chore(marketplace): record client coordination gate

.project-docs/30-worklog/tasks/20260828-plugin-marketplace-client-5f8b3d72.md

@@ -0,0 +1,110 @@
+# Task: Implement curated plugin marketplace Release A client
+
+## Identity
+
+- Task ID: 20260828-plugin-marketplace-client-5f8b3d72
+- Mode: Feature
+- Branch: codex/20260828-plugin-marketplace-client-5f8b3d72-plugin-marketplace-client
+- Worktree: D:\Datas\OthersProjects\makelore-plugin-marketplace-client-5f8b3d72
+- Base commit: 1ca8deb54b7b530ab8c5b6a5b7e613730c3b97ec
+- Owner: codex-root
+- Status: In Progress
+
+## Scope
+
+- Coordinate the repository-local Marketplace Release A MakeLore unit from exact
+  completed Plugin P0 evidence head `1ca8deb54b7b530ab8c5b6a5b7e613730c3b97ec`.
+- Deliver MLM-00 through MLM-06, the packaged-client half of XMA-01,
+  dependency-ordered integration, fixed-base review/remediation, package proof, and
+  exact final evidence on this isolated branch.
+- Own only this coordinator worktree/branch, coordinator task record, merger/package
+  proof verification, and cross-repository acceptance ledger.
+
+## Intent And Constraints
+
+- Implement Marketplace Release A only: schema-v2 declarative parsing, code-owned
+  Ed25519 trust, Main-owned Works Marketplace/Library access, atomic Package Store,
+  one effective plugin snapshot, and Marketplace/My Plugins/Project Plugins UI.
+- Keep acquisition, device installation, project selection, backend configuration,
+  Agent assignment, authorization, invocation, and billing separate. No UI action may
+  silently chain another state mutation.
+- Preserve the completed Plugin P0/Data Service behavior: exact bundled schema 1,
+  project ID retention, ten typed tools, four preview operations, closed capability
+  envelope, child-empty workers, and zero Token Point transactions.
+- Keep Release B closed: no hosted adapter, Provider endpoint/credential, Plugin
+  Charges, Plugin Credits, arbitrary local code/scripts/native/hooks/LSP/stdio MCP,
+  or generic invoke/config/ledger.
+- Product trust accepts only code-owned official public keys. Tests may inject
+  ephemeral verifiers through service dependencies; no production private key or
+  arbitrary runtime public-key override may be committed.
+- Use exact-frontier isolated implementers, disjoint ownership, one source commit per
+  ticket, one repository-local merger, read-only fixed-range reviewers, and one
+  remediation owner at a time. Implementers are not alone and must preserve others'
+  work.
+- The user root `main` worktree, old P0 coordinator, live services, push, deployment,
+  publication, and PR fabrication are outside authority. No PR is created for this
+  local-only delivery.
+
+## Project Context Loaded
+
+- Concurrent and Planning Gates passed in the registered isolated worktree. Task ID,
+  owner, mode, branch, worktree, and exact base match the task-context owner record.
+- Fully read `AGENTS.md`, the implementation specification, ticket graph, accepted
+  detailed design, project-memory startup set, relevant architecture/evidence/
+  commitment/stale material, completed Plugin P0 client record, and current manifest,
+  registry, project selection, effective Pi, Host composition, Plugin Center, tests,
+  and package scripts.
+- Exact Git facts: HEAD is `1ca8deb54b7b530ab8c5b6a5b7e613730c3b97ec`;
+  reviewed product head `78fb7d730731a7b0ebadf12418ca4c2eb6ef3310` is an
+  ancestor. The remaining base delta is P0 evidence only. User root `main` is not the
+  source or implementation worktree.
+- The completed P0 coordinator is read-only evidence. Other same-topic local owners
+  are completed implementers/remediators or read-only historical reviewers; no active
+  peer owns this new branch or has a semantic conflict with the Release A DAG.
+- Canonical integrated memory predates the unintegrated P0 coordinator; its exact task
+  evidence and this frozen base/spec control Marketplace work.
+- Likely modules are exactly the MLM-01 through MLM-04 ownership sets: schema-v2 and
+  signature primitives; Marketplace client/account cache/Package Store; effective
+  resolver/Main/Pi lifecycle; Renderer pages/stores/routes; and MLM-05 package proof.
+
+## Ticket Ownership
+
+- MLM-00, MLM-05, MLM-06 coordination, and XMA-01 client evidence: this coordinator.
+- MLM-01 through MLM-04: exact-frontier isolated implementers in graph order. MLM-02
+  remains blocked until MLM-01 is integrated and the WSM-03/WSM-04 DTO is frozen.
+- MLM-06 Standards and Spec axes: independent read-only reviewers. Accepted root
+  causes route to one isolated remediation implementer at a time before repeat review.
+- Current frontier after this checkpoint is `{WSM-01, MLM-01}` only.
+
+## Outcome
+
+- MLM-00 completed. The coordinator unit is isolated from the exact accepted P0
+  evidence head, both documentation gates pass, semantic overlap is clear, and no
+  client product file changed before opening MLM-01.
+- The official platform public key is not present and remains a production activation
+  input; the parser/signature implementation and injected-key acceptance still proceed.
+- No push, PR, deployment, production key generation, or publication was attempted.
+
+## Verification
+
+- `git rev-parse HEAD` returned exact `1ca8deb54b7b530ab8c5b6a5b7e613730c3b97ec`;
+  ancestry of reviewed product head `78fb7d7...` passed. The only initial status entry
+  was this task record.
+- `corepack pnpm --version` reported the repository-pinned `10.33.4`.
+- This fresh worktree lacked dependencies, so `corepack pnpm install
+  --frozen-lockfile` restored the locked 997-package graph entirely from the package
+  store; no source or lockfile changed.
+- `corepack pnpm run typecheck` passed.
+- The ten-file manifest/capability-policy/project-selection/Pi/Host/Plugin Center
+  baseline passed `68 passed, 2 skipped` (`70` total) in 10.27 seconds with one
+  worker. The two skips are the existing staged-runtime gates.
+- The run was proportionate: a type/parser/registry/Pi failure would have stopped
+  MLM-01 because schema-v2 primitives cannot safely extend a broken claimed P0 base.
+
+## Follow-ups
+
+- None recorded.
+
+## Promotion Candidates
+
+- None recorded.