# E-commerce process mining (Agent Skill)

> Employee process mining for an e-commerce back office: a consented browser extension that records DOM events, not pixels, a form for the work a browser cannot see, and an AI pipeline that writes per-role SOPs and ranks what to automate.

Page: https://timerise.ai/skills/ecommerce-process-mining

Agent Skill `ecommerce-process-mining`: https://github.com/timerise-ai/ecommerce-process-mining. Category: AI & integrations. Runs on Chrome MV3 + Next.js; backend: Postgres/Supabase with row-level security, or Firestore.

Latest release: v0.1.7 (2026-09-29).

Install: npx skills add timerise-ai/ecommerce-process-mining. Timerise builds it on a brief; the price comes from the brief.

Nobody in an e-commerce back office can tell you exactly how an order, a return or a supplier claim is handled. The work is spread across the shop admin, marketplace seller panels, carrier portals, the helpdesk and the ERP, and it lives in people's heads. Onboarding takes months, audits guess, and automation projects start without a map.

Recording that work is possible, but the screens are full of other people's data. The employee can consent. The customer whose order is on screen never did. That single fact decides the design.

This skill gives a coding agent the whole pipeline the way we build it: a consented Manifest V3 extension that reads DOM events rather than pixels, exclusions applied in the extension and again on the server, values that would need scrubbing never read at all, a gap-capture form for work outside the browser, and a batch AI step that turns the record into per-role SOPs and a ranked list of what to automate first. Managers see aggregates, and consent is re-read on every batch.

Build employee process mining for an e-commerce back office: a consented Manifest V3 browser extension that captures DOM events rather than pixels from the admin tools staff already use (shop admin, marketplace seller panels, carrier portals, helpdesk, WMS, ERP), plus a gap-capture form for the work a browser cannot see, feeding an AI pipeline that writes per-role SOPs and ranks automation candidates. Use when: (1) documenting how order, return, listing, supplier and support work is really done, for onboarding, audit or automation scoping, (2) building or auditing an employee activity-capture extension, its consent model, its PII scrubbing, or its PKCE connect flow, (3) the user mentions: process mining, task mining, SOP generation, "document what employees do", routine capture, browser extension capture, DOM event capture, MutationObserver, captureVisibleTab, chrome.identity launchWebAuthFlow, consent toggle, excluded domains, PII scrubber, dom_confidence, perceptual hash, works council, GDPR Art. 88. Carries a scrubber that tells a card from an EAN, one exclusion matcher shared by the extension and the server, an atomic one-time-code exchange, an append-only consent ledger, and aggregate-only enrollment stats, each held by the tests and the SQL checks shipped with it. Next.js App Router and Postgres oriented; the backend is a seam. Not product analytics, not session replay, not screen recording, and not event-log mining from ERP tables.

This skill was written by the engineer who has shipped this module. The earlier implementation it was audited against was the employee process-mining module of a back-office platform, of which the consent record, the gap-capture form and a manager view ran while the capture path existed as design notes. The templates here hold the properties such a module has to hold: consent that is per person and per tenant and answered from the database on every batch, one exclusion matcher imported by both sides, a scrubber that tells a card number from a barcode, a one-time code that can be redeemed exactly once, a consent history nobody can rewrite, and an enrollment count that is withheld when the number would name the people. Each is stated as a rule below and held by the suites in [`references/testing.md`](references/testing.md); [`references/provenance.md`](references/provenance.md) has the record, and the maturity tags say which parts have run in production and which have not.

What it builds:
- A consented MV3 extension reading DOM events rather than pixels
- A gap-capture form
- An ingest route that scrubs before it stores
- A batch AI pipeline writing per-role SOPs and a ranked automation shortlist

When to use:
- Mapping real order, return, listing, purchasing or support workflows across several web tools
- Building the capture extension, its consent, exclusion and pause controls, or the ingest API
- Generating per-role SOPs, or ranking manual work by cost so automation can be scoped

Non-negotiables:
- A privacy switch never fails open. Unreadable pause state reads as paused, an unparseable host reads as excluded, and a failed consent save leaves the toggle showing what the server believes. The pause reducer, the exclusion matcher and the toggle hook each assert their failure case.
- A value you would have to scrub is never read. Password, card, one-time-code and hidden fields are skipped at the point of capture, and the scrubber is the net behind that, not a licence to read. The value gate and the scrubber have separate suites, and the scrubber runs again on the server, where it is authoritative.
- A one-time code is claimed in one statement. `DELETE ... RETURNING`, with the challenge verified after the claim, so two concurrent redeems cannot both mint a key. The SQL checks run a first claim, a second claim, a wrong extension id and an expired code.
- An authorization request from an unknown extension id is refused. A well-formed id proves nothing about who published the extension, so the console keeps an allowlist in configuration, empty by default and with no id written into code, and re-validates it in the authorize action, where hidden inputs are attacker-controlled.
- Success is never reported for an event that was not stored. The emitter returns false rather than swallowing a write error, and the route answers `207` with the indexes to retry, because a `200` makes the extension delete its only copy. An in-memory store standing in for a missing database is not storage.
- Who opted in is not a manager's business. There is no team policy on the consent table, only an aggregate function that suppresses small groups and full enrollment alike. The SQL checks assert that a manager role reads zero consent rows, whatever the page renders.

Not this:
- Customer behaviour on the storefront: Product analytics. This module captures staff at work, not shoppers
- "Who opened this link": Server-side visit logging; the `visit-logger` skill
- Data out of, or actions into, a service with no API: The sibling [`browser-extension-connector`](https://github.com/timerise-ai/browser-extension-connector) skill, which replays the page's own session; this one only observes what the employee does
- Process mining over ERP or OMS event logs: A data-warehouse job over case id, activity and timestamp. No capture is needed
- Productivity scoring, leaderboards, who has not opted in: Nothing here. The database withholds the rows, and `references/consent-and-privacy.md` says why
- Session replay or screen recording: A replay vendor. This reads the DOM and stores structure, not video
- Work in desktop applications: The gap-capture form. A browser extension sees browser tabs only

What to tell your agent:
- Build a browser extension our back-office staff install with consent. It records what they do in the shop admin and carrier portals as DOM events, never screenshots, and sends them to our Next.js app on Supabase.
- From the captured events, write an SOP for each role and rank the manual tasks worth automating by the time they take.
- Make sure the capture never stores card numbers or customer emails, and that staff can pause it or exclude a domain.

Agent eval results (newest per agent and prompt):
- Gemini CLI (gemini-3.8-flash) on v0.1.7, 2026-09-29: pass (Supabase)
- Codex CLI (gpt-6-astra) on v0.1.7, 2026-09-29: pass (Supabase)
- Claude Code (claude-opus-5-5) on v0.1.7, 2026-09-29: pass (Supabase)

Recent releases:
- v0.1.7 (2026-09-29): Wording release, from scoring the prompt-1 agent eval runs against 0.1.6. The templates and the suite are unchanged.
- v0.1.6 (2026-09-29): Wording release, from scoring the prompt-1 agent eval runs against 0.1.5. The templates and the suite are unchanged.
- v0.1.5 (2026-09-29): Wording release, from scoring the prompt-1 agent eval runs against 0.1.4. The templates and the suite are unchanged.