From c73fcf1d2d2e5dccea6f3b403a3b7c00bdc0b25a Mon Sep 17 00:00:00 2001 From: brother7 <7brother7@gmail.com> Date: Fri, 28 Aug 2026 13:00:19 +0800 Subject: [PATCH] chore(marketplace): record MLM-01 integration --- ...0828-plugin-marketplace-client-5f8b3d72.md | 19 ++- .../tasks/20260828-plugin-mlm01-5c8d1e4f.md | 148 ------------------ 2 files changed, 18 insertions(+), 149 deletions(-) delete mode 100644 .project-docs/30-worklog/tasks/20260828-plugin-mlm01-5c8d1e4f.md diff --git a/.project-docs/30-worklog/tasks/20260828-plugin-marketplace-client-5f8b3d72.md b/.project-docs/30-worklog/tasks/20260828-plugin-marketplace-client-5f8b3d72.md index 6383876..72bb9c7 100644 --- a/.project-docs/30-worklog/tasks/20260828-plugin-marketplace-client-5f8b3d72.md +++ b/.project-docs/30-worklog/tasks/20260828-plugin-marketplace-client-5f8b3d72.md @@ -74,7 +74,13 @@ remains blocked until MLM-01 is integrated and the WSM-03/WSM-04 DTO is frozen. - MLM-06 Standards and Spec axes: independent read-only reviewers. Accepted root causes route to one isolated remediation implementer at a time before repeat review. -- Current frontier after this checkpoint is `{WSM-01, MLM-01}` only. +- MLM-01 source task `20260828-plugin-mlm01-5c8d1e4f` was dispatched from exact + coordinator frontier `4d8b1fcec0a751d2935effc7816c7e59f568ec65`, completed as + source commit `352a3b7280bb48854beb5281d2b4923b76793367`, and was integrated + without conflict as coordinator product commit + `898e2b7bdde4bdd77a5659d7b4e294d0607656e3`. +- Current client frontier is the post-MLM-01 documentation checkpoint. MLM-02 remains + blocked until WSM-03/WSM-04 freeze the Marketplace/publication DTO contract. ## Outcome @@ -84,6 +90,12 @@ - The official platform public key is not present and remains a production activation input; the parser/signature implementation and injected-key acceptance still proceed. - No push, PR, deployment, production key generation, or publication was attempted. +- MLM-01 delivered schema-1 compatibility, closed schema-2 `skill_only` and + declarative `platform_hosted` parsing, bounded JSON Schema validation, fixed release + descriptor bytes, Ed25519 verification, compatibility/provenance checks, and a + code-owned production trust seam. The official Ed25519 public key remains absent, + so the production activation hold is preserved and the default trust store fails + closed; no production private key or runtime key override was added. ## Verification @@ -100,6 +112,11 @@ worker. The two skips are the existing staged-runtime gates. - The run was proportionate: a type/parser/registry/Pi failure would have stopped MLM-01 because schema-v2 primitives cannot safely extend a broken claimed P0 base. +- MLM-01 source verification passed the complete repository suite (`1713 passed`, + `2 skipped`) plus the single-worker pressure case (`1 passed`), typecheck, lint, + Vite build, documentation drift, and task-context completion. Source parent, clean + status, changed-file ownership, and `ready_for_integration` status were independently + verified before integration. ## Follow-ups diff --git a/.project-docs/30-worklog/tasks/20260828-plugin-mlm01-5c8d1e4f.md b/.project-docs/30-worklog/tasks/20260828-plugin-mlm01-5c8d1e4f.md deleted file mode 100644 index 4d0653a..0000000 --- a/.project-docs/30-worklog/tasks/20260828-plugin-mlm01-5c8d1e4f.md +++ /dev/null @@ -1,148 +0,0 @@ -# Task: Marketplace MLM-01 package selection and signature trust - -## Identity - -- Task ID: 20260828-plugin-mlm01-5c8d1e4f -- Mode: Feature -- Branch: codex/20260828-plugin-mlm01-5c8d1e4f-mlm01-package-trust -- Worktree: D:\Datas\OthersProjects\makelore-plugin-marketplace-client-mlm01-5c8d1e4f -- Base commit: 4d8b1fcec0a751d2935effc7816c7e59f568ec65 -- Owner: codex-mlm01 -- Status: Ready for Integration - -## Scope - -- Implement ticket MLM-01 from the exact Marketplace Release A client frontier: - schema-v2 declarative package parsing, bounded hosted/skill-only definitions, - fixed release-descriptor serialization, Ed25519 verification, strict SemVer - client-range checks, and the code-owned production trust-store seam. -- Own only `shared/coding-plugins.ts`, - `electron/coding-plugins/manifest.ts`, the new descriptor/signature/trusted-key - modules, focused fixtures/tests for those modules, and this task record. -- Do not touch marketplace/network clients, Package Store, account/project - services, Pi/Host/Renderer consumers, server/Operations code, hosted runtime, - billing, or Release B tickets. - -## Project Context Loaded - -- Concurrent Task Gate passed after `check_project_docs.py`; `task_context.py - start` and `status --json` match this task ID, owner, isolated worktree, - branch, mode, and exact base. -- Planning Gate passed after reading `AGENTS.md`, the mandatory project-memory - startup set, relevant architecture/domain/evidence/reflection/commitment/stale - records, the Marketplace implementation spec sections 1-6, 10.1, 13.2-13.3, - the full ticket graph MLM-01, the accepted Marketplace design sections 6, - 11.2-11.5, 14, and 18.3, and peer task records for the coordinator and prior - P0 package/policy/runtime work. -- Current integrated memory is a historical snapshot and predates Marketplace; - the exact implementation spec, ticket graph, design authority, and coordinator - frontier are authoritative. The prior P0 parser is the compatibility baseline, - not a source branch to merge or modify. -- Other active local owners are the Marketplace client coordinator and historical - P0/review tasks in separate worktrees. Their records identify no semantic - conflict with this isolated parser/trust scope. The coordinator owns only - integration/documentation and later Marketplace tickets; MLM-02 owns the - network/Package Store files after this handoff. - -## Intent And Constraints - -- Preserve schema-1 bundled compatibility exactly, including code-owned adapter, - settings, and preview privilege allowlists; schema-2 packages cannot name any - such privilege and cannot narrow arbitrary strings into code-owned IDs. -- Accept only the closed schema-2 vocabulary: `skill_only` with empty tools and - grants, or declarative `platform_hosted` with protocol - `makelore-hosted.v1`, namespaced permissions, closed bounded input/output - schemas, and `projectWriteLease=false`. Parsing does not execute package files - or implement hosted runtime. -- Reject unknown object fields/components/paths, malformed or unbounded JSON - Schema, duplicate tool/capability mappings, unsupported local execution, - invalid identifiers, and schema-v2 adapter/settings/preview claims with stable - validation failures. -- Build the exact compact, fixed-order release descriptor bytes from the closed - shape and verify descriptor identity, artifact size/SHA-256, Ed25519 signature, - known key ID, and MakeLore compatibility range. No generic canonicalizer is - introduced. -- Production trust is code-owned and fail-closed when the official public key is - absent. No environment/runtime public-key override and no production private - key are allowed. Ephemeral keys may be injected only through test/service - dependencies. -- Keep parsed definitions immutable and distinguish trusted Package Store - provenance from manifest self-assertion. Do not add network, install, index, - account, project, registry, Pi, Host, Renderer, billing, or Release B behavior. - -## Implementation Plan - -1. Inspect the exact base parser, shared contracts, package-resource path helpers, - and existing test conventions; identify compatibility seams without editing. -2. Add red focused tests for schema-v2 golden/invalid cases, bounded schema - validation, immutable provenance, descriptor byte order/identity and digest, - compatibility ranges, key lookup/fail-closed trust, and Ed25519 failure modes. -3. Implement the smallest cohesive shared definitions and parser/descriptor/ - signature/trusted-key modules within the ownership boundary. -4. Run the owned focused suite, relevant existing manifest/package regressions, - typecheck, scoped/full lint, and diff/doc gates; investigate only failures - attributable to this ticket. -5. Update this record with the actual outcome and verification ledger, run - task-aware drift, complete `task_context.py`, and return one clean source - commit whose sole parent is the exact dispatch base. - -## Outcome - -- Implemented MLM-01 from the exact `4d8b1fcec0a751d2935effc7816c7e59f568ec65` - frontier. Schema 1 remains bundled/Data Service compatible while schema 2 now - parses immutable `skill_only` and declarative `platform_hosted` definitions, - including the closed bounded JSON Schema subset, hosted permission namespace, - tool/operation uniqueness, and trusted package metadata. -- Added the fixed compact release descriptor serializer/parser, strict SemVer - range comparison, Ed25519 descriptor verifier, and a code-owned fail-closed - signing-key loader. Injected key stores remain an explicit test/service seam; - no environment key override or production private key was added. -- The official MakeLore Ed25519 public key has not been supplied. Production - signing activation therefore remains an explicit hold represented by the empty - code-owned trust table and `PLUGIN_SIGNING_KEY_ACTIVATION_HOLD`; injected-key - verification is covered and is not presented as production activation. -- No network, Package Store, account/project, registry, Pi/Host, Renderer, - billing, hosted runtime, server, Operations, or Release B code was changed. - -## Verification - -- Before each check, the concrete failure and follow-up action were defined: - - `check_project_docs.py`: detect malformed/missing project-docs concurrency - assets; PASS before planning and implementation. - - `task_context.py status --json`: detect owner/base/worktree/branch drift; - PASS for this task and exact dispatch base. - - Initial focused red run: detect missing contract modules; it failed as - expected before implementation, then became green after the modules landed. - - `vitest run tests/unit/coding-plugin-marketplace-contract.test.ts`: detect - schema/descriptor/trust regressions; PASS, 19 tests. - - Existing manifest/Data Service/Pi resource suite: detect schema-1 and - packaged-resource regressions; PASS, 4 files/46 tests. - - Registry/adapter/Pi extension host/bundle/tool suite: detect shared contract - projection regressions; PASS, 5 files/39 tests. - - `pnpm run typecheck`: detect TypeScript contract/import errors; PASS. - - Scoped ESLint: one empty-interface error was fixed in the task-owned - manifest options type; rerun PASS with no errors. - - `pnpm run lint:check`: detect repository lint errors; PASS with five - pre-existing React warnings and zero errors. - - `pnpm run build:vite`: detect renderer/Electron build regressions from the - shared contract changes; PASS with only the repository's existing chunk and - dynamic-import warnings. - - `pnpm test`: detect cross-repository client unit regressions; PASS, 202 test - files/1713 passed/2 skipped, followed by pressure suite 1/1. - - `git diff --check`: detect whitespace/boundary corruption; PASS. -- Final task-aware `check_doc_drift.py` and `task_context.py complete` are the - remaining handoff gates and will be run before the source commit. - -## Follow-ups - -- Supply the official platform Ed25519 public key through the code-owned release - resource before production activation; keep the deployment private key only in - the Works Square deployment secret. -- MLM-02 may consume these primitives after this single source commit is merged - into the client coordinator frontier; its Package Store must compare requested - Release metadata before atomically installing bytes. - -## Promotion Candidates - -- None. This feature task did not modify canonical project memory or accepted - decisions.