From 29cf322f1ac0500295c1afec076800aea3908eb3 Mon Sep 17 00:00:00 2001 From: brother7 <7brother7@gmail.com> Date: Thu, 27 Aug 2026 20:43:01 +0800 Subject: [PATCH] docs(coding): record ML-07 remediation --- ...0260827-makelore-plugin-client-7d3a91c4.md | 34 +++- ...260827-plugin-ml07-remediation-5d8c2a71.md | 171 ------------------ 2 files changed, 33 insertions(+), 172 deletions(-) delete mode 100644 .project-docs/30-worklog/tasks/20260827-plugin-ml07-remediation-5d8c2a71.md diff --git a/.project-docs/30-worklog/tasks/20260827-makelore-plugin-client-7d3a91c4.md b/.project-docs/30-worklog/tasks/20260827-makelore-plugin-client-7d3a91c4.md index 6bdfe16..29f1f61 100644 --- a/.project-docs/30-worklog/tasks/20260827-makelore-plugin-client-7d3a91c4.md +++ b/.project-docs/30-worklog/tasks/20260827-makelore-plugin-client-7d3a91c4.md @@ -8,7 +8,7 @@ - Worktree: D:\Datas\OthersProjects\makelore-plugin-client-7d3a91c4 - Base commit: eb5d15d68470b30ec181164f08f0d7b027ef0006 - Owner: codex-root -- Status: In Progress (ML-00 through ML-06 complete; ML-07 fixed-range review pending) +- Status: In Progress (ML-07 remediation integrated; repeat fixed-range review pending) ## Scope @@ -135,6 +135,14 @@ core coding resources, and final Pi runtime artifact. The implementation range contains no arbitrary plugin execution, generic invoke/config/ledger, marketplace, publication coupling, `plugin_charges`, Plugin Credits, or P1 code. +- The first ML-07 fixed-range review over exact `eb5d15d...9407c67` returned + Standards FAIL and Spec FAIL. Ten independent accepted root causes were assigned + to one isolated remediation owner; the package-parser duplication finding was + reported by both axes and counted once. Source remediation commit + `2492f8af5ba27d914b2c0b2789b46f78305c924d` had exact parent + `9407c67df21c2f0f50bb0362c826fcff643d9d5f` and was integrated without conflict + as coordinator product commit `cf13aa7`. The foreign remediation task record is + removed from this coordinator while remaining in its source worktree. ## Verification @@ -348,6 +356,30 @@ generic ledger/config/invoke, marketplace/publication coupling, checksums, or P1 implementation. +## ML-07 First Review And Remediation + +- Fixed range `eb5d15d68470b30ec181164f08f0d7b027ef0006` through + `9407c67df21c2f0f50bb0362c826fcff643d9d5f`: Standards FAIL and Spec FAIL. + Accepted issues were production package-parser/static-definition duplication, + disabled Skill implicit activation, missing preview/exact operation policy join, + the direct Pi Data Service fallback, missing request/fault evidence, unbounded + policy fetch/body, ready-enable settings loss, unsafe Skill-ID typing, + out-of-order project-load commits, and stale README inventory. +- The sole remediation commit makes the parsed frozen package definitions the Main + authority; projects three capabilities/fourteen exact operations while keeping + preview non-tool; removes the second Pi direct path; makes disabled retained Skill + availability explicit; bounds policy refresh; preserves ready settings on enable; + uses `CodingSkillId`; guards A/B loads; and updates README. +- Source verification: focused 10 files / 60 tests; full 202 files / 1,680 passed / + 2 staged-runtime skips; typecheck passed; ESLint 0 errors with the same 5 existing + warnings; full Windows build/NSIS passed; Pi artifact proof passed with four core + Skills plus the package-owned Data Service. Stable replay and one-401-refresh + request identity remains `pi:run-a:resource-a`; all ten tools traverse the real + adapter/registry/conversation parser with bounded quota, size, revision, and + Retry-After contexts. +- Repeat Standards and Spec review must use the unchanged base `eb5d15d...` and the + post-remediation coordinator documentation checkpoint as its exact head. + ## Follow-ups - ML-07 must review the fixed committed range from exact diff --git a/.project-docs/30-worklog/tasks/20260827-plugin-ml07-remediation-5d8c2a71.md b/.project-docs/30-worklog/tasks/20260827-plugin-ml07-remediation-5d8c2a71.md deleted file mode 100644 index fa68712..0000000 --- a/.project-docs/30-worklog/tasks/20260827-plugin-ml07-remediation-5d8c2a71.md +++ /dev/null @@ -1,171 +0,0 @@ -# Task: Remediate accepted MakeLore ML-07 review findings - -## Identity - -- Task ID: 20260827-plugin-ml07-remediation-5d8c2a71 -- Mode: Feature -- Branch: codex/20260827-plugin-ml07-remediation-5d8c2a71-plugin-ml07-remediation -- Worktree: D:\Datas\OthersProjects\makelore-plugin-ml07-remediation-5d8c2a71 -- Base commit: 9407c67df21c2f0f50bb0362c826fcff643d9d5f -- Owner: ml07-remediator -- Status: Ready for integration - -## Scope - -- Remediate the ten accepted ML-07 fixed-range findings on exact reviewed head - `9407c67df21c2f0f50bb0362c826fcff643d9d5f`. -- Own only the product files and directly focused tests explicitly delegated by the - coordinator: bundled plugin/Skill definitions, project/capability/Host - projections, policy client, Pi product-tool seam, Renderer Plugin Center store - and views, README, and focused package/runtime/conversation tests. -- Deliver one final remediation commit whose sole parent is the reviewed head. - -## Intent And Constraints - -- Make the parsed fixed bundled package set the single production authority; - preserve enablement, Agent assignment, backend configuration, and billing as - independent states; join all three Data Service capabilities and fourteen - operations exactly against policy. -- Remove the forbidden direct Data Service path from `PiProductTools`; keep the - capability registry as the sole non-core invocation path and retain bounded - stable request/fault semantics. -- Bound policy fetch plus body consumption, preserve preview/settings data on - enable, prevent stale project-load commits, use the stable Coding Skill type, - and update current-state README wording. -- Test first in focused behavior groups. Do not add generic plugin/P1 framework, - compatibility layers, checksums, static fallback lists, or touch files outside - the coordinator ownership list without stopping for an explicit transfer. -- Do not modify the user root worktree, push, open a PR, or spawn subagents. - -## Project Context Loaded - -Task context: -- Task ID: `20260827-plugin-ml07-remediation-5d8c2a71` -- Mode: Feature -- Branch: `codex/20260827-plugin-ml07-remediation-5d8c2a71-plugin-ml07-remediation` -- Worktree: `D:\Datas\OthersProjects\makelore-plugin-ml07-remediation-5d8c2a71` -- Base commit: `9407c67df21c2f0f50bb0362c826fcff643d9d5f` -- Other active local tasks: the ML-07 Standards and Spec reviewers are read-only - peers on the same head; ML-01 through ML-06 source tasks are ready for - integration and the client coordinator owns only its integration branch/record. -- Overlap or semantic-conflict assessment: no unresolved conflict. This task is the - coordinator-designated sole remediation owner; reviewers do not write product - files and earlier ticket owners have completed their scopes. - -Read: -- `AGENTS.md`; mandatory `implement-spec` and `maintain-project-docs` skills. -- `.project-docs/05-agent-entry/{memory-index,read-before-planning,planning-gate}.md` - and the required project positioning/current state/decision/architecture/domain/ - evidence/reflection/commitment/stale records. -- ADR-006, the active/coordinator/ML-01 through ML-07 peer task records, the plugin - implementation spec §§3, 6-10.2, 12, ticket ML-07, and detailed design §§2, - 5-9, 14, 17. - -Relevant understanding: -- Project goal: preserve Pi as the sole Main-owned Coding runtime while adding one - fixed first-party bundled plugin package with strict project and policy authority. -- Current integrated focus: canonical memory predates this unintegrated plugin - branch; the frozen specification and exact reviewed head control this task. -- Active task scope: the ten accepted findings only, within the delegated file list. -- Active constraints: no generic invoke/config/ledger/marketplace/arbitrary code, - no duplicated Skill/tool authority, no root-worktree writes. -- Decisions affecting this task: ADR-006 and the plugin spec require Main authority, - dynamic worker resources, accepted/uncertain non-replay, and bounded product DTOs. -- Evidence, reflections, or commitments affecting this task: Windows package proof - exists on the reviewed head; staged runtime skips and the historical unrelated E2E - timeout must not be overstated as passes. -- Files or modules likely involved: the exact delegated shared definitions, - manifest/registry/project service, policy client, composition/product services, - Pi product-tools, Renderer plugin store/page/configuration selector, README, and - directly corresponding unit/E2E tests. -- Unknowns, stale docs, or conflicts: the generic positioning template is stale; - current-state memory does not include this branch. Neither changes the frozen - contract. No semantic peer conflict is known. - -Gate result: -- Passed on 2026-08-27. - -## Plan - -1. Add red tests for startup parsed-definition authority, normalized equality, - disabled retained Skill availability, exact policy join, and removal of the - direct Data Service product-tool path; implement the smallest shared/Main fix. -2. Add red tests for stable request identity/fault propagation and bounded policy - fetch+body deadline; change production only where failures expose defects. -3. Add red tests for ready-instance retention on enable, stable Skill typing, and - out-of-order Renderer loads; implement the bounded lifecycle/UI fixes. -4. Update README inventory/enablement wording, run affected focused regressions, - typecheck, lint, build, package proof, and broader relevant suites. -5. Record exact results, run documentation drift/completion gates, create one clean - commit directly on the reviewed base, and return the test ledger/deviations. - -## Outcome - -- Electron Main composition now synchronously loads and validates the fixed bundled - package roots, freezes the parsed outer definition set, and injects that same set - into project, capability, and package-Skill projections. Production no longer - falls back to the shared duplicated definition catalog or a hard-coded package - Skill path. -- Package operation ownership now includes the code-owned `data-service.preview` - get/list/put/delete operations. The policy projection joins exactly three - capabilities and fourteen operations; preview operations remain non-tool SDK - operations, and Renderer displays each operation's joined billing/tool metadata. -- Plugin Skill availability is explicit across Product contracts, Host commands, - worker runtime context, and the Agent selector. Disabled unassigned Skills are - hidden, retained assignments remain selected/persisted but ineffective, and - re-enable restores availability without a new assignment implicitly enabling the - plugin. The genuine first-read legacy assignment migration remains intact. -- `PiProductTools` has no Data Service option, adapter, configure method, ten-name - fallback, or fabricated billing envelope. All non-core tools use the capability - registry. `ProductCodingSkill` and commands use `CodingSkillId` without the old - unsafe cast. -- Policy refresh now places fetch, headers, and bounded body consumption under the - existing deadline/abort seam and retains unknown/stale fallback semantics. - Plugin Center loads use latest-generation commit guards, and enabling an already - ready Data Service inspects before one atomic state commit while retaining its - actual instance usage/settings. -- README now describes four core Skill roots plus the package-owned Data Service - Skill and distinguishes project enablement from Agent assignment. - -## Verification - -- Test-first red evidence initially exposed five failures: missing fourteen-operation - normalization, stale A/B store success, missing ready-enable inspection, and - unbounded never-settling policy headers/body. Later focused tests also exposed - Host plugin-ID/Skill-ID mapping, command/runtime availability, and the unfrozen - parsed outer definition set; all were fixed at their existing seams. -- Focused final suite: 10 files, 60 tests passed. It covers normalized sync/async - package equality and freezing; exact three-capability/fourteen-operation mixed - policy projection; Host/Renderer disabled-retained/re-enable behavior; ready - instance retention; policy headers/body deadlines; A/B load ordering; and legacy - assignment versus new assignment behavior. -- Request/fault evidence: a repeated registry invocation with the same run/resource - (representing reconnect/event replay) preserves `pi:run-a:resource-a`; a real - `DataServiceCloudClient` authoritative 401, one forced token refresh, operations, - adapter, and registry invocation preserves that same ID. All ten Data Service - tools route representative `DataServiceOperations` faults through the real adapter - and registry into `productToolDetailsOfResult`, including quota context, - `actual`/`limit`, `current_revision`, and `retry_after_seconds`. -- `corepack pnpm test`: 201 files / 1,679 passed / 2 skipped, followed by the pressure - file 1 file / 1 passed (202 files / 1,680 passed / 2 skipped total). -- `corepack pnpm run typecheck`: passed. -- `corepack pnpm exec eslint .`: passed with zero errors and five pre-existing - warnings in non-owned `src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`. -- `corepack pnpm run build`: passed through Renderer/Main/Preload/utility builds, - Pi runtime bundle, Windows unpacked artifact, and NSIS installer. -- `node scripts/verify-pi-product-artifact.mjs --app-exe - release/win-unpacked/Makelore.exe --samples 1 --timeout-ms 10000`: result `pass`; - package proof reports four core Skills and package-owned Data Service with ten - tools and five package files. An earlier invocation used an unsupported - `--project-root` argument and failed before verification; rerunning with the - documented interface passed without a source/script change. - -## Follow-ups - -- Coordinator will rerun the required integration ledger on the integrated commit. -- No full external-provider verification is claimed; the artifact verifier reports - its existing Phase-0 platform/provider waivers separately from this remediation. - -## Promotion Candidates - -- None recorded.