feat(coding): add plugin capability policy registry

.project-docs/30-worklog/tasks/20260827-plugin-ml02-policy-registry-3f7b2c91.md

@@ -0,0 +1,118 @@
+# Task: Implement ML-02 plugin policy registry
+
+## Identity
+
+- Task ID: 20260827-plugin-ml02-policy-registry-3f7b2c91
+- Mode: Feature
+- Branch: codex/20260827-plugin-ml02-policy-registry-3f7b2c91-plugin-ml02-policy-registry
+- Worktree: D:\Datas\OthersProjects\makelore-plugin-ml02-policy-registry-3f7b2c91
+- Base commit: d9c9a2b0dd8fd495c6aa5a0994598192ad9c8e58
+- Owner: codex-ml02
+- Status: Ready for Integration
+
+## Scope
+
+- Implement ML-02 from exact frontier `d9c9a2b0dd8fd495c6aa5a0994598192ad9c8e58`:
+  - strict policy catalog client with exact parsing, join, coalesced refresh, and
+    current/stale/unavailable state;
+  - capability registry and trusted `makelore-capability.v1` envelope;
+  - in-process Data Service adapter and generic Pi product-tool delegation;
+  - bounded capability/billing/conversation contracts and ten-tool regression
+    coverage.
+- Owned product/test files are exactly the ML-02 ticket list, plus the one-time
+  coordinator-approved ownership transfer for the envelope display branch in
+  `src/pages/Chat/CodingConversationTimeline.tsx`; this task record is the only
+  project-document file owned by this task.
+
+## Intent And Constraints
+
+- Follow implementation spec sections 5.3 and 7.1, 7.3-7.4 and ticket ML-02.
+- Consume ML-01 exported definitions/project-service seams and the frozen WS-02
+  catalog DTO. Do not modify worker materialization/CLI, Host routes, preview
+  sessions, other Renderer files, or files owned by other tickets. The
+  coordinator explicitly transferred only the `ToolDetails` envelope
+  discriminator/display branch in `CodingConversationTimeline.tsx` to ML-02.
+- Preserve typed Data Service routes and Main-owned identity/credentials. No
+  generic invoke/config/ledger, P1 paid policy, Plugin Credits, marketplace,
+  arbitrary code/MCP/hooks, or publication coupling.
+- Use `runId` + `resourceId` for deterministic Pi request IDs with no UUID fallback;
+  client code cannot manufacture server billing receipts and included calls make
+  no Token Point transaction.
+
+## Project Context Loaded
+
+- Concurrent Task Gate passed after `check_project_docs.py`; task identity,
+  isolated worktree, branch, owner, and base match the Git-common owner record.
+- Planning Gate passed. Required entry, positioning, integrated state, decisions,
+  architecture/data-flow, domain, evidence, reflection, commitments, and stale
+  context were read. The positioning file is still the repository template, and
+  integrated memory predates this plugin feature; the accepted implementation
+  spec, ticket graph, ML-01 peer record, and coordinator frontier are authoritative
+  for this task.
+- Other same-repository active scopes are the client coordinator and ML-01 source
+  task. ML-01 is ready for integration and owns package/selection files only;
+  client coordinator owns integration and later tickets. The initial Renderer
+  ownership conflict was explicitly resolved by a one-file, one-branch transfer
+  from the coordinator; no remaining semantic conflict or file overlap exists.
+- Cross-repository WS-02 is consumed as a frozen input: schema version 1, one
+  `makelore.data-service` plugin, three capabilities/fourteen operations, and
+  `platform_metered` unavailable projected as `billing_unavailable`.
+
+## Implementation Plan
+
+1. Inspect existing Data Service/Pi/conversation seams and ML-01 definitions.
+2. Add contract types, strict parser/client state, registry/adaptor, and generic
+   Pi delegation with tests first where practical.
+3. Migrate conversation detail/result unions and the transferred timeline
+   consumer to the bounded capability envelope while preserving
+   `data-service.v1` only as the payload schema and retaining whitelisted context.
+4. Run owned focused tests, relevant existing regressions, typecheck, scoped/full
+   lint, diff/doc gates; update this record and produce one implementation commit.
+
+## Outcome
+
+- Implemented the strict Plugin Policy catalog client with exact DTO parsing,
+  coalesced refresh, and current/stale/unavailable state preservation.
+- Implemented the bundled capability registry with exact policy joins,
+  package/selection/Skill/role/policy admission and invoke revalidation, child
+  plugin-empty behavior, and trusted `makelore-capability.v1` envelopes.
+- Added the in-process Data Service adapter for all ten contract operations and
+  moved Pi product-tool delegation to the registry while preserving core tools
+  and the compatibility fallback.
+- Added bounded billing receipts, result/conversation contracts, deterministic
+  `pi:${runId}:${resourceId}` request IDs, domain-fault context handling, and
+  focused regression coverage.
+- No P1 paid policy, generic invoke/config/ledger, credits, marketplace,
+  arbitrary code/MCP/hooks, publication coupling, or out-of-scope file changes
+  were introduced. The coordinator-approved one-file Renderer ownership
+  transfer was used only for the envelope discriminator/display adaptation.
+
+## Verification
+
+- Owned focused suite: 5 files, 38 passed.
+- Transferred Renderer timeline focused suite: 1 file, 4 passed.
+- Relevant existing regressions: 8 files, 62 passed, 2 skipped.
+- Full test command: 193 files, 1,642 passed, 2 skipped; isolated pressure
+  test: 1 passed.
+- Owned-file ESLint (including the transferred timeline) and full `lint:check`:
+  0 errors; full lint reports only
+  the 5 pre-existing warnings in `src/pages/Home/index.tsx` and
+  `src/pages/Makelore/index.tsx`.
+- `git diff --check` passed.
+- Typecheck passed after replacing the transferred Renderer consumer's stale
+  `data-service.v1` discriminator with the bounded
+  `makelore-capability.v1` envelope branch.
+- Task-aware documentation drift check and `task_context complete` remain
+  completion gates.
+
+## Follow-ups
+
+- No downstream follow-up remains for the transferred timeline branch: it now
+  consumes `makelore-capability.v1`, while `data-service.v1` remains only the
+  nested payload schema for the Data Service adapter.
+
+## Promotion Candidates
+
+- None. The implementation follows the accepted plugin-platform spec and
+  frozen WS-02 catalog contract without proposing canonical project-memory
+  changes.