diff --git a/.project-docs/20-architecture/data-flow.md b/.project-docs/20-architecture/data-flow.md index 13ee9dc..1f3edef 100644 --- a/.project-docs/20-architecture/data-flow.md +++ b/.project-docs/20-architecture/data-flow.md @@ -4,6 +4,9 @@ | Flow | Source | Destination | Notes | |---|---|---|---| +| Marketplace catalog and Account Library | Signed-in Renderer intent | bounded Host API → Main Marketplace client/cache → Works Square catalog, Library, resolve, Admission, and download APIs | Main binds requests to the current Account and response generation. Free acquisition changes only Account Library; it does not install, enable a project, assign an Agent Skill, or authorize runtime execution. | +| Marketplace device installation | Account Library entry and explicit channel | Main resolve/Admission/download → descriptor/signature/archive/client compatibility verification → immutable Package Store index switch | Stable and explicit Beta remain distinct even when they resolve to the same immutable Release. Failed install/update retains the previous current release; explicit uninstall waits only for protecting worker/account references and completes after the final worker exits. | +| Effective Plugin worker snapshot | Installed trusted package + project selection + Agent assignments + current server policy | effective resolver → Registry/resource loader/Extension Host/tool catalog → parent Pi worker | One frozen snapshot supplies Skills, tools, package roots, and runtime authorization. Disable, account/project switch, logout, Renderer crash, Main shutdown, or worker generation change invalidates future actions without mutating persisted unknown assignments; child workers receive no Plugin projection. | | 桌面认证生命周期 | Renderer 登录、刷新与注销请求 | Host API → Main Works Session → Works Square `/api/auth/{login,mobile-login,refresh,logout}` → one-feel auth | Main 加密持有并先持久化轮换 token；客户端不携带 OAuth client secret；连续 7 天未使用才清除会话，终止性 `400`/`401` fail closed | | 用户模块入口策略 | 会话恢复 / 登录 / 刷新 | Electron Main → Works `/api/auth/me` → 四布尔安全投影 → Renderer auth store → 卡片/路由/provider gate | 缺失对象或字段默认 `true`；`design` 映射 `painting`；终止性 `401` 清理 Main/Renderer 会话；全局 `/settings` 不受 Code gate | | 项目创建 | 新建项目对话框 | Host API → Main 项目初始化 | 创建时固定 `ProjectType`；小游戏/小程序原子生成受控模板，自定义只生成项目空间 | diff --git a/.project-docs/20-architecture/module-map.md b/.project-docs/20-architecture/module-map.md index 703c5a1..b58c7f4 100644 --- a/.project-docs/20-architecture/module-map.md +++ b/.project-docs/20-architecture/module-map.md @@ -4,6 +4,10 @@ | Path | Responsibility | Owner Notes | |---|---|---| +| `electron/coding-plugins/manifest.ts`, `release-descriptor.ts`, `signature-verifier.ts`, and `trusted-keys.ts` | Closed Plugin package/descriptor parsing, compatibility checks, canonical archive validation, and Ed25519 trust | Schema 1 bundled compatibility and schema 2 `skill_only`/declarative `platform_hosted` are parsed fail closed. The production trust store accepts no Marketplace package until the official public key is built in. | +| `electron/coding-plugins/account-plugin-cache.ts`, `marketplace-client.ts`, and `package-store.ts` | Main-owned Account Library cache, authenticated server client, and atomic immutable device installation store | Account acquisition and device installation are separate. Package bytes switch atomically only after descriptor, signature, archive, client-range, and provenance checks; failed updates preserve the prior current release. | +| `electron/coding-plugins/effective-resolver.ts`, `registry.ts`, `project-service.ts`, and `electron/coding-runtime/pi/**` | One effective installed-plugin projection and frozen parent-worker runtime snapshot | Project enablement and Agent Skill assignment are preserved independently. Only trusted, compatible, installed, policy-admitted resources enter a new parent worker; child workers remain empty and active workers retain frozen bytes until disposal. | +| `electron/api/routes/plugin-marketplace.ts`, `src/stores/plugin-marketplace.ts`, `src/pages/PluginMarketplace/`, `src/pages/MyPlugins/`, and `src/pages/ProjectPlugins/` | Bounded Main routes and Renderer projections for catalog, Library, device, and project actions | Renderer receives no Account token, filesystem path, Admission, package bytes, or signed download URL. Catalog/Library/device/project generations prevent stale A/B or cross-action results from replacing current state. | | `src/components/works/ProjectPublishAction.tsx` | 可发布项目的一键提交、云构建轮询与用户可理解状态 | 只通过 Renderer API 提交非敏感元数据；绑定告警不终止轮询 | | `src/lib/works-square.ts` | Renderer 侧 Works Square Host API 契约与安全错误映射 | 不接触 Token、ZIP、本地绝对路径或自动部署状态 | | `electron/api/routes/works.ts` | Works Host API、Renderer capability 门禁、上游安全投影 | 发布凭据、打包、上传与本地绑定均在 Main 内完成 | diff --git a/.project-docs/30-worklog/current-state.md b/.project-docs/30-worklog/current-state.md index 2d39193..3a7188c 100644 --- a/.project-docs/30-worklog/current-state.md +++ b/.project-docs/30-worklog/current-state.md @@ -4,6 +4,19 @@ This file is the integrated default-branch snapshot. Feature tasks record progre ## Integrated Through +- MakeLore curated Plugin Marketplace Release A source + `40df677a31ff7651f962151eb84b925987781c03` from task + `20260828-plugin-marketplace-client-5f8b3d72` is integrated by task + `20260830-integrate-plugin-marketplace-client-6e3b9d82`. Electron Main now owns + the authenticated Marketplace/Library client, immutable Package Store, trusted + release verification, effective installed-plugin resolution, and frozen Pi worker + materialization; Renderer exposes Marketplace, My Plugins, and Project Plugins + projections without receiving credentials, paths, Admissions, or signed URLs. + Data Service remains system-included and consumes zero Token Points. R7 Standards + and Spec reviews passed with zero findings, and XMA-01 passed all twelve live groups + against real PostgreSQL and a signed-in packaged Windows client. Production trust + activation remains HOLD until the official Ed25519 public key is built in; Release B + and hosted Provider runtime remain closed. - Updater downgrade-prevention source commit `2e61800` from feature task `20260826-fix-version-update-check-7c91a4` is integrated by task `20260826-recover-pi-updater-integration-8f3a6c21`. Every automatic-update diff --git a/.project-docs/30-worklog/tasks/20260826-makelore-data-service-client-b72e4c19.md b/.project-docs/30-worklog/tasks/20260826-makelore-data-service-client-b72e4c19.md deleted file mode 100644 index ba75a31..0000000 --- a/.project-docs/30-worklog/tasks/20260826-makelore-data-service-client-b72e4c19.md +++ /dev/null @@ -1,510 +0,0 @@ -# Task: Implement MakeLore Development Data Service P0 client - -## Identity - -- Task ID: 20260826-makelore-data-service-client-b72e4c19 -- Mode: Feature -- Branch: codex/20260826-makelore-data-service-client-b72e4c19-makelore-data-service-client -- Worktree: D:\Datas\OthersProjects\makelore-data-service-client-b72e4c19 -- Base commit: f2456039230f68e3ecb2c8653fc3379c23bbe5ce -- Owner: codex-root -- Status: In Progress (implementation, review, and X-01 complete; draft PR publication externally blocked) - -## Scope - -- Coordinate the repository-local `implement-spec` run for client tickets ML-00 - through ML-09 from post-Pi-integration base - `f2456039230f68e3ecb2c8653fc3379c23bbe5ce`. -- Deliver durable MakeLore project identity, Main-owned Data Service cloud/Host - operations, purpose-specific Pi tools, preview data sessions and CDP injection, - the thin generated SDK, bundled Data Service Skill, focused/full verification, - repository-local review, and one remediation pass when findings require it. -- Own the client implementation branch and merge only commits returned by isolated - ticket worktrees in dependency order. - -## Intent And Constraints - -- Follow the server repository's implementation specification, ticket graph, - canonical integration contract, and accepted ADR without reopening the frozen P0 - product scope. -- Preserve the integrated Pi `0.84.2` hard cutover, product-neutral Snapshot/Patch - contracts, Main/Renderer trust boundary, current Host route ordering, and the - existing Agent Browser abstraction. -- `.niancode/project.json` owns the durable optional `projectId`; local project IDs, - Pi session/resource IDs, and the `opencode-projects` compatibility store name remain - local identities. -- Electron Main remains the only Works credential owner. Generated code receives only - an ephemeral exact-Origin data capability; no credential, owner, path, arbitrary - endpoint, or cloud project ID becomes a model-controlled input. -- Do not restore OpenCode, add Firebase compatibility, published-runtime support, - retries for ambiguous writes, a filesystem-copy engine, or a generic operation - multiplexer. -- The root `main` worktree remains clean and unowned. All writes stay in this isolated - coordinator worktree or ticket-specific linked worktrees. - -## Planning Gate - -- Result: Passed on 2026-08-26. -- Loaded MakeLore `AGENTS.md`, required project-memory entry documents, current state, - accepted auth and Pi decisions, relevant architecture/domain/evidence/commitment - material, the cross-repository Data Service spec/graph/contract, and the exact Pi, - Host API, project-storage, session, and Agent Browser seams at the recorded base. -- Registry review found 147 historical owners. Most are ready-for-integration and - represented in the selected base. Ten remain marked planning; nine have placeholder - scopes and therefore unknown coordination state, while one owns an unrelated AI - Design E2E file. No declared Data Service or owned-path semantic conflict exists. -- Real PostgreSQL, signed-in accounts, deployment inputs, and platform-specific E2E - prerequisites remain external acceptance inputs and will not be inferred as passed. - -## Ticket Ownership - -- ML-00: coordinator in this worktree. -- ML-01 through ML-07: isolated implementer worktrees from the exact merged frontier - commit, with the file ownership defined by the ticket graph. -- ML-08: repository-local merger in this implementation worktree. -- ML-09: read-only review followed by one isolated remediation implementer if needed. -- X-01: coordinated only after reviewed server and client branches are ready. - -## Outcome - -- Integrated ML-01 project identity from the exact integration frontier - `7e54b8fbda1899b73334d7c3e732ce8e73460ed8` with no cherry-pick conflict. - Implementer commit `274172ac9d7ea2468242448d4b0b19fd2205f8fb` was - cherry-picked as feature commit `43f58fc` (`feat(coding): add durable - project identity core`). The delivered scope is limited to identity core, - coding-project Host routes/composition and callback wiring, release-proof - fixtures, and focused tests. The implementer task record was removed from - this coordinator's net diff; the source worktree retains its own record. -- Integrated ML-02 identity UX from the exact ML-01 frontier - `5ac08d509f8962a3c2c0ec1b1afef84a435f116d` with no cherry-pick conflict. - Implementer commit `363660a81b3f79ffab4594763170932790f41299` was - cherry-picked as feature commit `ce8e210` (`feat(coding): add project - identity UX`). The delivered scope is limited to the Sidebar and Project - Configuration identity controls, Renderer facade/store projections, focused - tests, and identity E2E; no Main, cloud, session, or provisioning logic was - added. The foreign ML-02 task record was deleted from this coordinator's net - diff after cherry-pick; the source worktree retains its own record. -- Integrated ML-03 Main Data Service from the exact ML-02 frontier - `003fe210f49de37c7ddf49cf10acde38705bf8c3` with no cherry-pick conflict. - Implementer commit `10d8132cc34f1a69fafdd9e9f7ff3693888fc3fc` was - cherry-picked as feature commit `c19227a` (`feat(coding): add Main Data - Service Host adapter`). The delivered scope is limited to the Main-owned - cloud client, shared safe DTOs, `DataServiceOperations` coding composition, - fixed `/api/works/data-service` Host routes, route precedence before the - Works catch-all, and focused tests; no preview/Pi/Renderer credential or - unrelated transport logic was added. The foreign ML-03 task record was - deleted from this coordinator after cherry-pick; the source worktree retains - its own record. The ML-04 frontier is this integrated commit plus the - coordinator's cleanup/record commit. -- Applied the ML-03 post-merge correctness correction from source commit - `0ecceef15d2e43190f835fd71a7a1478222f1ba8` onto coordinator frontier - `e15d8b7f51bea6b56558c981964082a4e76e523c`. The expected modify/delete - conflict was limited to the already-removed foreign ML-03 task record; it - was kept deleted, and the correction cherry-picked as feature commit - `6b36753` (`fix(coding): reject mismatched Data Service errors`). The Main - client now rejects known error codes paired with undocumented HTTP statuses - as `upstream_invalid_response`, with one focused regression test. The ML-04 - frontier is `6b36753` plus this coordinator record commit. -- Integrated ML-04 from source commits - `e4fdeaea02cab216f4e7ff4543d57ca9e2aab33b` and - `93609d5890b6be4c51c083125d3d8ab7ebd3d02d` in the requested order as - coordinator commits `1d63233cd03425e9158b9c4868b3cfc0e508bc6f` and - `f61990f3a7f5ea417ca3eecc6702e71398f77d7f`. Git auto-merged the known - `data-service-client.ts` overlap without a conflict; the ML-03 - `ERROR_STATUS_BY_CODE` ↔ HTTP-status validation remains alongside the ML-04 - trusted `projectPath` authority seam. The ten parent-only underscore tools, - closed inputs, shared in-process `DataServiceOperations`, safe details and - literal confirmation behavior are retained. The foreign ML-04 task record - was removed from this coordinator after both cherry-picks; the source record - remains in `D:\Datas\OthersProjects\makelore-ml04-pi-data-tools-8d3c91a7`. - The ML-04 frontier is `f61990f3a7f5ea417ca3eecc6702e71398f77d7f` plus this - coordinator cleanup/record commit. -- Integrated ML-05 from source commit - `080b8801d29274b506700f94391339d98fb7aa0d` at the exact ML-04 frontier - `bec67082b3dade05e900911c13ad804e781309f6` as coordinator commit `e842dd4` - (`feat(coding): add preview data runtime session`), with no cherry-pick - conflict. The delivered scope is limited to the Main-owned ephemeral - preview session manager, exact `/api/runtime/data/v1` data-only routes, - early route precedence, trusted Data Service forwarding, lifecycle - invalidation wiring, and focused loopback coverage; ML-06 pre-document - injection was not included. The foreign ML-05 task record was removed from - this coordinator after cherry-pick; the source record remains in - `D:\Datas\OthersProjects\makelore-ml05-preview-data-session-5c8e2a71`. - The ML-06 frontier is `e842dd4` plus this coordinator cleanup/record commit. -- Integrated ML-06 from source commit - `992a0a68d743f766f19bc34c245adca4431ba321` at the exact ML-05 frontier - `14fec701086f60d78466b8e1cc3fb57ca8d7e200` as coordinator commit `38d63a9` - (`feat(agent-browser): add opt-in preview data injection`), with no - cherry-pick conflict. The delivered scope is limited to the explicit Agent - Browser preview-data opt-in, exact-Origin CDP pre-document script lifecycle, - child-session tracking/cleanup, and Main/session invalidation wiring; the - ordinary arbitrary-URL path remains data-free and no second BrowserWindow or - preload was added. The foreign ML-06 task record was removed from this - coordinator after cherry-pick; the source record remains in - `D:\Datas\OthersProjects\makelore-ml06-agent-browser-injection-2c7e91a4`. - The ML-07 frontier is `38d63a9` plus this coordinator cleanup/record commit. -- Integrated ML-07 from source commit - `d22ceef104b4f95e7a35888875dcb1c18245c190` at the exact ML-06 frontier - `552c6162a57894b713ea1f47d356fa48c0fc0cf1` as coordinator commit `549069d` - (`feat(coding): add generated Data Service SDK skill`), with no cherry-pick - conflict. The delivered scope is limited to the bundled Data Service Skill, - canonical TypeScript/JavaScript SDK assets, existing skill registry/display - registration, and focused SDK/install/workflow tests. The source commit and - coordinator range contain no root `task_plan.md`, `findings.md`, or - `progress.md` scratch files. The foreign ML-07 task record was removed from - this coordinator after cherry-pick; the source record remains in - `D:\Datas\OthersProjects\makelore-ml07-data-service-sdk-skill-6b4e91c2`. - The ML-08 frontier is `549069d` plus this coordinator cleanup/record commit. -- Completed ML-08 merge-and-verify on the exact clean product frontier - `a981b07faaa64b20bf9aef6353218fef26695ca2`, with fixed client base - `f2456039230f68e3ecb2c8653fc3379c23bbe5ce`. ML-01 through ML-07 are present - in dependency order through that product HEAD; this step made no product - changes. The five required verification commands and their one known E2E - failure are recorded below. The product HEAD immediately before this - documentation update was `a981b07faaa64b20bf9aef6353218fef26695ca2`. -- Integrated ML-09 remediation source commit - `b5060f254bfdb3a748739b74b1f583cc0236fa7c` from its exact parent - `239e20d2cf2242d636f9d42684f76f5777d9d1ee` as coordinator product commit - `38843e091fbbe68ec934336b8ed3a08c955afb28`, with no cherry-pick conflict. - The eight accepted review findings are all represented in the coordinator: - normal Pi parent Data Service allowlisting; camelCase Skill input; - credential-free HTTP/HTTPS loopback Origins; browser-generation lifecycle - fencing; README/Skill workflow documentation; narrow shared route parsers; - removal of the unused Agent Browser `onLifecycle` option; and removal of the - unused `handleDataServiceRoute` alias. The foreign ML-09 task record was - deleted from this coordinator while its source record remains in - `D:\Datas\OthersProjects\makelore-ml09-data-service-remediation-5e7c2a91`. - The product frontier after this merge is `38843e091fbbe68ec934336b8ed3a08c955afb28`. -- Final ML-09 repository-local review is complete over the fixed client review - range `f2456039230f68e3ecb2c8653fc3379c23bbe5ce` → - `bb832c66660d993baa6147cf058078a5cd89fcb2`. Standards: PASS. Spec: PASS. - ML-00 through ML-09 product delivery, review, and the single remediation - pass are complete; this conclusion does not claim the external X-01 live - acceptance. - -## Verification - -- `pnpm exec vitest run tests/unit/coding-project-identity.test.ts - tests/unit/coding-projects-migration.test.ts - tests/unit/coding-core-routes.test.ts - tests/unit/coding-projects-schema-v2.test.ts`: 4 files / 48 tests passed. -- `pnpm typecheck`: passed. -- `pnpm lint:check`: passed with 0 errors and 5 pre-existing warnings in - `src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`; none are in - the ML-01 paths. -- `git diff --check`: passed. -- Cherry-pick parent, coordinator branch, and required integration frontier - were verified against `7e54b8fbda1899b73334d7c3e732ce8e73460ed8` before - integration; the cherry-pick completed without conflicts. -- ML-02 focused Renderer tests: - `pnpm exec vitest run tests/unit/coding-projects-facade.test.ts - tests/unit/project-config-store.test.ts - tests/unit/coding-workspace-store.test.ts --maxWorkers=1`: 3 files / 10 - tests passed. -- `pnpm build:vite`: passed; generated the Main/Preload bundles required by - the Electron fixture. -- `pnpm test:electron:windows`: 2 files / 4 tests passed. -- `pnpm exec playwright test tests/e2e/coding-project-identity.spec.ts - --config=playwright.config.ts`: 2 tests passed after the Vite build. -- `pnpm exec playwright test - tests/e2e/project-configuration-skills.spec.ts - --config=playwright.config.ts`: 1 test passed. -- `pnpm typecheck`: passed. -- `pnpm lint:check`: passed with 0 errors and 5 pre-existing warnings in - `src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`; none are in - the ML-02 paths. -- `git diff --check`: passed; the net ML-02 path audit contains only Renderer - UI/facade/store and tests, with no `electron/`, `resources/`, or `scripts/` - files. -- Implementer-provided broader results (not rerun by this merger): `pnpm test` - passed with 183 files / 1554 tests and 2 skipped; the full E2E run passed 25 - tests and reproduced one pre-existing PI model-combobox failure at - `tests/e2e/pi-coding-first-chat.spec.ts:575` on its direct rerun. This - unrelated failure remains visible and is not masked by the focused passes. -- ML-03 focused tests: `pnpm exec vitest run - tests/unit/data-service-client.test.ts tests/unit/data-service-routes.test.ts - tests/unit/data-service-server-registration.test.ts --maxWorkers=1` — 3 - files / 17 tests passed. -- ML-03 regression tests: `pnpm exec vitest run - tests/unit/coding-core-routes.test.ts tests/unit/coding-project-identity.test.ts - tests/unit/host-api-proxy.test.ts tests/unit/works-routes.test.ts - --maxWorkers=1` — 4 files / 82 tests passed. -- `pnpm typecheck`: passed. -- `pnpm lint:check`: passed with 0 errors and the same 5 existing warnings in - `src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`. -- `git diff --check`: passed. -- Coordinator branch, clean state, exact ML-02 HEAD, and ML-03 commit parent - were verified before integration; cherry-pick completed without conflicts. -- ML-03 correction focused tests: the same 3-file command passed 18 tests after - integrating `6b36753`. -- ML-03 correction `pnpm typecheck`: passed. -- ML-03 correction `pnpm lint:check`: passed with 0 errors and the same 5 - existing warnings in `src/pages/Home/index.tsx` and - `src/pages/Makelore/index.tsx`. -- ML-03 correction `git diff --check`: passed. -- Correction cherry-pick was applied from the exact `e15d8b7` coordinator - frontier; only the expected foreign task-record modify/delete conflict - occurred, and the source record remains in the source worktree. -- The coordinator already had this task's Git-common ownership in feature mode - under `codex-root`; the required integration-mode resume was rejected by the - task gate, so the same task was resumed in its existing feature mode without - changing ownership, branch, or worktree. -- ML-04 Pi focused suite: `pnpm exec vitest run - tests/unit/pi-product-tools.test.ts tests/unit/pi-extension-bundle.test.ts - tests/unit/pi-extension-host.test.ts --maxWorkers=1` — 3 files / 23 tests - passed. -- ML-04 Data Service/projector + Pi focused suite: - `pnpm exec vitest run tests/unit/data-service-client.test.ts - tests/unit/data-service-routes.test.ts - tests/unit/data-service-server-registration.test.ts - tests/unit/coding-conversation-contracts.test.ts - tests/unit/coding-conversation-timeline.test.tsx - tests/unit/coding-product-tools-facade.test.ts - tests/unit/pi-extension-ui-projector.test.ts - tests/unit/pi-product-tools.test.ts tests/unit/pi-extension-bundle.test.ts - tests/unit/pi-extension-host.test.ts --maxWorkers=1` — 10 files / 62 tests - passed. -- ML-04 `pnpm typecheck`: passed. -- ML-04 `pnpm lint:check`: passed with 0 errors and the same 5 pre-existing - warnings in `src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`. -- ML-04 `git diff --check`: passed after the foreign task-record cleanup. -- ML-05 source focused/loopback suite: - `pnpm exec vitest run tests/unit/preview-data-session.test.ts - tests/unit/data-service-routes.test.ts tests/unit/coding-core-routes.test.ts - tests/unit/agent-browser-core.test.ts - tests/unit/coding-attachments-routes.test.ts --maxWorkers=1` — 5 files / - 107 tests passed. -- ML-05 adjacent Data Service/client regressions: - `pnpm exec vitest run tests/unit/data-service-client.test.ts - tests/unit/data-service-routes.test.ts - tests/unit/data-service-server-registration.test.ts - tests/unit/coding-conversation-contracts.test.ts - tests/unit/coding-conversation-timeline.test.tsx - tests/unit/coding-product-tools-facade.test.ts - tests/unit/pi-extension-ui-projector.test.ts tests/unit/pi-product-tools.test.ts - tests/unit/pi-extension-bundle.test.ts tests/unit/pi-extension-host.test.ts - --maxWorkers=1` — 10 files / 62 tests passed. -- ML-05 `pnpm typecheck`: passed. -- ML-05 `pnpm lint:check`: passed with 0 errors and the same 5 pre-existing - warnings in `src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`. -- ML-05 `pnpm build`: passed Vite, Electron, Pi runtime, and Windows NSIS - packaging; the existing dynamic-import/chunk, optional dependency, and - absent optional packaged-resource warnings remained visible. -- ML-05 `pnpm test:electron:windows`: 2 files / 4 tests passed. -- ML-05 `git diff --check`: passed; the only coordinator deletion is the - foreign ML-05 task record, and the source worktree retains it. -- ML-05 exclusion scan over the merged diff found no - `injectProjectData`, `__MAKELORE_DATA__`, - `Page.addScriptToEvaluateOnNewDocument`, script-ID tracking, or navigation - injection markers. -- ML-06 was integrated from source commit - `992a0a68d743f766f19bc34c245adca4431ba321` at the exact ML-05 frontier - `14fec701086f60d78466b8e1cc3fb57ca8d7e200` as coordinator commit `38d63a9` - (`feat(agent-browser): add opt-in preview data injection`), with no - cherry-pick conflict. The change adds only the explicit Agent Browser - preview-data opt-in, exact-Origin CDP pre-document script lifecycle, - child-session tracking/cleanup, and Main/session invalidation wiring. The - foreign ML-06 task record was removed from this coordinator after - cherry-pick; the source record remains in - `D:\Datas\OthersProjects\makelore-ml06-agent-browser-injection-2c7e91a4`. - The ML-07 frontier is `38d63a9` plus this coordinator cleanup/record commit. -- ML-06 focused Vitest: - `pnpm exec vitest run tests/unit/agent-browser-core.test.ts - tests/unit/agent-browser-routes.test.ts tests/unit/pi-product-tools.test.ts - tests/unit/coding-core-routes.test.ts --maxWorkers=1` — 4 files / 122 tests - passed. -- ML-05 preview regressions after ML-06: - `pnpm exec vitest run tests/unit/preview-data-session.test.ts - tests/unit/data-service-routes.test.ts tests/unit/coding-core-routes.test.ts - tests/unit/agent-browser-core.test.ts - tests/unit/coding-attachments-routes.test.ts --maxWorkers=1` — 5 files / - 120 tests passed. -- ML-06 `pnpm test:electron:windows`: 2 files / 4 tests passed. -- ML-06 `pnpm typecheck`: passed. -- ML-06 `pnpm lint:check`: passed with 0 errors and the same 5 pre-existing - warnings in `src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`. -- ML-06 `pnpm build:vite`: passed for renderer, Main, preload, and utility - worker; existing dynamic-import and large-chunk warnings remained visible. -- ML-06 full E2E `pnpm test:e2e`: 25 tests passed and 1 existing test failed - at `tests/e2e/pi-coding-first-chat.spec.ts:575` because the `当前对话模型` - combobox remained disabled until timeout. A direct rerun of that test - reproduced the same timeout; this is not an ML-06 injection path and is not - counted as an E2E pass. -- ML-06 boundary checks passed: no new `BrowserWindow` or preload was added, - the ordinary arbitrary-URL path remains data-free, and the expected changed - path list contains only Agent Browser/session wiring, route/Pi propagation, - focused tests, and the task record. -- ML-06 `git diff --check`: passed after foreign task-record cleanup. -- ML-07 focused SDK/Skill assets: - `pnpm exec vitest run tests/unit/data-service-sdk-assets.test.ts - --maxWorkers=1` — after normalizing coordinator checkout line endings to the - source's canonical LF bytes, 1 file / 14 tests passed. The initial checkout - run had 13 passed and 1 frontmatter assertion failure caused solely by - CRLF; the normalized working files hash exactly to their committed blobs. -- ML-07 adjacent registry/display/resource/Pi suite: - `pnpm exec vitest run tests/unit/data-service-sdk-assets.test.ts - tests/unit/skill-display.test.ts tests/unit/pi-resource-loader.test.ts - tests/unit/pi-product-tools.test.ts --maxWorkers=1` — 4 files / 34 tests - passed. Packaged resource listing includes `SKILL.md`, `assets/`, - `assets/makelore-data.ts`, and `assets/makelore-data.js`. -- ML-07 full unit verification: the normal parallel runner had 1 Vitest fork - worker exit unexpectedly after 187/188 files and 1606 passed tests (2 - skipped), with no assertion failure. The serial rerun - `pnpm exec vitest run --exclude tests/unit/coding-chat-pressure.test.tsx - --maxWorkers=1` passed 188 files / 1610 tests with 2 skipped, followed by - `pnpm exec vitest run tests/unit/coding-chat-pressure.test.tsx - --maxWorkers=1` — 1 test passed. -- ML-07 `pnpm typecheck`: passed. -- ML-07 `pnpm lint:check`: passed with 0 errors and the same 5 pre-existing - warnings in `src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`. -- ML-07 `pnpm build`: passed Vite, Electron, Pi runtime, and Windows NSIS - packaging; existing dynamic-import/chunk, optional dependency, and absent - optional packaged-resource warnings remained visible. -- ML-07 `pnpm test:electron:windows`: 2 files / 4 tests passed. -- ML-07 affected E2E: - `pnpm exec playwright test tests/e2e/project-configuration-skills.spec.ts - --config=playwright.config.ts` — 1 test passed. -- ML-07 SDK static boundary checks found no cloud credential, external URL, - retry call, cache/offline storage, Firebase, or Works Square behavior; the - only Authorization/Bearer use is the injected local preview token required - by the contract. Skill checks confirmed inspect → explicit - `data_service_configure` → `agent_browser` → read-back → report ordering and - the exact-copy/no-op/conflict policy. -- ML-07 root-scratch and boundary scans passed; changed paths are limited to - the Data Service skill assets, registry/display registration, focused tests, - and the task record. `git diff --check` passed after foreign task-record - cleanup. -- ML-08 precondition: coordinator branch was clean at product HEAD - `a981b07faaa64b20bf9aef6353218fef26695ca2`, based on - `f2456039230f68e3ecb2c8653fc3379c23bbe5ce`; no product file was changed by - this verification step. -- ML-08 command ledger (run in this coordinator worktree): - `pnpm typecheck` — exit 0, passed, approximately 5.32s. -- `pnpm lint:check` — exit 0, passed with 0 errors and the same 5 existing - warnings in `src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`, - approximately 10.01s. -- `pnpm test` — exit 0, passed; main suite 188 files / 1610 tests passed / 2 - skipped (Vitest-reported 42.86s), followed by the pressure suite 1 file / 1 - test passed (1.77s). No assertion failure or worker exit occurred. -- `pnpm test:electron:windows` — exit 0, passed; 2 files / 4 tests passed - (Vitest-reported 1.02s; command approximately 2.34s). -- `pnpm test:e2e` — exit 1; its required `build:vite` phases completed - successfully, then Playwright ran 26 tests with 25 passed and 1 failed. - The failure is the known `tests/e2e/pi-coding-first-chat.spec.ts:575` - `locator.selectOption` 30s timeout because combobox `当前对话模型` remained - disabled; this is not an E2E pass and remains a release/acceptance deviation. - Playwright reported approximately 1.0m for the run. The build emitted only - existing dynamic-import and chunk-size warnings. -- ML-08 post-command hygiene: `git diff --check` passed; the first drift - invocation was unavailable because `python` is not on the PowerShell PATH, - then the same `check_doc_drift.py --task-id - 20260826-makelore-data-service-client-b72e4c19` check passed using the - configured bundled Python runtime. Test/build output remained ignored and - the worktree was clean before this task-record update. -- ML-09 precondition: coordinator was clean at exact ML-08 HEAD - `239e20d2cf2242d636f9d42684f76f5777d9d1ee`; the remediation source parent - matched that HEAD exactly and cherry-pick produced product commit - `38843e091fbbe68ec934336b8ed3a08c955afb28`. -- ML-09 focused remediation ledger: the 10-file equivalent set - (`data-service-sdk-assets`, `data-service-server-registration`, - `pi-rpc-foundation`, `pi-worker-process-real`, `preview-data-session`, - `agent-browser-core`, `agent-browser-routes`, `data-service-routes`, - `pi-extension-bundle`, and `pi-extension-ui-projector`) passed with 142 - tests and 2 skipped; Vitest reported 16.45s. -- ML-09 adjacent regressions covering tool profile, Data Service client/routes, - preview/browser adapter, Skill resource, and Pi host paths: 8 files / 77 - tests passed; Vitest reported 6.75s. -- ML-09 `pnpm typecheck`: exit 0, passed, approximately 5.31s. -- ML-09 `pnpm lint:check`: exit 0, passed with 0 errors and the same 5 - existing warnings in `src/pages/Home/index.tsx` and - `src/pages/Makelore/index.tsx`. -- ML-09 `pnpm build`: exit 0, passed through Vite, staged Pi runtime, and - Windows Electron/NSIS packaging. Existing dynamic-import/chunk-size, - optional-resource, npm shell deprecation, absent optional resource, and - non-fatal NSIS patch/signing warnings remained visible. -- ML-09 `pnpm test:electron:windows`: exit 0, 2 files / 4 tests passed - (Vitest 1.04s; command approximately 2.28s). -- ML-09 affected E2E `pnpm exec playwright test - tests/e2e/project-configuration-skills.spec.ts --config=playwright.config.ts`: - exit 0, 1 test passed (2.9s). -- ML-09 affected Pi E2E `pnpm exec playwright test - tests/e2e/pi-coding-first-chat.spec.ts --config=playwright.config.ts`: - exit 1, 1 test passed and 1 failed (33.8s). The known failure remains at - `tests/e2e/pi-coding-first-chat.spec.ts:575`: `当前对话模型` resolves to a - disabled combobox and `selectOption` times out after 30s. It is not counted - as an E2E pass and no remediation diff evidence connects it to ML-09. -- ML-09 eight-item boundary checks all passed: the exact ten Data Service - names are used by the normal Pi parent default while child profiles remain - explicit and Data Service-free; Skill input uses only `injectProjectData`; - loopback Origin and generation guards are present; README/Skill docs are - present; both route modules use the narrow parser module while retaining - route-specific failures; `subscribeLifecycle` remains without - `onLifecycle`; and only `handleDataServiceRoutes` remains. The merged path - audit matched the expected 15 source paths with no extra or missing path, - and the added-lines scope scan found no Firebase, Redis, retry/cache, or - published-runtime expansion. -- Final ML-09 review ledger: fixed range - `f2456039230f68e3ecb2c8653fc3379c23bbe5ce` → - `bb832c66660d993baa6147cf058078a5cd89fcb2`; Standards PASS and Spec PASS. - ML-00 through ML-09 product/review scope is complete. This documentation - update changes no product files; the worktree remains held for X-01. - -### X-01 cross-repository acceptance - -- The installed Windows client used for final acceptance was staged from product HEAD - `c52a559b46f72273a02e2dba18e65a5f6c4224c9`, against reviewed server product - `13d4bc1b87c9d66cdd26b9a3c40f69d9c039a2e9`, disposable real PostgreSQL at Alembic - revision `20260826_0058_data_service`, and a disposable local signed identity - provider. Test identities were isolated aliases for account A, account B, - expired-session refresh, capacity quota, and mutation-rate cases; no production - credential or secret was used or persisted. -- Live acceptance exposed four client defects on the actual CDP path. The single - ML-09 remediation owner fixed them in committed product changes: preserve/defer the - exact target origin across initial `about:blank` injection (`0a4f526`, `afb5c10`), - enable the Page domain before installing root/child scripts (`23c49aa`), and bound - crashed-target cleanup so close/reopen cannot hang (`c52a559`). Each source task - added focused regression tests, passed its project-documentation gates, and was - integrated in order without editing the user root worktree. -- All 15 specification section 14 groups then passed through the packaged client: - lazy provisioning; configure plus preview write/read; restart and move; bind/raw - copy sharing; independent-copy separation; two-way owner isolation; one session - refresh; no-op/conflict/delete-recreate revision behavior; item/byte pagination and - cursor expiry; atomic quota/rate failures; collection/reset/orphan removal; exact - Origin and all ten lifecycle invalidations; external `runtime_unavailable`; and the - credential-absence ledger. Every invalidated preview endpoint became unusable, and - the data capability could not call general Host routes. -- Final product-head verification passed `pnpm typecheck`, `pnpm lint:check` with zero - errors and the same five existing warnings, `pnpm test` with 188 files / 1615 tests - passed and 2 skipped plus the single pressure test, and - `pnpm test:electron:windows` with 2 files / 4 tests. The packaged current-head build - was used for the successful live run. The earlier full Playwright run remains - accurately recorded as 25 passed / 1 existing unrelated model-selector timeout; it - is not relabeled as passed. -- Final post-X-01 review fixed the full committed product range - `f2456039230f68e3ecb2c8653fc3379c23bbe5ce` → - `c52a559b46f72273a02e2dba18e65a5f6c4224c9`. The independent Standards reviewer - returned PASS with no actionable finding, including the four CDP/lifecycle fixes - and all prior ML-09 remediations. The independent Spec reviewer returned PASS with - no actionable finding across specification sections 8 through 14, exact-Origin - installation/exposure, bounded crash cleanup, identity and Main-only credential - boundaries, SDK/Skill behavior, and the frozen P0 scope. -- The disposable client profiles and preview projects were removed by the harness; - local server/identity-provider processes were stopped, the PostgreSQL container was - removed, and all untracked operational scripts were deleted. No acceptance harness - is a product artifact. -- Go decision for implemented P0 behavior: **GO**, subject to publishing both draft - PRs once repository credentials/tooling are available. Rollout remains server-first, - and published works/external browser data runtime remain outside P0. - -## Follow-ups - -- GitLab HTTPS PR authentication remains unavailable non-interactively in this - environment and `gh`/`glab` are not installed; draft PR promotion remains - blocked and no draft PR is claimed from this worktree. -- The existing full E2E deviation remains: 25 passed / 1 failed at - `tests/e2e/pi-coding-first-chat.spec.ts:575` because the `当前对话模型` - combobox stays disabled until the 30s selector timeout. - -## Promotion Candidates - -- None recorded. diff --git a/.project-docs/30-worklog/tasks/20260827-makelore-plugin-client-7d3a91c4.md b/.project-docs/30-worklog/tasks/20260827-makelore-plugin-client-7d3a91c4.md deleted file mode 100644 index ad0a600..0000000 --- a/.project-docs/30-worklog/tasks/20260827-makelore-plugin-client-7d3a91c4.md +++ /dev/null @@ -1,523 +0,0 @@ -# Task: Implement MakeLore Plugin Platform P0 client - -## Identity - -- Task ID: 20260827-makelore-plugin-client-7d3a91c4 -- Mode: Feature -- Branch: codex/20260827-makelore-plugin-client-7d3a91c4-makelore-plugin-client -- Worktree: D:\Datas\OthersProjects\makelore-plugin-client-7d3a91c4 -- Base commit: eb5d15d68470b30ec181164f08f0d7b027ef0006 -- Owner: codex-root -- Status: Ready for Integration - -## Scope - -- Coordinate the repository-local `implement-spec` unit for ML-00 through ML-07 - from exact accepted Data Service head - `eb5d15d68470b30ec181164f08f0d7b027ef0006`. -- Deliver the fixed bundled package, project selection, strict policy/capability - registry and envelope, dynamic Pi Skill/tool materialization, Host/lifecycle - integration, Plugin Center, packaged proof, verification, and fixed-range review. -- Own only this isolated client branch, repository-local integration, project task - record, client verification, and the client half of X-01 evidence. - -## Intent And Constraints - -- Preserve accepted Data Service project identity, Main-owned credential and typed - operation seams, exact-Origin preview lifecycle, SDK/Skill behavior, and Pi 0.84.2 - hard-cutover contracts. -- Keep package availability, local enablement, Agent Skill assignment, backend - configuration, invocation, and billing policy independently observable. -- P0 scans only fixed bundled roots and adds no arbitrary code/MCP/hooks, - marketplace, download/update, generic invoke/config/ledger, Plugin Credits, - `plugin_charges`, publication coupling, or external-browser capability. -- Renderer cannot choose project authority, owner, credential, policy, price, or - request identity; child workers receive no plugin Skills/tools. -- All implementation tickets use exact-frontier isolated worktrees and one commit; - implementers are not alone in the repository and must not revert other changes. -- The user root `main` worktree is read-only. The user did not request publication; - no PR is claimed unless one actually exists. - -## Project Context Loaded - -- Task ID/mode/branch/worktree/base match the Git-common owner record exactly. -- Read `AGENTS.md`, the mandatory project-memory entry set, active task record, - positioning/current-state/decision/architecture/data-flow/domain/evidence/ - reflection/commitment/stale material, the implementation spec, detailed-design - sections 6-9 and 14-17, ticket graph, and the accepted Data Service client peer. -- Other local owners: 149 including this task (12 planning, 137 ready for - integration). The only same-topic peer is the completed Data Service coordinator - whose exact evidence head is this task's base; it is not resumed or modified. -- Overlap assessment: no unresolved semantic conflict. ML-01 through ML-05 have - disjoint primary ownership and execute strictly in graph order; ML-02 waits for - both ML-01 and the exact WS-02 catalog DTO. -- Current integrated memory predates this unintegrated Data Service/plugin work; - accepted branch/task evidence and the frozen spec control this feature branch. -- Likely modules are the package/project-service, policy/capability registry, - Pi resource/runtime, Host composition/lifecycle, Renderer Plugin Center, and - packaged-proof paths named by the ticket graph. -- Gate result: Passed on 2026-08-27. - -## Ticket Ownership - -- ML-00, ML-06, and X-01 client evidence: coordinator in this worktree. -- ML-01 through ML-05: isolated implementers from exact frontier commits, with ML-02 - waiting for WS-02's catalog shape. -- ML-07: fixed-range Standards/Spec reviewers; accepted findings go to one isolated - remediation owner before repeat review. - -## Outcome - -- ML-00 completed: the client coordination unit is isolated from exact accepted - Data Service evidence head, ownership/planning gates passed, and no product file - changed before the first implementation frontier. -- Integrated ML-01 from replacement source commit - `c092863ee600808e8a7c15440b3c370fd649a885` at the exact ML-00 frontier - `2ab1c51a2404086cbd688ac80154765d7c5d4662` as coordinator product commit - `422150d4fabdcc703952797875f88f239ca1e37a`, with no cherry-pick conflict. - The superseded `f83038d371888cca87f0f04d0e61906d499668eb` was not - cherry-picked. ML-01 adds the fixed bundled Data Service plugin manifest and - capability projection, atomic project plugin selection service, package-owned - Skill/SDK resource move, and core Skill registry projection. The coordinator - foreign ML-01 task record is removed in the docs checkpoint while its source - record remains in - `D:\Datas\OthersProjects\makelore-plugin-ml01-package-selection-8d3c7a21`. - The exact downstream product frontier handed to ML-02 is - `422150d4fabdcc703952797875f88f239ca1e37a`. - -- Integrated ML-02 from source task - `20260827-plugin-ml02-policy-registry-3f7b2c91` and sole source commit - `0064043c8f1e0e80c0b73dd0064b3abe8ba30b01`, whose exact parent was the - coordinator frontier `d9c9a2b0dd8fd495c6aa5a0994598192ad9c8e58`. - The cherry-pick produced coordinator product commit - `a0361a3cda08ab4d7454d35caa56a5a4304a9dca` without conflict. The foreign - ML-02 task record was deleted from this coordinator while its source record - remains in - `D:\Datas\OthersProjects\makelore-plugin-ml02-policy-registry-3f7b2c91`. - ML-02 consumes the frozen WS-02 catalog DTO: schema version 1, one - `makelore.data-service` plugin, three capabilities/fourteen operations, and - `platform_metered` unavailable projected as `billing_unavailable`. The - coordinator-approved one-time ownership transfer covered only the - `ToolDetails` envelope discriminator/display branch in - `src/pages/Chat/CodingConversationTimeline.tsx`; no other Renderer, - worker, Host, preview, or P1 path was transferred or changed. The exact - downstream product frontier handed to ML-03 is - `a0361a3cda08ab4d7454d35caa56a5a4304a9dca`. - -- Integrated ML-03 from source task - `20260827-plugin-ml03-worker-materialization-9b2e6c41` and sole source commit - `945d6bd81016eec373a82f63182cf1f7cf0718f5`, whose exact parent was the - coordinator frontier `c4dd8923a0076920e8a7fd8820fdc01bdfde1760`. - The cherry-pick produced coordinator product commit - `fd891ff3bb87a29381a0a7006fb4618ec4fe144f` without conflict. The foreign - ML-03 task record was deleted from this coordinator while its source record - remains in - `D:\Datas\OthersProjects\makelore-plugin-ml03-worker-materialization-9b2e6c41`. - ML-03 owns exactly six Pi product files and five Pi-focused tests: one frozen - effective worker-resource snapshot, dynamic Skill/declaration/bridge/CLI - materialization, child-empty exposure, known-disabled/re-enabled assignment - behavior, old-worker refusal, and removal of the static Data Service worker - list. The source task execution briefly shared a worktree with an earlier - agent; that agent was interrupted when discovered, and the final commit was - then fully reviewed by serial takeover. This record does not claim that the - source task was never concurrently shared. The exact downstream product - frontier handed to ML-04 is - `fd891ff3bb87a29381a0a7006fb4618ec4fe144f`. - -- ML-04 and ML-05 are integrated through their exact dependency frontiers. ML-04 - composes the bounded Main-owned project plugin Host projection and lifecycle; - ML-05 adds the project-level Plugin Center and typed Data Service settings without - moving project, credential, policy, or billing authority into Renderer. -- ML-06 completed from exact post-ML-05 checkpoint - `8fea40238fcb6431fd805c7dd0d717bef0cfd1bb`. Packaged-proof commit - `7141a91a2c1c00881b18702508d2be8a398a0823` verifies the bundled plugin - manifest, capability manifest, Skill, TS/JS SDK assets, adapter/tool catalog, - core coding resources, and final Pi runtime artifact. The implementation range - contains no arbitrary plugin execution, generic invoke/config/ledger, - marketplace, publication coupling, `plugin_charges`, Plugin Credits, or P1 code. -- The first ML-07 fixed-range review over exact `eb5d15d...9407c67` returned - Standards FAIL and Spec FAIL. Ten independent accepted root causes were assigned - to one isolated remediation owner; the package-parser duplication finding was - reported by both axes and counted once. Source remediation commit - `2492f8af5ba27d914b2c0b2789b46f78305c924d` had exact parent - `9407c67df21c2f0f50bb0362c826fcff643d9d5f` and was integrated without conflict - as coordinator product commit `cf13aa7`. The foreign remediation task record is - removed from this coordinator while remaining in its source worktree. - -## Verification - -- `git rev-parse HEAD` before the checkpoint returned exact - `eb5d15d68470b30ec181164f08f0d7b027ef0006`. -- The fresh worktree initially had no `node_modules`, so the first typecheck failed - only because `tsc` was unavailable. `corepack pnpm install --frozen-lockfile` - installed the locked 997-package graph with pnpm `10.33.4`; no source or lockfile - changed. -- `corepack pnpm run typecheck` then passed. -- The nine-file Data Service/Pi/package baseline (`data-service-sdk-assets`, - `data-service-server-registration`, `pi-product-tools`, `pi-extension-host`, - `pi-worker-process-real`, `coding-conversation-contracts`, - `preview-data-session`, `data-service-routes`, and `pi-product-artifact`) passed - `70 passed, 2 skipped` in 10.21s with one worker. -- No client product file changed; only this task-scoped record is committed by - ML-00. The root `main` worktree was restored clean at `f245603...` after an - initial task-context claim selected the clean root despite isolation arguments; - the generated record/claim were removed through the normal release path before - the successful isolated start from `eb5d15d...`. -- ML-01 precondition and merge: coordinator was clean at exact frontier - `2ab1c51a2404086cbd688ac80154765d7c5d4662`; replacement source parent matched - exactly; cherry-pick produced `422150d4fabdcc703952797875f88f239ca1e37a` - without conflict. -- ML-01 focused verification: - `corepack pnpm exec vitest run tests/unit/data-service-sdk-assets.test.ts - tests/unit/coding-plugin-manifest.test.ts tests/unit/project-plugin-service.test.ts - tests/unit/skill-display.test.ts tests/unit/pi-product-tools.test.ts - --maxWorkers=1` — 5 files / 45 tests passed (Vitest 3.15s). -- ML-01 `corepack pnpm run typecheck` — passed. -- ML-01 `corepack pnpm run lint:check` — passed with 0 errors and the same 5 - pre-existing warnings in `src/pages/Home/index.tsx` and - `src/pages/Makelore/index.tsx`. -- Scoped ESLint over ML-01-owned source/tests — passed with no output. -- The Skill and SDK resource move is byte-for-byte (`R100`). The ML-01-owned - `tests/unit/data-service-sdk-assets.test.ts` assertion now targets the - canonical package path and passed; this merger did not edit unrelated tests. - Any remaining consumer of the removed legacy - `resources/coding-skills/data-service` path must migrate under its owning - ticket, not this merger. -- ML-01 path/scope audit matched the source change set: package manifest/service, - existing Skill registry/shared definitions, plugin resources, and focused tests - only. No P1 policy/capability-invoke, Pi runtime, Host, Renderer, - marketplace/download/update, generic execution, pricing, or billing paths were - added. `git diff --check` passed. -- ML-02 precondition and merge: coordinator was clean at exact frontier - `d9c9a2b0dd8fd495c6aa5a0994598192ad9c8e58`; source commit - `0064043c8f1e0e80c0b73dd0064b3abe8ba30b01` had that exact parent and - cherry-picked without conflict as - `a0361a3cda08ab4d7454d35caa56a5a4304a9dca`. The source change set was - limited to the policy client, capability registry/Data Service adapter, Pi - product-tool delegation, bounded shared contracts, focused tests, and the - one approved timeline branch. No other Renderer, worker, Host, preview, or - P1 file was present; the source task record remains in its worktree. -- ML-02 focused verification: - `corepack pnpm exec vitest run tests/unit/plugin-policy-client.test.ts - tests/unit/coding-capability-registry.test.ts - tests/unit/data-service-plugin-adapter.test.ts tests/unit/pi-product-tools.test.ts - tests/unit/coding-conversation-contracts.test.ts --maxWorkers=1` — 5 files / - 38 tests passed (Vitest 3.26s). -- Transferred timeline verification: - `corepack pnpm exec vitest run tests/unit/coding-conversation-timeline.test.tsx - --maxWorkers=1` — 1 file / 4 tests passed (Vitest 1.65s). -- Relevant adjacent regressions: - `coding-plugin-manifest`, `project-plugin-service`, `skill-display`, - `coding-chat-panel`, `coding-product-services`, `coding-product-tools-facade`, - `data-service-client`, and `data-service-routes` — 8 files / 57 tests passed - (Vitest 9.69s, one worker). -- `corepack pnpm run typecheck` — passed. `corepack pnpm run lint:check` — - passed with 0 errors and the same 5 pre-existing warnings in - `src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`. -- Product contract audit passed: no `details.schema === 'data-service.v1'` - consumer remains; every `data-service.v1` occurrence in `src/`, `electron/`, - `shared/`, and `tests/` is the nested `payload_schema` contract. The ML-02 - net change passed `git diff --check`. -- ML-03 precondition and merge: coordinator was clean at exact frontier - `c4dd8923a0076920e8a7fd8820fdc01bdfde1760`; source commit - `945d6bd81016eec373a82f63182cf1f7cf0718f5` had that exact parent and - cherry-picked without conflict as - `fd891ff3bb87a29381a0a7006fb4618ec4fe144f`. The merged change set contains - exactly six Pi product files and five named Pi tests, with no other Host, - Renderer, registry, preview, or P1 path; the source task record remains in - its worktree. The source execution's brief shared-worktree incident and - interruption were retained accurately; the merger's review and verification - were performed serially after takeover. -- ML-03 owned focused verification: - `corepack pnpm exec vitest run tests/unit/pi-resource-loader.test.ts - tests/unit/pi-extension-host.test.ts tests/unit/pi-extension-bundle.test.ts - tests/unit/pi-worker-process-real.test.ts tests/unit/pi-rpc-foundation.test.ts - --maxWorkers=1` — 5 files / 43 passed / 2 skipped (Vitest 7.65s; the skips - are staged-runtime gated). -- All Pi regressions: - `pi-*.test.ts` — 30 files / 169 passed / 2 skipped (Vitest 19.34s, one - worker). -- `corepack pnpm run typecheck` — passed. `corepack pnpm run lint:check` — - passed with 0 errors and the same 5 pre-existing warnings in - `src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`. -- `corepack pnpm run build:vite` — passed for Renderer, Main, Preload, and - utility bundles; only existing dynamic-import/chunk-size warnings were - emitted. The ML-03 changed files contain no static Data Service worker list; - dynamic declarations, bridge allowlisting, CLI agreement, child-empty - exposure, disabled/re-enabled assignment, and old-worker behavior are - covered by the owned focused suite. `git diff --check` passed. -- ML-04 precondition and merge: coordinator was clean at exact frontier - `a92cd904d33d4fa0b7c2413188186852a39eb6d4`; source commit - `1e925bc10ade8aed1a580362dfa65223993e3a24` had that exact parent and - cherry-picked without conflict as - `a18727ecf8f40c1d85e2d40922bcf3bc8d1a0ed3`. The product change set contains - four Main API files (`coding-composition`, `coding-product-services`, - `route-handlers`, and `routes/coding-plugins`), three new focused tests, and - one existing Data Service server-registration test update. There are no - changes to `project-service`, preview, Renderer, P1, `electron/api/context.ts`, - `electron/api/server.ts`, or `electron/main/index.ts`; the source task record - remains in its worktree. -- ML-04 focused verification: - `corepack pnpm exec vitest run tests/unit/coding-plugin-routes.test.ts - tests/unit/coding-plugin-composition.test.ts tests/unit/coding-plugin-lifecycle.test.ts - tests/unit/coding-product-services.test.ts tests/unit/data-service-server-registration.test.ts - tests/unit/coding-core-routes.test.ts tests/unit/coding-project-identity.test.ts - tests/unit/main-quit-lifecycle.test.ts --maxWorkers=1` — 8 files / 47 tests - passed (Vitest 4.73s). The route tests confirm exact GET - `/api/coding/plugins?projectId=...` and PUT `/api/coding/plugins/{plugin_id}` - bodies with Main-only authority; composition/lifecycle tests cover bounded - projection and `list`/`setEnabled`/`deactivate` wiring. -- ML-04 adjacent policy/capability/Data Service/Pi/preview regressions: - `coding-capability-registry`, `plugin-policy-client`, - `data-service-plugin-adapter`, `coding-conversation-contracts`, - `pi-product-tools`, `data-service-routes`, `data-service-sdk-assets`, - `pi-extension-bundle`, `pi-extension-host`, `pi-resource-loader`, - `preview-data-session`, and `pi-worker-process-real` — 12 files / 86 passed / - 2 skipped (Vitest 8.37s, one worker; skips are staged-runtime gated). -- `corepack pnpm run typecheck` — passed. `corepack pnpm run lint:check` — - passed with 0 errors and the same 5 pre-existing warnings in - `src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`. -- `corepack pnpm run build:vite` — passed for Renderer, Main, Preload, and - utility bundles; only existing dynamic-import/chunk-size warnings were - emitted. `git diff --check` passed. - -## ML-05 Integration - -- Integrated ML-05 from source task - `20260827-plugin-ml05-plugin-center-6c1e9a42` and sole source commit - `379e575efba8cecb17b10e5e195f05924b827782`, whose exact parent was the - coordinator frontier `b6d9e6156fdc98aa792045692cc25fdce993a531`. - The cherry-pick produced coordinator product commit - `cb1fd2629ce861f72eada35a83e730986fb1c3d1` without conflict. The source - commit contained its source task record plus fourteen Renderer/product-test - files; the foreign task record was deleted from this coordinator in this - checkpoint while the source record remains in - `D:\Datas\OthersProjects\makelore-plugin-ml05-plugin-center-6c1e9a42`. - ML-05 adds the project-scoped Plugin Center, typed project-plugin client/store, - Data Service settings surface, and project navigation. It does not add Main - authority, worker, preview, policy, marketplace, or P1 behavior. The exact - downstream product frontier handed to ML-06 is the post-merge docs checkpoint - recorded below. -- ML-05 focused regression command (using the repository's actual singular - `coding-plugin-routes.test.ts` filename) passed 13 files / 75 tests in 8.64s - with one worker. `corepack pnpm run typecheck` passed. `corepack pnpm run - lint:check` passed with 0 errors and the same 5 pre-existing warnings in - `src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`. -- `corepack pnpm run build:vite` passed for Renderer, Main, Preload, and utility - bundles with only existing dynamic-import/chunk-size warnings. After this - required build, `corepack pnpm exec playwright test - tests/e2e/project-plugins.spec.ts --config=playwright.config.ts` passed 1/1 - test in 1.7s. A preliminary direct Playwright invocation against stale - `dist-electron` timed out waiting for the new navigation test id; it is not - counted as a product failure because the repository E2E contract builds first. - -## ML-06 Merge, Package Proof, And Verification - -- Exact ML-06 base/checkpoint: - `8fea40238fcb6431fd805c7dd0d717bef0cfd1bb`; packaged-proof product head: - `7141a91a2c1c00881b18702508d2be8a398a0823`. The product commit changed only - `scripts/lib/pi-product-artifact.mjs` and - `tests/unit/pi-product-artifact.test.ts`; no semantic merge conflict or - ownership transfer occurred. -- `corepack pnpm exec vitest run tests/unit/pi-product-artifact.test.ts - --maxWorkers=1` — 1 file / 7 tests passed. -- `corepack pnpm run typecheck` — passed. `corepack pnpm run lint:check` — - 0 errors and the same 5 pre-existing warnings in `src/pages/Home/index.tsx` - and `src/pages/Makelore/index.tsx`. -- `corepack pnpm test` — normal suite 200 files / 1,667 passed / 2 skipped, - followed by the isolated pressure suite 1 file / 1 passed. Combined result: - 1,668 passed / 2 staged-runtime skips. -- `corepack pnpm test:electron:windows` — 2 files / 5 tests passed. -- `corepack pnpm test:e2e` rebuilt Renderer/Main/Preload/utility and completed - 26 passed / 1 failed. The failure exactly reproduces the frozen baseline: - `pi-coding-first-chat.spec.ts` timed out after 30 seconds because the existing - `当前对话模型` combobox remained disabled at `selectOption`. The new - `project-plugins.spec.ts` passed. The failure is recorded, not converted to a - pass and not attributed to Plugin Center. -- A fresh `corepack pnpm run package:win` rerun could not reacquire fixed uv - `0.10.0`: GitHub first reset the connection and the one targeted retry timed - out before product packaging. The worktree remained clean. The already-built - Windows artifact was independently verified as current head rather than - assumed from its timestamp: - - `corepack pnpm run verify:artifact:win` passed and reported both - `gitCommit` and `verificationHead` as exact - `7141a91a2c1c00881b18702508d2be8a398a0823`, with packaged - Python, uv, npm, Electron, Node, and native modules present. - - `corepack pnpm run verify:artifact:pi` passed the outer product-artifact - contract and proved one `makelore.data-service` package, its manifest, - capability manifest, `data-service` Skill, both SDK assets, adapter, exact - ten-tool catalog, core coding resources, Pi closure, and packaged runtime - probe. The nested legacy runtime report remains `partial-pass` only for its - recorded cross-platform/real-provider waivers; no such waiver is promoted to - a Plugin Platform pass. -- `git diff --check eb5d15d...7141a91` passed. Full-range path/content review - found only canonical manifest/registry lists and negative unsupported-component - tests; it found no static Pi CLI Data Service allowlist, arbitrary execution, - generic ledger/config/invoke, marketplace/publication coupling, checksums, or - P1 implementation. - -## ML-07 First Review And Remediation - -- Fixed range `eb5d15d68470b30ec181164f08f0d7b027ef0006` through - `9407c67df21c2f0f50bb0362c826fcff643d9d5f`: Standards FAIL and Spec FAIL. - Accepted issues were production package-parser/static-definition duplication, - disabled Skill implicit activation, missing preview/exact operation policy join, - the direct Pi Data Service fallback, missing request/fault evidence, unbounded - policy fetch/body, ready-enable settings loss, unsafe Skill-ID typing, - out-of-order project-load commits, and stale README inventory. -- The sole remediation commit makes the parsed frozen package definitions the Main - authority; projects three capabilities/fourteen exact operations while keeping - preview non-tool; removes the second Pi direct path; makes disabled retained Skill - availability explicit; bounds policy refresh; preserves ready settings on enable; - uses `CodingSkillId`; guards A/B loads; and updates README. -- Source verification: focused 10 files / 60 tests; full 202 files / 1,680 passed / - 2 staged-runtime skips; typecheck passed; ESLint 0 errors with the same 5 existing - warnings; full Windows build/NSIS passed; Pi artifact proof passed with four core - Skills plus the package-owned Data Service. Stable replay and one-401-refresh - request identity remains `pi:run-a:resource-a`; all ten tools traverse the real - adapter/registry/conversation parser with bounded quota, size, revision, and - Retry-After contexts. -- Repeat Standards and Spec review must use the unchanged base `eb5d15d...` and the - post-remediation coordinator documentation checkpoint as its exact head. - -## ML-07 Repeat Review And R2 Remediation - -- Repeat fixed-range review over exact `eb5d15d...29cf322` confirmed the first - remediation but returned Standards FAIL and Spec FAIL on four remaining issues: - the Data Service adapter still consulted a static tool-definition catalog; late - project-A mutations could overwrite loaded project B; persisted reconnect/replay - identity evidence was still a direct repeated invocation; and child/core-only - workers still waited on optional policy refresh. -- The same sole remediation implementer returned source commit - `278e53304a10a0336b8b737b85c158c5f2a40d84` with exact parent - `29cf322f1ac0500295c1afec076800aea3908eb3`; it integrated without conflict as - coordinator commit `f0ac7d7`. The foreign source task record is removed here and - remains in its isolated source worktree. -- The adapter now validates the parsed registry-supplied tool; project-scoped enable, - configure, reset, collection removal, and project removal all reject stale - generation/project completions; policy refresh occurs only for an assigned - server-backed parent; and the extension bundle test persists run/resource identity, - reconnects/reimports, replays the same resource through the authenticated bridge - and real registry, and preserves exact - `pi:persisted-run:persisted-resource`. -- Source verification: affected 8 files / 44 tests passed; typecheck passed; focused - ESLint clean and full lint 0 errors with the same 5 existing warnings; Windows - staged/unpacked build passed; Pi packaged artifact verification passed. - Coordinator `corepack pnpm test` passed 201 normal files / 1,685 tests with 2 - staged-runtime skips, followed by the isolated pressure file 1/1 (202 files / - 1,686 passed / 2 skipped total). - -## ML-07 R3 Review And Remediation - -- The third fixed-range Standards and Spec reviews over exact - `eb5d15d68470b30ec181164f08f0d7b027ef0006...405b9f64fd6872f6b4bd4c4429e6aaff2fa0b84a` - agreed on one remaining medium-severity root cause: a same-project manual refresh - could race enable/configure/reset/removal mutations, allowing an old GET to - overwrite a successful mutation or causing the successful mutation and its - authoritative reload to be discarded. -- The same sole remediation implementer returned source commit - `92bce15a7e70440e78b2ff8d90b2e57470d14d77` with exact parent - `405b9f64fd6872f6b4bd4c4429e6aaff2fa0b84a`; it integrated without conflict as - coordinator commit `e3e34d3`. The foreign source task record is removed here and - remains in its isolated source worktree. -- A per-project operation epoch now separates internal load flights by project and - epoch. Successful mutations advance the epoch before committing, so reads begun - before or during the mutation cannot win and post-mutation authoritative reloads - cannot coalesce with stale flights. The existing stable public pending key and the - latest-requested-project A-to-B guard remain intact. -- Source verification recorded the expected red failures for all supported race - orderings, then 13/13 store tests and 4 files / 22 expanded focused tests passed; - typecheck, scoped ESLint, full lint, diff, documentation drift, and task completion - gates passed. No UI, Main, Preload, package, or asset ownership was used. -- After integration, coordinator `corepack pnpm test` passed 201 normal files / - 1,692 tests with 2 staged-runtime skips, followed by the isolated pressure file - 1/1 (202 files / 1,693 passed / 2 skipped total). Coordinator typecheck passed; - full lint reported 0 errors and the unchanged 5 warnings in Home and Makelore. - -## ML-07 R4 Review And Remediation - -- The fourth fixed-range review over exact - `eb5d15d68470b30ec181164f08f0d7b027ef0006...07ea9da858b4a412191747a6c80f465cf2d46d45` - returned Spec PASS and Standards FAIL on one supported remaining load-ordering - case. With A1 pending, then B pending, selecting A again reused A1 before - renewing its generation, so B retained the only committable generation and - could leave the active A page displaying B's projection. -- The same sole remediation implementer returned source commit - `d0addfa743d97d4ac9c3385a1d364f94b1ccf6d5` with exact parent - `07ea9da858b4a412191747a6c80f465cf2d46d45`; it integrated without conflict as - coordinator commit `7fab721`. The foreign source task record is removed here - and remains in its isolated source worktree. -- Each keyed load flight now owns a mutable generation token. Reselecting that - same key/epoch after another project intent intervenes promotes the shared - flight to a new global generation before returning it; consecutive same-project - duplicate loads still share one request and one promise. B therefore loses - commit eligibility, while A completes without a manual retry and the stable - public pending key remains unchanged. -- Source red evidence was 2 new failures with 13 existing passes; after the fix, - store tests passed 15/15 and the expanded four-file suite passed 24/24. - Typecheck, scoped ESLint, full lint with 0 errors and the unchanged 5 warnings, - diff, project-documentation drift, and task completion gates passed. No UI, - Main, Preload, package, or asset ownership was used. -- After integration, coordinator `corepack pnpm test` passed 201 normal files / - 1,694 tests with 2 staged-runtime skips, followed by the isolated pressure file - 1/1 (202 files / 1,695 passed / 2 skipped total). Coordinator typecheck passed; - full lint reported 0 errors and the unchanged 5 warnings in Home and Makelore. - -## ML-07 R5 Final Review And Cross-Repository X-01 - -- The final independent Standards and Spec reviews both PASS with zero - actionable findings over fixed range - `eb5d15d68470b30ec181164f08f0d7b027ef0006...78fb7d730731a7b0ebadf12418ca4c2eb6ef3310`; - the merge base is the exact accepted Data Service base and `git diff --check` - is clean. R5 reconfirmed the intent-aware A1/B/A2 shared-flight fix in both - completion orders, the R3 mutation epochs, the complete package-to-policy-to- - Pi-to-preview authority chain, and all P0 exclusions. -- Exact-head coordinator verification is 201 normal files / 1,694 passed / 2 - staged-runtime skips plus the isolated pressure file 1/1, for 202 files / - 1,695 passed / 2 skipped total. Typecheck passed; full lint has zero errors and - the unchanged five out-of-range Home/Makelore warnings. The reviewers did not - represent their dependency-free fresh worktrees as additional test passes. -- X-01 ran against this exact client head and server head - `e862a74532a1e57086659f3bf3201ea17e7b60a8`. The packaged Windows artifact was - independently verified at the exact client head; its installer SHA-256 is - `ED2C4BA9337E53446E73EFFC305B0082A4E1FE3C454238495EDA7B9A94F2D677`. - The Pi artifact proof contains one Data Service package, five fixed package - files, exactly ten tools, and four core Skills. -- The final live harness exited zero with all implementation-spec section 10.3 - groups `1` through `12` passing against PostgreSQL 16.13 and the packaged, - normally initialized, signed-in application. The real parent provider request, - persisted worker context, and live Pi CLI all carried the same exact ten Data - Service tools; the real child carried none. All ten tools executed and produced - `makelore-capability.v1` details. -- Enable created only local selection. Configure created the backend and the Skill - installed the byte-exact packaged SDK. Exact-Origin preview put/get succeeded; - disable rejected an old-worker new invoke, invalidated preview, removed the Skill - from the next worker, and preserved cloud data; re-enable restored the retained - assignment/backend/data. Move, rename, raw copy, independent copy, bind-existing, - and a second signed-in owner with the same durable ID all matched the frozen - identity/owner-isolation contract. -- Live faults preserved quota `current=20/limit=20`, size - `actual=40011/limit=32768`, revision `current_revision=1`, and rate - `retry_after_seconds=46`. The size case used the server's supported isolated - 32 KiB configuration so it could traverse the bounded 64 KiB Pi bridge; no - committed limit changed. Catalog first-failure/current/stale states, exact - three-capability/fourteen-operation join, and included-only billing all passed. -- Plugin Center showed `当前包含，不按单次调用扣点`; Data Service usage reached - 120 documents while real Token Point transactions stayed `0 -> 0`. Preview - invalidation passed for disable, identity change, project switch, cross-Origin - navigation, Agent Browser renderer crash, logout, and Main shutdown. -- With 20 live instances/120 documents retained, server downgrade to `0063` - refused and left exact Alembic head `20260827_data_service_0064`; this is the - server-first rollback boundary, not a repository-test inference. -- Final cleanup stopped only the verified acceptance IdP helpers, removed the - exact disposable PostgreSQL container, and moved the exact X-01 temp directory - to the Windows Recycle Bin. All acceptance ports are closed; the container and - original temp path are absent. The recycled temp directory remains recoverable. - -## Follow-ups - -- None. No PR, push, publication, or user root-worktree mutation was performed. - -## Promotion Candidates - -- None recorded. diff --git a/.project-docs/30-worklog/tasks/20260828-plugin-marketplace-client-5f8b3d72.md b/.project-docs/30-worklog/tasks/20260828-plugin-marketplace-client-5f8b3d72.md deleted file mode 100644 index 338d503..0000000 --- a/.project-docs/30-worklog/tasks/20260828-plugin-marketplace-client-5f8b3d72.md +++ /dev/null @@ -1,406 +0,0 @@ -# Task: Implement curated plugin marketplace Release A client - -## Identity - -- Task ID: 20260828-plugin-marketplace-client-5f8b3d72 -- Mode: Feature -- Branch: codex/20260828-plugin-marketplace-client-5f8b3d72-plugin-marketplace-client -- Worktree: D:\Datas\OthersProjects\makelore-plugin-marketplace-client-5f8b3d72 -- Base commit: 1ca8deb54b7b530ab8c5b6a5b7e613730c3b97ec -- Owner: codex-root -- Status: Completed - -## Scope - -- Coordinate the repository-local Marketplace Release A MakeLore unit from exact - completed Plugin P0 evidence head `1ca8deb54b7b530ab8c5b6a5b7e613730c3b97ec`. -- Deliver MLM-00 through MLM-06, the packaged-client half of XMA-01, - dependency-ordered integration, fixed-base review/remediation, package proof, and - exact final evidence on this isolated branch. -- Own only this coordinator worktree/branch, coordinator task record, merger/package - proof verification, and cross-repository acceptance ledger. - -## Intent And Constraints - -- Implement Marketplace Release A only: schema-v2 declarative parsing, code-owned - Ed25519 trust, Main-owned Works Marketplace/Library access, atomic Package Store, - one effective plugin snapshot, and Marketplace/My Plugins/Project Plugins UI. -- Keep acquisition, device installation, project selection, backend configuration, - Agent assignment, authorization, invocation, and billing separate. No UI action may - silently chain another state mutation. -- Preserve the completed Plugin P0/Data Service behavior: exact bundled schema 1, - project ID retention, ten typed tools, four preview operations, closed capability - envelope, child-empty workers, and zero Token Point transactions. -- Keep Release B closed: no hosted adapter, Provider endpoint/credential, Plugin - Charges, Plugin Credits, arbitrary local code/scripts/native/hooks/LSP/stdio MCP, - or generic invoke/config/ledger. -- Product trust accepts only code-owned official public keys. Tests may inject - ephemeral verifiers through service dependencies; no production private key or - arbitrary runtime public-key override may be committed. -- Use exact-frontier isolated implementers, disjoint ownership, one source commit per - ticket, one repository-local merger, read-only fixed-range reviewers, and one - remediation owner at a time. Implementers are not alone and must preserve others' - work. -- The user root `main` worktree, old P0 coordinator, live services, push, deployment, - publication, and PR fabrication are outside authority. No PR is created for this - local-only delivery. - -## Project Context Loaded - -- Concurrent and Planning Gates passed in the registered isolated worktree. Task ID, - owner, mode, branch, worktree, and exact base match the task-context owner record. -- Fully read `AGENTS.md`, the implementation specification, ticket graph, accepted - detailed design, project-memory startup set, relevant architecture/evidence/ - commitment/stale material, completed Plugin P0 client record, and current manifest, - registry, project selection, effective Pi, Host composition, Plugin Center, tests, - and package scripts. -- Exact Git facts: HEAD is `1ca8deb54b7b530ab8c5b6a5b7e613730c3b97ec`; - reviewed product head `78fb7d730731a7b0ebadf12418ca4c2eb6ef3310` is an - ancestor. The remaining base delta is P0 evidence only. User root `main` is not the - source or implementation worktree. -- The completed P0 coordinator is read-only evidence. Other same-topic local owners - are completed implementers/remediators or read-only historical reviewers; no active - peer owns this new branch or has a semantic conflict with the Release A DAG. -- Canonical integrated memory predates the unintegrated P0 coordinator; its exact task - evidence and this frozen base/spec control Marketplace work. -- Likely modules are exactly the MLM-01 through MLM-04 ownership sets: schema-v2 and - signature primitives; Marketplace client/account cache/Package Store; effective - resolver/Main/Pi lifecycle; Renderer pages/stores/routes; and MLM-05 package proof. - -## Ticket Ownership - -- MLM-00, MLM-05, MLM-06 coordination, and XMA-01 client evidence: this coordinator. -- MLM-01 through MLM-04: exact-frontier isolated implementers in graph order. MLM-02 - remains blocked until MLM-01 is integrated and the WSM-03/WSM-04 DTO is frozen. -- MLM-06 Standards and Spec axes: independent read-only reviewers. Accepted root - causes route to one isolated remediation implementer at a time before repeat review. -- MLM-01 source task `20260828-plugin-mlm01-5c8d1e4f` was dispatched from exact - coordinator frontier `4d8b1fcec0a751d2935effc7816c7e59f568ec65`, completed as - source commit `352a3b7280bb48854beb5281d2b4923b76793367`, and was integrated - without conflict as coordinator product commit - `898e2b7bdde4bdd77a5659d7b4e294d0607656e3`. -- MLM-02 source task `20260828-plugin-marketplace-mlm02-9b7c4e1a` was dispatched - from exact post-MLM-01 frontier - `c73fcf1d2d2e5dccea6f3b403a3b7c00bdc0b25a`, completed as source commit - `1b6f5aaccaf55fc98657fc93824015471818f6e6`, and was integrated without - conflict as coordinator product commit - `4052fa85cc4c9bfb0bed5b529dd6209007a65ef3`. -- Current client frontier contains the frozen MLM-02 Marketplace client/account - cache/Package Store contract. MLM-03 may now start from the documentation - checkpoint recorded after this integration. -- MLM-03 task `20260828-plugin-marketplace-mlm03-4c8e1a7d` was dispatched from - exact frontier `1d64b89499f68de721e0f1c845dad2c57f1a78ed`. Its original agent was - interrupted after becoming unresponsive; a serial finisher resumed the same - registered owner and preserved the dirty worktree with no concurrent writer. - The completed source commit `7ad6b8c66d9ca64b5778690667c91c424aae456a` - was integrated without conflict as coordinator product commit - `05917a789a9b9f30ed9500f4cd1210ec72119646`. Coordinator-transferred - Package Store ownership was limited to removing unconditional latest-Release - protection while preserving account-snapshot and active-worker protection. -- MLM-04 task `20260828-marketplace-mlm04-renderer-e4c7a2` completed from exact - frontier `8b6824a8ba08d8df98fc75af17e170bf3d8ed630` as source commit - `d61221d34da49f97dd4a9aeb1081fb3544cc6c86` and was integrated without - conflict as coordinator product commit - `97c9ad1aad2638609168a8e1901b61b5ba671def`. Three coordinator-approved - seam transfers remained minimal: joined safe Library/installation projection, - explicit project `unknownPluginIds`, and disable-only removal for an already - selected unknown ID. No Main route, registry, Pi, or Package Store source was - otherwise expanded. -- MLM-05 merger task `20260828-marketplace-mlm05-merger-c73a91e4` verified the - already integrated source/product ledger from exact frontier - `2c4f766b3b61d4540919495043322d438cc17ec3`. Its artifact-proof-only source - commit `3ab257d3f0226ecba40166f306b939319061e551` was integrated without - conflict as coordinator product commit - `43c464a556d32a1ac564a5bb79f92741c4d9d635`. -- MLM-06 fixed-range Standards and Spec review found eleven deduplicated roots. - The sole remediation task `20260828-marketplace-mlm06-remediation-6d3a9c82` - completed from exact frontier `8dfa5428606076b847966750134061de6fbe91ba` - as source commit `291b64ab0ef4779a44e09a386de31332abe1f57b` and was integrated - without conflict as coordinator product commit - `1614f7efc1fc81efc3b4d1c80827948976f1427b`. -- MLM-06 R2 fixed-range Standards and Spec review found eight remaining roots. - The same sole remediation owner completed task - `20260828-marketplace-mlm06-r2-remediation-6f4a2d91` from exact frontier - `2c3baf6dff975ce229d80a35450c5e79e271651b` as source commit - `f7d2dc148896bfbe0ee8a9e7f040f3e05c634b2e`. It was integrated without - conflict as coordinator product commit - `11d0af01663ad5b35a86fbe037c9277a5283f9a3`; the source/product trees are - identical after excluding the task-scoped handoff record. -- MLM-06 R3 review found eight actionable roots. After the user explicitly approved - recovery of the unresponsive owner, the coordinator force-released that owner and - adopted the existing task/worktree without stash, reset, clean, branch replacement, - or loss of its intermediate diff. Task - `20260828-marketplace-mlm06-r3-remediation-9e4c2a71` completed from exact frontier - `57962591de71fc0a9f142dbcd130e3308754e423` as sole source commit - `34341b932ac3a74788658bc0ed0a2732e140f72e`. It was integrated without - conflict as coordinator product commit - `3df794c2e736bde2c797c99aa8ad55b967e89ea6`. -- MLM-06 R4 fixed-range Standards and Spec review found three deduplicated roots: - trusted stale Library disabled local `skill_only`, content-derived resolve identity - prevented later channel/Admission progress, and Skill-owner collision remained - invisible to Project Plugins. The sole remediation task - `20260829-marketplace-mlm06-r4-remediation-b7e3c921` completed from exact frontier - `d04b031040a1c109a0c2c5ede2584bb0b75a3bb2` as source commit - `4465beabee4f6ff9e24a83e3e2a109a60fe37d1e`. It was integrated without - conflict as coordinator product commit - `227b8214a820e6a0a2b6758f89fb3bbfa65faf83`; the foreign task record remains - only on its source branch. - -## Outcome - -- Marketplace Release A MakeLore implementation and live acceptance are complete. - The final R6 source commit - `32f703e1f4e41b1e7314bd63c6a034c1e412c9fb` was integrated as product commit - `c56ddb9d3b14990f5dcd4f12eaa58d925e569292`; final reviewed documentation head was - `474c6f7688fb728641da5f567e42bbf05ad45117`. -- R7 Standards and Spec independently passed the fixed range - `1ca8deb54b7b530ab8c5b6a5b7e613730c3b97ec...474c6f7688fb728641da5f567e42bbf05ad45117` - with zero actionable findings. XMA-01 then passed all twelve Release A groups. - Production trust activation remains HOLD only because the official Ed25519 public - key has not been supplied; the packaged app correctly fails closed without it. -- MLM-00 completed. The coordinator unit is isolated from the exact accepted P0 - evidence head, both documentation gates pass, semantic overlap is clear, and no - client product file changed before opening MLM-01. -- The official platform public key is not present and remains a production activation - input; the parser/signature implementation and injected-key acceptance still proceed. -- No push, PR, deployment, production key generation, or publication was attempted. -- MLM-01 delivered schema-1 compatibility, closed schema-2 `skill_only` and - declarative `platform_hosted` parsing, bounded JSON Schema validation, fixed release - descriptor bytes, Ed25519 verification, compatibility/provenance checks, and a - code-owned production trust seam. The official Ed25519 public key remains absent, - so the production activation hold is preserved and the default trust store fails - closed; no production private key or runtime key override was added. -- MLM-02 delivered the bounded authenticated Marketplace client, session/account - cache, and atomic immutable Package Store. Acquisition and download remain - separate from project enablement, Agent assignment, runtime authorization, and - billing; distributed packages are descriptor/signature/size/SHA/schema/client-range - verified before an atomic index switch, and install failure preserves the previous - release. Account A/B snapshots remain isolated and logout/account switch invalidates - them. The official public key activation hold remains unchanged. -- MLM-03 delivered one effective installed-plugin resolver, Main-owned Marketplace - routes, and a frozen parent-worker snapshot shared across resource loading, - Extension Host, tool declarations, CLI/context, and runtime authorization. Child - workers remain empty; active Releases are registered for Package Store cleanup; - old workers reject new plugin actions after invalidation. Unknown or uninstalled - Skill assignments remain in project/Agent configuration but do not enter runtime - projections, and automatically become effective again when the trusted package - source returns. -- MLM-04 delivered global Marketplace and My Plugins pages plus the joined Project - Plugins state. The four user actions remain distinct and call only their matching - Main route; fresh installation/account projection, stale/error states, retained - unknown project IDs, typed Data Service settings, account/project generation, and - mutation epochs are bounded in Renderer state. No account, filesystem path, - Release Admission, token, or signed URL authority enters Renderer. -- MLM-06 remediation paired every frozen Skill with its verified package root, - separated explicit device uninstall from Library removal, added exact Package - Store orphan recovery and current-Release selection, bounded whole-response - deadlines, and serialized same-account reads and cross-Plugin mutations by intent. - It also exposed explicit beta and bounded unavailable states through Main/Renderer, - made the packed trust proof read the real `app.asar`, and synchronized README. - Official-key absence remains a fail-closed production activation hold. -- MLM-06 R2 remediation closes source ownership collisions, per-Plugin mutation - ordering, protected-current uninstall projection, current-client compatibility - revalidation, installed-channel projection, same-account cache completion order, - reachable packaged trust proof, and the shared My Plugins E2E gap. Explicit Beta - remains on its selected channel; when the server's bounded Library authority changes - the current channel version, Renderer reports a truthful channel-change/unavailable - state without inventing a yanked field. Unknown assignments and incompatible packages - remain persisted but do not enter a new effective worker snapshot. -- MLM-06 R3 remediation reserves bundled Data Service and all other non-Marketplace - Skill IDs before Marketplace resolution; binds queued Package Store work to the - originating account; separates Library/device Renderer intents; distinguishes - explicit uninstall from background cleanup; enforces the canonical Skill-only - archive contract; projects client incompatibility and no-version unavailable - installations truthfully; and binds packed proof to package-main-reachable Main, - HTML, minified ESM, dynamic Renderer, and Marketplace chunks. No config/assignment - rewrite, hidden acquisition/enablement, Token Point path, Release B runtime, or - production trust override was added. -- MLM-06 R4 remediation keeps verified local `skill_only` resources effective under - trusted stale Library while hosted/server-backed definitions fail closed; separates - resolve content digest from per-logical-sync identity with explicit replay support; - and projects bundled/core/Marketplace Skill-owner collision as closed - `skill_owner_conflict`/`unavailable` state. Project and Agent assignments remain - preserved, and no new authority, compatibility layer, or Release B path was added. -- MLM-06 R5 remediation aligns schema-v2 execution mode with the canonical/server - `synchronous | job` contract; makes explicit device uninstall clear Package Store - current selection immediately while retaining only frozen active-worker bytes; and - preserves Beta channel/version identity in a bounded failed device mutation. A - released active-worker record is removable on the next explicit cleanup, while - background cleanup still refuses to guess a missing current selection. R5 Spec and - Standards reported the same three findings and no independent additional issue. -- MLM-06 R6 remediation completes explicit uninstall automatically when the last - protecting worker exits, while another account snapshot continues to block deletion - and an explicit reinstall cancels the pending cleanup. Same-Release Stable/Beta - selection now persists the requested channel without a redownload or worker hot swap. - My Plugins presents system-included Data Service as supplied with MakeLore and exposes - no package download/update/delete action, while retaining project enablement and Agent - assignment. R6 Spec and Standards deduplicated to these three roots and no fourth. - -## Verification - -- `git rev-parse HEAD` returned exact `1ca8deb54b7b530ab8c5b6a5b7e613730c3b97ec`; - ancestry of reviewed product head `78fb7d7...` passed. The only initial status entry - was this task record. -- `corepack pnpm --version` reported the repository-pinned `10.33.4`. -- This fresh worktree lacked dependencies, so `corepack pnpm install - --frozen-lockfile` restored the locked 997-package graph entirely from the package - store; no source or lockfile changed. -- `corepack pnpm run typecheck` passed. -- The ten-file manifest/capability-policy/project-selection/Pi/Host/Plugin Center - baseline passed `68 passed, 2 skipped` (`70` total) in 10.27 seconds with one - worker. The two skips are the existing staged-runtime gates. -- The run was proportionate: a type/parser/registry/Pi failure would have stopped - MLM-01 because schema-v2 primitives cannot safely extend a broken claimed P0 base. -- MLM-01 source verification passed the complete repository suite (`1713 passed`, - `2 skipped`) plus the single-worker pressure case (`1 passed`), typecheck, lint, - Vite build, documentation drift, and task-context completion. Source parent, clean - status, changed-file ownership, and `ready_for_integration` status were independently - verified before integration. -- MLM-02 source verification passed focused `14`, adjacent parser/contract `43`, - full Vitest `1727 passed, 2 skipped`, and the pressure case `1 passed`, plus - typecheck, owned/full lint (zero errors and five pre-existing warnings), Vite - build, diff/doc gates, and task-context completion. Its exact sole parent, five - owned paths, clean status, and `READY_FOR_INTEGRATION` state were independently - verified before cherry-pick. -- MLM-03 verification passed 142 focused/adjacent tests with two staged-runtime - skips, full Vitest `1738 passed, 2 skipped`, the pressure case, typecheck, lint - with zero errors and five unchanged warnings, Vite build, Windows package, - Windows and Pi artifact verification, publish-runtime verification, diff/doc - gates, and task-context completion. The Windows installer embedded exact source - HEAD `7ad6b8c...`; production signing, real Provider, macOS, and native Linux - activation evidence remain explicit external/platform holds rather than passes. -- MLM-04 verification passed 73 focused/adjacent tests across 12 files, typecheck, - lint with zero errors and five unchanged warnings, Vite build, two Marketplace/ - Project Plugins Electron Playwright cases, six Windows Electron Vitest cases, and - documentation drift. Its task record also captured the actual interface-polish - Before/After changes: bounded hit targets, explicit transitions, wrapping, and - tabular dynamic values within the existing design system. -- MLM-05 verification passed 121 focused tests, 78 P0/Data Service/Pi/preview - regressions with two staged-runtime skips, nine packed-proof tests, full Vitest - `1761 passed, 2 skipped`, the pressure case, typecheck, lint with zero errors and - five unchanged warnings, Vite build, six Windows Electron tests, two targeted - Marketplace E2E cases, Windows package, and Pi artifact verification. The full - E2E run passed 27 cases; its sole failure was the unchanged - `pi-coding-first-chat.spec.ts` disabled-model-combobox timeout. The packed proof - found schema-2 `skill_only`, unknown-key fail-closed, Library/install/update/ - effective routes, Renderer assets, and no private-key/runtime-key override. - Official public-key production trust remains HOLD. -- MLM-06 verification passed focused 82 tests, trust/contract 30 tests, adjacent 66 - tests, complete single-worker Vitest `1779 passed, 2 skipped`, the pressure case, - typecheck, lint with zero errors and five unchanged warnings, Vite build, six - Windows Electron tests, and Marketplace E2E. Full E2E passed 27 of 28; the only - failure remained the unchanged disabled-model-combobox timeout. The four-worker - unit run reached 207/208 files and 1769 passes before one assertion-free worker - exit; the complete one-worker rerun is the product result. Windows x64 staging and - building passed; the aggregate `package:win` arm64 uv download hit an external - GitHub connect timeout. Both Pi and Windows artifact verifiers passed on the clean - final source commit, with embedded `gitCommit` and `verificationHead` equal to - `291b64a...`; the real packed trust source contains no private key and fails closed - while the official public key is absent. -- MLM-06 R2 verification passed six focused files / 69 tests, 39 adjacent tests, - complete single-worker Vitest `1789 passed, 2 skipped`, the pressure case, - typecheck, lint with zero errors and five unchanged warnings, Vite builds, six - Windows Electron tests, and both Marketplace E2E cases. Windows x64 staging and - unpacked building passed. The artifact unit suite passed 12/12 and the fresh - `release/win-unpacked` Pi verifier passed after following `package.json.main` - through the real Windows app.asar with native entry separators; Marketplace trust - remains official-key-absent fail-closed with no private-key material. XMA-01 was not - run and no full-E2E pass beyond the targeted Marketplace file is claimed here. -- MLM-06 R3 source verification passed six focused files / 73 tests, 28 adjacent - files / 229 tests, full Vitest `1799 passed, 2 skipped` plus pressure `1 passed`, - typecheck, lint with zero errors and five unchanged warnings, Vite builds, six - Windows Electron tests, and Marketplace/Project Plugins E2E 3/3. Full E2E passed - 28/29; the sole failure is the same unchanged - `pi-coding-first-chat.spec.ts:575` disabled-model-combobox timeout. The Marketplace - auth test's own old-page/new-page bootstrap race was diagnosed from a 3/5 failing - loop and stabilized to 5/5 before the original target reran. -- The first real package proof exposed a genuine verifier gap: Vite's - `import{...}from"..."` edge was missing from the reachable graph. A realistic - ASAR unit went red 1/13 and green 13/13; the same real app.asar then verified - Marketplace trust/routes/Renderer assets successfully. Final x64 staging and - electron-builder/NSIS ran from clean source HEAD. The aggregate download wrapper - was retried after GitHub `ECONNRESET` and connect timeout; already verified x64 - Python/uv were restored from the first successful package, then final x64 staging - and builder passed without changing tracked files. -- Final `verify:artifact:pi` passed with Marketplace `result: pass`, Data Service ten - tools, Pi 0.84.2, no closure gaps, and only the inherited real-Provider/cross- - platform partial-pass waivers. `verify:artifact:win` embedded exact source - `gitCommit`/`verificationHead` - `34341b932ac3a74788658bc0ed0a2732e140f72e`; installer size is 208,238,894 - bytes and SHA-256 is - `1531A3ACA2AB3387870606ADA54EE40DA9079DB9E2864DE7B8FFEBAF47A453D3`. - Python, uv 0.10.0, npm 11.6.2, native addons, Unicode copy, and publish-runtime all - passed. The official Ed25519 public key is still absent, so production activation - remains fail-closed HOLD rather than a claimed production release. -- MLM-06 R4 source verification began with six exact red assertions and finished with - three owned files / 46 focused tests, 17 adjacent Marketplace/Main/Pi/Renderer files - / 143 tests, full Vitest `1803 passed, 2 skipped` plus pressure `1 passed`, typecheck, - scoped/full lint (zero errors and the unchanged five warnings), Vite builds, and six - Windows Electron tests passing. Target Marketplace/Project Plugins E2E first ran - 2/3 with the known auth-bootstrap ordering failure before Library fetch; that sole - case reran 1/1 passed. Final x64 staging, Electron/NSIS builder, packaged Pi/ - Marketplace proof, Windows runtime proof, and publish runtime all passed from clean - source `4465beabee4f6ff9e24a83e3e2a109a60fe37d1e`. Windows proof embedded that exact - `gitCommit`/`verificationHead`; installer size is 208,238,992 bytes and SHA-256 is - `F407F2319408F60E8BEFCDC304A72CB4022F764FA44F40210774CDBE1C190483`. - The aggregate wrapper's only failure was an external GitHub `ECONNRESET` while - downloading unused win32-arm64 uv after x64 Python/uv had succeeded; the reviewed - x64 build/proof is complete and tracked files remained clean. -- MLM-06 R5 source verification began with the exact old behavior at four failures / - 60 passes, then passed manifest/Package Store/store focused 64/64, 11 adjacent - Marketplace/Main/effective/Pi files / 126 tests, and Renderer Beta projection 20/20. - Typecheck and scoped ESLint passed; full lint had zero errors and the unchanged five - Home/Makelore warnings. Vite built Renderer, Main, Preload, and utility worker. Full - Vitest passed 208 files / 1,807 tests with two staged-runtime skips, followed by the - pressure case 1/1. The first sandboxed build and doc-drift attempts were blocked only - by Windows user-directory/task-registry permissions; the identical authorized runs - passed. No trust key, package layout, packaged resource, or artifact verifier changed, - so artifact packaging was not repeated before the fresh fixed-range review. -- MLM-06 R6 source verification passed the three owned red/green suites with 51 tests, - ten adjacent Package Store/Main/Pi/Renderer files with 116 tests, full Vitest 208 files - / 1,812 tests with two staged-runtime skips, and the pressure case 1/1. Typecheck and - scoped ESLint passed; full lint had zero errors and the unchanged five Home/Makelore - warnings. Vite built Renderer, Main, Preload, and utility worker. Diff, project-docs, - documentation-drift, task-context completion, sole-parent, and clean-worktree gates - passed. No trust key, package layout, packaged resource, or artifact verifier changed, - so artifact packaging was not repeated before the fresh fixed-range review. -- MLM-06 R7 Standards task `20260830-marketplace-mlm06-standards-r7-a8c4e291` - and Spec task `20260830-marketplace-mlm06-spec-r7-b7d5f3a2` both returned PASS - with zero findings at exact clean head - `474c6f7688fb728641da5f567e42bbf05ad45117`. They rechecked Package Store cleanup, - Stable/Beta channel authority, system-included Data Service projection, account - cache/intent, effective resolver/registry/Pi lifecycle, Main/Renderer authority, - packaged trust reachability, and Release B exclusions. -- XMA-01 used the signed-in packaged Windows application at that exact head against - the real reviewed server and PostgreSQL. Marketplace and Data Service catalog/detail - were visible; account A Library state was isolated from account B; package install, - project enablement, Agent assignment, Pi materialization, immutable update/freeze, - cached rollback, lifecycle/account switching, and unknown-key fail-closed behavior - passed. System-included Data Service exposed no account/device download action. -- Final x64 staging, electron-builder, Windows artifact verification, and packed - Marketplace/Pi proof passed. `Makelore-2.0.0-win-x64.exe` was 208,235,670 bytes with - SHA-256 `738A2F6573C502281787F418EA666C6E62C287CA0EC13C6EB22369DAB0B3FFFA`. - The aggregate wrapper's only deviations were two external GitHub uv 0.10.0 download - reset/timeouts; exact cached uv 0.10.0 binaries were verified and used for the - successful x64 stage/build. No tracked client file changed during acceptance. - -## Follow-ups - -- Production activation remains HOLD until the official Ed25519 public key is built - into MakeLore. The matching server private key must remain deployment-secret-only; - no production key was generated or committed. -- Release B remains closed behind PROVIDER-GATE. No hosted Provider/runtime, metering, - refund, Plugin Charges, XMB-01, deployment, publication, push, or PR was started. - -## Promotion Candidates - -- After MLM-06 review and XMA-01, promote the Marketplace Main/Package Store/effective - resolver chain into `.project-docs/20-architecture/module-map.md` and - `data-flow.md`, including account cache, immutable installation, frozen worker - snapshot, and lifecycle invalidation. -- Refresh `.project-docs/30-worklog/current-state.md` and - `.project-docs/40-domain/business-rules.md` with the separation between Account - Library, Device Installation, project enablement, Agent assignment, runtime - authorization, and billing; retain the official public-key activation hold. -- Add the final MLM-05/MLM-06/XMA-01 evidence to the evidence index only after live - acceptance; repository package/tests must not be promoted as signed-in live proof. diff --git a/.project-docs/40-domain/business-rules.md b/.project-docs/40-domain/business-rules.md index b52d9ac..cc800be 100644 --- a/.project-docs/40-domain/business-rules.md +++ b/.project-docs/40-domain/business-rules.md @@ -2,6 +2,27 @@ ## Durable Rules +- Marketplace Release A is curated: only Operations publishes packages. Users may + acquire an eligible Plugin for free; only server-declared metered operations may + later consume Token Points, and system-included Data Service remains zero-charge. +- Account Library, Device Installation, project enablement, Agent assignment, runtime + authorization, and billing are separate states. No read, install, acquisition, or + assignment may silently advance another state. +- Marketplace packages become effective only after closed manifest/descriptor parsing, + canonical archive and client-compatibility checks, Ed25519 verification, immutable + Package Store selection, project enablement, Agent projection, and current server + policy admission. Unknown or unavailable IDs remain persisted but do not materialize. +- A parent Pi worker freezes the exact verified package root, Skills, tools, policy, + Account, project, and Release for its lifetime; child workers receive no Plugin + resources. Lifecycle invalidation blocks new actions but does not hot-swap a running + worker or delete bytes it still owns. +- System-included Data Service ships with MakeLore and has no Library acquisition, + Admission, download, update, or device-uninstall action. Users may still enable it + per project and assign its Skill to an Agent. +- Production Marketplace trust fails closed while the official Ed25519 public key is + absent. Test-only/integration keys and packaged unknown-key rejection are evidence, + not authority to activate production. Release B hosted Provider runtime remains + closed behind its separate Provider gate. - 面向用户的 AI 编程新建流程必须在 `mini_game`、`mini_program`、`custom` 中选择；`ProjectType` 是产品类型，创建后不能通过 UI 或 Host API 修改，未传类型的兼容 API 调用按 `custom` 处理。 - 新建小游戏和小程序会生成平台固定版本的受控 Vite 发布模板，并可使用项目配置中的单一“提交审核”入口；`custom` 和缺少类型字段的旧项目不提供一键发布。 - `ProjectType` 不等于 `BuildPreset`：第一期两个可发布产品类型都映射到内部受控 Vite preset；本地 `projectType` 不是授权边界，Main-owned 安全打包、Host API 和服务端包体校验仍必须执行。 diff --git a/.project-docs/50-evidence/evidence-index.md b/.project-docs/50-evidence/evidence-index.md index 6826a98..b790c66 100644 --- a/.project-docs/50-evidence/evidence-index.md +++ b/.project-docs/50-evidence/evidence-index.md @@ -4,6 +4,7 @@ Use this index for searchable, traceable evidence records. | Date | Topic | Status | Source | Detail | |---|---|---|---|---| +| 2026-08-30 | MakeLore curated Plugin Marketplace Release A | Integrated locally; XMA-01 live acceptance PASS; production trust activation HOLD | Source `40df677a31ff7651f962151eb84b925987781c03`, source task `20260828-plugin-marketplace-client-5f8b3d72`, integration task `20260830-integrate-plugin-marketplace-client-6e3b9d82` | R7 Standards/Spec passed with zero findings. XMA-01 passed 12/12 using real PostgreSQL, signed-in packaged MakeLore, Operations-published temporary-key packages, A/B account isolation, immutable install/update/freeze/rollback, project/Agent/Pi materialization, lifecycle invalidation, pricing-only ETag change, Data Service 10 tools/14 operations and zero Token Point transactions. Final Windows installer was 208,235,670 bytes with SHA-256 `738A2F6573C502281787F418EA666C6E62C287CA0EC13C6EB22369DAB0B3FFFA`. The official Ed25519 public key was not supplied, so the production trust store correctly remains fail closed; no deployment or production publication occurred. | | 2026-08-26 | Makelore Code Pi hard cutover、后台运行 ownership 与 Works user-context Provider 修复 | 本地 `main` 已集成；Windows 最终安装包与 packaged proof Pass；真实 Provider/macOS/native Linux 非 Pass | 集成交付 `48a9189`、实现 `a098266`、任务 `20260826-fix-pi-model-provider-8d4c2a71` / `20260826-integrate-pi-provider-fix-6e4c2a91`、`docs/pi-runtime-release-runbook.md` | OpenCode production runtime/package/plugin/fallback 已删除，Pi `0.84.2` 是唯一 runtime。未解析 Conversation 现在 validate→persist resolved model→prepare；exact Works `works square AI gateway did not return one-api user context` 会失效缓存 credential、以非重试 Provider-auth failure 结束且不自动 replay，`agent_end willRetry:false` 不再被 `agent_settled` 覆盖成 completed。聚焦 47/47、related 54/54、projector 12/12、181 files / 1541 full unit + pressure、typecheck、lint、Vite build、Windows Electron 4/4、publish/runtime/artifact/Pi/subagent/final packaged proof 通过。NSIS 208,162,564 bytes，SHA-256 `A02F79FCD3273FB0B013450492DC788B6E5ED7BBC1007468FB83BE949B8CB30D`，未签名；final app.asar SHA-256 `A8394D0F7324B27D2C95469ABD4E2A39C739EABCC6D8B41E1D65BA4B41FB9D39`。真实 Provider 是 Explicitly Waived / Accepted Risk 且 `realTurnVerified=false`；macOS x64/arm64 与 native non-WSL Linux 未验收。 | | 2026-08-21 | AI 编程模型切换真实 OpenCode wire 与 fresh runtime proxy token 修复 | 客户端实现及自动化验证通过；新构建真实本地 smoke 待执行 | 源任务 `20260821-model-switch-runtime-fix-a83d6c91`、源提交 `cce7722`、集成任务 `20260821-integrate-model-switch-fix-8f2d6c41` | 本地 1.1.8 / OpenCode 1.18.9 日志暴露旧请求缺少 `model.id`，且每进程 Host API token 被误判为 provider credential rotation。Main client 现将内部 `modelID` 映射为 wire `id`；owned fresh runtime 构建时注入当前 proxy token，持久化该已生效值不再要求 restart，attached/unknown 与 timeout/partial persistence 仍 fail closed。4 files / 171 focused、177 files / 2074 full unit、typecheck、lint（0 errors / 6 existing warnings）、production build 与 Electron E2E 1/1 通过。 | | 2026-08-20 | AI 编程 Session 模型切换与新增伙伴 hot-add | 客户端实现及自动化验证通过；真实 provider 多 Session smoke 仍沿用既有待验收项 | 源任务 `20260820-session-model-agent-hotfix-6e4c9a2f`、源提交 `c0163bc`、集成任务 `20260820-integrate-session-model-hotfix-7b3e91c4` | 页面选择器与 `/models` / `/model` 通过 OpenCode native Session endpoint 切换模型，普通执行不再覆盖选择或要求 runtime restart；Agent readiness 改为逐 id，新增唯一 id 在 owned fresh generation 被 live registry 发现后可用，同 id 编辑与删后重建仍 fail closed。405 focused、176 files / 2068 full unit、typecheck、lint（0 errors / 6 existing warnings）、Vite build 与 Electron E2E 1/1 通过。 |