docs(project): record marketplace client remediation
This commit is contained in:
@@ -1,255 +0,0 @@
|
||||
# Task: Marketplace MLM-06 fixed-range remediation
|
||||
|
||||
## Identity
|
||||
|
||||
- Task ID: 20260828-marketplace-mlm06-remediation-6d3a9c82
|
||||
- Mode: Feature
|
||||
- Branch: codex/20260828-marketplace-mlm06-remediation-6d3a9c82-marketplace-mlm06-remediation
|
||||
- Worktree: D:\Datas\OthersProjects\makelore-plugin-marketplace-client-mlm06-remediation-6d3a9c82
|
||||
- Base commit: 8dfa5428606076b847966750134061de6fbe91ba
|
||||
- Owner: marketplace-mlm06-remediator
|
||||
- Status: Ready for Integration
|
||||
|
||||
## Scope
|
||||
|
||||
- Implement the sole MLM-06 fixed-range remediation from the exact reviewed
|
||||
client head `8dfa5428606076b847966750134061de6fbe91ba`.
|
||||
- Close all 11 deduplicated actionable roots from the Standards and Spec reviews:
|
||||
skill/package-root pairing; explicit device uninstall; packaged trust proof;
|
||||
precise package-store orphan recovery; same-account Library read ordering;
|
||||
README architecture/product synchronization; whole-response Marketplace
|
||||
deadlines; cached-release rollback current selection; cross-plugin mutation
|
||||
intent ordering; explicit-beta Main/My Plugins action; and bounded yanked,
|
||||
incompatible, signature, and unavailable projections.
|
||||
- Own only the remediation seams and their focused tests: `electron/coding-plugins`
|
||||
registry/resource loading, Package Store/account cache/marketplace client and
|
||||
lifecycle seams; the packaged artifact verifier and proof; Main Marketplace
|
||||
beta/status projection; Renderer Marketplace/My Plugins stores/facades/pages;
|
||||
`README.md`; and this task record. Preserve all unrelated changes already in
|
||||
the coordinator product head.
|
||||
|
||||
## Intent And Constraints
|
||||
|
||||
- Use one isolated feature worktree and one source commit. The source commit must
|
||||
have sole parent `8dfa5428606076b847966750134061de6fbe91ba`, be clean, and end
|
||||
in `READY_FOR_INTEGRATION` after task documentation gates.
|
||||
- Keep every mutation behind the existing Main Host API and closed DTOs. Do not
|
||||
add Provider/hosted runtime, billing, Token Point, arbitrary code/MCP/hooks,
|
||||
project schema changes, or XMA-01/live/deployment work.
|
||||
- Preserve the single frozen effective snapshot. Every Skill entry must remain
|
||||
paired with its verified package root through resource loading, bridge, CLI,
|
||||
and lifecycle consumers; no compatibility union or first-match root fallback.
|
||||
- Explicit device uninstall is distinct from Library remove: it may remove an
|
||||
unprotected installed package, while active workers and account snapshots keep
|
||||
their releases protected and Library rows remain intact.
|
||||
- Packaged trust proof must inspect the actual packaged `app.asar`/build artifact
|
||||
trust source and prove no private key; checkout source files are not evidence.
|
||||
- Orphan recovery may reuse/remove only the exact, fully validated matching
|
||||
plugin/release package left by the interrupted rename/index sequence.
|
||||
- Same-account Library reads use current selection intent/generation; the
|
||||
different-plugin mutation race uses its own request intent/epoch allocated
|
||||
before the request. Account A/B isolation, duplicate coalescing, and explicit
|
||||
beta/current-versus-stable semantics remain intact.
|
||||
- Request deadlines cover both Marketplace response headers and body consumption
|
||||
under one overall Abort/deadline. Rollback changes the Package Store current
|
||||
selection while retaining immutable releases and active-worker freeze.
|
||||
- UI changes stay in the existing light design system, use bounded user copy and
|
||||
explicit transitions/hit targets, and record Before/After interface impact in
|
||||
this task record. Keep the official platform public-key production activation
|
||||
hold explicit.
|
||||
|
||||
## Project Context Loaded
|
||||
|
||||
Task context:
|
||||
- Task ID: `20260828-marketplace-mlm06-remediation-6d3a9c82`
|
||||
- Mode: Feature
|
||||
- Branch: `codex/20260828-marketplace-mlm06-remediation-6d3a9c82-marketplace-mlm06-remediation`
|
||||
- Worktree: `D:\Datas\OthersProjects\makelore-plugin-marketplace-client-mlm06-remediation-6d3a9c82`
|
||||
- Base commit: `8dfa5428606076b847966750134061de6fbe91ba`
|
||||
- Other active local tasks: Marketplace coordinator; earlier MLM-01 through
|
||||
MLM-05 records/worktrees; MLM-06 Standards and Spec fixed-range review records.
|
||||
- Overlap or semantic-conflict assessment: Overlap is intentional and limited to
|
||||
the listed review-accepted seams. No peer may write this remediation worktree,
|
||||
and no semantic conflict remains with the accepted Release A boundary. The
|
||||
same-account Library read race and different-plugin mutation race are separate
|
||||
state-intent problems with separate tests and guards. User root worktrees and
|
||||
all server/Operations worktrees remain out of scope.
|
||||
|
||||
Read:
|
||||
- `C:\Users\7brot\.agents\skills\implement-spec\SKILL.md`
|
||||
- `C:\Users\7brot\.codex\skills\maintain-project-docs\SKILL.md`
|
||||
- `C:\Users\7brot\.codex\skills\make-interfaces-feel-better\SKILL.md` and
|
||||
`typography.md`, `surfaces.md`, `animations.md`, `performance.md`
|
||||
- `D:\Datas\OthersProjects\makelore\AGENTS.md`, project-memory startup set,
|
||||
architecture/domain/evidence/reflection/commitment/stale indexes, and peer
|
||||
task records
|
||||
- canonical Marketplace implementation spec, ticket graph, and accepted design
|
||||
proposal in `D:\Datas\PythonProjects\works-square-server-plugin-marketplace-spec-7c2e9a41`
|
||||
|
||||
Relevant understanding:
|
||||
- Main owns authentication, filesystem, Marketplace access, package trust,
|
||||
install paths, release/admission authority, and bounded error projection;
|
||||
Renderer consumes closed safe projections only.
|
||||
- Release A separates Operations publication, account Library, device install,
|
||||
project selection, Agent assignment, runtime authorization, and billing.
|
||||
Acquire/download/install/update/enable/assignment never write Token Points.
|
||||
- Schema-v1 bundled Data Service and schema-v2 declarative `skill_only` remain
|
||||
the only active runtime paths. Release B Provider/hosted/charges is closed.
|
||||
- The coordinator head already passed the first fixed-range reviews except the
|
||||
listed review roots. This task must preserve its single effective resolver,
|
||||
frozen worker snapshots, account isolation, and current UI contract.
|
||||
|
||||
Gate result:
|
||||
- Concurrent Task Gate: Passed. `check_project_docs.py` passed; task-context
|
||||
ownership exactly matches the task ID, owner, feature mode, branch, isolated
|
||||
worktree, and exact base.
|
||||
- Planning Gate: Passed. Required memory/spec/design/peer scope was read; the
|
||||
accepted review findings provide disjoint, explicit ownership and no unresolved
|
||||
semantic conflict blocks the remediation plan.
|
||||
|
||||
## Implementation Plan
|
||||
|
||||
1. Add failing tests for each accepted root at its existing seam, including
|
||||
duplicate relative Skill paths, install/delete protection states, app.asar
|
||||
trust proof, exact orphan recovery, header/body timeout, rollback projection,
|
||||
same-account read intent, cross-plugin mutation epochs, explicit beta/status
|
||||
projections, and bounded UI copy/routes.
|
||||
2. Implement the smallest cohesive fixes in registry/resource loader, package
|
||||
store/account cache/marketplace client, verifier, Main projection, and
|
||||
Renderer store/pages. Keep immutable release and account/admission boundaries.
|
||||
3. Run focused and adjacent unit suites after each red/green seam, then typecheck,
|
||||
lint, Vite build, Marketplace E2E, Windows Electron/package/artifact proof,
|
||||
and document drift. Record unrelated baseline failures without widening scope.
|
||||
4. Update outcome/verification and complete task-context only after a clean single
|
||||
source commit with the exact sole parent.
|
||||
|
||||
## Outcome
|
||||
|
||||
- Implemented the complete MLM-06 fixed-range remediation in the isolated client
|
||||
worktree without changing the coordinator or user root worktrees. The single
|
||||
frozen effective snapshot now preserves each marketplace Skill with its
|
||||
verified package root, and the same pairing flows through resource loading,
|
||||
Extension Host registration, CLI/context, and lifecycle consumers. Package
|
||||
Store state now has an explicit current-release selection, exact orphan
|
||||
recovery, explicit device uninstall, active-worker protection, and account
|
||||
resolve-cache invalidation without changing Library membership. Marketplace
|
||||
body and header reads share one bounded deadline; Main exposes the explicit
|
||||
beta action and bounded release/library/runtime errors; Renderer state keeps
|
||||
same-account reads and cross-plugin mutations ordered by their own intent
|
||||
generations. The packaged proof reads the actual app.asar trust seam and
|
||||
records a code-owned, empty, fail-closed trust table with no private-key or
|
||||
runtime-key override. README now documents the Marketplace/My Plugins/Project
|
||||
Plugins separation and Main/Package Store/effective-runtime architecture.
|
||||
|
||||
### Fixed-range roots
|
||||
|
||||
1. Skill/package-root pairing: effective snapshot entries retain the verified
|
||||
package root; resource loading no longer selects the first matching root, and
|
||||
collision coverage proves two same-relative-path Skills stay isolated.
|
||||
2. Device uninstall: explicit uninstall removes only the unprotected device
|
||||
package and its account resolve-cache entry; Library rows remain, active
|
||||
workers and snapshots remain protected, and a later resolve can reinstall.
|
||||
3. Packaged trust proof: verifier reads compiled JavaScript from the actual
|
||||
app.asar, recognizes the code-owned provenance marker plus empty frozen
|
||||
table, and rejects environment/private-key material. The official production
|
||||
Ed25519 public key is still an explicit activation HOLD.
|
||||
4. Orphan recovery: a crash left between release-directory rename and index
|
||||
write recovers only the exact plugin/release directory with its matching
|
||||
archive and fully validated descriptor/artifact/signature/compatibility;
|
||||
unrelated or incomplete directories remain conflicts.
|
||||
5. Same-account Library reads: generation and mutation-epoch guards prevent an
|
||||
older response from replacing a newer read intent while preserving duplicate
|
||||
request coalescing.
|
||||
6. Documentation: README covers Marketplace, My Plugins, Project Plugins,
|
||||
Main, Package Store, effective snapshots, skill-only scope, and production
|
||||
key activation HOLD.
|
||||
7. Request deadline: Marketplace headers and bounded body consumption execute
|
||||
under one Abort/deadline, including never-body response coverage.
|
||||
8. Rollback selection: cached immutable releases switch an explicit Package
|
||||
Store current pointer; projections and next workers use that pointer rather
|
||||
than installed-time ordering, while active workers stay frozen.
|
||||
9. Library mutation ordering: each mutation allocates its request intent before
|
||||
sending; stale responses cannot overwrite newer different-plugin mutations,
|
||||
with both completion orders and account A/B isolation covered.
|
||||
10. Explicit beta: Main has a real beta route/facade and My Plugins exposes a
|
||||
user-triggered Beta action only; beta never follows stable rollout buckets
|
||||
or auto-acquires a release.
|
||||
11. Bounded status projection: yanked, incompatible, signature, artifact,
|
||||
runtime-suspended, library-required, and backend-unavailable results remain
|
||||
distinct through Main/Host/Renderer routes and bounded My Plugins copy,
|
||||
including cached/unavailable Library entries.
|
||||
|
||||
### Interface impact
|
||||
|
||||
- Before: My Plugins and Project Plugins could expose stale or ambiguous
|
||||
installation state, and release errors collapsed into generic unavailable
|
||||
messages; Marketplace requests could hang after headers; Beta had no explicit
|
||||
Main action.
|
||||
- After: the existing light design system presents explicit Beta, install,
|
||||
unavailable, and rollback-aware states with bounded Chinese copy, stable hit
|
||||
targets, and independent loading/mutation transitions. No new authority,
|
||||
account identity, filesystem path, or open-ended runtime payload crosses into
|
||||
Renderer.
|
||||
|
||||
## Verification
|
||||
|
||||
- Planning/concurrency gates: `check_project_docs.py` passed; task-context
|
||||
identity matched task ID, owner, feature mode, branch, isolated worktree, and
|
||||
exact base `8dfa5428606076b847966750134061de6fbe91ba`.
|
||||
- First natural RED: the five review-targeted suites reported **33 passed / 9
|
||||
failed**; failures covered unpaired same-entryPath Skill roots, uninstall
|
||||
remaining kept, missing packaged trust reader, never-body deadline, and stale
|
||||
intent commits. No source implementation was treated as green before these
|
||||
failures were observed.
|
||||
- Focused GREEN checkpoints: initial package/resource seams **18 + 8 passed**;
|
||||
final fixed-range focused run **8 files / 82 passed**; post-marker trust and
|
||||
contract run **2 files / 30 passed**; the broader focused checkpoint was **9
|
||||
files / 101 passed**. Adjacent Marketplace/Pi/Host/Package Store suites were
|
||||
**13 files / 66 passed**.
|
||||
- `pnpm exec vitest run --exclude tests/unit/coding-chat-pressure.test.tsx
|
||||
--maxWorkers=1`: **208 files / 1779 passed / 2 skipped**. The repository
|
||||
`pnpm test` 4-worker attempt reached **207 files / 1769 passed / 2 skipped**
|
||||
before one Vitest worker exited unexpectedly without an assertion failure;
|
||||
the serial rerun is the final full-unit evidence.
|
||||
- `pnpm exec vitest run tests/unit/coding-chat-pressure.test.tsx
|
||||
--maxWorkers=1`: **1 file / 1 passed**.
|
||||
- `pnpm run typecheck`: passed after the final trust-marker change.
|
||||
`pnpm run lint:check`: **0 errors**, five existing warnings in
|
||||
`src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`.
|
||||
- `pnpm run build:vite`: passed for Renderer, Main, Preload, and utility
|
||||
bundles; only existing dynamic-import/chunk-size warnings. The final
|
||||
`pnpm run package:stage:win-x64` also passed with **130 packages / 6 assets**.
|
||||
- `pnpm run test:e2e`: **27 passed / 1 failed**. Marketplace catalog/detail
|
||||
flow and Project Plugins passed. The one unchanged baseline failure is
|
||||
`tests/e2e/pi-coding-first-chat.spec.ts:539`: the existing `当前对话模型`
|
||||
combobox remained disabled during `selectOption` until its 30-second timeout;
|
||||
no Marketplace test failed.
|
||||
- `pnpm run test:electron:windows`: **2 files / 6 passed**.
|
||||
- `pnpm run package:win`: Python win32-x64 and x64 staging were successful, but
|
||||
the required win32-arm64 uv download from GitHub failed with
|
||||
`UND_ERR_CONNECT_TIMEOUT`; this is recorded as an environment deviation and
|
||||
is not claimed as a full package:win pass. Direct Electron Builder then
|
||||
produced the x64 unpacked/NSIS artifact successfully.
|
||||
- `pnpm run verify:artifact:pi`: passed against the actual fresh Windows
|
||||
`app.asar`; Marketplace proof reports
|
||||
`official-key-absent-fail-closed`, `productionKeyIds=[]`, and
|
||||
`privateKeyMaterialInTrustSource=false`, with packaged Pi closure, bundled
|
||||
Data Service resources, extension markers, and runtime probe passing. The
|
||||
verifier no longer reads checkout `trusted-keys.ts`.
|
||||
- Pre-commit source checks: `git diff --check` and the fixed-range forbidden
|
||||
source scan passed. No Provider/hosted runtime, billing, Token Point,
|
||||
arbitrary code/MCP/hooks, publication, XMA-01, push, PR, or deploy was added.
|
||||
|
||||
## Follow-ups
|
||||
|
||||
- Official platform Ed25519 public key material has not been supplied; keep
|
||||
production activation on HOLD. Tests use only injected temporary key stores,
|
||||
and no production private key was generated or committed.
|
||||
- The full multi-architecture `package:win` remains dependent on the external
|
||||
GitHub win32-arm64 uv download; x64 artifact evidence is separate and
|
||||
complete. Keep the known disabled-model-combobox E2E baseline visible until
|
||||
its owning runtime test is fixed.
|
||||
|
||||
## Promotion Candidates
|
||||
|
||||
- None recorded.
|
||||
@@ -112,6 +112,12 @@
|
||||
commit `3ab257d3f0226ecba40166f306b939319061e551` was integrated without
|
||||
conflict as coordinator product commit
|
||||
`43c464a556d32a1ac564a5bb79f92741c4d9d635`.
|
||||
- MLM-06 fixed-range Standards and Spec review found eleven deduplicated roots.
|
||||
The sole remediation task `20260828-marketplace-mlm06-remediation-6d3a9c82`
|
||||
completed from exact frontier `8dfa5428606076b847966750134061de6fbe91ba`
|
||||
as source commit `291b64ab0ef4779a44e09a386de31332abe1f57b` and was integrated
|
||||
without conflict as coordinator product commit
|
||||
`1614f7efc1fc81efc3b4d1c80827948976f1427b`.
|
||||
|
||||
## Outcome
|
||||
|
||||
@@ -148,6 +154,13 @@
|
||||
unknown project IDs, typed Data Service settings, account/project generation, and
|
||||
mutation epochs are bounded in Renderer state. No account, filesystem path,
|
||||
Release Admission, token, or signed URL authority enters Renderer.
|
||||
- MLM-06 remediation paired every frozen Skill with its verified package root,
|
||||
separated explicit device uninstall from Library removal, added exact Package
|
||||
Store orphan recovery and current-Release selection, bounded whole-response
|
||||
deadlines, and serialized same-account reads and cross-Plugin mutations by intent.
|
||||
It also exposed explicit beta and bounded unavailable states through Main/Renderer,
|
||||
made the packed trust proof read the real `app.asar`, and synchronized README.
|
||||
Official-key absence remains a fail-closed production activation hold.
|
||||
|
||||
## Verification
|
||||
|
||||
@@ -198,6 +211,18 @@
|
||||
found schema-2 `skill_only`, unknown-key fail-closed, Library/install/update/
|
||||
effective routes, Renderer assets, and no private-key/runtime-key override.
|
||||
Official public-key production trust remains HOLD.
|
||||
- MLM-06 verification passed focused 82 tests, trust/contract 30 tests, adjacent 66
|
||||
tests, complete single-worker Vitest `1779 passed, 2 skipped`, the pressure case,
|
||||
typecheck, lint with zero errors and five unchanged warnings, Vite build, six
|
||||
Windows Electron tests, and Marketplace E2E. Full E2E passed 27 of 28; the only
|
||||
failure remained the unchanged disabled-model-combobox timeout. The four-worker
|
||||
unit run reached 207/208 files and 1769 passes before one assertion-free worker
|
||||
exit; the complete one-worker rerun is the product result. Windows x64 staging and
|
||||
building passed; the aggregate `package:win` arm64 uv download hit an external
|
||||
GitHub connect timeout. Both Pi and Windows artifact verifiers passed on the clean
|
||||
final source commit, with embedded `gitCommit` and `verificationHead` equal to
|
||||
`291b64a...`; the real packed trust source contains no private key and fails closed
|
||||
while the official public key is absent.
|
||||
|
||||
## Follow-ups
|
||||
|
||||
|
||||
Reference in New Issue
Block a user