C6 Playable Agent POC
A proof-of-concept web application for planning C6 Mahjong pair-match playable ads with the OpenAI Responses API, then building them with a GPT-5.6 Sol agent in an isolated Vercel Sandbox.
Credential model
Playable Studio uses one server-managed OpenRouter API Key for requirement planning, analysis, media generation, and confirmed Sandbox builds. Configure OPENROUTER_API_KEY only in the server runtime or deployment secret manager; the browser never asks visitors for a key and never receives the shared credential.
The application sends OpenAI-compatible requests to https://openrouter.ai/api/v1 and intentionally does not fall back to OPENAI_API_KEY or AI_GATEWAY_API_KEY. Never store or expose the shared key in the database, user profile, browser storage, NEXT_PUBLIC_* variables, logs, generated HTML, or build artifacts.
The application defaults to the OpenRouter-qualified model ID openai/gpt-5.6-sol. The shared key must have access to the configured PLAYABLE_AGENT_MODEL before requirement planning or a Sandbox build can start.
POC workflow
- Open the public studio and describe the game idea conversationally. The requirement Agent answers informational messages without
changing the Brief; requirement messages use domain tools to maintain a persistent Brief,
inspect safe asset metadata, read Plugin capabilities, and request only the missing input.
- Route the idea to an exact template match, an approximate template adaptation, or direct freeform generation.
- Upload or select assets and confirm the complete production configuration.
- Build and validate the playable in an isolated Sandbox.
- Preview or switch between passing versions and download the offline single-file HTML.
Freeform generation uses the closest registered mode only as workspace scaffolding; it does not create a persistent
custom Plugin. The POC does not use repository selection, GitHub Issue input, automatic branches, commits, or pull
requests for playable tasks.
Local setup
Requirements:
- Node.js and Corepack
- pnpm 10.28.0 (pinned in
package.json; use the same version locally and in CI)
- PostgreSQL
- Vercel Sandbox credentials
Install and verify the baseline:
corepack enable
pnpm install
pnpm type-check
pnpm build
pnpm check:build-traces
Production builds use webpack, matching the development scripts. With Next.js 16.0.10,
Turbopack can trace both pnpm directory symlinks and files beneath those same paths;
Vercel rejects the resulting function packages even when compilation succeeds.
The trace check detects these conflicts before deployment.
Copy the checked-in environment template and fill in the infrastructure values. GitHub OAuth values are not required for Playable Studio:
cp .env.example .env.local
The environment contract is:
POSTGRES_URL=
JWE_SECRET=
BLOB_READ_WRITE_TOKEN=
SANDBOX_VERCEL_TOKEN=
SANDBOX_VERCEL_TEAM_ID=
SANDBOX_VERCEL_PROJECT_ID=
MAX_SANDBOX_DURATION=300
OPENROUTER_API_KEY=
PLAYABLE_AGENT_MODEL=openai/gpt-5.6-sol
PLAYABLE_REQUIREMENT_MAX_STEPS=20
PLAYABLE_REQUIREMENT_REASONING_EFFORT=high
PLAYABLE_SANDBOX_VALIDATION_ENABLED=1
LOCAL_HARNESS_MODE=0
LOCAL_CODEX_MODE=0
Set OPENROUTER_API_KEY in .env.local for local server use and in the deployment secret manager for production. Do not commit its value. Tasks and uploaded assets are intentionally shared by all visitors in this public POC.
The requirement agent defaults to at most 20 model decisions per user message with high reasoning effort, in both production and local Codex CLI mode. Set PLAYABLE_REQUIREMENT_MAX_STEPS to a positive safe integer and PLAYABLE_REQUIREMENT_REASONING_EFFORT to low, medium, or high to override them. Missing or invalid values fall back to the defaults. Tool-analysis steps and structured-output repair attempts share this step budget; a terminal reply ends the loop early. Higher limits and reasoning effort can increase response latency and model usage. These settings do not change build-agent reasoning effort.
Requirement updates preserve unchanged fields through incremental patches. Builds receive the Requirement Brief and recent user evidence captured at confirmation. See requirement quality and conversation replay for the handoff contract and pnpm replay:requirements commands.
PLAYABLE_SANDBOX_VALIDATION_ENABLED defaults to enabled. Set it to 0 to skip the host behavioral validation command, the Codex browser-acceptance phase, and its temporary validation checklist when diagnosing build latency. The platform still checks the artifact contract, offline resources, responsive layout, and credentials before publishing an artifact.
The deployment network must resolve vercel.com and allow outbound HTTPS traffic to vercel.com:443, which is the API origin used by @vercel/sandbox 3.x. Run the connectivity preflight inside the deployed runtime or its release job:
pnpm check:sandbox-connectivity
The command exits unsuccessfully with a static DNS-specific or HTTPS-egress-specific message. A failure must be fixed in the hosting provider's DNS, firewall, proxy, or outbound allowlist; application code cannot override a blocked network route.
Production-equivalent local agent
To test the same shared-key Responses API structured streaming, Codex Harness build, PostgreSQL, Blob, and Vercel Sandbox path used by the
deployment while using the same public POC task identity, run:
pnpm local:harness
This mode reads OPENROUTER_API_KEY from the server environment and uses the same Agent implementation and API billing path
as production; only the shared identity is replaced with the fixed local development user. Requirement chat does not create
a Sandbox. A confirmed build requires all three SANDBOX_VERCEL_* values because the local process does not receive
Vercel's deployment OIDC identity. For an end-to-end OAuth check, use pnpm dev instead.
Local Codex CLI agent
To run the real local workflow with saved Codex CLI authentication and without GitHub OAuth, link the project, pull the
shared POC variables, migrate the database, and start the dedicated mode. The Vercel environment selector is only used
as a configuration source here; this POC uses the same Postgres and Blob resources in every environment.
npx vercel link --yes --scope make-money --project playable-agent-poc
npx vercel env pull .env.local --environment=development --yes --scope make-money
node --env-file=.env.local ./node_modules/drizzle-kit/bin.cjs migrate
pnpm smoke:local-codex
pnpm local:codex
This mode uses the real PostgreSQL repository, private Blob store, Codex CLI, and Vercel Sandbox. It is disabled on
Vercel deployments and never forwards project environment variables to the Codex child process. Its identity and
event stream differ from production, so use pnpm local:harness for deployment-parity Agent testing.
Run the development server:
pnpm dev
Local demo prototype
To exercise the complete UI without login, PostgreSQL, Blob, OpenAI, or Vercel Sandbox credentials, run:
pnpm demo
This explicitly temporary mode uses an in-memory task repository and artifact store plus the vendored local Skill
builder. It performs the real four-mode build and behavior check, but its confirmation Agent is deterministic and all
tasks disappear when the development server restarts. Do not enable LOCAL_DEMO_MODE in a deployed environment.
Design and implementation
License
This repository retains the template's license and required attribution. See LICENSE.
