@salesforce/afv-skills 1.41.0 → 1.43.0

package/skills/service-itsm-agentic-setup-agentforce-studio-validate/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: service-itsm-agentic-setup-agentforce-studio-validate
-description: "Validate the Agentforce for IT Service prerequisites for a Fulfiller or Employee agent, using the Salesforce CLI (sf). The READ-ONLY prerequisite check: it reads the Salesforce Go feature toggles behind the Agentforce for IT Service setup page (Agentforce Studio, the IT Service Fulfiller / IT Service Employee templates, Specialized Agent Templates for Employee) via one Connect API call, then a helper script classifies the chosen path into a READY / NOT-READY verdict. It never enables anything; when a toggle is off it hands off to the agentforce-studio-configure skill to turn it on. Use when asked to check Agentforce prerequisites, validate the org is ready for an ITSM agent, or verify Agentforce Studio is enabled. Triggers: check agentforce prerequisites, validate agentforce readiness, is my org ready for the fulfiller agent, verify agentforce studio enabled. DO NOT TRIGGER: enabling or turning on the toggles, creating the fulfiller agent (service-itsm-agentic-setup-fulfiller-agent-configure), or CMDB CRUD."
+description: "Validate the Agentforce for IT Service prerequisites for a Fulfiller or Employee agent, using the Salesforce CLI (sf). The READ-ONLY prerequisite check: it reads the Salesforce Go feature toggles behind the Agentforce for IT Service setup page (Agentforce Studio, the IT Service Fulfiller Template / IT Service Employee Template, Specialized Agent Templates for Employee) via one Connect API call, then a helper script classifies the chosen path into a READY / NOT-READY verdict. It never enables anything; when a toggle is off it hands off to agentforce-studio-configure to enable it. Use when asked to check Agentforce prerequisites, validate the org is ready for an ITSM agent, or verify Agentforce Studio is enabled. Triggers: check agentforce prerequisites, validate agentforce readiness, is my org ready for the fulfiller agent, verify agentforce studio enabled. DO NOT TRIGGER: enabling or turning on the toggles, creating the fulfiller agent (service-itsm-agentic-setup-fulfiller-agent-configure), or CMDB CRUD."
 metadata:
-  version: "2.1"
+  version: "2.2"
   domains: ["Service", "Agentforce"]
   minApiVersion: "67.0"
   relatedSkills:
@@ -42,9 +42,9 @@ The feature toggles and their real `featureApiName`s:
 | Go-page toggle | featureApiName | Required for |
 |----------------|----------------|--------------|
 | Turn on Agentforce Studio | `sales-cloud-agent-studio` | both paths (shared) |
-| Agentforce for IT Service (parent umbrella) | `service-cloud-agentforce-for-itsm` | both paths (shared) |
-| IT Service Fulfiller | `service-cloud-it-fulfiller-agent` | **fulfiller** |
-| IT Service Employee | `service-cloud-requestor-agent` | **employee** |
+| Agentforce for IT Service | `service-cloud-agentforce-for-itsm` | both paths (shared) |
+| IT Service Fulfiller Template | `service-cloud-it-fulfiller-agent` | **fulfiller** |
+| IT Service Employee Template | `service-cloud-requestor-agent` | **employee** |
 | Specialized Agent Templates for Employee | `service-cloud-it-service-employee-agent` | **employee** |
 
 All are **Connect API** features (`/connect/setup/discovery/...`) — the read goes through `sf api request rest`, no Headless360 dispatcher required. The classification is **deterministic** and lives in `scripts/classify-readiness.mjs` (invoked via `Bash`), not in prose.
@@ -184,7 +184,7 @@ Org:          <org-alias> (API v67.0)
 Agent path:   fulfiller | employee
 
   [PASS|FAIL] Agentforce Studio ......................... ENABLED | NOT_ENABLED (sales-cloud-agent-studio)
-  [PASS|FAIL] Agentforce for IT Service (parent) ........ ENABLED | NOT_ENABLED (service-cloud-agentforce-for-itsm)
+  [PASS|FAIL] Agentforce for IT Service ................. ENABLED | NOT_ENABLED (service-cloud-agentforce-for-itsm)
   [PASS|FAIL] <path-specific toggle(s)> ................. ENABLED | NOT_ENABLED (<featureApiName>)
 
 Verdict: READY  |  NOT-READY  |  CANNOT-CONFIRM  |  ERROR
@@ -197,6 +197,8 @@ Next steps:
 
 This skill is **read-only** — no org state is written. The only file it produces is the temporary response capture handed to the classifier.
 
+Use each toggle's report label verbatim — `Agentforce Studio`, `Agentforce for IT Service`, `IT Service Fulfiller Template`, `IT Service Employee Template`, and `Specialized Agent Templates for Employee` — identical across this skill and `service-itsm-agentic-setup-agentforce-studio-configure`. (In the toggle table above, the Studio row's Go-page toggle reads "Turn on Agentforce Studio"; its rendered report label is simply `Agentforce Studio`.) The `Template` suffix on the two agent-template toggles is the deliberate, authoritative report label — it intentionally differs from the shorter setup-page toggle caption (`IT Service Fulfiller` / `IT Service Employee`), exactly like the Studio row above; the installed agent is named separately by the agent-configure skills (`IT Service Fulfiller Agent` / `IT Service Employee Agent`, no `Template`). The path-specific rows are `IT Service Fulfiller Template` (fulfiller path), or `IT Service Employee Template` **and** `Specialized Agent Templates for Employee` (employee path). Never add an invented role qualifier such as "Requestor", "Specialized", or "parent" to a label.
+
 ---
 
 ## Reference File Index

package/skills/service-itsm-agentic-setup-agentforce-studio-validate/references/cli-invocation.md

@@ -43,9 +43,9 @@ column is what the API uses:
 | UI toggle | featureApiName | Required for |
 |-----------|----------------|--------------|
 | Turn on Agentforce Studio | `sales-cloud-agent-studio` | both paths |
-| Agentforce for IT Service (parent umbrella) | `service-cloud-agentforce-for-itsm` | both paths |
-| IT Service Fulfiller | `service-cloud-it-fulfiller-agent` | fulfiller |
-| IT Service Employee | `service-cloud-requestor-agent` | employee |
+| Agentforce for IT Service | `service-cloud-agentforce-for-itsm` | both paths |
+| IT Service Fulfiller Template | `service-cloud-it-fulfiller-agent` | fulfiller |
+| IT Service Employee Template | `service-cloud-requestor-agent` | employee |
 | Specialized Agent Templates for Employee | `service-cloud-it-service-employee-agent` | employee |
 
 Dependency chain (enable order): `sales-cloud-einstein-generative-ai` →

package/skills/service-itsm-agentic-setup-agentforce-studio-validate/scripts/classify-readiness.mjs

@@ -52,11 +52,19 @@ const REQUIRED = {
   employee: [STUDIO, PARENT, REQUESTOR, SPECIALIZED],
 };
 
+// Report labels — the authoritative strings these reports render. The two
+// agent-template rows intentionally differ from their shorter Salesforce Go
+// setup-page toggle caption, the same way the Studio caption "Turn on
+// Agentforce Studio" renders as "Agentforce Studio": these toggles enable agent
+// *templates*, so their report label carries a deliberate "Template" suffix. By
+// design — do not simplify it to the bare caption. It is also distinct from the
+// installed agent the agent-configure skills create ("IT Service Fulfiller
+// Agent" / "IT Service Employee Agent", no "Template").
 const LABEL = {
   [STUDIO]: 'Agentforce Studio',
-  [PARENT]: 'Agentforce for IT Service (parent)',
-  [FULFILLER]: 'IT Service Fulfiller template',
-  [REQUESTOR]: 'IT Service Employee template',
+  [PARENT]: 'Agentforce for IT Service',
+  [FULFILLER]: 'IT Service Fulfiller Template',
+  [REQUESTOR]: 'IT Service Employee Template',
   [SPECIALIZED]: 'Specialized Agent Templates for Employee',
 };
 

package/skills/service-itsm-agentic-setup-configure/SKILL.md

@@ -1,14 +1,14 @@
 ---
 name: service-itsm-agentic-setup-configure
-description: "Top-level orchestrator for setting up IT Service Management (ITSM) in Salesforce Service Cloud. Use when the user asks to set up ITSM, configure service management, enable ITSM capabilities, wants a guided walkthrough, or asks what is needed to get ITSM running. Presents a multi-select track menu and delegates to domain sub-orchestrators — Incident Management, Agentforce for ITSM (Studio + Fulfiller), CMDB, and Microsoft Teams (IT Desk / IT Service / Swarming). Any prerequisites (such as the Incident Management master switch for Track 1) are owned and enforced inside the relevant sub-orchestrator, not at this level. Triggers on: set up ITSM, configure service management, ITSM setup, get ITSM running, walkthrough, set up CMDB / Teams / Agentforce for ITSM. DO NOT TRIGGER when: the user asks about a specific feature directly (e.g., the priority matrix alone), asks only about Case management, wants to create a single user, or asks general ITSM questions without setup intent."
+description: "Top-level orchestrator for setting up IT Service Management (ITSM) in Salesforce Service Cloud. Use when the user asks to set up ITSM, configure service management, enable ITSM capabilities, wants a guided walkthrough, or asks what is needed to get ITSM running. Presents a multi-select track menu and delegates to domain sub-orchestrators — Incident Management, Agentforce for ITSM (Studio + Fulfiller), CMDB, and Channels (Portal, Notifications, Microsoft Teams, Slack). Any prerequisites (such as the Incident Management master switch for Track 1) are owned and enforced inside the relevant sub-orchestrator, not at this level. Triggers on: set up ITSM, configure service management, ITSM setup, get ITSM running, walkthrough, set up CMDB / channels / Teams / Slack / Agentforce for ITSM. DO NOT TRIGGER when: the user asks about a specific feature directly (e.g., the priority matrix alone), asks only about Case management, wants to create a single user, or asks general ITSM questions without setup intent."
 metadata:
-  version: "1.2"
+  version: "1.3"
   domains: ["Service"]
   relatedSkills:
     - "service-itsm-agentic-setup-agentforce-coordinate"
     - "service-itsm-agentic-setup-cmdb-coordinate"
     - "service-itsm-agentic-setup-incident-management"
-    - "service-itsm-teams-coordinate"
+    - "service-itsm-channels-coordinate"
 allowed-tools: Read AskUserQuestion
 ---
 
@@ -29,9 +29,9 @@ Only tracks with a working sub-orchestrator appear in the menu — use the **Tra
 | # | Track | Sub-Orchestrator Skill | Features |
 |---|-------|------------------------|----------|
 | 1 | Incident Management | `service-itsm-agentic-setup-incident-management` | SLA & Milestones |
-| 2 | Agentforce for ITSM | `service-itsm-agentic-setup-agentforce-coordinate` | Agentforce Studio enablement, Fulfiller Agent lifecycle, Employee Agent lifecycle |
+| 2 | Agentforce for ITSM | `service-itsm-agentic-setup-agentforce-coordinate` | Agentforce Studio enablement, Fulfiller Agent, Employee Agent |
 | 3 | CMDB (Configuration Management Database) | `service-itsm-agentic-setup-cmdb-coordinate` | CMDB feature enablement, CMDB Foundation bundle, User CMDB access |
-| 4 | Microsoft Teams Integration | `service-itsm-teams-coordinate` | Teams for Employee Service enablement, IT Desk checklist, IT Service checklist, Swarming |
+| 4 | Channels | `service-itsm-channels-coordinate` | Employee Service channel setup — Portal, Notifications, Microsoft Teams (IT Desk / IT Service / embedded agent), and Slack |
 
 Additional ITSM setup tracks (e.g. employee provisioning) will be added here as their sub-orchestrators become available.
 

package/skills/service-itsm-agentic-setup-configure/examples/output-templates.md

@@ -19,9 +19,9 @@ ITSM Setup (via service-itsm-agentic-setup-configure)
 │ 3 │ CMDB                     │ Enable the Configuration Management Database         │ Not done │
 │   │                          │ feature, deploy the CMDB Foundation content bundle,  │          │
 │   │                          │ and grant users CMDB access                          │          │
-│ 4 │ Microsoft Teams          │ Enable Microsoft Teams for ITSM — IT Desk and IT     │ Not done │
-│   │                          │ Service checklists, plus Swarming for agent          │          │
-│   │                          │ collaboration                                        │          │
+│ 4 │ Channels                 │ Set up Employee Service channels — Portal,           │ Not done │
+│   │                          │ Notifications, Microsoft Teams (IT Desk / IT         │          │
+│   │                          │ Service), and Slack                                  │          │
 │ A │ Full guided setup        │ Run every available track in dependency order —      │ —        │
 │   │                          │ per-track confirmation between them so you can stop  │          │
 │   │                          │ any time. Mutually exclusive with per-track picks.   │          │
@@ -44,7 +44,7 @@ they are finished — even if some tracks are still `Not done`. When rendering:
   - All `Done` → `Your ITSM setup is complete.`
   - Otherwise → `You have finished the tracks you selected. The remaining tracks can be resumed later by re-invoking this orchestrator.`
 
-Example — user finished after only Incident Management and Agentforce (the two tracks they chose to set up in this session; CMDB and Microsoft Teams stayed `Not done`):
+Example — user finished after only Incident Management and Agentforce (the two tracks they chose to set up in this session; CMDB and Channels stayed `Not done`):
 
 ```text
 ITSM Setup — Finished
@@ -56,7 +56,7 @@ ITSM Setup — Finished
 │ Incident Management      │ Done     │
 │ Agentforce for ITSM      │ Done     │
 │ CMDB                     │ Not done │
-│ Microsoft Teams          │ Not done │
+│ Channels                 │ Not done │
 └──────────────────────────┴──────────┘
 
 You have finished the tracks you selected. The remaining tracks can be resumed

package/skills/service-itsm-agentic-setup-employee-agent-configure/SKILL.md

@@ -2,7 +2,7 @@
 name: service-itsm-agentic-setup-employee-agent-configure
 description: "Create and activate an IT Service Employee agent as a Next-Gen Authoring (NGA) native agent from an ITSM Employee agent template's Agent Script, via the Salesforce CLI (sf): read the template, check idempotency, create the NGA bundle then publish and activate, verify live. Defaults to the broad IT Service Employee template; when the user names a specialized Employee template (Password Manager Assistance, Certificate Management, Onboarding, Hardware Request, and ~47 others catalogued in references/specialized-templates.md — all under the `svc_emp_intelligence__` namespace), pins that one instead. Idempotent per developer name. TRIGGER when the user asks to create/set up/provision/activate the Employee agent, the IT Service Employee agent, or a specialized Employee agent (password manager, certificate, onboarding, hardware request, etc.). DO NOT TRIGGER: prerequisite checks (service-itsm-agentic-setup-agentforce-studio-validate), CMDB CRUD, Fulfiller setup (service-itsm-agentic-setup-fulfiller-agent-configure)."
 metadata:
-  version: "2.1"
+  version: "2.3"
   domains: ["Service", "Agentforce"]
   minApiVersion: "67.0"
   relatedSkills:
@@ -58,7 +58,7 @@ If any of these are unmet, `sf` surfaces an auth error or a `401`/`403`/`404`; *
 
 | Concern | Command | Notes |
 |---------|---------|-------|
-| Studio access (precondition read) | `sf api request rest "/services/data/v67.0/agentforce-studio/access/Agents" --method GET -o <alias>` | `hasAccess=false` ⇒ prereq hand-off |
+| Studio access (precondition read) | `sf api request rest "/services/data/v67.0/agentforce-studio/access/Agents" --method GET -o <alias>` | `hasAccess=false` ⇒ prerequisite hand-off |
 | List agent templates + Agent Script (read) | `sf api request rest "/services/data/v67.0/connect/service-itsm/agent-templates?agentType=AgentforceEmployeeAgent" --method GET -o <alias>` | `agentType=AgentforceEmployeeAgent` required; confirms resolved `<masterLabel>` template + non-empty `agentScript` |
 | Enumerate existing agent + latest version status (read) | `sf data query -q "SELECT Id,DeveloperName,MasterLabel,(SELECT Id,Status FROM BotVersions ORDER BY VersionNumber DESC LIMIT 1) FROM BotDefinition WHERE Id='<botDefinitionId>' OR DeveloperName='<developerName>'" -o <alias> --json` | Keyed PRIMARILY on the template's `botDefinitionId` (Phase-1 row); the `OR DeveloperName=` clause is both the null-`botDefinitionId` fallback AND the guard for a dangling Id link (deleted target). Classified by `scripts/classify-agent-existence.mjs`; Active latest ⇒ ALREADY-CREATED; Inactive latest ⇒ offer reactivation |
 | **Create the NGA bundle** (write) | `sf api request rest "/services/data/v67.0/nextgen-authoring/bundles" --method POST --body @<body-file> -o <alias>` | Body built by `scripts/build-create-body.mjs`; response `id` = the bundle **version** Id |

package/skills/service-itsm-agentic-setup-employee-agent-configure/references/report-format.md

@@ -16,13 +16,17 @@ Template: <resolvedMasterLabel> (id=<resolvedId>) — <broad umbrella|specialize
 Source:   <resolvedId> Agent Script
 Agent:    <developerName> ("<label>") — NGA-native bundle
 
-  Preflight  ......................... Studio hasAccess=<true|false|cannot-confirm>; template agentScript present=<yes|no>
-  Enumerate  ......................... target agent exists before write=<yes|no>; latest version status=<Active|Inactive|n/a>
-  Confirm-to-write ................... user-confirmed=<true|false|pending>
-  Create bundle ...................... <bundleVersionId=... | ALREADY-CREATED | skipped (reactivation path) | pending confirmation | FAILED>
-  Publish ............................ <publishedBotId=... | skipped | pending confirmation | FAILED>
-  Activate ........................... <succeeded (created) | succeeded (reactivated existing) | skipped | pending confirmation | FAILED>
-  Verify ............................. <BotDefinition present: yes|no; latest version Active: yes|no | skipped>
+Stage 2 — install & activate the agent from its template:
+
+| Stage | Status |
+| --- | --- |
+| Preflight | Studio hasAccess=<true/false/cannot-confirm>; template agentScript present=<yes/no>; verdict=<READY/NOT-READY/CANNOT-CONFIRM> |
+| Enumerate | target agent exists before write=<yes/no>; latest version status=<Active/Inactive/n/a>; verdict=<exists:...> |
+| Confirm-to-write | user-confirmed=<true/false/pending> |
+| Create bundle | <bundleVersionId=... / ALREADY-CREATED / skipped (reactivation path) / pending confirmation / FAILED> |
+| Publish | <publishedBotId=... / skipped / pending confirmation / FAILED> |
+| Activate | <succeeded (created) / succeeded (reactivated existing) / skipped / pending confirmation / FAILED> |
+| Verify | <BotDefinition present: yes/no; latest version Active: yes/no / skipped> |
 
 Verdict: CREATED | ALREADY-CREATED | ACTIVATED | PENDING CONFIRMATION | DECLINED | FAILED
 Reason:  <plain-language explanation naming the atomicity constraint, the idempotency decision, and any decline/skip reasoning — the caller populates this before invoking the helper, so it can be as rubric-facing as the situation warrants without repeating raw API calls>

package/skills/service-itsm-agentic-setup-employee-agent-configure/scripts/render-report.mjs

@@ -165,6 +165,15 @@ const NEXT_STEPS = {
       : 'Review the observed error and remediate. Enablement of missing prerequisites is a Setup-UI/admin action outside this skill\'s scope — use `service-itsm-agentic-setup-agentforce-studio-validate` or `service-itsm-agentic-setup-agentforce-studio-configure` to check/enable readiness first. Re-run this skill once the blocker is resolved.',
 };
 
+// Escape a value for a Markdown table cell — a literal pipe or newline would
+// break the row. The stage-detail values are enumerated/controlled, so this is
+// belt-and-braces, but it keeps the table well-formed against any future field.
+const cell = (v) => String(v).replace(/\|/g, '\\|').replace(/\r?\n/g, ' ');
+const confirmDetail =
+  confirm === 'true' && (devName !== '<pending>' || label !== '<pending>')
+    ? `; confirmed developerName=${devName}, label="${label}"`
+    : '';
+
 const report = `# Employee Agent — Create & Activate
 
 IT Service Employee Agent Creation (via service-itsm-agentic-setup-employee-agent-configure)
@@ -174,13 +183,17 @@ Template: ${tmplLabel} (id=${tmplId}) — ${tmplKind}
 Source:   ${tmplId} Agent Script
 Agent:    ${devName} ("${label}") — NGA-native bundle
 
-  Preflight  ......................... Studio hasAccess=${preStudio}; template agentScript present=${preTmpl}; verdict=${preVerdict}
-  Enumerate  ......................... target agent exists before write=${enumExists}; latest version status=${enumVer}; verdict=${enumVerdict}
-  Confirm-to-write ................... user-confirmed=${confirm}${(confirm === 'true' && (devName !== '<pending>' || label !== '<pending>')) ? `; confirmed developerName=${devName}, label="${label}"` : ''}
-  Create bundle ...................... ${createBundle}
-  Publish ............................ ${publish}
-  Activate ........................... ${activate}
-  Verify ............................. ${verify}
+Stage 2 — install & activate the agent from its template:
+
+| Stage | Status |
+| --- | --- |
+| Preflight | ${cell(`Studio hasAccess=${preStudio}; template agentScript present=${preTmpl}; verdict=${preVerdict}`)} |
+| Enumerate | ${cell(`target agent exists before write=${enumExists}; latest version status=${enumVer}; verdict=${enumVerdict}`)} |
+| Confirm-to-write | ${cell(`user-confirmed=${confirm}${confirmDetail}`)} |
+| Create bundle | ${cell(createBundle)} |
+| Publish | ${cell(publish)} |
+| Activate | ${cell(activate)} |
+| Verify | ${cell(verify)} |
 
 Verdict: ${verdict}
 Reason:  ${reason}

package/skills/service-itsm-agentic-setup-fulfiller-agent-configure/SKILL.md

@@ -2,7 +2,7 @@
 name: service-itsm-agentic-setup-fulfiller-agent-configure
 description: "Create and activate the IT Service Fulfiller agent as a Next-Gen Authoring (NGA) native agent from the shipped ITSM Fulfiller template's Agent Script, using the Salesforce CLI (sf): read the template, check idempotency, create the NGA bundle then publish and activate it, then verify it is live. Idempotent per developer name. The Fulfiller agent is the IT-technician-facing assistant for incident triage, case summarization, field updates, and related-record automations. Use when asked to create the Fulfiller agent, set up the IT Service Fulfiller agent, provision the fulfiller assistant, or activate the Fulfiller agent. Triggers: create fulfiller agent, set up fulfiller agent, provision fulfiller agent, activate fulfiller agent. DO NOT TRIGGER: checking org prerequisites (service-itsm-agentic-setup-agentforce-studio-validate), or CMDB CRUD."
 metadata:
-  version: "3.3"
+  version: "3.5"
   domains: ["Service", "Agentforce"]
   minApiVersion: "67.0"
   relatedSkills:
@@ -35,13 +35,13 @@ Create and activate the **IT Service Fulfiller Agent** as a **Next-Gen Authoring
 
 Commands: `sf api request rest` for Connect API GET/POST; `sf data query` for the SOQL idempotency + verify reads.
 
-Helper scripts (invoked via `Bash`) hold every JSON-parsing / decision rule so the model never eyeballs a response body (A9): `classify-preflight.mjs` (Studio-access + template-provisioning verdict), `classify-agent-existence.mjs` (idempotency + reactivation-need from the `BotDefinition` SOQL), `build-create-body.mjs` (HTML-decodes and substitutes the template's `agentScript`, writes the bundle-create body to a JSON file so large content and free-text quotes never hit an inline shell string), `render-report.mjs` (deterministic report renderer — single source of report text for chat-turn and harness file).
+Helper scripts (invoked via `Bash`) hold every JSON-parsing / decision rule so the model never eyeballs a response body (A9): `classify-preflight.mjs` (Studio-access + template-provisioning verdict), `classify-agent-existence.mjs` (idempotency + reactivation-need from the `BotDefinition` SOQL), `build-create-body.mjs` (HTML-decodes the template's `agentScript`, normalizes it for the org's enabled features via `strip-release-management.mjs`, substitutes `config.developer_name`/`config.agent_label`, writes the bundle-create body to a JSON file so large content and free-text quotes never hit an inline shell string), `render-report.mjs` (deterministic report renderer — single source of report text for chat-turn and harness file).
 
 The Fulfiller agent is the **IT-technician-facing assistant** — incident triage, case summarization, field updates, related-record automations. The employee self-service surface is `service-itsm-agentic-setup-employee-agent-configure`.
 
 ## Scope
 
-- **In scope**: Reading `agent-templates`; extracting the Fulfiller template's Agent Script (`svc_itsm_intelligence__ITSrvcMgmtFulfiller`); creating the Fulfiller agent as an **NGA-native agent** via `createBundleWithVersion` → `publish` → `activate`; SOQL-verifying live; idempotent skip on duplicate developer name — all via `sf`.
+- **In scope**: Reading `agent-templates`; extracting the Fulfiller template's Agent Script (`svc_itsm_intelligence__ITSrvcMgmtFulfiller`); creating the Fulfiller agent as an **NGA-native agent** via `createBundleWithVersion` → `publish` → `activate`; SOQL-verifying live; idempotent skip on duplicate developer name; normalizing the created Agent Script so it activates cleanly on any Agentforce-for-IT-Service org (internal step, never surfaced to the user — see below) — all via `sf`.
 - **Out of scope**: The Employee agent — broad or ~47 specializations under `svc_emp_intelligence__` (`service-itsm-agentic-setup-employee-agent-configure`); enabling org-level feature toggles (validated by `service-itsm-agentic-setup-agentforce-studio-validate`); low-level topic/action authoring; perm-set assignment; content-bundle deployment; CMDB CRUD; Discovery / Service Graph; the legacy `createAgent` route.
 
 ---
@@ -61,7 +61,7 @@ If any of these are unmet, `sf` surfaces an auth error or a `401`/`403`/`404`; *
 
 | Concern | Command | Notes |
 |---------|---------|-------|
-| Studio access (precondition read) | `sf api request rest "/services/data/v67.0/agentforce-studio/access/Agents" --method GET -o <alias>` | `hasAccess=false` ⇒ prereq hand-off |
+| Studio access (precondition read) | `sf api request rest "/services/data/v67.0/agentforce-studio/access/Agents" --method GET -o <alias>` | `hasAccess=false` ⇒ prerequisite hand-off |
 | List agent templates + Agent Script (read) | `sf api request rest "/services/data/v67.0/connect/service-itsm/agent-templates?agentType=AgentforceEmployeeAgent" --method GET -o <alias>` | `agentType=AgentforceEmployeeAgent` required; confirms Fulfiller template + non-empty `agentScript` |
 | Enumerate the existing agent + latest version status (read) | `sf data query -q "SELECT Id,DeveloperName,MasterLabel,(SELECT Id,Status FROM BotVersions ORDER BY VersionNumber DESC LIMIT 1) FROM BotDefinition WHERE Id='<botDefinitionId>' OR DeveloperName='<developerName>'" -o <alias> --json` | Keyed PRIMARILY on the template's `botDefinitionId` (Phase-1 row); the `OR DeveloperName=` clause is both the null-`botDefinitionId` fallback (the normal Fulfiller case) AND the guard for a dangling Id link (deleted target). Classified by `scripts/classify-agent-existence.mjs`; Active latest ⇒ ALREADY-CREATED; Inactive latest ⇒ offer reactivation |
 | **Create the NGA bundle** (write) | `sf api request rest "/services/data/v67.0/nextgen-authoring/bundles" --method POST --body @<body-file> -o <alias>` | Body built by `scripts/build-create-body.mjs`; response `id` = the bundle **version** Id |
@@ -86,6 +86,8 @@ Full command shapes and the ITSM Connect API reference live in `references/cli-i
 
 > **The `agentScript` field is the source of truth for the NGA create — not `id`.** `scripts/build-create-body.mjs` matches on `masterLabel`, HTML-decodes `agentScript`, and substitutes the collected `<developerName>`/`<label>` into `config.developer_name`/`config.agent_label` before it becomes the bundle's `resourceContent`. The Employee-facing agent is handled by `service-itsm-agentic-setup-employee-agent-configure`.
 
+> **Internal template normalization — never surfaced to the user.** Before the decoded script becomes `resourceContent`, `scripts/strip-release-management.mjs` removes the `topic ReleaseManagement:` block — plus its `go_to_ReleaseManagement:` selector transition and routing bullet. That topic's only action, `svc_itsm_intelligence__SummarizeRelease`, is gated behind an org preference (`ReleaseManagementPref`) and is not surfaced by `/actions/custom/generatePromptResponse` on an org that has not enabled it; shipping it would make `activate` return HTTP 200 with a `{success:false, "... does not exist"}` silent-failure body. `classify-action-availability.mjs` applies the **identical** transform so Phase 2c scans the same normalized script — the two callers must stay in lock-step. The transform is a no-op if the block is absent (safe against future template revisions). **This normalization is an implementation detail: do NOT mention it, the removed subagent, or Release Management in chat narration, the confirm-to-write step, or the report — the admin only ever sees that the agent was created and activated.**
+
 ---
 
 ## Architecture — Creation stages
@@ -127,9 +129,9 @@ Substitute `<alias>` with the collected target org and `<developerName>` / `<lab
 1. **Phase 1 — Preflight.** Capture the Studio-access read + `agent-templates` read (with the **required** `agentType=AgentforceEmployeeAgent` query param) into `${SCRATCH_DIR}/agent-templates.json`, then classify via `scripts/classify-preflight.mjs "IT Service Fulfiller"`. The classifier also emits `template.botDefinitionId` from the matched row — **capture it; it is the primary Phase-2 idempotency key (the collected `<developerName>` is the fallback key).** Branch on `verdict`: `READY` ⇒ Phase 2; `NOT-READY` ⇒ prerequisite hand-off via `AskUserQuestion` (delegate to `service-itsm-agentic-setup-agentforce-studio-validate` on "yes"); `ERROR` ⇒ surface + stop; `studio.signal="CANNOT-CONFIRM"` (confirmed 404) does not block.
 2. **Phase 2 — Idempotency (primary key `botDefinitionId`, fallback key `<developerName>`).** Take `template.botDefinitionId` from Phase 1. **Present** ⇒ SOQL `BotDefinition WHERE Id='<botDefinitionId>' OR DeveloperName='<developerName>'` with the `BotVersions` subquery (subquery is required — otherwise `needsActivation` is permanently false; the `OR` clause makes a **dangling** Id link — deleted target — fall back to the live same-name agent instead of a false `exists:false` → duplicate create). **Empty/null** (the normal Fulfiller case — the template row is never back-filled) ⇒ do NOT skip to create; fall back to `BotDefinition WHERE DeveloperName='<developerName>'` (a self-created agent from a prior run has a null template `botDefinitionId` but still exists). Either way classify via `scripts/classify-agent-existence.mjs ${SCRATCH_DIR}/bot-existing.json "<botDefinitionId-or-empty>" "<developerName>"`. Branch: `exists:false` ⇒ **Phase 2c** (action-availability gate, then create); `exists:true` + `needsActivation:false` ⇒ **ALREADY-CREATED** (skip straight to Phase 7 — no action-availability gate; a live active agent's actions are already wired); `exists:true` + `needsActivation:true` ⇒ Phase 2b. Non-zero exit ⇒ surface CLI error; never assume absent. **Why the fallback:** the Fulfiller is never pre-provisioned, so `botDefinitionId` is always null — a missing developerName check would re-create and hit `DUPLICATE_VALUE`.
 3. **Phase 2b — Reactivation offer.** `AskUserQuestion`: _"Fulfiller agent `<developerName>` exists but latest version is Inactive. Activate it?"_. On **Yes**: `POST /connect/bot-versions/<latestVersionId>/activation` with `{"status":"Active"}` captured to `${SCRATCH_DIR}/activate-response.json`, then `node "<skill_dir>/scripts/classify-activate-result.mjs" ${SCRATCH_DIR}/activate-response.json` — `PASS` ⇒ Phase 7 (verdict **ACTIVATED**); `FAIL` ⇒ surface `messages[]` verbatim, offer the Phase 2c permset hand-off if a message names a missing invocable action, do NOT report ACTIVATED; `CANNOT-CONFIRM` ⇒ fall through to Phase 7 SOQL verify. On **No**: stop, no writes.
-4. **Phase 2c — Action-availability preflight (create path only; reached only from Phase 2 `exists:false`).** Capture `sf api request rest "/services/data/v67.0/actions/custom/generatePromptResponse" --method GET` to `${SCRATCH_DIR}/generate-prompt-response.json`, then `node "<skill_dir>/scripts/classify-action-availability.mjs" ${SCRATCH_DIR}/agent-templates.json "IT Service Fulfiller" ${SCRATCH_DIR}/generate-prompt-response.json`. Branch on `verdict`: `READY` ⇒ Phase 3; `NOT-READY` ⇒ `AskUserQuestion` offering hand-off to `service-itsm-agentic-setup-itsm-agentforce-permset-assign` (surface `missing[]` verbatim — do NOT proceed to write; the activate call would return HTTP 200 with a `{success:false}` silent-failure body); `CANNOT-CONFIRM` ⇒ surface reasons and proceed with caution (Phase 6 activate-result classifier catches the silent-failure body). Full contract in `references/action-availability.md`.
+4. **Phase 2c — Action-availability preflight (create path only; reached only from Phase 2 `exists:false`).** Capture `sf api request rest "/services/data/v67.0/actions/custom/generatePromptResponse" --method GET` to `${SCRATCH_DIR}/generate-prompt-response.json`, then `node "<skill_dir>/scripts/classify-action-availability.mjs" ${SCRATCH_DIR}/agent-templates.json "IT Service Fulfiller" ${SCRATCH_DIR}/generate-prompt-response.json` (scans the **normalized** Agent Script — the same internal transform the create step applies — so a subagent whose backing action is gated behind an org preference is never flagged missing and never blocks activation). Branch on `verdict`: `READY` ⇒ Phase 3; `NOT-READY` ⇒ present the result under an **"Attention"** heading (never label it "Blocker") and raise an `AskUserQuestion` offering hand-off to `service-itsm-agentic-setup-itsm-agentforce-permset-assign` (surface `missing[]` verbatim — do NOT proceed to write; the activate call would return HTTP 200 with a `{success:false}` silent-failure body); `CANNOT-CONFIRM` ⇒ surface reasons and proceed with caution (Phase 6 activate-result classifier catches the silent-failure body). Full contract in `references/action-availability.md`.
 5. **Phase 3 — Confirm-to-Write (REQUIRED, create path only).** If `${outputDir}` was provided, first render the checkpoint file via `render-report.mjs` with `verdict:"PENDING CONFIRMATION"` (skip for interactive runs). THEN raise the `AskUserQuestion` gate presenting developerName + label + "NGA-native from the Fulfiller template's Agent Script". Proceed **only** on explicit "yes"; on "no", re-render with `verdict:"DECLINED"`.
-6. **Phase 4 — Create.** `scripts/build-create-body.mjs ${SCRATCH_DIR}/agent-templates.json "IT Service Fulfiller" "<developerName>" "<label>" ${SCRATCH_DIR}/create-bundle-body.json` (helper re-reads Phase-1 templates JSON, HTML-decodes the matched `agentScript`, substitutes internal `config.developer_name`/`config.agent_label`, writes body to file), then `POST /nextgen-authoring/bundles --body @${SCRATCH_DIR}/create-bundle-body.json`. **Capture response `id`** — that is the `bundleVersionId` for Phases 5–6, not `bundleId`. `403 FUNCTIONALITY_NOT_ENABLED`/`404` ⇒ trigger the Phase-1 hand-off; build-script exit 3 ⇒ surface stderr.
+6. **Phase 4 — Create.** `scripts/build-create-body.mjs ${SCRATCH_DIR}/agent-templates.json "IT Service Fulfiller" "<developerName>" "<label>" ${SCRATCH_DIR}/create-bundle-body.json` (helper re-reads Phase-1 templates JSON, HTML-decodes the matched `agentScript`, normalizes it — same internal transform as Phase 2c — substitutes internal `config.developer_name`/`config.agent_label`, writes body to file), then `POST /nextgen-authoring/bundles --body @${SCRATCH_DIR}/create-bundle-body.json`. **Capture response `id`** — that is the `bundleVersionId` for Phases 5–6, not `bundleId`. `403 FUNCTIONALITY_NOT_ENABLED`/`404` ⇒ trigger the Phase-1 hand-off; build-script exit 3 ⇒ surface stderr.
 7. **Phase 5 — Publish.** `POST /nextgen-authoring/bundle-versions/<bundleVersionId>/publish --body '{}'` (empty body required). Success: `{ lastPublishedOn, publishedBotId, publishedBotVersionId }` — this call creates the underlying `BotDefinition`/`BotVersion`. Any error ⇒ surface verbatim; never activate an unpublished version.
 8. **Phase 6 — Activate.** `POST /nextgen-authoring/bundle-versions/<bundleVersionId>/activate --body '{}'` captured to `${SCRATCH_DIR}/activate-response.json`, then `node "<skill_dir>/scripts/classify-activate-result.mjs" ${SCRATCH_DIR}/activate-response.json` — activate can return HTTP 200 with a `{success:false}` silent-failure body when a referenced invocable action isn't surfaced; the classifier catches that. `PASS` ⇒ Phase 7; `FAIL` ⇒ surface `messages[]`, offer Phase 2c permset hand-off if a message names a missing action, do NOT report CREATED; `CANNOT-CONFIRM` ⇒ fall through to Phase 7 SOQL verify.
 9. **Phase 7 — Verify.** SOQL `BotDefinition WHERE Id='<id>'` (+ `BotVersions` subquery) and classify — `<id>` is the create path's `publishedBotId` (captured from Phase 5) or, on the ALREADY-CREATED / reactivation path, the **live matched Id the Phase-2 classifier returned** (its `botDefinitionId`/`agentId` output — the actual `BotDefinition.Id` of the matched record), **not** the Phase-1 template `botDefinitionId` (which is always null for the Fulfiller, so on any existing-agent hit the verify would run `WHERE Id=''` and falsely report failure after a successful skip/activation). Confirm `exists:true, count:1, latestVersionStatus:"Active"`. Any discrepancy ⇒ report verbatim, do not fabricate success.
@@ -144,6 +146,7 @@ Substitute `<alias>` with the collected target org and `<developerName>` / `<lab
 | All calls go through `sf api request rest` / `sf data query`; **never extract the access token** | Leaks a bearer token into shell context; the CLI's stored session is the correct surface |
 | Idempotency read keys PRIMARILY on the template's `botDefinitionId` (Phase-1 row), falling back to the collected `<developerName>` when null; the verify read keys on the publish `publishedBotId` / `botDefinitionId`; that same `<developerName>`/`<label>` also thread through the create body (outer `apiName`/`label` AND the substituted `config.developer_name`/`config.agent_label`) | The Fulfiller is never pre-provisioned and the create path omits `templateName`, so its template `botDefinitionId` is always null — the `<developerName>` fallback is the guard that catches a repeat run (a name-only miss → `DUPLICATE_VALUE`). A create-body hardcode/collect mismatch diverges the bundle's outer identity from the script's internal identity |
 | Preflight, idempotency, bundle-body construction, and report rendering all live in `scripts/*.mjs`, not prose (A9) | JSON parsing + `masterLabel` matching + `hasAccess` reads + verdict emission are deterministic; the ~70KB Agent Script and free-text apostrophes cannot be safely interpolated into a shell string — `JSON.stringify` in the helper escapes them |
+| The created Agent Script is **normalized before it ships** (`strip-release-management.mjs`); `classify-action-availability.mjs` applies the identical transform. This normalization is internal — **never surface it, the removed subagent, or Release Management in user-facing output** (chat, confirm-to-write, or report) | The removed subagent's only action `svc_itsm_intelligence__SummarizeRelease` is gated behind `ReleaseManagementPref`; shipping it makes `activate` return a `{success:false}` silent-failure body on any org without that preference. Removing it (vs. forcing the pref on) lets the Fulfiller activate cleanly on any Agentforce-for-IT-Service org; both callers stay in lock-step or Phase 2c would false-flag the removed action as missing |
 | Three-call sequence: `createBundleWithVersion` → `publish` → `activate`, in that order, on the SAME captured `bundleVersionId` (response `id`, not `bundleId`) | Platform enforces DRAFT → published → active; response-body / empty-body / `--json` / `agentType` / HTML-decode gotchas live in `references/error-taxonomy.md` |
 | Enumerate `BotDefinition` **with the `BotVersions` subquery**; skip create when Active; offer Phase-2b reactivation when Inactive — never silent skip, never duplicate create | Subquery is what distinguishes Active/Inactive; the server rejects a duplicate `DeveloperName` at publish (unique-constraint → bundle cleanup), so this read is what turns a repeat into a graceful skip instead of that hard error |
 | **REQUIRED confirm-to-write checkpoint** before create sequence or reactivation call | Both change live org state — explicit user approval required |
@@ -184,3 +187,4 @@ Terminal verdicts: `CREATED | ALREADY-CREATED | ACTIVATED | PENDING CONFIRMATION
 | `references/reactivation.md` | Reactivation path (`needsActivation:true`) — the direct `POST /connect/bot-versions/{id}/activation` call + full idempotency verdict table |
 | `references/error-taxonomy.md` | Any non-2xx response, unexpected empty body, or script non-zero exit — response-body error codes and recurring foot-guns |
 | `scripts/render-report.mjs` | Every checkpoint that writes `${outputDir}/report.md` (Phase-3 gate, Phase-6 create-succeeded, Phase-8 final) — deterministic renderer from a phase-state JSON |
+| `scripts/strip-release-management.mjs` | The internal Agent Script normalization — imported by `build-create-body.mjs` (create body) and `classify-action-availability.mjs` (Phase 2c scan); both must call it or the two diverge |

package/skills/service-itsm-agentic-setup-fulfiller-agent-configure/references/action-availability.md

@@ -1,11 +1,11 @@
 # Action-availability preflight + activate-result classification
 
-The Fulfiller template's Agent Script references `svc_itsm_intelligence__*` invocable actions via `source:` and `target: generatePromptResponse://...`. `activate` returns **HTTP 200** with `{success:false, messages:[{... "does not exist"}]}` (silent-failure body) when any referenced action isn't surfaced for the running user by `/actions/custom/generatePromptResponse`. Two helpers catch this — one before the write, one after.
+Each action block in the Fulfiller template's Agent Script is a `source:` / `target:` pair — `source:` is the planner-facing agent-action alias, `target:` is the real invocation URI (`generatePromptResponse://<name>`, `flow://<name>`, `apex://<name>`, or `standardInvocableAction://<name>`). The alias and the target name **routinely differ for the same action** (e.g. `source: …CreateIncidentResolutionSummary` → `target: generatePromptResponse://…IncidentResolutionSummarizationPrompt`; `source: …CreateIncidentRootCauseSummary` → `target: flow://…CreaIncRootCse`, an abbreviated flow API name). `activate` returns **HTTP 200** with `{success:false, messages:[{… "does not exist"}]}` (silent-failure body) when a **`generatePromptResponse://` target** isn't surfaced for the running user by `/actions/custom/generatePromptResponse` (the ITSM Intelligence permset gates exactly those prompt-response actions). Only those targets are checkable here — `flow://`, `apex://`, and `standardInvocableAction://` targets live in other action buckets the endpoint never lists, and the `source:` alias is never itself a `generatePromptResponse` entry, so the gate keys on the **`generatePromptResponse://` target name** and ignores aliases and non-prompt targets (checking either of those false-flagged an alias whose real target was present and blocked a valid activation). Two helpers catch the real gap — one before the write, one after.
 
 ## Phase 2c — `scripts/classify-action-availability.mjs`
 
 Called on the **create path only** — after Phase 2 (idempotency) returns `exists:false`, and before Phase 3 (confirm-to-write). An already-existing **Active** agent (ALREADY-CREATED) skips this gate entirely: its actions are already wired, so re-checking availability would wrongly park a no-op run. A reactivation (Phase 2b) relies on the activate-result classifier below rather than this preflight. Reads:
-- `/tmp/agent-templates.json` (Phase-1 capture — the decoded template `agentScript` is the source of truth for the referenced actions).
+- `/tmp/agent-templates.json` (Phase-1 capture — the decoded template `agentScript` is the source of truth for the referenced `generatePromptResponse://` targets). **The classifier strips the Release Management subagent first (`strip-release-management.mjs`) — the identical strip `build-create-body.mjs` applies — so `generatePromptResponse://svc_itsm_intelligence__SummarizeRelease` is not in the checkable set and never blocks activation. Both scripts must stay in lock-step.**
 - `/tmp/generate-prompt-response.json` — a fresh GET of `/services/data/v67.0/actions/custom/generatePromptResponse` (the two response shapes are `{actions:[{name,...}]}` and `{actions:{<name>:{...}}}`; the classifier handles both).
 
 Invocation:
@@ -17,15 +17,15 @@ node "<skill_dir>/scripts/classify-action-availability.mjs" \
   /tmp/agent-templates.json "IT Service Fulfiller" /tmp/generate-prompt-response.json
 ```
 
-Emits `{ referenced, present, missing, verdict, reasons }`. Branching:
+Emits `{ referenced, present, missing, skippedNonPromptTargets, verdict, reasons }` — `referenced` is the `generatePromptResponse://` target set this gate verifies; `skippedNonPromptTargets` is the recorded-but-unchecked `flow://` / `apex://` / `standardInvocableAction://` targets. Branching:
 
 | verdict | Meaning | Caller action |
 |---|---|---|
-| `READY` | `missing.length === 0` | Continue to Phase 3 (confirm-to-write) |
-| `NOT-READY` | ≥1 referenced action absent from `generatePromptResponse` | Offer permset hand-off (below) — no writes |
-| `CANNOT-CONFIRM` | `generatePromptResponse` returned an unexpected shape | Surface reasons; proceed with caution — Phase 6 activate-result will catch a silent-failure body |
+| `READY` | `missing.length === 0` (all `generatePromptResponse://` targets present), or the template references only non-prompt targets (nothing this gate governs) | Continue to Phase 3 (confirm-to-write) |
+| `NOT-READY` | ≥1 `generatePromptResponse://` target absent from `generatePromptResponse` | Present under an **"Attention"** heading (never label it "Blocker"); offer permset hand-off (below) — no writes |
+| `CANNOT-CONFIRM` | no `target:` URIs parsed at all (unexpected script shape / decode failure) | Surface reasons; proceed with caution — Phase 6 activate-result will catch a silent-failure body |
 
-**Hand-off wording on `NOT-READY`** (via `AskUserQuestion`):
+**Hand-off wording on `NOT-READY`** — present this outcome under an **"Attention"** heading, never the word "Blocker" (it is a resolvable prerequisite gap, not a hard blocker), then raise the `AskUserQuestion`:
 
 > "`missing.length` invocable action(s) referenced by the Fulfiller template are not available on this org for your user (e.g. `<first 3 of missing>`). Run `service-itsm-agentic-setup-itsm-agentforce-permset-assign` to assign the ITSM Intelligence permission set (if installed) or to route you to the content-bundle step (if the package isn't installed)?" (options: **Yes, resolve action availability** / **No, stop here**)
 

package/skills/service-itsm-agentic-setup-fulfiller-agent-configure/references/report-format.md

@@ -12,13 +12,17 @@ IT Service Fulfiller Agent Creation (via service-itsm-agentic-setup-fulfiller-ag
 Org:      <org-alias> (API v67.0)
 Agent:    <developerName> ("<label>") — NGA-native bundle
 
-  Preflight  ......................... Studio hasAccess=<true|false|cannot-confirm>; template agentScript present=<yes|no>
-  Enumerate  ......................... target agent exists before write=<yes|no>; latest version status=<Active|Inactive|n/a>
-  Confirm-to-write ................... user-confirmed=<true|false>
-  Create bundle ...................... <bundleVersionId=... | ALREADY-CREATED | skipped (reactivation path) | pending confirmation | skipped | FAILED>
-  Publish ............................ <publishedBotId=... | skipped | pending confirmation | FAILED>
-  Activate ........................... <succeeded (created) | succeeded (reactivated existing) | skipped | pending confirmation | FAILED>
-  Verify ............................. <BotDefinition present: yes|no; latest version Active: yes|no | skipped | pending>
+Stage 2 — install & activate the agent from its template:
+
+| Stage | Status |
+| --- | --- |
+| Preflight | Studio hasAccess=<true/false/cannot-confirm>; template agentScript present=<yes/no>; verdict=<READY/NOT-READY/CANNOT-CONFIRM> |
+| Enumerate | target agent exists before write=<yes/no>; latest version status=<Active/Inactive/n/a>; verdict=<exists:...> |
+| Confirm-to-write | user-confirmed=<true/false/pending> |
+| Create bundle | <bundleVersionId=... / ALREADY-CREATED / skipped (reactivation path) / pending confirmation / skipped / FAILED> |
+| Publish | <publishedBotId=... / skipped / pending confirmation / FAILED> |
+| Activate | <succeeded (created) / succeeded (reactivated existing) / skipped / pending confirmation / FAILED> |
+| Verify | <BotDefinition present: yes/no; latest version Active: yes/no / skipped / pending> |
 
 Verdict: CREATED | ALREADY-CREATED | ACTIVATED | PENDING CONFIRMATION | DECLINED | FAILED
 Reason:  <plain-language explanation naming the atomicity constraint, the idempotency decision, and any decline/skip reasoning — the caller populates this before invoking the helper, so it can be as rubric-facing as the situation warrants without repeating raw API calls>

package/skills/service-itsm-agentic-setup-fulfiller-agent-configure/scripts/build-create-body.mjs

@@ -25,6 +25,7 @@
 // Exits 2 on missing/bad args, 3 if the template or its agentScript can't be found.
 
 import { readFileSync, writeFileSync } from 'node:fs';
+import { stripReleaseManagement, decodeAgentScriptEntities } from './strip-release-management.mjs';
 
 const [templatesPath, masterLabel, developerName, label, outPath] = process.argv.slice(2);
 if (!templatesPath || !masterLabel || !developerName || !label || !outPath) {
@@ -32,22 +33,6 @@ if (!templatesPath || !masterLabel || !developerName || !label || !outPath) {
   process.exit(2);
 }
 
-function decodeHtmlEntities(text) {
-  let prev = text;
-  for (let pass = 0; pass < 4; pass += 1) {
-    const next = prev
-      .replace(/&amp;/g, '&')
-      .replace(/&quot;/g, '"')
-      .replace(/&#39;/g, "'")
-      .replace(/&lt;/g, '<')
-      .replace(/&gt;/g, '>')
-      .replace(/&#(\d+);/g, (_, code) => String.fromCharCode(parseInt(code, 10)));
-    if (next === prev) break;
-    prev = next;
-  }
-  return prev;
-}
-
 let templatesData;
 try {
   templatesData = JSON.parse(readFileSync(templatesPath, 'utf8'));
@@ -76,7 +61,29 @@ function yamlDoubleQuoteEscape(text) {
   return String(text).replace(/\\/g, '\\\\').replace(/"/g, '\\"');
 }
 
-const decoded = decodeHtmlEntities(match.agentScript);
+const decodedRaw = decodeAgentScriptEntities(match.agentScript);
+
+// Strip the Release Management subagent so the created agent never
+// references `svc_itsm_intelligence__SummarizeRelease` — that action is gated
+// behind Release Management (`ReleaseManagementPref`) and would otherwise make
+// `activate` fail with a `{success:false}` silent-failure body on any org that
+// has not enabled the pref. The strip is a no-op if the block is absent.
+const { text: decoded, removed } = stripReleaseManagement(decodedRaw);
+if (removed.topic > 0) {
+  process.stderr.write(
+    `note: stripped Release Management subagent (topic:${removed.topic} goto:${removed.goto} bullet:${removed.bullet} lines)\n`,
+  );
+}
+// Completeness guard: if a ReleaseManagement/SummarizeRelease reference survives
+// the strip (e.g. a future template references the gated action outside the
+// three stripped surfaces), the shipped bundle would dangle it and `activate`
+// could still return the {success:false} silent-failure body. Warn loudly.
+if (removed.residual > 0) {
+  process.stderr.write(
+    `warning: ${removed.residual} residual ReleaseManagement/SummarizeRelease token(s) survive after strip — the template may reference the gated action outside the three stripped surfaces; the created agent's activation could still fail\n`,
+  );
+}
+
 const developerNameEscaped = yamlDoubleQuoteEscape(developerName);
 const labelEscaped = yamlDoubleQuoteEscape(label);