Closed-beta boundary
This workflow is for approved first-party and closed-beta World developer tasks. It does not open public third-party World onboarding or self-service production access.
The published preparation baseline is @bunchagames/world-provider-kit 0.1.0 with @bunchagames/cli 0.1.4. Creator lifecycle notification support is available only after the separately published 0.1.1/0.1.5 release gate; always confirm the registry version before relying on that capability.
What the external workflow can do
- Initialize and validate a secret-free WorldProviderCandidateV1.
- Inspect and package deterministic provider and browser artifacts.
- Run local or approved integration preflight. Preflight is never official Buncha Games certification.
- Build a deterministic privacy-safe handoff for the existing Buncha Games platform task.
- For an approved cloud-draft design, opt in to the candidate declaration and run the provider-owned adapter through the Kit API. The CLI validates the resulting JSON but never executes adapter code.
- For an approved creator-notification design, opt in explicitly and return only validated, content-free capability evidence. Opaque recipient references and moderation messages never enter the handoff.
- Use a developer token to read only the authorized parent World's sanitized blockers and next handoff when the status feature is enabled.
What it cannot do
- Review or approve a deployment manifest.
- Issue or sign official certification.
- Write the platform registry or apply a migration.
- Deploy, register, connect, activate, suspend, retire, publish, or roll back a World.
- Read another World's state, internal receipts, deployment credentials, private content, provider payloads, or production secrets.
Local command sequence
buncha-games worlds candidate init --world-key <issued-key> --world-slug <slug> --parent-game-id <uuid> --profile <profile> --out world-provider-candidate.json [--cloud-drafts] [--creator-lifecycle-notifications]
buncha-games worlds candidate validate --candidate world-provider-candidate.json --json
buncha-games worlds provider package --candidate world-provider-candidate.json --provider-dir <provider-artifact> --browser-dir <browser-artifact> --out-dir .buncha-world-package --update-candidate --json
buncha-games worlds provider preflight --candidate world-provider-candidate.json --environment integration [--cloud-draft-evidence world-cloud-draft-evidence.json] [--creator-notification-evidence creator-notification-evidence.json] --out world-provider-preflight.json --json
buncha-games worlds handoff build --candidate world-provider-candidate.json --package-report .buncha-world-package/package-report.json --preflight world-provider-preflight.json [--cloud-draft-evidence world-cloud-draft-evidence.json] [--creator-notification-evidence creator-notification-evidence.json] --out world-provider-handoff.zip --json
buncha-games worlds status --world-key <issued-key> --jsonOptional cloud-draft adapter boundary
The published Provider Kit exports runWorldCloudDraftProviderPreflight(). A provider-owned script calls that API with two synthetic actors, initial/changed fixtures, measured meters, and cleanup. Opaque project and revision handles remain transient and never enter evidence.
The resulting evidence is unofficial. It cannot approve cost, issue certification, deploy or migrate the provider, register a World, or enable cloud persistence.
Privacy rules
- Never include .env files, private keys, API tokens, JWTs, Share Ride secrets, account identifiers, private content, object keys, raw logs, or production credentials.
- Candidates name required secrets but never contain secret values.
- Keep provider and game implementation in the existing World repository. Return the handoff to the existing Buncha Games platform task.
Copy-paste prompt for a game developer agent
You are working in the existing game/provider repository for <WORLD NAME>.
Remain in that repository. Do not inspect or modify the Buncha Games platform
repository, deploy production resources, apply migrations, change CORS or
provider gates, activate a build, or expose the World publicly.
Use only the published @bunchagames/world-provider-kit and buncha-games worlds
CLI commands to initialize and validate WorldProviderCandidateV1, create
deterministic provider/browser packages, run local or approved integration
preflight, and build the privacy-safe handoff bundle. Preflight is not official
certification. Never include secret values, private keys, JWTs, Share Ride
capabilities, account identifiers, private content, object keys, or raw logs.
If the accepted architecture declares provider-cloud-draft-persistence, run the
provider-owned adapter from this repository through the Provider Kit API. Pass
only its validated, content-free evidence JSON to the CLI. Never ask the CLI to
load adapter code, and never include project/revision handles or draft payloads.
If the accepted architecture declares creator-lifecycle-notifications, return
only its validated, content-free evidence. Never include opaque recipient
references, account identifiers, assertions, email addresses, creator content,
or internal moderation diagnostics.
Return the complete handoff bundle path, candidate hash, artifact hashes,
preflight result, source commit, migration head, recovery/rollback references,
and any blockers to the existing Buncha Games platform task. The platform task
owns review, certification, registry, deployment, registration, activation,
suspension, rollback, and all production approvals.