docs(makelore): record platform auth rollback

.project-docs/10-decisions/adr-004-square-auth-lifecycle-boundary.md

@@ -2,27 +2,25 @@
 
 ## Status
 
-Accepted and implemented on 2026-08-19; amended on 2026-10-10.
+Accepted and implemented on 2026-08-19.
 
 ## Context
 
-The desktop client obtained tokens from Works Square but refreshed them directly against the custom identity service with an embedded OAuth client secret. That mixed issuer/client boundary made rotation dependent on two independently configured clients and could turn an otherwise valid persisted session into `invalid_grant`, returning the user to the login page hours later. The platform account system now exposes a standard OIDC issuer for the public platform identity while the existing Works Square password/mobile facade remains available for its legacy path.
+The desktop client obtained tokens from Works Square but refreshed them directly against the custom identity service with an embedded OAuth client secret. That mixed issuer/client boundary made rotation dependent on two independently configured clients and could turn an otherwise valid persisted session into `invalid_grant`, returning the user to the login page hours later.
 
 ## Decision
 
 - Renderer sends authentication operations only to Electron Main.
 - Electron Main owns access/refresh tokens, encrypted persistence, refresh rotation, terminal failure cleanup, and the seven-day inactivity policy.
 - Optional remembered username/password data is a separate Electron Main record. Packaged builds encrypt it with OS-protected storage; it is never Renderer-persisted or stored by Works Square.
-- Platform account login uses Main-owned Authorization Code + PKCE against the configured platform OIDC issuer: system browser, exact `niancode://auth/callback`, state/nonce/S256 validation, and a registered public Makelore client without a secret. Main owns the code exchange and all resulting tokens.
+- Desktop login, mobile login, refresh, and logout use fixed Works Square `/api/auth/*` endpoints.
-- Legacy password/mobile login, refresh, and logout use fixed Works Square `/api/auth/*` endpoints.
 - Works Square owns the confidential upstream OAuth client configuration and proxies the lifecycle to the identity service.
-- The desktop bundle must not contain a confidential OAuth client secret or call the custom one-feel identity service directly; platform OIDC access remains behind the Main boundary and uses the configured standard issuer.
+- The desktop bundle must not contain an OAuth client secret or call the custom identity service directly.
 - Logout and mobile login preserve remembered-password data. A successful password login with the option cleared removes the previous record; unavailable secure storage disables the option.
 
 ## Consequences
 
 - The matching Works Square server endpoints must be deployed before this client is released.
-- The packaged client must receive `PLATFORM_AUTH_ISSUER` and the registered Makelore client/redirect configuration before platform login can be released; no username, email, or legacy identifier is used to rebind a platform subject.
 - OAuth credential rotation or upstream endpoint changes are server-side configuration changes rather than desktop releases.
 - A terminal refresh `400` or `401` still fails closed and clears the local session; transient failures preserve the established retry behavior.
 - Remembered-password persistence is convenience behavior rather than session authority. Its failure must not grant authentication or move password persistence to Works Square/Renderer.

.project-docs/10-decisions/decision-index.md

@@ -36,7 +36,7 @@
 | ADR-007 | AI Design 采用单一 Current Specification、Living Form 与不可变 Quote 的 V2 权威；active plan 与 reference alias 是其公共投影 | Accepted / implemented, amended 2026-09-07 | 2026-08-30 | AI Design Renderer、Electron Main、Works Square V2 API | `adr-007-ai-design-living-form-v2.md` |
 | ADR-002 | Robot V1 采用 Main 门控的引导式热点配网并衔接现有六位 Binding | Accepted / implemented, default on | 2026-08-16 | Robot Renderer、Host API、Electron Main、现有固件热点入口 | `adr-002-robot-guided-hotspot-binding-v1.md` |
 | ADR-003 | Robot 配网页内扫描并连接 Windows/macOS 热点 | Accepted / implemented with physical release gates pending | 2026-08-16 | Robot Renderer、Host API、Electron Main、Windows WLAN、macOS CoreWLAN/CoreLocation | `adr-003-robot-in-app-hotspot-connection.md` |
-| ADR-004 | Works Square 与平台 OIDC 共同由 Electron Main 统一拥有桌面认证生命周期边界 | Accepted / implemented, amended 2026-10-10 | 2026-08-19 | Renderer、Host API、Electron Main、Works Square auth facade、platform OIDC issuer | `adr-004-square-auth-lifecycle-boundary.md` |
+| ADR-004 | Works Square 统一拥有桌面认证生命周期边界 | Accepted / implemented | 2026-08-19 | Renderer、Host API、Electron Main、Works Square auth facade | `adr-004-square-auth-lifecycle-boundary.md` |
 | ADR-006 | Makelore Code 以 Pi `0.84.2` 为唯一 runtime，父 Conversation 复用一个 Main-owned Agent Server 并隔离逻辑 Runtime/Session/provider/lease，产品只暴露 Snapshot/Patch 合同 | Accepted / implemented, amended 2026-08-31 | 2026-08-26 | Code Renderer、Host API、Electron Main、Pi runtime、Provider/resource、packaging | `adr-006-pi-runtime-hard-cutover.md` |
 
 ## Superseded Decisions

.project-docs/20-architecture/data-flow.md

@@ -78,7 +78,7 @@ Main 在接收带图消息时立即将上传 attachment id 放入 optimistic use
 | Effective Plugin worker snapshot | Installed trusted package or code-owned official definition + project selection + applicable Agent assignments + current server policy | effective resolver → Registry/resource loader/Extension Host/tool catalog → parent Pi worker | One frozen snapshot supplies Skills, tools, package roots, and runtime authorization. Data Service、Game Resource 与 Project Scaffold 直接按项目启用状态取得资源；Agent assignment 只对采用该范围的其他 Plugin 保持权威。Disable、账号/项目切换、logout、Renderer crash、Main shutdown 或 worker generation 变化会使后续动作失效，但不改写持久化的未知 assignment；child worker 不接收 Plugin 投影。 |
 | Plugin workspace navigation | Project Configuration `插件` ResourceCard or compatibility URL | `/project-config/plugins` → Project Configuration remains mounted → same-page wide Plugin sheet → unified Plugin stores/Main routes | Code sidebar has no standalone Plugin entry. `/plugins` and old Plugin URLs only preserve query/filter intent while redirecting; embedding does not merge acquisition, install, project enablement, assignment, runtime authorization, or billing lifecycles. |
 | Hosted Game Resource operation and delivery | Eligible parent `makelore.game-resource` generate call plus one explicit confirmation | frozen Plugin adapter → Main delivery coordinator → one `GameResourceClient` submission → internal status polling → all terminal downloads → `assets/generated/game-resource/<executionId>/` in the frozen original project | Server policy owns pricing、payer、Admission 与 Provider receipt state；Main owns the durable local delivery receipt and filesystem. `submission_unknown` 不会作为新请求重放。重启或重试只恢复下载/保存，共享项目写租约仅在终态落盘期间持有；Agent 只收到一张进度/结果卡片，不暴露 status/save 工具，也不要求第二次确认。 |
-| 桌面认证生命周期 | Renderer 登录、刷新与注销请求 | 平台账号：Host API → Main 系统浏览器 OIDC Authorization Code + PKCE → 配置的 issuer discovery/authorize/token/userinfo/revoke；传统密码/手机路径：Host API → Main Works Session → Works Square `/api/auth/{login,mobile-login,refresh,logout}` → one-feel auth | Main 加密持有并先持久化轮换 token；平台路径使用 state/nonce/S256 与精确 `niancode://auth/callback`，客户端不携带 confidential OAuth client secret；连续 7 天未使用才清除本地会话，终止性 `400`/`401` fail closed |
+| 桌面认证生命周期 | Renderer 登录、刷新与注销请求 | Host API → Main Works Session → Works Square `/api/auth/{login,mobile-login,refresh,logout}` → one-feel auth | Main 加密持有并先持久化轮换 token；客户端不携带 OAuth client secret；连续 7 天未使用才清除会话，终止性 `400`/`401` fail closed |
 | Permanent Token Point Wallet | 已登录账号菜单、窗口 focus、明确充值或恢复订单 | Renderer → Main `/api/works/billing/*` → Works Square 固定账务 API → safe wallet/order projection | 本人精确余额与另一付款方可用性分开；稳定充值身份、冻结订单、原单恢复与服务端确认入账遵循上方数据流。会员、周额度与重置卡流程已移除。 |
 | 用户模块入口策略 | 会话恢复 / 登录 / 刷新 | Electron Main → Works `/api/auth/me` → 三布尔安全投影 → Renderer auth store → 卡片/路由/provider gate | 缺失对象或字段默认 `true`；`design` 映射 `painting`；额外旧字段被忽略；终止性 `401` 清理 Main/Renderer 会话；全局 `/settings` 不受 Code gate |
 | 项目创建 | 新建项目对话框中的目录选择 | Renderer 内部默认 `interactive_ai_app` → Host API → Main 生成 UUID 并原子初始化 | 普通用户不选择类型、模板或项目身份；只生成 `.makelore/project.json` 与 `knowledge/`，随后直接进入 `/chat`。既有 `custom`/历史类型和底层兼容入口仍保留 |

.project-docs/20-architecture/system-overview.md

@@ -48,7 +48,7 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
 | Project Configuration | 目录选择式创建、Agent/Skill/知识与项目资源配置 | 新建流程不暴露类型、模板或身份选择：Renderer 写入内部默认 `interactive_ai_app`，Main 生成 UUID，并只创建 `.makelore/project.json` 与 `knowledge/`；既有 `custom` 与历史类型继续兼容 |
 | Project Scaffold Skill | 显式生成固定版本的交互式 AI 应用起步文件，并提供发布准备度指导 | 官方 `makelore.project-scaffold` bundled Marketplace Plugin；账号已获取且项目启用后自动提供给每个父 Agent，不需要伙伴分配，child 为空；它不是创建或聊天前置条件。完整预检、不覆盖、受控回滚，不安装依赖、不联网、不构建、不上传、不提审。 |
 | Project Release Builder | Main-owned 安全快照、本地 npm/Vite 构建、双归档与 artifact contract | 固定 npm 11.6.2；Vite 由项目 lockfile 锁定；产物与预检使用同一内存字节 |
-| Works Session & Remembered Password | Main-owned 登录、刷新、注销、七天真实活动滑动续期与可选密码回填 | 平台账号登录经系统浏览器走配置的 OIDC Authorization Code + PKCE（state/nonce/S256 与精确 `niancode://auth/callback`）；传统密码/手机登录、刷新、注销仍统一经过 Works Square。轮换凭据由 Main 安全持有和持久化。记住密码使用独立的 packaged-only OS 加密记录，不进入 Renderer 持久状态或 Works Square；客户端不携带 confidential OAuth client secret |
+| Works Session & Remembered Password | Main-owned 登录、刷新、注销、七天真实活动滑动续期与可选密码回填 | 登录、刷新、注销统一经过 Works Square；轮换凭据由 Main 安全持有和持久化。记住密码使用独立的 packaged-only OS 加密记录，不进入 Renderer 持久状态或 Works Square；客户端不携带 OAuth client secret |
 | Permanent Token Point Wallet | Main-owned `/api/works/billing/*` 固定路由、安全投影 → Renderer 账号菜单与 PointWallet | 本人精确余额、充值、冻结订单恢复与流水；另一付款方仅投影可用性。真实新注册赠 100 点，充值 1 元兑 50 点、永不过期，旧权益取消。Main 持有认证，稳定请求身份避免模糊结果重复下单；只有服务端确认后才显示入账，旧会员/重置卡入口已移除。 |
 | Module Access Policy | Main-owned `/api/auth/me` projection → Renderer auth state → module chooser/router | Renderer 接收 Code/Canvas/Robot/Agents 四个布尔权限；服务端 `design` 映射客户端 `painting`，云模块两端均为 `cloud_agents`；缺失对象/字段默认开启，额外字段被忽略 |
 | Submission Binding | 保存云端已接受的精确 app/version/review/hash 绑定 | schema v2 只记录成功提交；旧中间态迁移为 `legacy_retired`，不恢复后台任务 |
@@ -77,7 +77,7 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
 
 ## Important Boundaries
 
-- Renderer 只能通过 Main Host API 发起认证操作。Electron Main 是 access/refresh token 的唯一客户端所有者；平台账号登录由 Main 使用配置的标准 OIDC issuer 完成 Authorization Code + PKCE（系统浏览器、state/nonce/S256、精确回调），传统密码/手机登录、刷新、注销仍经过 Works Square 固定路由。客户端不得直连 one-feel/custom 身份服务，也不得保存 confidential OAuth client secret。
+- Renderer 只能通过 Main Host API 发起认证操作。Electron Main 是 access/refresh token 的唯一客户端所有者；登录、刷新、注销统一经过 Works Square 固定路由，客户端不得直连 one-feel/custom 身份服务，也不得保存 confidential OAuth client secret。
 - 可选的记住密码记录属于 Electron Main 的独立本机边界，只能在正式安装包且 OS 凭据加密可用时落盘；Renderer 不得持久化账号密码，Works Square 不得接收记住标志或新增密码持久化。
 - Code、Canvas 与 Robot 是三个已启用顶层产品模块；Robot 仍是唯一硬件产品模块，不存在单独 Hardware 卡片。
 - 每个登录用户可由 Works `module_access` 关闭任意顶层模块入口。Main 只投影三个布尔值；被关闭卡片置灰不可点，根/深层/别名路由在 `MainLayout` 和模块初始化前拦截。Code provider 必须等待 auth policy hydration，而全局 `/settings` 不属于 Code policy guard。

.project-docs/30-worklog/current-state.md

@@ -4,7 +4,9 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 ## Integrated Through
 
-- 2026-10-10：按用户确认，将 Makelore 平台 SSO 源 `7236def07d6a9a5cfde70c3239c6ac53764bcd7d` 无冲突快进合入本地 `main`，并修正来源登记提交 `86216b8458db9a2c58850a6835fd1a76cee5a846`。Electron Main 通过系统浏览器使用平台 OIDC Authorization Code + PKCE，校验 state/nonce/S256、精确 `niancode://auth/callback`，并在 Main 内持有 access/refresh token；平台身份按 issuer + `sub=platform:<UUID>` 使用，传统 Works Square 密码/手机登录路径保留。源验证沿用 65 项聚焦测试、typecheck 与变更文件 lint；本次未推送、部署、迁移真实账号、改 LMS 或支付。已有 3 份外来未跟踪文档原样保留且未纳入提交。见[源任务](tasks/20261010-makelore-platform-sso-a1b2.md)和[本次集成](tasks/20261010-integrate-makelore-platform-sso-9c2d.md)。
+- 2026-10-11：按用户明确要求，将 Makelore 平台 SSO 回滚源 `e28beff`（原平台 OIDC 实现 `7236def` 的逆提交）合入本地集成分支，客户端恢复 Works Square 传统密码/手机登录、刷新与注销边界。回滚验证沿用源任务的 60 项聚焦测试、typecheck、scoped lint、Renderer-only Vite build 与 `git diff --check`；正常 D: 构建仍因磁盘空间不足未完成。本次未推送、部署、迁移真实账号、改 LMS 或支付；主目录 3 份外来未跟踪文档原样保留且未纳入提交。此前 2026-10-10 的 OIDC 条目和来源任务继续保留为历史证据，当前运行时以本条及 ADR-004 为准。见[回滚源任务](tasks/20261011-rollback-makelore-platform-auth-7c4e9a2b.md)和[本次集成](tasks/20261011-integrate-rollback-makelore-c9d8e7f6.md)。
+
+- 2026-10-10：按用户确认，将 Makelore 平台 SSO 源 `7236def07d6a9a5cfde70c3239c6ac53764bcd7d` 无冲突快进合入本地 `main`，并修正来源登记提交 `86216b8458db9a2c58850a6835fd1a76cee5a846`。Electron Main 通过系统浏览器使用平台 OIDC Authorization Code + PKCE，校验 state/nonce/S256、精确 `niancode://auth/callback`，并在 Main 内持有 access/refresh token；平台身份按 issuer + `sub=platform:<UUID>` 使用，传统 Works Square 密码/手机登录路径保留。该条记录的是已回滚的历史迭代，不代表当前客户端状态。源验证沿用 65 项聚焦测试、typecheck 与变更文件 lint；本次未推送、部署、迁移真实账号、改 LMS 或支付。已有 3 份外来未跟踪文档原样保留且未纳入提交。见[源任务](tasks/20261010-makelore-platform-sso-a1b2.md)和[本次集成](tasks/20261010-integrate-makelore-platform-sso-9c2d.md)。
 
 - 2026-10-09：按用户要求，将集成源 `35e2a9149aed7d918176f00369cee6528505cdb8` 从 `fe1a3775` 无冲突快进合入本地 `main`。应用、测试、配置与已验证源保持相同，本次仅补充主分支交付记录。原有 3 份外来文档原样保留且未纳入提交；全部源分支和工作区按用户要求保留。未推送、部署、迁移生产数据或发布安装包；真实机构、OSS/网络、支付和设备验收仍待执行。见[本次合并](tasks/20261009-merge-product-dd0461f9.md)。本条更新下方独立分支阶段的未合主分支状态，历史来源记录不改写。
 
@@ -1236,4 +1238,4 @@ Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选
 
 ## Last Updated
 
-2026-10-10
+2026-10-11

.project-docs/30-worklog/tasks/20261011-integrate-rollback-makelore-c9d8e7f6.md

@@ -0,0 +1,98 @@
+# Task: Integrate Makelore platform SSO rollback
+
+## Identity
+
+- Task ID: 20261011-integrate-rollback-makelore-c9d8e7f6
+- Mode: Integration
+- Branch: codex/20261011-integrate-rollback-makelore-c9d8e7f6-integrate-makelore-rollback-c9d8e7f6
+- Worktree: C:\Users\7brot\.codex-worktrees\makelore\20261011-integrate-rollback-makelore-c9d8e7f6
+- Base commit: f2a0eefc9ec5dfc2a09c15745b4786bc61682968
+- Owner: codex
+- Status: Ready for Integration
+
+## Scope
+
+- Integrate the completed Makelore rollback commit `e28beff` from
+  `20261011-rollback-makelore-platform-auth-7c4e9a2b` onto the local `main`
+  baseline `f2a0eefc9ec5dfc2a09c15745b4786bc61682968`.
+- Reconcile the canonical OIDC claims in ADR-004, the decision index, data
+  flow, system overview, and current state so they describe the restored
+  Works Square legacy login boundary after this rollback.
+- Preserve the original SSO source and former integration task records as
+  historical evidence. The three known primary-checkout task documents are
+  outside this worktree and must remain byte-for-byte unchanged and excluded
+  from the integration commit.
+
+## Intent And Constraints
+
+- The user explicitly authorized the account-iteration rollback and local
+  integration. This task changes only the Makelore client rollback and its
+  canonical project-memory reconciliation; it does not touch one-feel,
+  Yuxi, LMS, payment behavior, real accounts, deployment, or remotes.
+- Source task records and peer worktrees are read-only. Do not reset, delete
+  branches, clean unknown files, or alter the Makelore primary checkout.
+- Keep the existing Works Square password/mobile facade, refresh, logout, and
+  remembered-password boundary as the current desktop authentication contract.
+
+## Project Context Loaded
+
+- Concurrent Task Gate: Passed. `check_project_docs.py` passed; this task
+  owns the isolated managed worktree and the integration lock.
+- Planning Gate: Passed after reading `read-before-planning.md`,
+  `memory-index.md`, this task record, project positioning, current state,
+  decision index, system overview, and the completed rollback source record.
+- Relevant peer scope: the rollback source is ready for integration and its
+  only canonical conflict is the now-stale platform OIDC description. Other
+  active Makelore tasks concern unrelated product areas and do not overlap
+  these authentication or canonical-memory paths.
+
+## Implementation Plan
+
+1. Cherry-pick the completed rollback commit and confirm only the documented
+   client, test, and README paths are reversed.
+2. Restore the canonical authentication description to the pre-OIDC
+   Works Square boundary, then add a current-state entry for this rollback
+   with source, verification, and the unresolved future SSO decision.
+3. Run whitespace, project-document drift, and focused regression checks that
+   distinguish restored legacy authentication from removed platform OIDC.
+4. Record the integration outcome, verification, preserved primary contents,
+   and follow-ups in this task record; complete the integration registration.
+
+## Outcome
+
+- Cherry-picked rollback commit `e28beff` as `45198ae`; the Makelore client
+  application, focused tests, and README now match the pre-SSO code baseline.
+- Reconciled ADR-004, the decision index, data flow, system overview, and
+  current state to make the Works Square legacy password/mobile login,
+  refresh, and logout boundary current again. The prior OIDC records remain
+  historical source evidence and are explicitly marked as superseded in the
+  current-state entry.
+- The Makelore primary checkout was not edited by this task. Its three known
+  untracked project task documents remain preserved and excluded from this
+  integration.
+
+## Verification
+
+- Concurrent and Planning Gates passed.
+- Source verification is recorded in
+  `20261011-rollback-makelore-platform-auth-7c4e9a2b`: 60 focused tests,
+  typecheck, scoped lint, `git diff --check`, and a renderer-only Vite build
+  passed; the normal D: output build was blocked by `ENOSPC`.
+- Integration verification passed: `git diff --name-status
+  87d3f03d751b93b607e56d3667c3655f2a03a792 HEAD -- .` excluding
+  `.project-docs/**` returned no paths, `git diff --check` passed, and
+  `check_doc_drift.py --task-id 20261011-integrate-rollback-makelore-c9d8e7f6`
+  passed. The isolated integration worktree has no dependency installation,
+  so the source test evidence was reused rather than rerunning the same suite.
+
+## Follow-ups
+
+- A future platform SSO implementation requires a new explicit design and
+  integration decision; this rollback leaves the client on the legacy path.
+- Re-run a normal Vite output build when D: has sufficient free space.
+
+## Promotion Candidates
+
+- None pending; the accepted rollback reconciliation is recorded in the
+  canonical documents above. The historical OIDC source and prior integration
+  task remain read-only evidence.