From 4a1e5d31213191a0102eab9278dd9887ba8738f4 Mon Sep 17 00:00:00 2001 From: brother7 <7brother7@gmail.com> Date: Tue, 1 Sep 2026 02:44:41 +0800 Subject: [PATCH] docs(web-search): record client integration --- .../20-architecture/system-overview.md | 5 +- .project-docs/30-worklog/current-state.md | 12 ++++ ...-web-search-client-integration-7d2f5b94.md | 12 +++- ...1-web-search-mlw03-composition-d9f5b3e2.md | 64 ------------------- .project-docs/40-domain/business-rules.md | 8 +++ 5 files changed, 33 insertions(+), 68 deletions(-) delete mode 100644 .project-docs/30-worklog/tasks/20260901-web-search-mlw03-composition-d9f5b3e2.md diff --git a/.project-docs/20-architecture/system-overview.md b/.project-docs/20-architecture/system-overview.md index 5e2bd26..be429f7 100644 --- a/.project-docs/20-architecture/system-overview.md +++ b/.project-docs/20-architecture/system-overview.md @@ -23,6 +23,7 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展 | Pi Conversation Runtime | 一个长驻 Pi `0.84.2` Agent Server 承载每条 active/warm Conversation 的隔离逻辑 Runtime/Session/JSONL channel | 严格 LF JSONL RPC、generation recovery、Snapshot hydration；top-level 逻辑 turn 并发 4、warm idle LRU 8；Server 退出统一使旧 channel 失效并按需单实例重启 | | Pi Provider & Managed Resources | Provider catalog、thread-local secret projection、model/resource revision、Prompt/Skill/extension materialization | 父凭据只进入选中逻辑线程的内存 credential store，child 凭据只进入该短命进程；不扫描项目或用户的 `.pi/.agents/.codex`，不把 secret 放进 argv、catalog 或 Renderer | | Pi Extension, Subagents & Lifecycle | 唯一显式 Makelore extension、UI interaction、ephemeral child、write lease 与 background run lease | child 并发 4、单次最多 8、禁止递归；active/uncertain run 不因页面隐藏或 confirmation timeout 被停止，replacement/stop 必须可解释并清理所有 ownership | +| Native Web Search Plugin | Signed Marketplace Package → effective parent snapshot → code-owned Main adapter → fixed Works Square Web Search route | Renderer/Package/Pi 不持有 Provider key、model 或 URL；每次搜索要求显式确认，closed receipt 与 result-less uncertain state 由 Main 投影，child 不继承 hosted tool | | AI Design Workspace & Living Form | 一个 Workspace 的当前 Direction、Current Specification、持久 Agent Session、conversation timeline、Tasks 与 Assets | Living Form 是服务端 Current Specification 的投影；Renderer 只持有草稿和已接受投影 | | AI Design Input & Reconciliation | Chat、字段/集合编辑、decision、proposal、lock、Asset binding 与 restore | 全部进入同一 `design.input.apply` reducer；稳定 command/operation ID 支持 unknown-result 重放，revision conflict 刷新权威状态 | | AI Design Gateway Routing | Main-owned Works Square V2 adapter 与 Direction event stream | Main 持有 Works Token、stream ticket、WebSocket、重试分类和错误脱敏；事件顺序与 Task progress 不构成 Specification 真值 | @@ -87,8 +88,8 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展 ## Related Decisions -- 当前长期边界记录于 README、ADR-002 至 ADR-007（ADR-001 已由 ADR-007 supersede）及各 Integration Gate；后续如改变唯一入口、凭据所有权、构建执行边界、Living Form/Specification 状态归属、Pi 单 runtime/worker/lease 边界、Learning/Marketplace 分发边界、Robot 配网边界或重新引入客户端部署协调器，应新增 ADR。 +- 当前长期边界记录于 README、ADR-002 至 ADR-007（ADR-001 已由 ADR-007 supersede）及各 Integration Gate；后续如改变唯一入口、凭据所有权、构建执行边界、Living Form/Specification 状态归属、Pi 单 runtime/worker/lease 边界、Learning/Marketplace/Web Search 分发边界、Robot 配网边界或重新引入客户端部署协调器，应新增 ADR。 ## Last Updated -2026-08-31 +2026-09-01 diff --git a/.project-docs/30-worklog/current-state.md b/.project-docs/30-worklog/current-state.md index 8199081..b6135c4 100644 --- a/.project-docs/30-worklog/current-state.md +++ b/.project-docs/30-worklog/current-state.md @@ -4,6 +4,18 @@ This file is the integrated default-branch snapshot. Feature tasks record progre ## Integrated Through +- Native Web Search client tickets MLW-01 through MLW-03 are integrated by task + `20260831-web-search-client-integration-7d2f5b94` through product commit + `60e6a8eeb35431b0f1fb569af4d1502683f16317`, against frozen Works Square DTO + frontier `a49c696ebc4213e3d62ece780961efbe17576f8e`. MakeLore now reuses the shared + hosted Admission resolver, calls the single fixed Web Search typed route from + Electron Main, materializes the signed Marketplace Skill/tool only in an eligible + frozen parent Pi snapshot, and renders the closed billing receipt without parsing + Web Search payloads in Renderer. The packaged Windows app proves that the route + and receipt parser are main-reachable while OpenAI Provider authority is absent. + Real PostgreSQL and paid OpenAI acceptance remain external HOLDs; production + activation still requires the official Ed25519 key, OpenAI key/model, price, and + privacy copy. - Human-authorized takeover task `20260831-promote-main-merge-5e9c7a31` completed the already-started local `main` merge as `03a9e866d4366e0a1cb416e26b424fe981071310`, recorded the transfer in diff --git a/.project-docs/30-worklog/tasks/20260831-web-search-client-integration-7d2f5b94.md b/.project-docs/30-worklog/tasks/20260831-web-search-client-integration-7d2f5b94.md index 741abcf..980e090 100644 --- a/.project-docs/30-worklog/tasks/20260831-web-search-client-integration-7d2f5b94.md +++ b/.project-docs/30-worklog/tasks/20260831-web-search-client-integration-7d2f5b94.md @@ -38,6 +38,11 @@ - Product commit: `fc68cf295131d8f73556bef59fdeae61239a649e`; source and product trees are exact-equal at `5c14e92224e8441d18a983dd7099cd6d76f83e85` before this Integration Documentation Gate removes the duplicate foreign task record. - Delivered the Main-only closed Web Search client, bounded same-operation reconciliation, code-owned adapter, and the minimal generic billing/conversation/Registry support for `not_started` and Main-only `receipt_unavailable`. The adapter uses the MLW-01 admission helper and trusted project/request identity; no composition, Renderer, Pi, Package Store/effective resolver, Provider authority, or server path changed. - Final source review aligned source title/URL bounds with the frozen Server DTO and preserved both MLW-01 typed admission failures. The clean source branch retains its complete task record; integration evidence is consolidated here. +- MLW-03 source task `20260901-web-search-mlw03-composition-d9f5b3e2` was integrated from exact frontier `68cb2e73beb17d5041198d020aaa7b2884124950`. + - Source commit: `52f6a0b148403c822a09880467f81416a181b259` (sole parent `68cb2e73beb17d5041198d020aaa7b2884124950`). + - Product commit: `60e6a8eeb35431b0f1fb569af4d1502683f16317`; source and product trees are exact-equal at `d570c40f2ad315c8a314f831fb4337300ae28fc2` before this Integration Documentation Gate removes the duplicate foreign task record. + - Delivered production composition registration, the dynamic Web Search parent/child/current-authority proof, a generic closed billing-status timeline projection, package-main-reachable route/receipt proof with Provider-authority exclusion, and current README documentation. No Web Search payload-specific Renderer or static tool allowlist was added. + - The clean source branch retains its complete task record. This coordinator checkpoint removes only the duplicate cherry-picked copy and records the accepted facts in canonical project memory. ## Verification @@ -49,11 +54,14 @@ - MLW-02 final focused suite passed `3 files / 35 tests`; adjacent hosted admission, Game Resource, Registry, conversation, Marketplace-client, and timeline regression passed `11 files / 114 tests`. - MLW-02 full unit suite passed `214 files / 1748 tests`, with two staged-runtime skips; pressure passed `1/1`. Typecheck, owned lint, full lint (zero errors and the same five existing warnings), and Vite Renderer/Main/Preload/utility builds passed. - MLW-02 diff, project-docs, document-drift, sole-parent, clean-worktree, and `READY_FOR_INTEGRATION` gates passed. No live Provider call or production activation occurred. +- MLW-03 TDD started with four exact focused failures and finished with 4 files / 40 tests passed; the adjacent Web Search/admission/composition/lifecycle/Pi/timeline/artifact suite passed 10 files / 82 tests. +- MLW-03 full unit suite passed 214 files / 1,751 tests with two staged-runtime skips; pressure passed 1/1. Typecheck, scoped lint, full lint (zero errors and the unchanged five warnings), Vite builds, Electron Windows 6/6, and target Marketplace/Project Plugins/Skill E2E 4/4 passed. +- Clean source HEAD Windows packaging and verification passed. `verify:artifact:win` embedded exact commit `52f6a0b148403c822a09880467f81416a181b259`; installer size was 208,252,221 bytes with SHA-256 `2D027DB5BE00336F1EB45D882519F971EB791014A1930C5FBED93FE6B15B6303`. `verify:artifact:pi` passed the real app.asar Web Search route/receipt/provider-authority proof; inherited Pi cross-platform/real-provider waivers remain unchanged. ## Follow-ups -- Start MLW-03 only from the clean post-MLW-02 coordinator frontier. MLW-03 owns composition, the generic timeline billing projection, dynamic tool/package proof, README, and necessary focused/E2E evidence; it must not reopen MLW-01/02 authority. -- Keep the live OpenAI XWS-01 group and production activation closed pending explicit external inputs and user authorization. +- Run fixed-range Standards and Spec review from client base `0a86ec825a5803bf7e037d3b23c39be23238c43d` through the clean post-MLW-03 documentation frontier; use one remediation owner only if either axis reports an actionable finding. +- Keep real PostgreSQL, the live paid OpenAI XWS-01 group, and production activation closed pending their explicit external inputs and user authorization. ## Promotion Candidates diff --git a/.project-docs/30-worklog/tasks/20260901-web-search-mlw03-composition-d9f5b3e2.md b/.project-docs/30-worklog/tasks/20260901-web-search-mlw03-composition-d9f5b3e2.md deleted file mode 100644 index 7bc0264..0000000 --- a/.project-docs/30-worklog/tasks/20260901-web-search-mlw03-composition-d9f5b3e2.md +++ /dev/null @@ -1,64 +0,0 @@ -# Task: Implement MLW-03 composition and packaged proof - -## Identity - -- Task ID: 20260901-web-search-mlw03-composition-d9f5b3e2 -- Mode: Feature -- Branch: codex/20260901-web-search-mlw03-composition-d9f5b3e2-web-search-mlw03-composition -- Worktree: D:\Datas\OthersProjects\makelore-web-search-mlw03-composition-d9f5b3e2 -- Base commit: 68cb2e73beb17d5041198d020aaa7b2884124950 -- Owner: web-search-mlw03-implementer -- Status: Ready for Integration - -## Scope - -- Wire the code-owned Web Search adapter into `electron/api/coding-composition.ts` so the existing effective-plugin snapshot is the only parent-worker materialization and invocation authority. -- Add the Web Search parent/child/current-authority scenario to `tests/unit/coding-capability-registry.test.ts` and the composition registration proof to `tests/unit/coding-plugin-composition.test.ts`. -- Add only a generic closed billing-state projection to `src/pages/Chat/CodingConversationTimeline.tsx` with focused coverage in `tests/unit/coding-conversation-timeline.test.tsx`; do not parse `web-search.v1` or add Web Search-specific Renderer state. -- Extend the packaged main-reachable proof in `scripts/lib/pi-product-artifact.mjs` and `tests/unit/pi-product-artifact.test.ts` for the fixed hosted Web Search route, receipt-unavailable parser, and absence of provider authority. The verifier script is a necessary adjacent proof file required by the MLW-03 acceptance criteria and has no competing ticket owner. -- Update `README.md` to describe the shipped native hosted Web Search capability and its production activation holds. -- Do not modify MLW-01 admission ownership, MLW-02 client/adapter/envelope ownership, project selection services, Marketplace pages, Provider/Server code, or Release B surfaces. - -## Intent And Constraints - -- Exact source base is `68cb2e73beb17d5041198d020aaa7b2884124950`; server DTO authority is frozen at `a49c696ebc4213e3d62ece780961efbe17576f8e`. -- Concurrent Task Gate and Planning Gate passed after verifying task identity, branch/worktree/base, clean product state, coordinator/MLW-01/MLW-02 peers, canonical implementation spec/design, and project memory. The older broad Web Search client task remains at its original base with no product diff and does not conflict with this exact-base ticket. -- Use test-first natural boundaries. Parent workers may receive one dynamically installed Web Search Skill/tool; child workers receive none. Disabled, uninstalled, stale, account-switched, project-switched, or logged-out state must affect only the next frozen worker snapshot. -- Keep provider key, model choice, provider URL, signed URL, admission authority, and account authority out of Renderer/package artifacts. No static tool allowlist, generic invoke route, `pi-web-search`, or third-party Pi extension. -- Real PostgreSQL, live paid OpenAI, production signing key, production OpenAI key/model/price/privacy copy, push, PR, deployment, and publication remain out of scope or explicitly held. - -## Plan - -1. Add focused failing tests for composition registration, dynamic parent/child/current invocation, generic billing projection, and packaged reachability/provider-authority exclusions. -2. Implement the smallest composition/timeline/artifact/README changes that turn those tests green. -3. Run focused and adjacent regressions, typecheck, lint, Vite/Electron/package proof as applicable, full unit pressure, documentation gates, and produce one clean source commit. - -## Outcome - -- Registered the code-owned Web Search adapter in both production capability execution and project-plugin inspection/deactivation paths. Marketplace-installed schema-v2 definitions remain the only Skill/tool source; no Web Search definition or tool allowlist was added to composition. -- Added an end-to-end registry proof for the frozen Web Search parent snapshot: one parent Skill/tool, no child inheritance, exact Main request/admission/envelope mapping, and refusal of a subsequent old-worker action after the project is disabled. -- Added a generic closed billing-state renderer for all `makelore-capability.v1` tools. `receipt_unavailable` is displayed as `收费状态未同步，请勿重复发起`; the timeline does not inspect `web-search.v1` answer/source payloads or add Web Search-specific state. -- Extended the package-main-reachable artifact proof to require the Web Search plugin ID, fixed Works route, and receipt-unavailable parser while rejecting embedded OpenAI key/origin authority. The built app remains fail-closed for the absent official Marketplace signing key. -- Updated README current-product documentation for native hosted Web Search, dynamic Marketplace Skill materialization, explicit Token Point confirmation, and production activation holds. - -## Verification - -- TDD boundary: after dependency materialization, the first focused run failed exactly four assertions (missing composition registration, generic receipt projection, Web Search artifact result field, and provider-authority rejection). The implementation turned the same boundary green: 4 files / 40 tests. -- Focused plus adjacent Web Search/admission/composition/lifecycle/Pi/timeline/artifact suite: 10 files / 82 tests passed. -- Full unit suite: 214 files / 1,751 tests passed / 2 staged-runtime tests skipped; isolated pressure suite: 1/1 passed. -- `pnpm run typecheck`: passed. Scoped ESLint: passed. Full `pnpm run lint:check`: 0 errors and the unchanged 5 warnings in Home/Makelore. -- `pnpm run build:vite`: passed for Renderer, Main, Preload, and utility worker. Electron Windows Vitest: 2 files / 6 tests passed. Marketplace, Project Plugins, and Skill configuration Playwright targets: 4/4 passed. -- `pnpm run package:win`: passed and produced the unpacked x64 app plus NSIS installer. The first installer was 208,252,283 bytes with SHA-256 `E6ABFA36C219F71FDBCAE811BA01DAEFFFAA3625FCCA17FE40C12CE507D0808E`; a clean-source-HEAD package/verification is required immediately after the sole commit before handoff. -- `pnpm run verify:artifact:pi`: passed against the real built `app.asar`; Marketplace proof includes the Web Search ID, fixed route, receipt parser, absent Web Search provider authority, and official-key-absent fail-closed trust. Existing Pi runtime result remains the inherited `partial-pass` for deferred cross-platform/real-provider evidence. -- `pnpm run verify:publish-runtime`: passed with npm 11.6.2. The pre-commit `verify:artifact:win` correctly refused to claim a clean artifact while the source diff was uncommitted; it is not a product failure and must be rerun on the source commit. -- `git diff --check`: passed. - -## Follow-ups - -- Real PostgreSQL lifecycle remains an external HOLD because no local service, Docker runtime, or `TEST_POSTGRESQL_DATABASE_URL` is available; SQLite is not accepted as a substitute. -- Live OpenAI acceptance remains HOLD because paid calls were not authorized. Production activation also remains HOLD for the official Ed25519 public key, `WEB_SEARCH_OPENAI_API_KEY`, approved model, price, and privacy copy. -- XWS-01 and the fixed-range Standards/Spec review remain coordinator-owned after MLW-03 integration. - -## Promotion Candidates - -- None recorded. diff --git a/.project-docs/40-domain/business-rules.md b/.project-docs/40-domain/business-rules.md index b9630a2..491b9b7 100644 --- a/.project-docs/40-domain/business-rules.md +++ b/.project-docs/40-domain/business-rules.md @@ -38,6 +38,14 @@ not expose Provider credentials, URLs, credit balances, raw responses, or Provider job IDs. Saving a hosted result must use bounded project-relative paths and the existing project write lease. +- Native Web Search is a user-acquired `platform_hosted` Marketplace Plugin. Free + acquisition, device installation, project enablement, Agent assignment, current + Admission, and explicit per-search Token Point confirmation are separate gates. + Only the frozen parent worker receives `makelore_web_search`; child workers receive + no hosted tool. `submission_unknown` is result-less and must not auto-retry, while + `receipt_unavailable` is a Main-only closed billing projection that tells the user + not to repeat the search. Provider key, model, URL, price authority, and raw response + never enter Renderer, the Package, Pi arguments, or project metadata. - 面向用户的 AI 编程新建流程必须在 `mini_game`、`mini_program`、`custom` 中选择；`ProjectType` 是产品类型，创建后不能通过 UI 或 Host API 修改，未传类型的兼容 API 调用按 `custom` 处理。 - 新建小游戏和小程序会生成平台固定版本的受控 Vite 发布模板，并可使用项目配置中的单一“提交审核”入口；`custom` 和缺少类型字段的旧项目不提供一键发布。 - `ProjectType` 不等于 `BuildPreset`：第一期两个可发布产品类型都映射到内部受控 Vite preset；本地 `projectType` 不是授权边界，Main-owned 安全打包、Host API 和服务端包体校验仍必须执行。