@salesforce/afv-skills 1.47.0 → 1.48.0

package/skills/education-cloud-domain-configure/references/domain-features/student-success.md

@@ -0,0 +1,249 @@
+# 1. Student Success
+
+**Purpose**: Track student advising, success interventions, care plans, and wellness support.
+
+**Prerequisites**:
+- All Foundation prerequisites (Section 0)
+- Cases enabled — advising uses case-based workflows
+- Salesforce Scheduler — for advising appointment booking
+- Experience Cloud license — for Learner Portal (student-facing)
+- OmniStudio — for portal components and guided experiences
+- CRM Analytics / Education Analytics — for Advisor Insights and KPI dashboards (optional)
+- Einstein Generative AI — for Einstein Advising Summary (optional)
+
+**Core features**:
+- Student records (Person Accounts)
+- Advising case management
+- Success teams for collaborative support
+- Care plans to track interventions
+- Alerts and notifications
+- Salesforce Scheduler for appointment booking
+
+### Sub-Feature Configuration
+
+> **Executed order (from Student Success testing):** Support Process → Case Record Types → Success Teams (create `CaseTeamTemplate` first) → Care Plans → Support Programs → Salesforce Scheduler. Do Care Plans AFTER Success Teams and Support Programs BEFORE Scheduler.
+
+> **License-gating on Care Plans / Support Programs / Scheduler writes.** These three toggle writes can return `400 INSUFFICIENT_ACCESS_OR_READONLY` (nothing written) on an under-licensed org — confirmed on a test org where the identical write failed on day 1 and succeeded (`success:true`) on day 2 after the org was given more licenses, with no skill/API change in between. Treat this error as **"check licensing on this org first,"** not as a fixed product limitation — retry after the admin confirms licensing rather than concluding the feature is unreachable via API.
+
+> **`IndustriesSettings` tooling GET cold-verify can 500 org-wide.** `GET /services/data/v68.0/tooling/sobjects/IndustriesSettings/<DurableId>` has been observed returning HTTP 500 `UNKNOWN_EXCEPTION` on every value read (any field, any API version) in at least one org, root-caused to a null UDD `LogicalFieldDefinition` on one preference column in that org's data — an org-data defect, not a skill or transport bug (`describe` and `SELECT Id, DurableId` still return 200; only value reads fail). If this GET 500s on 3 consecutive attempts, stop retrying the API path and ask the admin to confirm the toggle's ON state in Setup UI instead — record that the write's `success:true` was confirmed via Setup UI, not cold-verified via API, and say so explicitly in any summary.
+
+#### Step 1 — Create Support Process
+
+**What it does**: Creates a Support Process named "Student Advising" to organize case statuses. Used as the `businessProcess` on the case record types in Step 2.
+
+**API approach** (works — try first):
+```bash
+POST /services/data/v68.0/sobjects/BusinessProcess
+{"Name":"Student Advising","TableEnumOrId":"Case","Description":"Advising case support process"}
+```
+Do **NOT** send `IsActive` on insert — it is `INVALID_FIELD_FOR_INSERT_UPDATE`. The BusinessProcess is active by default. Capture the returned `Id` and the `Name` ("Student Advising") — Step 2 references the process by **Name**, not Id.
+
+**Setup path** (UI fallback):
+1. Navigate to Setup → Quick Find → "Support Processes" → Click New
+2. For "Existing Support Process", select Master
+3. Enter support process name: "Student Advising"
+4. Click Save; leave Case Status as default, click Save again
+
+**Verification** (read back by the Id captured at creation — a SOQL `SELECT Id FROM <Object> WHERE ...` via `queryParams` also works if you need to re-find the record later):
+```http
+GET /services/data/v68.0/sobjects/BusinessProcess/<id-captured-from-create-response>
+```
+
+---
+
+#### Step 2 — Create Advising Case Record Types
+
+**What it does**: Creates specialized case record types for different advising scenarios.
+
+**API approach** (works — try first). Use the Tooling `RecordType` with the `FullName` + `Metadata` shape (NOT flat columns). `businessProcess` = the BusinessProcess **Name** from Step 1, not its Id:
+```http
+POST /services/data/v68.0/tooling/sobjects/RecordType
+{"FullName":"Case.Academic","Metadata":{"label":"Academic","active":true,"businessProcess":"Student Advising","description":"Academic advising cases"}}
+```
+Repeat with `FullName` `Case.Health`, `Case.Wellbeing` (and `Case.FinancialAid` if used), changing `label`.
+
+**Profile permissions (record type visibility) are NOT applied via this API** — the record type is created but not assigned to any profile. Assigning it to profiles is a separate step (Setup → Profiles → Record Type Settings, or a `Profile` metadata deploy).
+
+**Setup path** (UI fallback):
+1. Setup → Quick Find → "Set Up Education Cloud" → Set Up Education Cloud → under "Create Advising Case Record Types" click "Create Case Record Types"
+2. On Case Record Types → New; for "Existing Record Type" select Master
+3. Enter label (e.g., "Academic"), Tab to auto-populate name
+4. For "Support Process" select "Student Advising"; select Active
+5. Select profile permissions → Next → Save
+6. Repeat for Health, Wellbeing (and optional Financial Aid)
+
+**Verification** (RecordType is a tooling object — use `/tooling/sobjects` for GET-by-Id, or `/tooling/query` via `queryParams` for a SOQL lookup):
+```http
+GET /services/data/v68.0/tooling/sobjects/RecordType/<id-captured-from-create-response>
+```
+Repeat per record type created (Academic, Health, Wellbeing, and FinancialAid if used), using each one's Id from its own create response.
+
+---
+
+#### Step 3 — Set Up Success Teams
+
+**What it does**: Creates success teams for collaborative case management, keyed to a case record type.
+
+**PREREQUISITE** — a `CaseTeamTemplate` must exist first; `SuccessTeam` references it by **Name** via `DefaultUnassignedCaseTeam`. Check existence first with `GET /services/data/v68.0/query` and `queryParams: {"q": "SELECT Id FROM CaseTeamTemplate WHERE Name='<name>'"}`; if none found, create directly and read back by the Id captured at creation:
+```http
+POST /services/data/v68.0/sobjects/CaseTeamTemplate
+{"Name":"Advising Team","Description":"Default advising success team"}
+```
+```http
+GET /services/data/v68.0/sobjects/CaseTeamTemplate/<id-captured-from-create-response>
+```
+
+**Create the Success Team** (`IsActive` IS writable here, unlike BusinessProcess). `CaseRecordTypeId` = the RecordType Id from Step 2; `DefaultUnassignedCaseTeam` = the CaseTeamTemplate **Name**:
+```http
+POST /services/data/v68.0/sobjects/SuccessTeam
+{"Name":"Academic Success Team","CaseRecordTypeId":"<Academic RecordType Id>","DefaultUnassignedCaseTeam":"Advising Team","IsActive":true}
+```
+Repeat per case record type (Wellbeing, Health).
+
+**Setup path** (UI fallback): Student Success app → Success Teams tab → New → name, select case record type, select/create case team → Save.
+
+**Verification** (read back each by the Id captured at creation — a SOQL `SELECT Id FROM <Object> WHERE ...` via `queryParams` also works if you need to re-find records later):
+```http
+GET /services/data/v68.0/sobjects/SuccessTeam/<id-captured-from-create-response>
+```
+Repeat per case record type's Success Team created above.
+
+---
+
+#### Step 4 — Enable Care Plans (after Success Teams)
+
+**What it does**: Enables care plans to track intervention plans, goals, and progress for at-risk students.
+
+**Write approach** (works — `IndustriesSettings` toggle). **IRREVERSIBLE.** Element is **`enableCarePlansPreference`** — do NOT use `enableCarePlans` (→ `FIELD_INTEGRITY_EXCEPTION`). Use the SKILL.md **Domain & Feature Toggle Write Path**:
+```json
+{
+  "type": "IndustriesSettings",
+  "fullName": "Industries",
+  "xmlRep": "<?xml version=\"1.0\" encoding=\"UTF-8\"?><IndustriesSettings xmlns=\"http://soap.sforce.com/2006/04/metadata\"><enableCarePlansPreference>true</enableCarePlansPreference></IndustriesSettings>"
+}
+```
+Do NOT use `setup/org/preferences/{name}` (404).
+
+**Verification** (cold read — `success:true` alone unreliable): tooling GET `IndustriesSettings` by DurableId `bWRjLzBIRS9JbmR1c3RyaWVzU2V0dGluZ3M=` and confirm `.Metadata.enableCarePlansPreference` / flat `IsCarePlansPreferenceEnabled` is `true`. If the GET 500s, fall back to a Setup UI confirmation (see license-gating/cold-verify note above) rather than reporting unverified.
+
+If the write itself 400s `INSUFFICIENT_ACCESS_OR_READONLY`, this is likely license-gated on this org — see note above.
+
+---
+
+#### Step 5 — Enable Support Programs (before Scheduler)
+
+**What it does**: Enables benefit/program management used by Student Success programs. Four toggles flip in a **single** metadata PUT.
+
+**Write approach** (works — `IndustriesSettings` toggles). **IRREVERSIBLE.** One PUT with all four elements:
+```json
+{
+  "type": "IndustriesSettings",
+  "fullName": "Industries",
+  "xmlRep": "<?xml version=\"1.0\" encoding=\"UTF-8\"?><IndustriesSettings xmlns=\"http://soap.sforce.com/2006/04/metadata\"><enableBenefitManagementPreference>true</enableBenefitManagementPreference><enableBenefitAndGoalSharingPref>true</enableBenefitAndGoalSharingPref><allowBenefitAssignmentWithInactiveProgramEnrollment>true</allowBenefitAssignmentWithInactiveProgramEnrollment><enableProgramCohorts>true</enableProgramCohorts></IndustriesSettings>"
+}
+```
+
+**Verification** (cold read): tooling GET by DurableId; confirm `.Metadata.enableBenefitManagementPreference`, `enableBenefitAndGoalSharingPref`, `allowBenefitAssignmentWithInactiveProgramEnrollment`, and `enableProgramCohorts` are all `true`. If the GET 500s, fall back to Setup UI confirmation (see license-gating/cold-verify note above).
+
+If the write itself 400s `INSUFFICIENT_ACCESS_OR_READONLY`, this is likely license-gated on this org — see note above.
+
+---
+
+#### Step 6 — Enable Salesforce Scheduler (partial — for advising appointments)
+
+**What it does**: Enables Salesforce Scheduler for students to book advising appointments. **Partially API-writable** — two org prefs flip via metadata PUT; the master enable + a couple settings are manual/UI only.
+
+**API-writable** (`IndustriesSettings` toggles — one PUT):
+```json
+{
+  "type": "IndustriesSettings",
+  "fullName": "Industries",
+  "xmlRep": "<?xml version=\"1.0\" encoding=\"UTF-8\"?><IndustriesSettings xmlns=\"http://soap.sforce.com/2006/04/metadata\"><enableEventManagementOrgPref>true</enableEventManagementOrgPref><enableShareSaWithArOrgPref>true</enableShareSaWithArOrgPref></IndustriesSettings>"
+}
+```
+Cold-verify `enableEventManagementOrgPref` and `enableShareSaWithArOrgPref` are `true`. If the cold-verify GET 500s, fall back to Setup UI confirmation (see license-gating/cold-verify note above); if the write 400s `INSUFFICIENT_ACCESS_OR_READONLY`, check licensing on this org before concluding the toggle is unreachable via API.
+
+**Manual / UI only** (NOT API-writable):
+- **Scheduler master enable** — license-gated (Field Service). Setup → Quick Find → "Salesforce Scheduler Settings" → turn on Salesforce Scheduler. If no license, enablement fails.
+- **Multiple Topics for Shifts** — skip (has its own prerequisites; not needed for advising).
+- **Schedule Appointments Using Engagement Channels** — enable manually in Salesforce Scheduler Settings.
+
+---
+
+#### Step 7 — Set Up the Advisor Console
+
+**What it does**: Configures the Advisor Console app with care plans, alerts, success teams, and appointment scheduler components.
+
+**Setup path**:
+1. Navigate to Setup → App Manager → Find "Advisor Console"
+2. Click Edit
+3. Assign page layouts and record types to advisor profiles
+4. Add relevant components to app:
+   - Care Plans
+   - Alerts
+   - Success Teams
+   - Appointment Scheduler
+   - Student 360 view
+5. Save and assign to advisor user profiles
+
+**Verification**: Check App Launcher shows Advisor Console for advisor users.
+
+---
+
+#### Step 8 — Set Up the Director Console (Student Success)
+
+**What it does**: Configures the Director Console with KPI components for directors.
+
+**Setup path**:
+1. Navigate to Setup → App Manager → Find "Director Console"
+2. Click Edit
+3. Configure visibility and KPI components for directors:
+   - Student Success KPIs
+   - Advisor performance metrics
+   - Care plan pipeline
+4. Save and assign to director user profiles
+
+**Verification**: Check App Launcher shows Director Console for director users.
+
+---
+
+#### Step 9 — Configure Performance Alerts
+
+**What it does**: Configures alert types (attendance, grades, concerns) and maps them to Success Teams.
+
+**Setup path**:
+1. Navigate to Student Success app → Alert Settings tab
+2. Configure alert types:
+   - Attendance alerts (threshold: < 80%)
+   - Grade alerts (threshold: < C average)
+   - Concern alerts (flagged by faculty)
+3. Map alerts to Success Teams and case record types
+4. Optionally connect to Care Plans via "Apply Care Plans to Alerts" feature
+5. Save
+
+**Verification**: Check Alert Settings show configured alert types.
+
+---
+
+#### Step 10 — Set Up the Learner Portal (Experience Cloud)
+
+**What it does**: Deploys student-facing portal with Action Center, Pulse Checks, Career Planning, Degree Planning.
+
+**Prerequisites**: Experience Cloud license required.
+
+**Setup path**:
+1. Navigate to Setup → Digital Experiences → All Sites
+2. Create new Experience Cloud site or configure existing site
+3. Add Student Success components:
+   - Action Center (tasks, alerts)
+   - Pulse Checks (wellness check-ins)
+   - Career Planning
+   - Degree Planning
+   - Appointment booking
+4. Configure access for authenticated students
+5. Publish and activate the portal
+
+**Verification**: Navigate to portal URL and verify components load for student users.
+
+---
+

package/skills/education-cloud-domain-configure/references/domain-features.md

@@ -0,0 +1,27 @@
+# Education Cloud Domain Features — Complete Setup Guide
+
+Configuration guide for each Education Cloud domain and its sub-features. Based on Salesforce Help Articles. Each domain's full setup steps live in its own reference file under `domain-features/` — open the one matching the domain being configured.
+
+## Domain Reference Files
+
+| Domain | File |
+|--------|------|
+| 1. Student Success | [domain-features/student-success.md](domain-features/student-success.md) |
+| 2. Recruitment & Admissions | [domain-features/recruitment-admissions.md](domain-features/recruitment-admissions.md) |
+| 3. Academic Operations | [domain-features/academic-operations.md](domain-features/academic-operations.md) |
+| 4. Alumni Relations | [domain-features/alumni-relations.md](domain-features/alumni-relations.md) |
+| 5. Student Management | [domain-features/student-management.md](domain-features/student-management.md) |
+| 6. Mentoring | [domain-features/mentoring.md](domain-features/mentoring.md) |
+| Cross-Domain Dependencies | [domain-features/cross-domain-dependencies.md](domain-features/cross-domain-dependencies.md) |
+| IndustriesSettings Toggle Fields — Quick Reference | [domain-features/industriessettings-toggle-reference.md](domain-features/industriessettings-toggle-reference.md) |
+
+## General Notes
+
+- All domains require Education Cloud Foundation and Person Accounts enabled first
+- Some sub-features require additional licenses (Field Service for Scheduler, Fundraising for gift management, Experience Cloud for portals)
+- Object names may vary by Education Cloud version — check API version compatibility
+- Verification queries may fail if objects are not yet provisioned (async provisioning) — wait 2-3 minutes and retry
+- Setup menu paths may change with Salesforce UI updates — if path not found, search Setup for the feature name
+- Write domain/feature toggles via the headless metadata PUT path (IndustriesSettings `xmlRep`, write `dispatch` tool); never `setup/org/preferences/{name}` (404). Fall back to UI instructions only on error
+- EDU toggles are IRREVERSIBLE (`false → true` only) — warn the user, never promise a revert
+- Student Management has no separate domain toggle — it is enabled when Academic Operations is configured with student enrollment records

package/skills/education-cloud-domain-configure/references/gotchas-extended.md

@@ -0,0 +1,23 @@
+# Additional Gotchas
+
+Lower-frequency gotchas and toggle-write failure classes, split out of `SKILL.md`'s Gotchas table (kept to the 10 highest-impact entries). Read this when the top-10 table doesn't cover the error you're seeing.
+
+| Issue | Resolution |
+|-------|------------|
+| Org edition not Enterprise+ | Education Cloud requires Enterprise, Performance, Unlimited, or Developer Edition — cannot install on lower editions |
+| Some sub-features require additional licenses | If enablement fails with license error, inform user of required license (e.g., Salesforce Scheduler requires Field Service, Fundraising requires Advancement license, Experience Cloud license for portals) |
+| Student Management has no separate domain toggle | Student Management is enabled when Academic Operations is configured with student enrollment records |
+| Record creation (Business Process, Learning Programs) must be done manually or via API | Education Cloud does not auto-create these records — user must create via Setup, Data API, or Tooling API after domain is enabled |
+| OmniStudio components must be activated separately | After OmniStudio is enabled, individual OmniScripts and FlexCards (Application Stages, Course Search, Matching Assessments) must be activated in Setup → OmniStudio |
+| Experience Cloud portals require separate configuration | After domain is enabled, portals (Learner Portal, Applicant Portal, Alumni Portal, Mentoring Portal) must be created/configured in Experience Builder with domain-specific components |
+| Sub-feature configuration steps vary significantly by domain | Always read the domain's file under `references/domain-features/` for domain-specific setup paths — Student Success, Recruitment & Admissions, and Academic Operations have 10+ sub-feature steps each |
+| Verification queries may fail if objects not yet provisioned | Some domains provision objects asynchronously — retry after 2-3 minutes if query fails with "invalid object" error |
+| `SELECT IsPersonAccountEnabled FROM Organization` returns `INVALID_FIELD` | No such column on `Organization` — verify Person Accounts via `Account/describe` (API, headless first) and check for `IsPersonAccount`/`Person*` fields, or `sf sobject describe -s Account` as fallback |
+| Profile permissions on newly created RecordTypes (including LearningAchievement types) are NOT settable via API | Record type creates successfully but has no profile visibility — flag as a manual follow-up step (Setup → Profiles → Record Type Settings, or a `Profile` metadata deploy) |
+| SOAP `updateMetadata` / `metadata/deployRequest` return `ROUTE_NOT_FOUND` | Blocked through the gateway — do NOT use; the headless metadata PUT is the supported write path (see "Endpoints that DO NOT work" in `SKILL.md`) |
+| **Failure class — Aura-only, no MDAPI/Tooling/REST route at all** (e.g. Industries Cloud Common Decision Tables Access, `BREDecisionTableAccess`) | Backing call is an internal Aura action with no external route — manual UI only, do not keep probing endpoints |
+| **Failure class — API write blocked at field level** (e.g. Intelligent Question Generation, `enableSmartAsmtQstnGeneration`) | Field exists and name is correct, but write returns `INSUFFICIENT_ACCESS_OR_READONLY: "cannot be accessed using the API"` — manual UI only |
+| **Failure class — hard reject on disable-only** (e.g. Discovery Framework, `enableIndustriesAssessment`) | `true→false` returns HTTP 500 `UNKNOWN_EXCEPTION`; this is separate from the general one-way irreversibility — the enable (`false→true`) direction is untested where the field was already `true` |
+| **Failure class — settings type invisible to Tooling/EntityDefinition but still MDAPI-writable** (e.g. Omnistudio Metadata, `OmniStudioSettings`, `fullName: OmniStudio`) | Metadata PUT write succeeds, but no GET/verify path exists via Tooling API — UI-confirmed only; if you encounter one of these, note it as write-succeeds-zero-verify-path rather than assuming failure |
+| **Failure class — type-level UPDATE block** (e.g. Timeline `TimelineSettings`, Video Calls `VideoCallsSettings`) | PUT returns HTTP 400 `UNSUPPORTED_OPERATION: "MetadataCrud does not support UPDATE on type: X"` — block is on the whole type, no `fullName` variant fixes it; manual UI only |
+| **Pattern — org preference API, not `IndustriesSettings`** (confirmed on Einstein Generative AI, `EinsteinGPTCopilotEnabled`) | Some toggles are Setup-Connect org preferences, not `IndustriesSettings` metadata fields — no `type`/`fullName`/`xmlRep`. Shape: `GET /services/data/v68.0/setup/org/preferences/<PrefName>` → `{"isPreferenceEnabled": bool}`; `PATCH` same path with `{"desiredState": true}` → response echoes post-write state. If a metadata PUT returns `FIELD_INTEGRITY_EXCEPTION: invalid at this location` for a plausible-looking element name, the field may not be on `IndustriesSettings` at all — try this org-preference path next before assuming manual-UI-only |

package/skills/education-cloud-domain-configure/references/toggle-write-path.md

@@ -0,0 +1,67 @@
+# Domain & Feature Toggle Write Path (authoritative)
+
+Education Cloud domain toggles — `enableEducationCloud`, `enableStudentSuccess`, `enableAcademicOperations`, `enableMentoring`, `enableCorporateRelations`, `enableStudentManagement`, `enableFinancialAid`, `enableFundraising`, `enableOutcomes`, `enableProgramCohorts`, `enableStudentGoals`, `enableAlumniRelations`, `enableRNADynamicApplications`, and ~28 similar — are **fields inside the `IndustriesSettings` settings file**. They are NOT in Core's `ORG_PREFERENCES` allowlist.
+
+> **IRREVERSIBLE — one-way by design.** These toggles are `false → true` only. `true → false` is rejected/unsupported. **WARN the user before flipping any toggle. Do NOT promise a revert or rollback.**
+
+## Endpoints that DO NOT work — never use these
+
+| Attempt | Result |
+|---------|--------|
+| `PATCH setup/org/preferences/{name}` | 404 — name not in ORG_PREFERENCES allowlist |
+| Tooling sObject `PATCH` on `IndustriesSettings` | 400 `JSON_PARSER_ERROR` (complexvalue fields) |
+| SOAP `/services/Soap/m/XX.0` `updateMetadata` | `ROUTE_NOT_FOUND` through the gateway |
+| `POST /services/data/vXX/metadata/deployRequest` (multipart zip) | `ROUTE_NOT_FOUND` through the gateway |
+
+## What writes via this path, what does not
+
+| Category | API-writable via metadata PUT? |
+|----------|-------------------------------|
+| Domain toggles (`enableStudentSuccess`, …) — **once foundation is ON** | Yes |
+| Sub-feature toggles (`enableCarePlansPreference`, Support Programs, Scheduler org prefs) — **once foundation is ON** | Yes |
+| **Education Cloud foundation** (`enableEducationCloud`) | No — via metadata PUT. **Confirmed silent no-op** for this specific field (`success:true`, stays `false`); the metadata PUT path itself is proven to route AND flip real sub-feature toggles (verified: `enableStudentGoals` `false→true`), so this is feature-specific, not a transport failure. Yes — via the dedicated invoke endpoint instead (see "Enabling the foundation" below). |
+
+## Enabling the foundation (`enableEducationCloud`) — dedicated invoke endpoint
+
+Root cause of the silent no-op: this toggle is AURA-IS-CANONICAL — the real enable action runs extra `ReleasableAction` provisioning wiring beyond a raw field flip, and only the dedicated controller endpoint below runs it. Do not attempt the metadata PUT for foundation.
+
+Same `dispatch`/`dispatch_readonly` tools and headless-360 transport as the metadata path, different URL:
+- READ: `GET /headless/invoke/platform/education-cloud-settings` (`dispatch_readonly` is fine) — inspect `educationCloudEnabled`.
+- WRITE: `PATCH /headless/invoke/platform/education-cloud-settings/enable-education-cloud` (empty body, via the write-enabled `dispatch` tool).
+- cold-VERIFY: repeat the GET above — confirm `educationCloudEnabled: true` on a fresh read. Also cold-check the `IndustriesSettings` tooling GET (`.Metadata.enableEducationCloud` / `IsEducationCloudEnabled`) as a secondary check — the invoke GET is authoritative if they disagree.
+- If the invoke endpoint errors or cold-verify still shows `false`: fall back to manual UI — Setup → Quick Find → "Set Up Education Cloud" → Toggle "Enable Education Cloud" → Save. Warn this cannot be disabled after enabling. Wait for user confirmation, then cold-verify again.
+| Person Accounts | No — manual UI only |
+| License-gated features (Salesforce Scheduler master enable, Field Service) | No — manual UI only |
+
+## The correct sequence: READ → WRITE → VERIFY (cold-verify is mandatory)
+
+**Constants:** API version `v68.0` · `IndustriesSettings` `DurableId` = `bWRjLzBIRS9JbmR1c3RyaWVzU2V0dGluZ3M=` (raw `=`, NOT url-encoded `%3D`).
+
+**1. READ (pre-read current state)** — `dispatch_readonly` GET is fine here:
+```http
+GET /services/data/v68.0/tooling/sobjects/IndustriesSettings/bWRjLzBIRS9JbmR1c3RyaWVzU2V0dGluZ3M=
+```
+Inspect `.Metadata.enable*` (and the flat `Is<X>Enabled` fields) for current state.
+
+> `SELECT ... FROM IndustriesSettings` returns **only `Id` and `DurableId` — NO `Metadata`.** You MUST GET the record by `DurableId` to read toggle state. Do NOT use the placeholder Id `000000000000000AAA`.
+
+**2. WRITE (flip the toggle)** — use the **write-enabled `dispatch` tool** (NOT `dispatch_readonly` — read-only *fakes* write success, returning `success:true` without writing). Synchronous, no polling:
+```http
+PUT /services/data/v68.0/headless/metadata
+```
+Structured JSON body — `type` is literally `IndustriesSettings`, `fullName` is `Industries`, `xmlRep` includes the XML declaration. One PUT can flip **multiple** elements at once:
+```json
+{
+  "type": "IndustriesSettings",
+  "fullName": "Industries",
+  "xmlRep": "<?xml version=\"1.0\" encoding=\"UTF-8\"?><IndustriesSettings xmlns=\"http://soap.sforce.com/2006/04/metadata\"><enableStudentSuccess>true</enableStudentSuccess></IndustriesSettings>"
+}
+```
+
+**3. VERIFY (cold read — REQUIRED)** — repeat step 1 and confirm `.Metadata.<element>` and/or the flat `Is<X>Enabled` field is now `true`.
+
+> **`success:true` alone is unreliable — always cold-verify.** The foundation write returned `success:true` yet no-op'd. Only a fresh GET of the record confirms the toggle actually flipped.
+
+> **Cold-verify fallback — the tooling GET can 500 org-wide.** Confirmed on a test org: `GET .../tooling/sobjects/IndustriesSettings/<DurableId>` returned HTTP 500 `UNKNOWN_EXCEPTION` on every value read (any field, any API version), root-caused to a null UDD `LogicalFieldDefinition` on one preference column in that org's data — an org-data defect, not a skill or transport bug (`describe` and `SELECT Id, DurableId` still returned 200). If this GET 500s on 3 consecutive attempts, stop retrying and ask the admin to confirm the toggle's state in Setup UI instead. Report it explicitly as "confirmed via Setup UI, not cold-verified via API" — never claim API cold-verify succeeded when it didn't.
+
+> **License-gating on the write itself.** A toggle write can return `400 INSUFFICIENT_ACCESS_OR_READONLY` (nothing written) purely because the org lacks a license, not because the feature is unreachable via API — confirmed on a test org where the identical write failed, then succeeded after the admin added licenses with no other change. On this error, ask whether the org is fully licensed for the feature before concluding the API path doesn't work.

package/skills/education-cloud-domain-configure/scripts/check_license_provisioned.py

@@ -0,0 +1,62 @@
+#!/usr/bin/env python3
+"""Decide whether Education Cloud is licensed/provisioned on the org.
+
+Permission set names for Education Cloud vary by org/release, so a single
+exact-name match is unreliable. Reads a JSON object from stdin:
+
+{
+  "permissionSets": [ { "Id": "...", "Name": "..." }, ... ],
+  "businessProfileDescribe": { "createable": true, ... } | null
+}
+
+`permissionSets` is the `records` array from
+`SELECT Id, Name FROM PermissionSet WHERE Name LIKE '%EducationCloud%'`.
+`businessProfileDescribe` is the describe result for the `BusinessProfile`
+sobject, or null/omitted if that describe call 404'd.
+
+Rows found in `permissionSets` -> provisioned. Zero rows -> cross-check
+`businessProfileDescribe.createable` before concluding not-provisioned.
+
+Usage:
+    python3 scripts/check_license_provisioned.py <<'JSON'
+    {"permissionSets": [], "businessProfileDescribe": {"createable": true}}
+    JSON
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+
+
+def main() -> int:
+    payload = json.load(sys.stdin)
+    permission_sets = payload.get("permissionSets") or []
+    describe = payload.get("businessProfileDescribe")
+
+    if permission_sets:
+        result = {
+            "provisioned": True,
+            "reason": "matching permission set(s) found",
+            "matchingPermissionSets": [ps.get("Name") for ps in permission_sets],
+        }
+    elif isinstance(describe, dict) and describe.get("createable") is True:
+        result = {
+            "provisioned": True,
+            "reason": "zero permission-set matches, but BusinessProfile is createable — treat as provisioned, note the mismatch",
+            "matchingPermissionSets": [],
+        }
+    else:
+        result = {
+            "provisioned": False,
+            "reason": "zero permission-set matches and BusinessProfile is not createable (404 or createable:false) — license not provisioned",
+            "matchingPermissionSets": [],
+        }
+
+    json.dump(result, sys.stdout, indent=2)
+    print()
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/skills/education-cloud-domain-configure/scripts/check_org_edition.py

@@ -0,0 +1,44 @@
+#!/usr/bin/env python3
+"""Check whether an org's edition meets Education Cloud's minimum requirement.
+
+Reads a JSON object from stdin shaped like a SOQL query result for
+`SELECT OrganizationType FROM Organization` (the `records` array, or a bare
+list containing that one record). Prints a JSON verdict.
+
+Usage:
+    python3 scripts/check_org_edition.py \
+        --allowed "Enterprise Edition,Performance Edition,Unlimited Edition,Developer Edition" <<'JSON'
+    {"records": [{"OrganizationType": "Enterprise Edition"}]}
+    JSON
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--allowed", required=True, help="Comma-separated list of qualifying OrganizationType values")
+    args = parser.parse_args()
+    allowed = [a.strip() for a in args.allowed.split(",") if a.strip()]
+
+    payload = json.load(sys.stdin)
+    records = payload.get("records", payload) if isinstance(payload, dict) else payload
+
+    if not records:
+        json.dump({"eligible": False, "organizationType": None, "reason": "no Organization record returned"}, sys.stdout, indent=2)
+        print()
+        return 0
+
+    org_type = records[0].get("OrganizationType")
+    result = {"eligible": org_type in allowed, "organizationType": org_type, "allowed": allowed}
+    json.dump(result, sys.stdout, indent=2)
+    print()
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/skills/education-cloud-domain-configure/scripts/check_permission_assigned.py

@@ -0,0 +1,39 @@
+#!/usr/bin/env python3
+"""Check whether the running user has one of the org's Education Cloud permission sets assigned.
+
+Reads a JSON object from stdin shaped like a SOQL query result for
+`SELECT Id, PermissionSet.Name FROM PermissionSetAssignment WHERE
+AssigneeId='<id>' AND PermissionSet.Name LIKE '%EducationCloud%'` (the
+`records` array, or a bare list). Prints a JSON verdict.
+
+Usage:
+    python3 scripts/check_permission_assigned.py <<'JSON'
+    {"records": [{"PermissionSet": {"Name": "EducationCloudAccess"}}]}
+    JSON
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+
+
+def main() -> int:
+    payload = json.load(sys.stdin)
+    records = payload.get("records", payload) if isinstance(payload, dict) else payload
+
+    names = []
+    for rec in records or []:
+        permission_set = rec.get("PermissionSet") or {}
+        name = permission_set.get("Name")
+        if name:
+            names.append(name)
+
+    result = {"assigned": bool(names), "matchingPermissionSets": names}
+    json.dump(result, sys.stdout, indent=2)
+    print()
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/skills/education-cloud-multi-campus-configure/SKILL.md

@@ -6,6 +6,8 @@ metadata:
   minApiVersion: "65.0"
   domains:
     - "Education"
+  relatedSkills:
+    - "education-cloud-domain-configure"
   accessCheck:
     - type: "license"
       value: "Education Cloud"
@@ -22,6 +24,11 @@ allowed-tools: |
   mcp__headless-360__describe
   mcp__headless-360__dispatch
   mcp__headless-360__dispatch_readonly
+  distribution:
+    sf-skills:
+      visibility: "public"
+    headless360Mcp:
+      visibility: "public"
 ---
 
 # Education Cloud Multi-Campus Institutional Hierarchy Configuration

package/skills/education-cloud-multi-campus-configure/references/foundation_prerequisites.md

@@ -1,9 +1,10 @@
 # Step 0 — Foundation Prerequisites
 
 This skill can run standalone, without any other Education Cloud setup skill running first. Verify
-these before Step 1 — they are shared across the EDU skill family. A gap here is a missing
-prerequisite to resolve, not a dead end — self-heal what's API-writable, ask/confirm before any
-write, otherwise instruct manual Setup and wait for confirmation.
+these before Step 1 — they are shared across the EDU skill family (also required by
+`education-cloud-domain-configure`). A gap here is a missing prerequisite to resolve, not a
+dead end — self-heal what's API-writable, ask/confirm before any write, otherwise instruct manual
+Setup and wait for confirmation.
 
 ## Checks (in order — each can stop the workflow if unresolved)