Get a clickable https://localhost prototype running quickly. The user story,
data-model curiosity, and App-Brief.md can proceed in parallel after
localhost is up. Missing appHostingAcl WRITE is a parallel track, not a
gate.
The Fusion prompt already covers the folder check, apps create and auth login with CDF flags filled in, "createdVia", apps skills pull, serving
https://localhost:<port>, and this project's MCP command. Run those
commands as given; do not re-ask org, project, cluster, or base URL. If
browser login stalls, loops, or never persists a session, stop and ask the
builder. This skill picks up from there.
Do not dump an empty App-Brief template as the opening move. Do not invent mkcert / brew / choco steps. Do not paste this skill body back into chat.
If a Fusion Custom apps prompt set "createdVia" on app.json, leave that
field as-is.
1. Clickable prototype on https://localhost
Serve the scaffold and open https://localhost:<port> in the browser. Fusion
loads the app at that URL. Do not wait for a finished persona or App-Brief.
Help them over certificate warnings with:
npx @cognite/cli@latest apps setup-https
Docs: https://docs.cognite.com/cdf/flows/guides/local-https
Do not invent mkcert steps. The scaffold already uses vite-plugin-mkcert
(see setup-flows-auth).
Catalog listing in Fusion Custom apps needs deploy plus appHostingAcl WRITE.
Say that once so they do not think the catalog is broken, then keep going.
2. Connect Industrial MCP
Follow connect-atlas-mcp: run the MCP command from the Fusion prompt as written, then finish OAuth in the browser. Do not rebuild the MCP URL or pick client ids here.
Docs: https://docs.cognite.com/cdf/build/industrial_mcp
3. Check app hosting access — REST, not an MCP query tool
Industrial MCP is graph / time series / documents. It does not inspect IAM. Do not invent an MCP query tool for this check.
GET {baseUrl}/api/v1/token/inspect
Authorization: Bearer <session>
There is no project in that path. Inspect itself needs projectsAcl:LIST and
groupsAcl:LIST. If the response is 403, treat access as unknown and keep
going.
In capabilities[], find appHostingAcl (camelCase). Filter projectScope to
this project (currentProject, allProjects, or projects includes the
project name). Actions are READ | WRITE | RUN.
Can create and deploy a hosted app: WRITE and scope: { all: {} }. Per-app
appExternalIdScope WRITE only edits those apps.
If WRITE (all apps) is missing: in one sentence, tell them to contact the CDF project admin to grant it, and to take action to request access. Then keep building (localhost, story, UI) while that request/ticket matures. Do not wait. Do not dump IAM JSON, do not paste tokens, do not say Fusion will grant this.
4. Inspect this project's data models
Be curious. Prefer MCP list/query tools. Fallback:
GET {baseUrl}/api/v1/projects/{project}/models/datamodels?limit=1000&includeGlobal=true
Look for opportunities in the real data. Name which models are relevant to the intent. Do not invent spaces or views.
See dm-graph-traversal for query vs list.
5. Stand in the SME's shoes
Put yourself in the shoes of that SME. Understand the craft and the pain in their day-to-day. Help them formulate the persona, one-sentence user story, and use cases. Do not wait for the admin.
6. App-Brief.md is the record — after the conversation
Only then write App-Brief.md. It is the most important record of app intent,
user story, and use cases. Use flows-app-brief.
Infer only what the conversation and data models support. Leave unknowns
empty. Do not invent customer, owner, or repository. Do not paste a blank
YAML template.
7. Deploy, sign, submit
Follow flows-external-app-submit to deploy, sign as builder, and submit for review. If they are not a certified builder yet, tell them how to submit and keep the app iterating locally until review lands.
Localhost, skills, deploy, sign, and submit can overlap with the access request. Do not wait for access before scaffolding or serving localhost.