Address dev-experience feedback: tone, durability, AIC naming, skill purpose

.gitignore

@@ -22,3 +22,4 @@ docs/
 *.local.json
 .env.local
 .env
+.plans/

evals/prompts/ping-foundation.yaml

@@ -175,6 +175,52 @@ trigger_prompts:
     expected_tier: curated
     notes: "Bare 'AIC' → pingone-st."
 
+  # ----- Config promotion (added 2026-06-22) -----
+
+  - id: T-83
+    prompt: "How do I promote my PingOne configuration from sandbox to production — what's supported and what's not?"
+    expected_anchors:
+      - plugins/ping-identity/skills/ping-foundation/references/curated/cross-platform/config-promotion.md
+    expected_tier: curated
+    notes: "PingOne native promotion scope + constraints."
+
+  - id: T-84
+    prompt: "We use AIC with dev, staging, and prod tenants. What's the right way to promote config between them?"
+    expected_anchors:
+      - plugins/ping-identity/skills/ping-foundation/references/curated/cross-platform/config-promotion.md
+    expected_tier: curated
+    notes: "AIC self-service promotion topology → config-promotion anchor."
+
+  - id: T-85
+    prompt: "We want a Terraform-based config-as-code pipeline for promoting PingOne and PingFederate config across environments. Where do we start?"
+    expected_anchors:
+      - plugins/ping-identity/skills/ping-foundation/references/curated/cross-platform/config-promotion.md
+    expected_tier: curated
+    notes: "Terraform GitOps promotion pattern → config-promotion anchor."
+
+  # ----- Ping CLI automation (added 2026-06-22) -----
+
+  - id: T-80
+    prompt: "How do I use pingcli to export my PingOne and PingFederate configuration as Terraform HCL?"
+    expected_anchors:
+      - plugins/ping-identity/skills/ping-foundation/references/curated/cross-platform/ping-cli-basics.md
+    expected_tier: curated
+    notes: "Explicit pingcli + Terraform export → cross-platform CLI anchor."
+
+  - id: T-81
+    prompt: "Set up multiple Ping CLI configuration profiles so I can promote DaVinci changes from dev to prod in CI/CD."
+    expected_anchors:
+      - plugins/ping-identity/skills/ping-foundation/references/curated/cross-platform/ping-cli-basics.md
+    expected_tier: curated
+    notes: "Multi-env profiles + CI/CD promotion → ping-cli-basics."
+
+  - id: T-82
+    prompt: "How do I authenticate pingcli to PingFederate and run admin API calls from a script?"
+    expected_anchors:
+      - plugins/ping-identity/skills/ping-foundation/references/curated/cross-platform/ping-cli-basics.md
+    expected_tier: curated
+    notes: "pingcli PingFederate auth + raw API → ping-cli-basics."
+
 non_trigger_prompts:
   - id: N-01
     prompt: "Build a DaVinci flow for customer login with risk-based step-up MFA."
@@ -203,6 +249,16 @@ non_trigger_prompts:
     expected_skill: ping-quickstart
     notes: "Bare command with no platform named — must route to ping-quickstart for clarification first."
 
+  - id: N-07
+    prompt: "Design a DaVinci flow that does passwordless login with passkeys."
+    expected_skill: ping-orchestration
+    notes: "DaVinci flow design belongs in ping-orchestration, not ping-foundation, even though pingcli can manage DaVinci resources."
+
+  - id: N-08
+    prompt: "How do I rotate the client secret on my PingOne Worker app?"
+    expected_skill: ping-foundation
+    notes: "Secret rotation is a platform admin task → core-admin-patterns.md, not config-promotion.md."
+
 ambiguous_prompts:
   - id: A-01
     prompt: "Configure MFA."

evals/prompts/ping-orchestration.yaml

@@ -132,6 +132,29 @@ trigger_prompts:
     expected_tier: curated
     notes: "feedback: push MFA transaction approval trigger"
 
+  # ----- Config promotion (added 2026-06-22) -----
+
+  - id: T-59
+    prompt: "I built a registration journey in our AIC dev tenant — how do I promote it to staging without breaking ESVs?"
+    expected_anchors:
+      - plugins/ping-identity/skills/ping-orchestration/references/curated/cross-platform/journey-and-flow-promotion.md
+    expected_tier: curated
+    notes: "AIC journey promotion + ESV gotcha → journey-and-flow-promotion anchor."
+
+  - id: T-60
+    prompt: "What's the best way to move a DaVinci flow from one PingOne environment to another and keep connector credentials per environment?"
+    expected_anchors:
+      - plugins/ping-identity/skills/ping-orchestration/references/curated/cross-platform/journey-and-flow-promotion.md
+    expected_tier: curated
+    notes: "DaVinci flow promotion variables → journey-and-flow-promotion anchor."
+
+  - id: T-61
+    prompt: "We have scripted decision nodes referencing environment-specific endpoints. How do we promote the journey across environments?"
+    expected_anchors:
+      - plugins/ping-identity/skills/ping-orchestration/references/curated/cross-platform/journey-and-flow-promotion.md
+    expected_tier: curated
+    notes: "Scripted Decision node + ESV placeholder during AIC promotion."
+
 non_trigger_prompts:
   - id: N-01
     prompt: "How do I install PingFederate on RHEL and configure initial admin settings?"

plugins/ping-identity/skills/ping-app-integration/SKILL.md

@@ -11,6 +11,8 @@ metadata:
 
 Implementation skill for integrating Ping Identity into web, mobile, and application SDK experiences.
 
+**What this skill does for you:** Generates app-side integration code — SDK wiring, OIDC/PKCE flows, token handling — and guides you through the SDK docs and troubleshooting where code generation alone is not enough. Primarily an artifact-generating skill.
+
 ## Invocation
 
 Invoke explicitly with `/ping-app-integration` or by saying "use ping-app-integration to...".

plugins/ping-identity/skills/ping-foundation/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ping-foundation
-description: "Use when setting up, configuring, or administering any Ping Identity platform — PingOne, PingOne Advanced Identity Cloud (AIC), or Ping Advanced Identity Software (PingAM, PingFederate, PingAccess, PingDirectory, PingID). Covers tenant/environment creation, app registration (including Worker apps and service accounts for M2M API access), SSO, directories, policies, and branding. Requires a named or clearly implied platform."
+description: "Use when setting up, configuring, or administering any Ping Identity platform — PingOne, PingOne Advanced Identity Cloud (AIC), or Ping Advanced Identity Software (PingAM, PingFederate, PingAccess, PingDirectory, PingID). Covers tenant/environment creation, app registration (including Worker apps and service accounts for M2M API access), SSO, directories, policies, branding, and CLI-driven configuration automation (pingcli, Terraform/CaC export, multi-env promotion). Requires a named or clearly implied platform."
 compatibility: Designed for Ping Identity platform tasks. MCP tools for PingOne and PingOne Advanced Identity Cloud (AIC) are used when available; console instructions provided as fallback.
 metadata:
   publisher: Ping Identity
@@ -11,6 +11,8 @@ metadata:
 
 Platform setup, administration, and core configuration for all Ping Identity deployments. Covers tenant and environment setup, apps, directories, policies, branding, and on-premises software administration. MCP tools handle execution; this skill supplies architecture patterns, sequencing, configuration constraints, and guardrails.
 
+**What this skill does for you:** Generates configuration and drives setup directly through MCP tools where they exist (PingOne, AIC); where a tool does not exist, it guides you through the docs with the correct sequencing, field constraints, and guardrails. Both modes are available — it uses whichever the platform supports for the task.
+
 ## Invocation
 
 Invoke explicitly with `/ping-foundation` or by saying "use ping-foundation to...".
@@ -26,6 +28,7 @@ Trigger on ANY question about setting up, configuring, administering, or plannin
 - Configure authentication policies, sign-on policies, or branding
 - Administer PingFederate, PingAccess, PingDirectory, or PingID
 - Deploy or upgrade on-premises Ping software
+- Automate configuration with Ping CLI (`pingcli`), export Terraform/CaC packages, or manage multi-environment promotion pipelines
 - Advisory: "How should I structure my tenant?", "What client type should I use?"
 
 ## When NOT to use this skill
@@ -93,6 +96,13 @@ Trigger on ANY question about setting up, configuring, administering, or plannin
 | PingAccess web app and API protection | `references/curated/ping-software/pingaccess-basics.md` |
 | Cross-platform admin patterns (LDAP, OIDC, APIs) | `references/curated/cross-platform/core-admin-patterns.md` |
 
+## Cross-platform tooling
+
+| Task | Anchor |
+|---|---|
+| CLI-driven config, multi-env profiles, Terraform/CaC export across PingOne, DaVinci, PingFederate | `references/curated/cross-platform/ping-cli-basics.md` |
+| Promote configuration between environments (PingOne native promotion, AIC self-service promotions, Ping CLI + Terraform config-as-code) | `references/curated/cross-platform/config-promotion.md` |
+
 ## MCP execution
 
 See `references/runtime/mcp-preflight.md` for MCP config and Cursor preflight steps.