Portal to Production API

/loop 30m Start the "Portal to Production API" loop.

Inspired by Zatanna (https://www.zatanna.ai).

Goal: blocked portal workflow is exposed as one stable production API with reliable auth, retries, and change monitoring
Max iterations: 15
Between iterations run: Run endpoint smoke tests: report success rate, p95 latency, session refresh, and structured response validity
Exit when: 10 consecutive successful calls with session refresh working and no unresolved portal drift alerts

## Before you start
- Connect GitHub (required) — Store recorded flows and endpoint code as PRs
- Attach Loop runner (required) — Self-pace iterations and run checks between passes.
- Attach Code change + verification (required) — Edit code or configs and verify locally.
- Attach Test repair (required) — Run tests and fix failures without weakening coverage.
- Target portal (read via browser) — Login-gated workflow to record
- Production API endpoint (write via api) — Stable agent-callable surface
- MCP clients (read via mcp) — Cursor / Claude Code callers

## Steps
1. Record workflow: Walk through the portal task once while capturing underlying network requests — login, sessions, API calls, and sequencing. [tools: Browser, Target portal]
2. Reconstruct flow: Model the real call graph: auth behavior, headers, retries, and edge cases. No UI selectors in the production path. [tools: GitHub]
3. Ship stable endpoint: Publish one clean, parameterized API your agents can call. Document request schema, response shape, and error codes. [tools: Production API endpoint, MCP clients]
4. Harden reliability: Add session management, automatic re-auth, retry policy, and portal change detection. [tools: GitHub]
   Command: npm run test:portal-api-smoke
5. Monitor and repair: Run smoke tests, detect drift when portals update, repair broken steps, and verify agents get fast responses. [tools: Production API endpoint]
   Command: npm run test:portal-api-smoke

Self-pace this loop. After each iteration, run the check command, read the output, and only continue if the exit condition is not met. Stop when the exit condition passes or max iterations is reached. Give a short status update each pass.

Guardrails:
- Prefer network-layer request replay over brittle browser automation for production paths
- Never store portal credentials in chat, code, or commits — use approved secrets storage only
- Keep a human in the loop for MFA and initial login during the record phase
- Stop and escalate on CAPTCHA blocks, rate limits, or unclear portal ToS constraints
- Return structured API data — do not scrape HTML when underlying JSON endpoints exist
- Document the recorded workflow and get approval before routing production agent traffic