[sea-snake]

Summary

The Internet Identity skill was 424 lines plus six files in references/, covering five jobs that are loaded at different times by different people. It becomes five skills, each a single SKILL.md:

Skill	What it is for
internet-identity	Sign-in, the client lifecycle, local development, and the primary origin an app's principals are permanently tied to
internet-identity-shared-sessions	One sign-in across sibling subdomains
internet-identity-attributes	A verified email or display name in the backend, Motoko and Rust
internet-identity-notifications	Web push from a canister while the app is closed
internet-identity-sso	The organization's own single sign-on, an IT admin's job

references/ is gone. Every reference file is absorbed into the body of the skill that owns it, so each skill reads end to end in one file and the Rust/Motoko asymmetry in attributes (Motoko inline, Rust one hop away) disappears.

Routing

No new frontmatter field: routing is the description plus backticked skill names in prose, which is what the repo already does. Each leaf skill opens with a one-line prerequisite pointing at internet-identity; internet-identity closes with the four follow-ups. Nothing outside the suite links to attributes, notifications or SSO, so those three cut cleanly. Origins do have inbound links, which is why they stay in core.

Content changes beyond moving text

• Mistake 9 was wrong and is replaced. It claimed that setting derivationOrigin to the gateway domain breaks authentication. It does not: validateDerivationOrigin.ts:31-37 compares the two origins in canonical form and returns valid before any fetch, so it is a no-op. The real mistake, letting the first origin with users be one you can lose, takes its place.
• Derivation origins are reframed around the canister id and moved after sign-in works rather than before it. The default, setting nothing, is already correct, so the section teaches a decision instead of a configuration.
• ii-derivation-origin is documented here for the first time. It appeared only in service-discoverability. Both directions of the relation are now described together with who reads each.
• shared-sessions.md built its client with derivationOrigin: \"https://auth.example.com\", a custom domain, which is the one thing the origins section advises against. Corrected to the canister address.
• app-metadata.md's opening was a heading and a sentence spliced together by a bad edit. Repaired.
• Notifications gains the parallel sign-in and consent pattern, a notifications toggle, the composed notification title (II shows the app's name then the title the canister sent, falling back to the origin's hostname), and the per-browser fan-out, informed by docs(authentication): notifying a user through Internet Identity developer-docs#438.
• Implementation details of our own libraries are out. A skill documents the public API, the documented errors and observable behaviour; where an internal fact has a consequence, the consequence is written instead of the mechanism.

Verified

• node scripts/check-project.js passes for 39 skills. The two warnings are pre-existing (autosync-ic-skills, sns-launch have no eval files); all five skills here do.
• Every code fence carries the language the original source used, checked block by block against the files being replaced.
• No em dashes and no banned vocabulary in any of the five.
• The two claims in the rewrite come from reading dfinity/internet-identity at origin/main, not from the existing docs: the derivation-origin no-op from validateDerivationOrigin.ts, and what the sign-in header shows from AuthorizeHeader.svelte. The notification title composition and the per-browser queue come from the service worker's wake-up path and the canister's notifications module.

Evaluations

Existing cases follow the skill that now owns them: 6 attribute cases, 4 shared-session cases and 3 notification cases move out of evaluations/internet-identity.json, which keeps 22. internet-identity-sso had no cases, since the three SSO cases in the old suite all test the app-side ssoDomain check that stays in core, so it gets three new adversarial ones for the discovery file: whole-file rejection on one bad value, exact-origin app_clients keys, and stable_identifier_claim on Entra ID. Trigger evals are rewritten per skill, with each sibling's queries as negatives.

Eval runs are in progress and will be posted as a comment on this PR.

🤖 Generated with Claude Code

[github-actions]

Skill Validation Report

Project Checks

✓ Project checks passed for 5 skills (0 warnings)

[Copilot]

🟡 Changes recommended

The SSO example now references undeclared client and timer identifiers, causing a runtime failure before the SSO check can be scheduled.

2 open issues

• Restore page-scoped client and timer declarations · New
• Distinguish reinstalling a canister from replacing its ID · New

What changed in this PR

Splits the Internet Identity documentation into five task-focused, single-file skills so agents can load the guidance relevant to each integration step.

Changes:

• Keeps sign-in, origin selection, app metadata, and API migration guidance in the core skill.
• Separates shared sessions, identity attributes, notifications, and organization SSO into dedicated skills.
• Redistributes evaluation cases and adds SSO configuration checks and skill-specific trigger examples.

File	Description
skills/​internet-identity/​SKILL.md	Refocuses core guidance and links to specialized skills.
skills/​internet-identity/​references/​rust-identity-attributes.md	Removes reference absorbed into the attributes skill.
skills/​internet-identity/​references/​older-api.md	Moves older API guidance into core.
skills/​internet-identity/​references/​app-metadata.md	Moves metadata guidance into core.
skills/​internet-identity-sso/​SKILL.md	Provides standalone organization SSO setup guidance.
skills/​internet-identity-shared-sessions/​SKILL.md	Covers cross-subdomain sessions and state updates.
skills/​internet-identity-notifications/​SKILL.md	Adds dedicated consent, sending, and delivery guidance.
skills/​internet-identity-attributes/​SKILL.md	Combines frontend requests and both backend implementations.
evaluations/​internet-identity.json	Narrows evaluations to core responsibilities.
evaluations/​internet-identity-sso.json	Adds discovery-file and provider configuration cases.
evaluations/​internet-identity-shared-sessions.json	Moves shared-session cases and adds focused triggers.
evaluations/​internet-identity-notifications.json	Moves notification cases and adds focused triggers.
evaluations/​internet-identity-attributes.json	Moves attribute verification cases and adds focused triggers.

_{Review effort: Balanced}

[sea-snake]

Eval results

Run with node scripts/evaluate-skills.js <skill>, full suite per new skill, with baseline.

Skill	Output evals (WITH / WITHOUT)	Triggers
internet-identity-notifications	12/14 / 3/14	5/5 should, 4/4 should-not
internet-identity-shared-sessions	19/20 / 14/20	4/4 should, 4/4 should-not
internet-identity-attributes	20/26 / 15/26	5/5 should, 4/4 should-not
internet-identity-sso	14/14 / 9/14	5/5 should, 4/4 should-not

Two cases scored below baseline, and neither is a content gap:

• Shared sign-in across sibling subdomains (8/9 vs 9/9). The one miss is the judge not accepting showResumeDialog(...) from the skill's own example as "a button". The baseline happened to write a literal <button>.
• Adversarial: using email instead of verified_email for access gating (3/5 vs 4/5). One of its expected behaviors asked the backend to look up the verified_email key directly. The skill teaches the library, which resolves verified_email into the email field of the struct handed to onVerified, so an answer that follows the skill reads attrs.email and was marked down for being right. Corrected in 1577b27 and re-run.

Adversarial: reading attribute data without verifying signer passes 2/5 with the skill against 1/5 without. Its expected behaviors want hand-written Rust showing the signer check, the trap on mismatch and the ICRC-3 decode, while the skill directs agents to the library and covers the hand-written path in a single sentence of its mistakes list. That gap predates this PR; worth either writing that path out or rescoping the case, in a change of its own.

Per-case results

===== internet-identity-notifications =====
  Notification consent returns a record, not a boolean:        WITH 5/5 | WITHOUT 1/5
  The sender list is required before any send works:           WITH 4/5 | WITHOUT 0/5
  Delivery is not the app's to control:                        WITH 3/4 | WITHOUT 2/4
  Trigger evals: should-trigger 5/5 | should-not-trigger 4/4

===== internet-identity-shared-sessions =====
  Shared sign-in across sibling subdomains:                    WITH 8/9 | WITHOUT 9/9
  Adversarial: shared cookie but different principals:         WITH 4/4 | WITHOUT 3/4
  Adversarial: silent re-issue without hint:                   WITH 4/4 | WITHOUT 1/4
  Adversarial: redirecting an already-open page to /reauth:    WITH 3/3 | WITHOUT 1/3
  Trigger evals: should-trigger 4/4 | should-not-trigger 4/4

===== internet-identity-attributes =====
  Adversarial: frontend-generated attribute nonce:             WITH 3/4 | WITHOUT 4/4
  Adversarial: reading attribute data without verifying signer:WITH 2/5 | WITHOUT 1/5
  Adversarial: substituting tid in the Microsoft scoped-key:   WITH 3/3 | WITHOUT 0/3
  Adversarial: using email instead of verified_email:          WITH 3/5 | WITHOUT 4/5
  Motoko backend uses the identity-attributes library:         WITH 5/5 | WITHOUT 5/5
  Adversarial: verified_email under an SSO scope:              WITH 4/4 | WITHOUT 1/4
  Trigger evals: should-trigger 5/5 | should-not-trigger 4/4

===== internet-identity-sso =====
  Adversarial: one bad value rejects the whole discovery file: WITH 5/5 | WITHOUT 1/5
  Adversarial: app_clients key must be the exact origin:       WITH 5/5 | WITHOUT 5/5
  Adversarial: stable identifier claim on Entra ID:            WITH 4/4 | WITHOUT 3/4
  Trigger evals: should-trigger 5/5 | should-not-trigger 4/4

Trigger evals are the part that matters most for a split: every skill fires on its own queries and on none of its siblings', including the three pairs most likely to collide (Let my app send users to their company's SSO goes to internet-identity, not internet-identity-sso; Add Internet Identity login to my frontend triggers none of the four leaves).

internet-identity keeps 22 cases and was not re-run in full: its content moved rather than changed, apart from Mistake 9 and the origins section. Say the word if you want that suite run too.

[sea-snake]

Follow-up on the two below-baseline cases from the results above.

Adversarial: using email instead of verified_email for access gating, after correcting the stale expectation in 1577b27: WITH 4/5 | WITHOUT 4/5. No longer below baseline, and no delta either.

Its one remaining miss is identical on both sides: neither answer says how Internet Identity establishes a verified email. The Keys table named the two routes and the mistakes list did not, so e851345 added them there too. Re-running after that change left the score at 4/5: the fact is now stated in two places and the answer still does not repeat it on a prompt about access gating. I have stopped there rather than keep editing the skill against the judge. The content is present; this is the case asking an answer to recite a mechanism the prompt does not ask about.

Shared sign-in across sibling subdomains (8/9 vs 9/9) stands as reported: the miss is showResumeDialog(...) from the skill's own example not reading as "a button" to the judge.