences and transient response summaries only.
- Include provenance links: customer website endpoint anchor plus data-dictionary table/field anchor.
- For failures, preserve the RFC 7807 `type`, `code`, `status`, `requestId`, `traceId`, and `fieldErrors` fields exactly as returned.

## When To Read References

- Read [references/workflows.md](/platform/1edtech/skill_pack/pack/references/workflows.md) when the task asks for runnable commands, a report, a smoke test, or an integration proof.
- Read [references/contract-map.md](/platform/1edtech/skill_pack/pack/references/contract-map.md) when the task asks which doc page proves a field, endpoint, error, auth rule, tenant rule, audit rule, idempotency rule, or create-tenant request body.