From 405b9f64fd6872f6b4bd4c4429e6aaff2fa0b84a Mon Sep 17 00:00:00 2001 From: brother7 <7brother7@gmail.com> Date: Thu, 27 Aug 2026 21:19:27 +0800 Subject: [PATCH] docs(coding): record ML-07 R2 remediation --- ...0260827-makelore-plugin-client-7d3a91c4.md | 29 +++++++- ...827-plugin-ml07-remediation-r2-6e9a3c41.md | 68 ------------------- 2 files changed, 28 insertions(+), 69 deletions(-) delete mode 100644 .project-docs/30-worklog/tasks/20260827-plugin-ml07-remediation-r2-6e9a3c41.md diff --git a/.project-docs/30-worklog/tasks/20260827-makelore-plugin-client-7d3a91c4.md b/.project-docs/30-worklog/tasks/20260827-makelore-plugin-client-7d3a91c4.md index 29f1f61..fb0af21 100644 --- a/.project-docs/30-worklog/tasks/20260827-makelore-plugin-client-7d3a91c4.md +++ b/.project-docs/30-worklog/tasks/20260827-makelore-plugin-client-7d3a91c4.md @@ -8,7 +8,7 @@ - Worktree: D:\Datas\OthersProjects\makelore-plugin-client-7d3a91c4 - Base commit: eb5d15d68470b30ec181164f08f0d7b027ef0006 - Owner: codex-root -- Status: In Progress (ML-07 remediation integrated; repeat fixed-range review pending) +- Status: In Progress (ML-07 R2 remediation integrated; third fixed-range review pending) ## Scope @@ -380,6 +380,33 @@ - Repeat Standards and Spec review must use the unchanged base `eb5d15d...` and the post-remediation coordinator documentation checkpoint as its exact head. +## ML-07 Repeat Review And R2 Remediation + +- Repeat fixed-range review over exact `eb5d15d...29cf322` confirmed the first + remediation but returned Standards FAIL and Spec FAIL on four remaining issues: + the Data Service adapter still consulted a static tool-definition catalog; late + project-A mutations could overwrite loaded project B; persisted reconnect/replay + identity evidence was still a direct repeated invocation; and child/core-only + workers still waited on optional policy refresh. +- The same sole remediation implementer returned source commit + `278e53304a10a0336b8b737b85c158c5f2a40d84` with exact parent + `29cf322f1ac0500295c1afec076800aea3908eb3`; it integrated without conflict as + coordinator commit `f0ac7d7`. The foreign source task record is removed here and + remains in its isolated source worktree. +- The adapter now validates the parsed registry-supplied tool; project-scoped enable, + configure, reset, collection removal, and project removal all reject stale + generation/project completions; policy refresh occurs only for an assigned + server-backed parent; and the extension bundle test persists run/resource identity, + reconnects/reimports, replays the same resource through the authenticated bridge + and real registry, and preserves exact + `pi:persisted-run:persisted-resource`. +- Source verification: affected 8 files / 44 tests passed; typecheck passed; focused + ESLint clean and full lint 0 errors with the same 5 existing warnings; Windows + staged/unpacked build passed; Pi packaged artifact verification passed. + Coordinator `corepack pnpm test` passed 201 normal files / 1,685 tests with 2 + staged-runtime skips, followed by the isolated pressure file 1/1 (202 files / + 1,686 passed / 2 skipped total). + ## Follow-ups - ML-07 must review the fixed committed range from exact diff --git a/.project-docs/30-worklog/tasks/20260827-plugin-ml07-remediation-r2-6e9a3c41.md b/.project-docs/30-worklog/tasks/20260827-plugin-ml07-remediation-r2-6e9a3c41.md deleted file mode 100644 index d54f139..0000000 --- a/.project-docs/30-worklog/tasks/20260827-plugin-ml07-remediation-r2-6e9a3c41.md +++ /dev/null @@ -1,68 +0,0 @@ -# Task: Remediate accepted MakeLore ML-07 R2 findings - -## Identity - -- Task ID: 20260827-plugin-ml07-remediation-r2-6e9a3c41 -- Mode: Feature -- Branch: codex/20260827-plugin-ml07-remediation-r2-6e9a3c41-plugin-ml07-remediation-r2 -- Worktree: D:\Datas\OthersProjects\makelore-plugin-ml07-remediation-r2-6e9a3c41 -- Base commit: 29cf322f1ac0500295c1afec076800aea3908eb3 -- Owner: ml07-remediator -- Status: Ready for Integration - -## Scope - -- Make the Data Service adapter validate the registry-supplied parsed tool instead of consulting a second static tool-definition table. -- Prevent stale project-scoped Plugin Center mutations from committing after a newer project load starts. -- Add persisted Pi run/resource identity evidence across reconnect and event replay through the existing extension bridge and capability registry. -- Refresh plugin policy only before a parent worker can materialize an assigned server-backed plugin; child and core-only resolutions must not wait. -- Change only the delegated product files, directly corresponding tests, and this record. - -## Intent And Constraints - -- Preserve the fixed first-party plugin boundary: package definitions are Main-authoritative, registry dispatch is the sole non-core tool path, and Pi remains the sole coding runtime. -- Preserve policy refresh before materializing an enabled and assigned server-backed plugin. Do not add facades, migration/checksum machinery, or a replay framework. -- Base and sole parent must remain `29cf322f1ac0500295c1afec076800aea3908eb3`; do not touch the coordinator or user root worktrees, push, or open a PR. -- Existing coordinator and reviewer tasks are read-only peers. The prior ML-07 remediation worktree is complete and must not be reused. - -## Project Context Loaded - -- Concurrent and Planning gates passed with `task_context.py`; status identifies this exact worktree, branch, base, task, and owner. -- Read the project memory entry/current-state/architecture/domain/data-flow/success criteria and relevant ADR/task records, including the coordinator, R2 reviewers, and prior remediation. -- Read the canonical plugin implementation spec (especially §§6-7.5, 10.2-12), detailed design (especially §§8.2-8.9, 15-17), and ML-07 plan ticket. -- Confirmed no ownership conflict: coordinator owns integration/its record; R2 reviewers are read-only; this task exclusively owns the bounded remediation files and focused tests. - -## Plan - -1. Add a red adapter test proving a registry-supplied schema controls validation, then remove the adapter's static definition lookup and run adapter/manifest/registry focus tests. -2. Add stale A-mutation/B-load store tests, then apply one generation/project guard consistently to `setEnabled` and adjacent Data Service mutation commits. -3. Move the refresh decision to the registry's existing role/assignment resolution seam; add never-settling child/core-only tests plus a server-backed parent refresh test, and remove the unconditional composition wrapper. -4. Extend the existing Pi extension bundle test to persist a run ID, reconnect/re-import, replay the same resource ID, and assert both calls traverse the bridge/real registry with the identical `pi::` request ID. Change production replay code only if this exposes a defect. -5. Run affected focused suites, typecheck, lint, build, and package proof proportionate to the changes; complete the task documentation gate and create one clean remediation commit. - -## Outcome - -- The Data Service adapter now validates and dispatches the immutable parsed tool supplied by the registry; its production dependency on `DATA_SERVICE_TOOL_DEFINITIONS` is removed while the typed ten-operation switch and domain bounds remain code-owned. -- Project-scoped enable/configure/reset/remove-collection/remove-project mutations capture both active project and load generation. A late project A response cannot inspect, commit, or trigger a reload after project B starts loading. -- Policy refresh now occurs inside the registry resource-resolution seam only for a parent with an assigned Skill owned by a server-backed plugin with a registered adapter. Child and parent/core-only resolution return without touching a stalled refresh; an assigned server-backed parent still refreshes before reading project enablement or policy state. -- The existing Pi extension bundle test persists `persisted-run`, reimports the generated extension to model reconnect, replays `persisted-resource`, and sends both calls through the authenticated bridge and real capability registry. Both results retain the exact request ID `pi:persisted-run:persisted-resource`; no production replay change was needed. -- The async/sync manifest loaders were intentionally not consolidated: their only duplication is the inherently different filesystem API flow, while both feed the same parser/validator. Refactoring that optional shape would not improve runtime authority within this bounded remediation. - -## Verification - -- Red evidence: adapter registry-schema test initially received success because the adapter replaced the supplied tool with the static definition; after the fix it rejects with `plugin_input_invalid` and the backend is not called. -- Red evidence: stale A enable and four adjacent Data Service mutation tests initially overwrote B or continued into inspect; after generation/project guards both pass without stale inspect/reload. -- Red evidence: assigned server-backed parent registry resolution initially never called refresh; after moving the decision into the registry it refreshes before enablement lookup. Never-settling refresh tests prove child and parent/core-only paths do not wait or call refresh. -- `pnpm exec vitest run` focused affected set: 8 files, 44 tests passed (`data-service-plugin-adapter`, plugin manifest/registry/composition/routes, store, Pi extension bundle, Pi resource loader). -- `pnpm run typecheck`: passed. -- Focused ESLint over all changed product/test files: passed with zero warnings/errors. Full `pnpm run lint` reported zero errors and five pre-existing unrelated warnings in Home/Makelore files. -- `pnpm run package:stage:win-x64`: passed (Vite renderer/Main/preload/utility builds and Pi runtime staging). -- First `pnpm run verify:artifact:pi` correctly reported a missing unpacked executable because Electron builder had not yet run. After `node scripts/run-electron-builder.mjs --win --publish never`, the verifier passed, including the package-owned Data Service manifest/Skill/tools and four core Skill roots. - -## Follow-ups - -- Coordinator will rerun the integration ledger/full suite after applying the sole remediation commit. - -## Promotion Candidates - -- None recorded.