diff --git a/.project-docs/30-worklog/tasks/20260828-marketplace-mlm06-remediation-6d3a9c82.md b/.project-docs/30-worklog/tasks/20260828-marketplace-mlm06-remediation-6d3a9c82.md deleted file mode 100644 index 65964e9..0000000 --- a/.project-docs/30-worklog/tasks/20260828-marketplace-mlm06-remediation-6d3a9c82.md +++ /dev/null @@ -1,255 +0,0 @@ -# Task: Marketplace MLM-06 fixed-range remediation - -## Identity - -- Task ID: 20260828-marketplace-mlm06-remediation-6d3a9c82 -- Mode: Feature -- Branch: codex/20260828-marketplace-mlm06-remediation-6d3a9c82-marketplace-mlm06-remediation -- Worktree: D:\Datas\OthersProjects\makelore-plugin-marketplace-client-mlm06-remediation-6d3a9c82 -- Base commit: 8dfa5428606076b847966750134061de6fbe91ba -- Owner: marketplace-mlm06-remediator -- Status: Ready for Integration - -## Scope - -- Implement the sole MLM-06 fixed-range remediation from the exact reviewed - client head `8dfa5428606076b847966750134061de6fbe91ba`. -- Close all 11 deduplicated actionable roots from the Standards and Spec reviews: - skill/package-root pairing; explicit device uninstall; packaged trust proof; - precise package-store orphan recovery; same-account Library read ordering; - README architecture/product synchronization; whole-response Marketplace - deadlines; cached-release rollback current selection; cross-plugin mutation - intent ordering; explicit-beta Main/My Plugins action; and bounded yanked, - incompatible, signature, and unavailable projections. -- Own only the remediation seams and their focused tests: `electron/coding-plugins` - registry/resource loading, Package Store/account cache/marketplace client and - lifecycle seams; the packaged artifact verifier and proof; Main Marketplace - beta/status projection; Renderer Marketplace/My Plugins stores/facades/pages; - `README.md`; and this task record. Preserve all unrelated changes already in - the coordinator product head. - -## Intent And Constraints - -- Use one isolated feature worktree and one source commit. The source commit must - have sole parent `8dfa5428606076b847966750134061de6fbe91ba`, be clean, and end - in `READY_FOR_INTEGRATION` after task documentation gates. -- Keep every mutation behind the existing Main Host API and closed DTOs. Do not - add Provider/hosted runtime, billing, Token Point, arbitrary code/MCP/hooks, - project schema changes, or XMA-01/live/deployment work. -- Preserve the single frozen effective snapshot. Every Skill entry must remain - paired with its verified package root through resource loading, bridge, CLI, - and lifecycle consumers; no compatibility union or first-match root fallback. -- Explicit device uninstall is distinct from Library remove: it may remove an - unprotected installed package, while active workers and account snapshots keep - their releases protected and Library rows remain intact. -- Packaged trust proof must inspect the actual packaged `app.asar`/build artifact - trust source and prove no private key; checkout source files are not evidence. -- Orphan recovery may reuse/remove only the exact, fully validated matching - plugin/release package left by the interrupted rename/index sequence. -- Same-account Library reads use current selection intent/generation; the - different-plugin mutation race uses its own request intent/epoch allocated - before the request. Account A/B isolation, duplicate coalescing, and explicit - beta/current-versus-stable semantics remain intact. -- Request deadlines cover both Marketplace response headers and body consumption - under one overall Abort/deadline. Rollback changes the Package Store current - selection while retaining immutable releases and active-worker freeze. -- UI changes stay in the existing light design system, use bounded user copy and - explicit transitions/hit targets, and record Before/After interface impact in - this task record. Keep the official platform public-key production activation - hold explicit. - -## Project Context Loaded - -Task context: -- Task ID: `20260828-marketplace-mlm06-remediation-6d3a9c82` -- Mode: Feature -- Branch: `codex/20260828-marketplace-mlm06-remediation-6d3a9c82-marketplace-mlm06-remediation` -- Worktree: `D:\Datas\OthersProjects\makelore-plugin-marketplace-client-mlm06-remediation-6d3a9c82` -- Base commit: `8dfa5428606076b847966750134061de6fbe91ba` -- Other active local tasks: Marketplace coordinator; earlier MLM-01 through - MLM-05 records/worktrees; MLM-06 Standards and Spec fixed-range review records. -- Overlap or semantic-conflict assessment: Overlap is intentional and limited to - the listed review-accepted seams. No peer may write this remediation worktree, - and no semantic conflict remains with the accepted Release A boundary. The - same-account Library read race and different-plugin mutation race are separate - state-intent problems with separate tests and guards. User root worktrees and - all server/Operations worktrees remain out of scope. - -Read: -- `C:\Users\7brot\.agents\skills\implement-spec\SKILL.md` -- `C:\Users\7brot\.codex\skills\maintain-project-docs\SKILL.md` -- `C:\Users\7brot\.codex\skills\make-interfaces-feel-better\SKILL.md` and - `typography.md`, `surfaces.md`, `animations.md`, `performance.md` -- `D:\Datas\OthersProjects\makelore\AGENTS.md`, project-memory startup set, - architecture/domain/evidence/reflection/commitment/stale indexes, and peer - task records -- canonical Marketplace implementation spec, ticket graph, and accepted design - proposal in `D:\Datas\PythonProjects\works-square-server-plugin-marketplace-spec-7c2e9a41` - -Relevant understanding: -- Main owns authentication, filesystem, Marketplace access, package trust, - install paths, release/admission authority, and bounded error projection; - Renderer consumes closed safe projections only. -- Release A separates Operations publication, account Library, device install, - project selection, Agent assignment, runtime authorization, and billing. - Acquire/download/install/update/enable/assignment never write Token Points. -- Schema-v1 bundled Data Service and schema-v2 declarative `skill_only` remain - the only active runtime paths. Release B Provider/hosted/charges is closed. -- The coordinator head already passed the first fixed-range reviews except the - listed review roots. This task must preserve its single effective resolver, - frozen worker snapshots, account isolation, and current UI contract. - -Gate result: -- Concurrent Task Gate: Passed. `check_project_docs.py` passed; task-context - ownership exactly matches the task ID, owner, feature mode, branch, isolated - worktree, and exact base. -- Planning Gate: Passed. Required memory/spec/design/peer scope was read; the - accepted review findings provide disjoint, explicit ownership and no unresolved - semantic conflict blocks the remediation plan. - -## Implementation Plan - -1. Add failing tests for each accepted root at its existing seam, including - duplicate relative Skill paths, install/delete protection states, app.asar - trust proof, exact orphan recovery, header/body timeout, rollback projection, - same-account read intent, cross-plugin mutation epochs, explicit beta/status - projections, and bounded UI copy/routes. -2. Implement the smallest cohesive fixes in registry/resource loader, package - store/account cache/marketplace client, verifier, Main projection, and - Renderer store/pages. Keep immutable release and account/admission boundaries. -3. Run focused and adjacent unit suites after each red/green seam, then typecheck, - lint, Vite build, Marketplace E2E, Windows Electron/package/artifact proof, - and document drift. Record unrelated baseline failures without widening scope. -4. Update outcome/verification and complete task-context only after a clean single - source commit with the exact sole parent. - -## Outcome - -- Implemented the complete MLM-06 fixed-range remediation in the isolated client - worktree without changing the coordinator or user root worktrees. The single - frozen effective snapshot now preserves each marketplace Skill with its - verified package root, and the same pairing flows through resource loading, - Extension Host registration, CLI/context, and lifecycle consumers. Package - Store state now has an explicit current-release selection, exact orphan - recovery, explicit device uninstall, active-worker protection, and account - resolve-cache invalidation without changing Library membership. Marketplace - body and header reads share one bounded deadline; Main exposes the explicit - beta action and bounded release/library/runtime errors; Renderer state keeps - same-account reads and cross-plugin mutations ordered by their own intent - generations. The packaged proof reads the actual app.asar trust seam and - records a code-owned, empty, fail-closed trust table with no private-key or - runtime-key override. README now documents the Marketplace/My Plugins/Project - Plugins separation and Main/Package Store/effective-runtime architecture. - -### Fixed-range roots - -1. Skill/package-root pairing: effective snapshot entries retain the verified - package root; resource loading no longer selects the first matching root, and - collision coverage proves two same-relative-path Skills stay isolated. -2. Device uninstall: explicit uninstall removes only the unprotected device - package and its account resolve-cache entry; Library rows remain, active - workers and snapshots remain protected, and a later resolve can reinstall. -3. Packaged trust proof: verifier reads compiled JavaScript from the actual - app.asar, recognizes the code-owned provenance marker plus empty frozen - table, and rejects environment/private-key material. The official production - Ed25519 public key is still an explicit activation HOLD. -4. Orphan recovery: a crash left between release-directory rename and index - write recovers only the exact plugin/release directory with its matching - archive and fully validated descriptor/artifact/signature/compatibility; - unrelated or incomplete directories remain conflicts. -5. Same-account Library reads: generation and mutation-epoch guards prevent an - older response from replacing a newer read intent while preserving duplicate - request coalescing. -6. Documentation: README covers Marketplace, My Plugins, Project Plugins, - Main, Package Store, effective snapshots, skill-only scope, and production - key activation HOLD. -7. Request deadline: Marketplace headers and bounded body consumption execute - under one Abort/deadline, including never-body response coverage. -8. Rollback selection: cached immutable releases switch an explicit Package - Store current pointer; projections and next workers use that pointer rather - than installed-time ordering, while active workers stay frozen. -9. Library mutation ordering: each mutation allocates its request intent before - sending; stale responses cannot overwrite newer different-plugin mutations, - with both completion orders and account A/B isolation covered. -10. Explicit beta: Main has a real beta route/facade and My Plugins exposes a - user-triggered Beta action only; beta never follows stable rollout buckets - or auto-acquires a release. -11. Bounded status projection: yanked, incompatible, signature, artifact, - runtime-suspended, library-required, and backend-unavailable results remain - distinct through Main/Host/Renderer routes and bounded My Plugins copy, - including cached/unavailable Library entries. - -### Interface impact - -- Before: My Plugins and Project Plugins could expose stale or ambiguous - installation state, and release errors collapsed into generic unavailable - messages; Marketplace requests could hang after headers; Beta had no explicit - Main action. -- After: the existing light design system presents explicit Beta, install, - unavailable, and rollback-aware states with bounded Chinese copy, stable hit - targets, and independent loading/mutation transitions. No new authority, - account identity, filesystem path, or open-ended runtime payload crosses into - Renderer. - -## Verification - -- Planning/concurrency gates: `check_project_docs.py` passed; task-context - identity matched task ID, owner, feature mode, branch, isolated worktree, and - exact base `8dfa5428606076b847966750134061de6fbe91ba`. -- First natural RED: the five review-targeted suites reported **33 passed / 9 - failed**; failures covered unpaired same-entryPath Skill roots, uninstall - remaining kept, missing packaged trust reader, never-body deadline, and stale - intent commits. No source implementation was treated as green before these - failures were observed. -- Focused GREEN checkpoints: initial package/resource seams **18 + 8 passed**; - final fixed-range focused run **8 files / 82 passed**; post-marker trust and - contract run **2 files / 30 passed**; the broader focused checkpoint was **9 - files / 101 passed**. Adjacent Marketplace/Pi/Host/Package Store suites were - **13 files / 66 passed**. -- `pnpm exec vitest run --exclude tests/unit/coding-chat-pressure.test.tsx - --maxWorkers=1`: **208 files / 1779 passed / 2 skipped**. The repository - `pnpm test` 4-worker attempt reached **207 files / 1769 passed / 2 skipped** - before one Vitest worker exited unexpectedly without an assertion failure; - the serial rerun is the final full-unit evidence. -- `pnpm exec vitest run tests/unit/coding-chat-pressure.test.tsx - --maxWorkers=1`: **1 file / 1 passed**. -- `pnpm run typecheck`: passed after the final trust-marker change. - `pnpm run lint:check`: **0 errors**, five existing warnings in - `src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`. -- `pnpm run build:vite`: passed for Renderer, Main, Preload, and utility - bundles; only existing dynamic-import/chunk-size warnings. The final - `pnpm run package:stage:win-x64` also passed with **130 packages / 6 assets**. -- `pnpm run test:e2e`: **27 passed / 1 failed**. Marketplace catalog/detail - flow and Project Plugins passed. The one unchanged baseline failure is - `tests/e2e/pi-coding-first-chat.spec.ts:539`: the existing `当前对话模型` - combobox remained disabled during `selectOption` until its 30-second timeout; - no Marketplace test failed. -- `pnpm run test:electron:windows`: **2 files / 6 passed**. -- `pnpm run package:win`: Python win32-x64 and x64 staging were successful, but - the required win32-arm64 uv download from GitHub failed with - `UND_ERR_CONNECT_TIMEOUT`; this is recorded as an environment deviation and - is not claimed as a full package:win pass. Direct Electron Builder then - produced the x64 unpacked/NSIS artifact successfully. -- `pnpm run verify:artifact:pi`: passed against the actual fresh Windows - `app.asar`; Marketplace proof reports - `official-key-absent-fail-closed`, `productionKeyIds=[]`, and - `privateKeyMaterialInTrustSource=false`, with packaged Pi closure, bundled - Data Service resources, extension markers, and runtime probe passing. The - verifier no longer reads checkout `trusted-keys.ts`. -- Pre-commit source checks: `git diff --check` and the fixed-range forbidden - source scan passed. No Provider/hosted runtime, billing, Token Point, - arbitrary code/MCP/hooks, publication, XMA-01, push, PR, or deploy was added. - -## Follow-ups - -- Official platform Ed25519 public key material has not been supplied; keep - production activation on HOLD. Tests use only injected temporary key stores, - and no production private key was generated or committed. -- The full multi-architecture `package:win` remains dependent on the external - GitHub win32-arm64 uv download; x64 artifact evidence is separate and - complete. Keep the known disabled-model-combobox E2E baseline visible until - its owning runtime test is fixed. - -## Promotion Candidates - -- None recorded. diff --git a/.project-docs/30-worklog/tasks/20260828-plugin-marketplace-client-5f8b3d72.md b/.project-docs/30-worklog/tasks/20260828-plugin-marketplace-client-5f8b3d72.md index 5e57322..64a11b7 100644 --- a/.project-docs/30-worklog/tasks/20260828-plugin-marketplace-client-5f8b3d72.md +++ b/.project-docs/30-worklog/tasks/20260828-plugin-marketplace-client-5f8b3d72.md @@ -112,6 +112,12 @@ commit `3ab257d3f0226ecba40166f306b939319061e551` was integrated without conflict as coordinator product commit `43c464a556d32a1ac564a5bb79f92741c4d9d635`. +- MLM-06 fixed-range Standards and Spec review found eleven deduplicated roots. + The sole remediation task `20260828-marketplace-mlm06-remediation-6d3a9c82` + completed from exact frontier `8dfa5428606076b847966750134061de6fbe91ba` + as source commit `291b64ab0ef4779a44e09a386de31332abe1f57b` and was integrated + without conflict as coordinator product commit + `1614f7efc1fc81efc3b4d1c80827948976f1427b`. ## Outcome @@ -148,6 +154,13 @@ unknown project IDs, typed Data Service settings, account/project generation, and mutation epochs are bounded in Renderer state. No account, filesystem path, Release Admission, token, or signed URL authority enters Renderer. +- MLM-06 remediation paired every frozen Skill with its verified package root, + separated explicit device uninstall from Library removal, added exact Package + Store orphan recovery and current-Release selection, bounded whole-response + deadlines, and serialized same-account reads and cross-Plugin mutations by intent. + It also exposed explicit beta and bounded unavailable states through Main/Renderer, + made the packed trust proof read the real `app.asar`, and synchronized README. + Official-key absence remains a fail-closed production activation hold. ## Verification @@ -198,6 +211,18 @@ found schema-2 `skill_only`, unknown-key fail-closed, Library/install/update/ effective routes, Renderer assets, and no private-key/runtime-key override. Official public-key production trust remains HOLD. +- MLM-06 verification passed focused 82 tests, trust/contract 30 tests, adjacent 66 + tests, complete single-worker Vitest `1779 passed, 2 skipped`, the pressure case, + typecheck, lint with zero errors and five unchanged warnings, Vite build, six + Windows Electron tests, and Marketplace E2E. Full E2E passed 27 of 28; the only + failure remained the unchanged disabled-model-combobox timeout. The four-worker + unit run reached 207/208 files and 1769 passes before one assertion-free worker + exit; the complete one-worker rerun is the product result. Windows x64 staging and + building passed; the aggregate `package:win` arm64 uv download hit an external + GitHub connect timeout. Both Pi and Windows artifact verifiers passed on the clean + final source commit, with embedded `gitCommit` and `verificationHead` equal to + `291b64a...`; the real packed trust source contains no private key and fails closed + while the official public key is absent. ## Follow-ups