chore(marketplace): record MLM-01 integration

.project-docs/30-worklog/tasks/20260828-plugin-marketplace-client-5f8b3d72.md

@@ -74,7 +74,13 @@
   remains blocked until MLM-01 is integrated and the WSM-03/WSM-04 DTO is frozen.
 - MLM-06 Standards and Spec axes: independent read-only reviewers. Accepted root
   causes route to one isolated remediation implementer at a time before repeat review.
-- Current frontier after this checkpoint is `{WSM-01, MLM-01}` only.
+- MLM-01 source task `20260828-plugin-mlm01-5c8d1e4f` was dispatched from exact
+  coordinator frontier `4d8b1fcec0a751d2935effc7816c7e59f568ec65`, completed as
+  source commit `352a3b7280bb48854beb5281d2b4923b76793367`, and was integrated
+  without conflict as coordinator product commit
+  `898e2b7bdde4bdd77a5659d7b4e294d0607656e3`.
+- Current client frontier is the post-MLM-01 documentation checkpoint. MLM-02 remains
+  blocked until WSM-03/WSM-04 freeze the Marketplace/publication DTO contract.
 
 ## Outcome
 
@@ -84,6 +90,12 @@
 - The official platform public key is not present and remains a production activation
   input; the parser/signature implementation and injected-key acceptance still proceed.
 - No push, PR, deployment, production key generation, or publication was attempted.
+- MLM-01 delivered schema-1 compatibility, closed schema-2 `skill_only` and
+  declarative `platform_hosted` parsing, bounded JSON Schema validation, fixed release
+  descriptor bytes, Ed25519 verification, compatibility/provenance checks, and a
+  code-owned production trust seam. The official Ed25519 public key remains absent,
+  so the production activation hold is preserved and the default trust store fails
+  closed; no production private key or runtime key override was added.
 
 ## Verification
 
@@ -100,6 +112,11 @@
   worker. The two skips are the existing staged-runtime gates.
 - The run was proportionate: a type/parser/registry/Pi failure would have stopped
   MLM-01 because schema-v2 primitives cannot safely extend a broken claimed P0 base.
+- MLM-01 source verification passed the complete repository suite (`1713 passed`,
+  `2 skipped`) plus the single-worker pressure case (`1 passed`), typecheck, lint,
+  Vite build, documentation drift, and task-context completion. Source parent, clean
+  status, changed-file ownership, and `ready_for_integration` status were independently
+  verified before integration.
 
 ## Follow-ups
 

.project-docs/30-worklog/tasks/20260828-plugin-mlm01-5c8d1e4f.md

@@ -1,148 +0,0 @@
-# Task: Marketplace MLM-01 package selection and signature trust
-
-## Identity
-
-- Task ID: 20260828-plugin-mlm01-5c8d1e4f
-- Mode: Feature
-- Branch: codex/20260828-plugin-mlm01-5c8d1e4f-mlm01-package-trust
-- Worktree: D:\Datas\OthersProjects\makelore-plugin-marketplace-client-mlm01-5c8d1e4f
-- Base commit: 4d8b1fcec0a751d2935effc7816c7e59f568ec65
-- Owner: codex-mlm01
-- Status: Ready for Integration
-
-## Scope
-
-- Implement ticket MLM-01 from the exact Marketplace Release A client frontier:
-  schema-v2 declarative package parsing, bounded hosted/skill-only definitions,
-  fixed release-descriptor serialization, Ed25519 verification, strict SemVer
-  client-range checks, and the code-owned production trust-store seam.
-- Own only `shared/coding-plugins.ts`,
-  `electron/coding-plugins/manifest.ts`, the new descriptor/signature/trusted-key
-  modules, focused fixtures/tests for those modules, and this task record.
-- Do not touch marketplace/network clients, Package Store, account/project
-  services, Pi/Host/Renderer consumers, server/Operations code, hosted runtime,
-  billing, or Release B tickets.
-
-## Project Context Loaded
-
-- Concurrent Task Gate passed after `check_project_docs.py`; `task_context.py
-  start` and `status --json` match this task ID, owner, isolated worktree,
-  branch, mode, and exact base.
-- Planning Gate passed after reading `AGENTS.md`, the mandatory project-memory
-  startup set, relevant architecture/domain/evidence/reflection/commitment/stale
-  records, the Marketplace implementation spec sections 1-6, 10.1, 13.2-13.3,
-  the full ticket graph MLM-01, the accepted Marketplace design sections 6,
-  11.2-11.5, 14, and 18.3, and peer task records for the coordinator and prior
-  P0 package/policy/runtime work.
-- Current integrated memory is a historical snapshot and predates Marketplace;
-  the exact implementation spec, ticket graph, design authority, and coordinator
-  frontier are authoritative. The prior P0 parser is the compatibility baseline,
-  not a source branch to merge or modify.
-- Other active local owners are the Marketplace client coordinator and historical
-  P0/review tasks in separate worktrees. Their records identify no semantic
-  conflict with this isolated parser/trust scope. The coordinator owns only
-  integration/documentation and later Marketplace tickets; MLM-02 owns the
-  network/Package Store files after this handoff.
-
-## Intent And Constraints
-
-- Preserve schema-1 bundled compatibility exactly, including code-owned adapter,
-  settings, and preview privilege allowlists; schema-2 packages cannot name any
-  such privilege and cannot narrow arbitrary strings into code-owned IDs.
-- Accept only the closed schema-2 vocabulary: `skill_only` with empty tools and
-  grants, or declarative `platform_hosted` with protocol
-  `makelore-hosted.v1`, namespaced permissions, closed bounded input/output
-  schemas, and `projectWriteLease=false`. Parsing does not execute package files
-  or implement hosted runtime.
-- Reject unknown object fields/components/paths, malformed or unbounded JSON
-  Schema, duplicate tool/capability mappings, unsupported local execution,
-  invalid identifiers, and schema-v2 adapter/settings/preview claims with stable
-  validation failures.
-- Build the exact compact, fixed-order release descriptor bytes from the closed
-  shape and verify descriptor identity, artifact size/SHA-256, Ed25519 signature,
-  known key ID, and MakeLore compatibility range. No generic canonicalizer is
-  introduced.
-- Production trust is code-owned and fail-closed when the official public key is
-  absent. No environment/runtime public-key override and no production private
-  key are allowed. Ephemeral keys may be injected only through test/service
-  dependencies.
-- Keep parsed definitions immutable and distinguish trusted Package Store
-  provenance from manifest self-assertion. Do not add network, install, index,
-  account, project, registry, Pi, Host, Renderer, billing, or Release B behavior.
-
-## Implementation Plan
-
-1. Inspect the exact base parser, shared contracts, package-resource path helpers,
-   and existing test conventions; identify compatibility seams without editing.
-2. Add red focused tests for schema-v2 golden/invalid cases, bounded schema
-   validation, immutable provenance, descriptor byte order/identity and digest,
-   compatibility ranges, key lookup/fail-closed trust, and Ed25519 failure modes.
-3. Implement the smallest cohesive shared definitions and parser/descriptor/
-   signature/trusted-key modules within the ownership boundary.
-4. Run the owned focused suite, relevant existing manifest/package regressions,
-   typecheck, scoped/full lint, and diff/doc gates; investigate only failures
-   attributable to this ticket.
-5. Update this record with the actual outcome and verification ledger, run
-   task-aware drift, complete `task_context.py`, and return one clean source
-   commit whose sole parent is the exact dispatch base.
-
-## Outcome
-
-- Implemented MLM-01 from the exact `4d8b1fcec0a751d2935effc7816c7e59f568ec65`
-  frontier. Schema 1 remains bundled/Data Service compatible while schema 2 now
-  parses immutable `skill_only` and declarative `platform_hosted` definitions,
-  including the closed bounded JSON Schema subset, hosted permission namespace,
-  tool/operation uniqueness, and trusted package metadata.
-- Added the fixed compact release descriptor serializer/parser, strict SemVer
-  range comparison, Ed25519 descriptor verifier, and a code-owned fail-closed
-  signing-key loader. Injected key stores remain an explicit test/service seam;
-  no environment key override or production private key was added.
-- The official MakeLore Ed25519 public key has not been supplied. Production
-  signing activation therefore remains an explicit hold represented by the empty
-  code-owned trust table and `PLUGIN_SIGNING_KEY_ACTIVATION_HOLD`; injected-key
-  verification is covered and is not presented as production activation.
-- No network, Package Store, account/project, registry, Pi/Host, Renderer,
-  billing, hosted runtime, server, Operations, or Release B code was changed.
-
-## Verification
-
-- Before each check, the concrete failure and follow-up action were defined:
-  - `check_project_docs.py`: detect malformed/missing project-docs concurrency
-    assets; PASS before planning and implementation.
-  - `task_context.py status --json`: detect owner/base/worktree/branch drift;
-    PASS for this task and exact dispatch base.
-  - Initial focused red run: detect missing contract modules; it failed as
-    expected before implementation, then became green after the modules landed.
-  - `vitest run tests/unit/coding-plugin-marketplace-contract.test.ts`: detect
-    schema/descriptor/trust regressions; PASS, 19 tests.
-  - Existing manifest/Data Service/Pi resource suite: detect schema-1 and
-    packaged-resource regressions; PASS, 4 files/46 tests.
-  - Registry/adapter/Pi extension host/bundle/tool suite: detect shared contract
-    projection regressions; PASS, 5 files/39 tests.
-  - `pnpm run typecheck`: detect TypeScript contract/import errors; PASS.
-  - Scoped ESLint: one empty-interface error was fixed in the task-owned
-    manifest options type; rerun PASS with no errors.
-  - `pnpm run lint:check`: detect repository lint errors; PASS with five
-    pre-existing React warnings and zero errors.
-  - `pnpm run build:vite`: detect renderer/Electron build regressions from the
-    shared contract changes; PASS with only the repository's existing chunk and
-    dynamic-import warnings.
-  - `pnpm test`: detect cross-repository client unit regressions; PASS, 202 test
-    files/1713 passed/2 skipped, followed by pressure suite 1/1.
-  - `git diff --check`: detect whitespace/boundary corruption; PASS.
-- Final task-aware `check_doc_drift.py` and `task_context.py complete` are the
-  remaining handoff gates and will be run before the source commit.
-
-## Follow-ups
-
-- Supply the official platform Ed25519 public key through the code-owned release
-  resource before production activation; keep the deployment private key only in
-  the Works Square deployment secret.
-- MLM-02 may consume these primitives after this single source commit is merged
-  into the client coordinator frontier; its Package Store must compare requested
-  Release metadata before atomically installing bytes.
-
-## Promotion Candidates
-
-- None. This feature task did not modify canonical project memory or accepted
-  decisions.