From 4d8b1fcec0a751d2935effc7816c7e59f568ec65 Mon Sep 17 00:00:00 2001 From: brother7 <7brother7@gmail.com> Date: Fri, 28 Aug 2026 12:12:57 +0800 Subject: [PATCH] chore(marketplace): record client coordination gate --- ...0828-plugin-marketplace-client-5f8b3d72.md | 110 ++++++++++++++++++ 1 file changed, 110 insertions(+) create mode 100644 .project-docs/30-worklog/tasks/20260828-plugin-marketplace-client-5f8b3d72.md diff --git a/.project-docs/30-worklog/tasks/20260828-plugin-marketplace-client-5f8b3d72.md b/.project-docs/30-worklog/tasks/20260828-plugin-marketplace-client-5f8b3d72.md new file mode 100644 index 0000000..6383876 --- /dev/null +++ b/.project-docs/30-worklog/tasks/20260828-plugin-marketplace-client-5f8b3d72.md @@ -0,0 +1,110 @@ +# Task: Implement curated plugin marketplace Release A client + +## Identity + +- Task ID: 20260828-plugin-marketplace-client-5f8b3d72 +- Mode: Feature +- Branch: codex/20260828-plugin-marketplace-client-5f8b3d72-plugin-marketplace-client +- Worktree: D:\Datas\OthersProjects\makelore-plugin-marketplace-client-5f8b3d72 +- Base commit: 1ca8deb54b7b530ab8c5b6a5b7e613730c3b97ec +- Owner: codex-root +- Status: In Progress + +## Scope + +- Coordinate the repository-local Marketplace Release A MakeLore unit from exact + completed Plugin P0 evidence head `1ca8deb54b7b530ab8c5b6a5b7e613730c3b97ec`. +- Deliver MLM-00 through MLM-06, the packaged-client half of XMA-01, + dependency-ordered integration, fixed-base review/remediation, package proof, and + exact final evidence on this isolated branch. +- Own only this coordinator worktree/branch, coordinator task record, merger/package + proof verification, and cross-repository acceptance ledger. + +## Intent And Constraints + +- Implement Marketplace Release A only: schema-v2 declarative parsing, code-owned + Ed25519 trust, Main-owned Works Marketplace/Library access, atomic Package Store, + one effective plugin snapshot, and Marketplace/My Plugins/Project Plugins UI. +- Keep acquisition, device installation, project selection, backend configuration, + Agent assignment, authorization, invocation, and billing separate. No UI action may + silently chain another state mutation. +- Preserve the completed Plugin P0/Data Service behavior: exact bundled schema 1, + project ID retention, ten typed tools, four preview operations, closed capability + envelope, child-empty workers, and zero Token Point transactions. +- Keep Release B closed: no hosted adapter, Provider endpoint/credential, Plugin + Charges, Plugin Credits, arbitrary local code/scripts/native/hooks/LSP/stdio MCP, + or generic invoke/config/ledger. +- Product trust accepts only code-owned official public keys. Tests may inject + ephemeral verifiers through service dependencies; no production private key or + arbitrary runtime public-key override may be committed. +- Use exact-frontier isolated implementers, disjoint ownership, one source commit per + ticket, one repository-local merger, read-only fixed-range reviewers, and one + remediation owner at a time. Implementers are not alone and must preserve others' + work. +- The user root `main` worktree, old P0 coordinator, live services, push, deployment, + publication, and PR fabrication are outside authority. No PR is created for this + local-only delivery. + +## Project Context Loaded + +- Concurrent and Planning Gates passed in the registered isolated worktree. Task ID, + owner, mode, branch, worktree, and exact base match the task-context owner record. +- Fully read `AGENTS.md`, the implementation specification, ticket graph, accepted + detailed design, project-memory startup set, relevant architecture/evidence/ + commitment/stale material, completed Plugin P0 client record, and current manifest, + registry, project selection, effective Pi, Host composition, Plugin Center, tests, + and package scripts. +- Exact Git facts: HEAD is `1ca8deb54b7b530ab8c5b6a5b7e613730c3b97ec`; + reviewed product head `78fb7d730731a7b0ebadf12418ca4c2eb6ef3310` is an + ancestor. The remaining base delta is P0 evidence only. User root `main` is not the + source or implementation worktree. +- The completed P0 coordinator is read-only evidence. Other same-topic local owners + are completed implementers/remediators or read-only historical reviewers; no active + peer owns this new branch or has a semantic conflict with the Release A DAG. +- Canonical integrated memory predates the unintegrated P0 coordinator; its exact task + evidence and this frozen base/spec control Marketplace work. +- Likely modules are exactly the MLM-01 through MLM-04 ownership sets: schema-v2 and + signature primitives; Marketplace client/account cache/Package Store; effective + resolver/Main/Pi lifecycle; Renderer pages/stores/routes; and MLM-05 package proof. + +## Ticket Ownership + +- MLM-00, MLM-05, MLM-06 coordination, and XMA-01 client evidence: this coordinator. +- MLM-01 through MLM-04: exact-frontier isolated implementers in graph order. MLM-02 + remains blocked until MLM-01 is integrated and the WSM-03/WSM-04 DTO is frozen. +- MLM-06 Standards and Spec axes: independent read-only reviewers. Accepted root + causes route to one isolated remediation implementer at a time before repeat review. +- Current frontier after this checkpoint is `{WSM-01, MLM-01}` only. + +## Outcome + +- MLM-00 completed. The coordinator unit is isolated from the exact accepted P0 + evidence head, both documentation gates pass, semantic overlap is clear, and no + client product file changed before opening MLM-01. +- The official platform public key is not present and remains a production activation + input; the parser/signature implementation and injected-key acceptance still proceed. +- No push, PR, deployment, production key generation, or publication was attempted. + +## Verification + +- `git rev-parse HEAD` returned exact `1ca8deb54b7b530ab8c5b6a5b7e613730c3b97ec`; + ancestry of reviewed product head `78fb7d7...` passed. The only initial status entry + was this task record. +- `corepack pnpm --version` reported the repository-pinned `10.33.4`. +- This fresh worktree lacked dependencies, so `corepack pnpm install + --frozen-lockfile` restored the locked 997-package graph entirely from the package + store; no source or lockfile changed. +- `corepack pnpm run typecheck` passed. +- The ten-file manifest/capability-policy/project-selection/Pi/Host/Plugin Center + baseline passed `68 passed, 2 skipped` (`70` total) in 10.27 seconds with one + worker. The two skips are the existing staged-runtime gates. +- The run was proportionate: a type/parser/registry/Pi failure would have stopped + MLM-01 because schema-v2 primitives cannot safely extend a broken claimed P0 base. + +## Follow-ups + +- None recorded. + +## Promotion Candidates + +- None recorded.