docs(deploy-to-cloud-engine): pin the II derivation origin at first deploy

[yhabib]

Motivation

The engine console now shows an app's canister address and names it as the origin an Internet Identity app should derive from (dfinity/control-panel#3394, dfinity/control-panel#3398). The console can only tell the user — the canisters are the user's to write, so the agent deploying them is the one that has to act. And it cannot be fixed later: a domain that has already collected sign-ins cannot be repointed at a derivation origin without orphaning every account made under it.

Changes

• Added a subsection to Step 2 saying to pin the derivation origin to the main canister's address on the first deploy, before the app has users.
• Pointed at the canister marked __META_MAIN_CANISTER: "true" as the one whose address to use — that is what the console derives the address from (ApplicationDetailView.svelte), and it is the same URL Step 2 already sets as __META_BASE_URL.
• Noted the Caffeine exception: Caffeine owns those apps' addresses, so the console withholds the row and the address is not the app's to derive from.
• Added Pitfall 18 and one eval case. Left the mechanics in internet-identity and linked to it.

Eval 17 — Adversarial: II app on an engine with a custom domain planned (WITH 4/4 | WITHOUT 2/4)

━━━ Adversarial: II app on an engine with a custom domain planned ━━━

  WITH skill: 4/4 passed
    ✅ Names the MAIN canister (marked __META_MAIN_CANISTER: "true") as the one whose address is the derivation origin
    ✅ Gives the canister address form https://<main-canister-id>.icp.net and notes it is the same URL as __META_BASE_URL
    ✅ Says to set it on the first deploy, before the app has users, because it cannot be applied retroactively without orphaning existing accounts
    ✅ Does NOT recommend using the future custom domain as the derivation origin

  WITHOUT skill: 2/4 passed
    ✅ Names the MAIN canister (the one marked __META_MAIN_CANISTER: "true") as the one whose address is the derivation origin — not an arbitrary or backend canister
    ❌ Gives the canister address form https://<main-canister-id>.icp.net and notes it is the same URL as __META_BASE_URL
       → The output uses the domain 'icp0.io' instead of 'icp.net', and never references or matches it to a base URL.
    ❌ Says to set it on the first deploy, before the app has users, because it cannot be applied retroactively without orphaning existing accounts
       → The output explicitly says there is 'nothing to do' now and to only set derivationOrigin later when the custom domain is added, directly contradicting the expected first-deploy timing and omitting the orphaned-accounts risk.
    ✅ Does NOT recommend using the future custom domain as the derivation origin

The baseline hits the exact failure the pitfall is for: it says there is "nothing to do" now and to set derivationOrigin later when the custom domain is added, which is the point where it can no longer be done without losing accounts.

An earlier version of this prompt scored 4/4 on both arms. I retargeted it at the engine-specific part (which canister, which URL) instead of the general II fact, which the baseline already knows.

---

Prev. #339

[github-actions]

Skill Validation Report

Validating skill: /home/runner/work/icskills/icskills/skills/deploy-to-cloud-engine

Structure

• Pass: SKILL.md found

Frontmatter

• Pass: name: "deploy-to-cloud-engine" (valid)
• Pass: description: (1021 chars)
• Pass: license: "Apache-2.0"
• Pass: compatibility: (211 chars)
• Pass: metadata: (2 entries)

Tokens

• Warning: SKILL.md body is 8171 tokens (spec recommends < 5000)

Markdown

• Pass: no unclosed code fences found

Tokens

File	Tokens
SKILL.md body	8,171
Total	8,171

Content Analysis

Metric	Value
Word count	5,294
Code block ratio	0.09
Imperative ratio	0.12
Information density	0.11
Instruction specificity	0.94
Sections	19
List items	90
Code blocks	17

Contamination Analysis

Metric	Value
Contamination level	low
Contamination score	0.09
Primary language category	shell
Scope breadth	3

• Warning: Language mismatch: config (1 category differ from primary)

Result: 1 warning

Project Checks

✓ Project checks passed for 1 skills (0 warnings)