From d04b031040a1c109a0c2c5ede2584bb0b75a3bb2 Mon Sep 17 00:00:00 2001 From: brother7 <7brother7@gmail.com> Date: Sat, 29 Aug 2026 12:39:13 +0800 Subject: [PATCH] docs(marketplace): record client r3 integration --- ...rketplace-mlm06-r3-remediation-9e4c2a71.md | 201 ------------------ ...0828-plugin-marketplace-client-5f8b3d72.md | 51 ++++- 2 files changed, 50 insertions(+), 202 deletions(-) delete mode 100644 .project-docs/30-worklog/tasks/20260828-marketplace-mlm06-r3-remediation-9e4c2a71.md diff --git a/.project-docs/30-worklog/tasks/20260828-marketplace-mlm06-r3-remediation-9e4c2a71.md b/.project-docs/30-worklog/tasks/20260828-marketplace-mlm06-r3-remediation-9e4c2a71.md deleted file mode 100644 index 9a3f1f3..0000000 --- a/.project-docs/30-worklog/tasks/20260828-marketplace-mlm06-r3-remediation-9e4c2a71.md +++ /dev/null @@ -1,201 +0,0 @@ -# Task: Marketplace MLM-06 R3 fixed-range remediation - -## Identity - -- Task ID: 20260828-marketplace-mlm06-r3-remediation-9e4c2a71 -- Mode: Feature -- Branch: codex/20260828-marketplace-mlm06-r3-remediation-9e4c2a71-marketplace-mlm06-r3-remediation -- Worktree: D:\Datas\OthersProjects\makelore-plugin-marketplace-mlm06-r3-remediation-9e4c2a71 -- Base commit: 57962591de71fc0a9f142dbcd130e3308754e423 -- Owner: marketplace-client-coordinator-r3-remediator -- Status: Ready for Integration - -## Scope - -- Sole MLM-06 R3 fixed-range remediation over the eight accepted actionable roots - handed off from exact client frontier - `57962591de71fc0a9f142dbcd130e3308754e423`. Product/test changes stay in this - isolated MakeLore worktree and are limited to the assigned resolver, Package - Store/archive validation, Renderer Marketplace store/My Plugins, project - projection, packaged artifact verifier, focused tests/E2E, and this task record. -- Preserve Marketplace Release A only. Data Service remains bundled, - system-included, typed, and zero Token Point; hosted Provider/Release B, - arbitrary local code/MCP/hooks, generic invoke/config/ledger, XMA-01, - deployment, publication, push, and PR creation are outside this task. -- Deliver one source commit containing this task record, with sole parent - `57962591de71fc0a9f142dbcd130e3308754e423`, a clean worktree, and - `READY_FOR_INTEGRATION` task-context completion. - -## Intent And Constraints - -- Human-confirmed recovery was required because the original implementation owner - stopped responding while leaving a known dirty worktree. The coordinator - interrupted that writer, ran `release --force`, reversibly backed up its untracked - task record, and successfully reclaimed this exact task/worktree with - `--adopt-existing`. The eight existing product/test paths were never stashed, - reset, cleaned, deleted, or moved. This owner is now the sole writer. -- Concurrent Task Gate passed after recovery: project-doc structure is valid and - task-context status matches this task ID, feature mode, owner, absolute worktree, - branch, and exact base. The coordinator, user root, server repository, and prior - review/source worktrees remain read-only. -- Planning Gate passed after reading the required project-memory startup set, - relevant peer records, implementation spec, ticket graph, accepted design, and - ADR-006. Canonical integrated memory predates Marketplace; the frozen spec/design, - coordinator ledger, and R3 fixed-range findings are the current authority. -- Implement test-first at each public seam. Do not add compatibility layers, - arbitrary prefixes, hidden request chaining, account/Library conflation, broad - archive-security frameworks, fabricated yanked fields, runtime key overrides, or - unrelated UI redesign. Explicit device uninstall remains distinct from Library - removal and background cleanup. -- Production Ed25519 activation remains HOLD. Tests may inject ephemeral keys only; - no production private key or arbitrary runtime trust source may be generated, - read, or committed. - -## Project Context Loaded - -- Task identity: `20260828-marketplace-mlm06-r3-remediation-9e4c2a71`, feature - mode, branch - `codex/20260828-marketplace-mlm06-r3-remediation-9e4c2a71-marketplace-mlm06-r3-remediation`, - worktree - `D:\Datas\OthersProjects\makelore-plugin-marketplace-mlm06-r3-remediation-9e4c2a71`, - owner `marketplace-client-coordinator-r3-remediator`, exact base - `57962591de71fc0a9f142dbcd130e3308754e423`. -- Other active Marketplace owners are completed source/remediation tasks, - read-only fixed-range reviewers, or the coordinator. No owner has write authority - in this worktree and no unresolved semantic conflict changes the eight-root plan. -- Main owns account, package, trust, filesystem, and effective-runtime authority; - Renderer consumes bounded projections. Account Library, Device Installation, - Project Selection, Agent assignment, authorization, and billing remain separate. -- The accepted eight roots are: bundled Skill collision reservation; pre-queue - account binding; independent same-plugin Library/device intents; explicit - uninstall versus cleanup; reachable packaged markers; canonical archive - validation; `client_incompatible` Project Plugins projection; and no-version My - Plugins presentation. -- Gate result: Passed. Project positioning is still a placeholder and shared - integrated memory predates Marketplace, both explicitly recorded as stale context - rather than silently treated as current authority. - -## Fixed-Range Ownership / Red Plan - -1. Reserve every non-Marketplace bundled Skill ID, including Data Service, and - reject conflicting Marketplace resources without rewriting configuration. -2. Capture the current account binding before queued Package Store work and verify - it before execution and completion so A-originated work cannot execute as B. -3. Split same-plugin Renderer Library and device intents while retaining latest-only - ordering within each domain and merging independent successful results. -4. Separate explicit uninstall from background cleanup; remove all unprotected - current/old releases and report `kept` only for actual protections. -5. Bind Marketplace artifact proof to the real packaged `package.json.main` - reachability graph and reject disconnected marker strings. -6. Enforce the canonical archive allowlist, extension/UTF-8 rules, and 256 KiB - manifest/Skill limits before atomic install, without adding a generic framework. -7. Project `client_incompatible` as bounded Project Plugins unavailable state. -8. Render no-version unavailable installation projections as not installed and not - deletable; keep versioned incompatible packages present and removable. - -## Implementation Plan - -1. Review the preserved dirty diff against all eight accepted roots and existing - focused tests; retain correct work and identify still-missing paths without - rewriting completed slices. -2. For each missing root, add an exact red test, apply the smallest green change, - and run the focused public-boundary regression with a stated failure consequence. -3. Run affected Marketplace/Pi/Data Service regressions, full unit/pressure, - typecheck, lint, Vite build, Windows Electron, Marketplace E2E, x64 packaging, - and the real artifact verifier. Record exact baseline/environment deviations. -4. Update this record with the recovery and RED→GREEN ledger, run diff/doc gates, - create the single source commit with the exact parent, complete task_context, and - verify a clean handoff. - -## Outcome - -- Recovered and completed the preserved implementation without resetting, stashing, - cleaning, or replacing any predecessor work. The only discarded filesystem data - was the trace CLI's own temporary extraction directory after diagnosis. -- Reserved every bundled/non-Marketplace Skill owner, so a signed Marketplace - package can no longer shadow the bundled Data Service Skill or another package's - Skill root. Project and Agent assignments remain unchanged and regain effect if - the original package returns. -- Bound Package Store sync/install/uninstall operations to the account captured - before queueing, with execution- and completion-time rechecks. Explicit uninstall - now removes every unprotected Release, while background cleanup may retain the - selected current Release; account snapshots and active workers remain protected. -- Split Renderer Library and device mutation intent per plugin/domain. Independent - successful operations merge instead of one domain silently suppressing the other. -- Hardened Release A archive admission to the canonical Skill-only tree, server- - aligned text/image extensions, fatal UTF-8 manifests/text, declared Skill roots, - and 256 KiB manifest/Skill limits. Script/native payloads and undeclared assets - fail before the atomic install write. -- Project Plugins maps `client_incompatible` to the bounded unavailable state. My - Plugins treats a no-version unavailable projection as not downloaded and not - deletable, while an incompatible versioned package remains visible/removable. -- Packaged proof now walks only files reachable from `package.json.main`, including - Main imports/requires, minified static ESM imports, dynamic Renderer chunks, and - HTML assets. Disconnected marker strings cannot satisfy trust or Marketplace - coverage. Test ASAR creation waits for the returned WritableStream `finish` - signal, eliminating partial archive reads without adding a production retry. -- Stabilized the Marketplace Electron test at its real bootstrap boundary: the - initial module-selection screen must be ready before replacing Main's Host API - handler and reloading with persisted auth. This removes an old-page/new-page auth - initialization race without changing production authentication. -- No hosted Provider, charging/Token Point path, arbitrary code/MCP/hooks, generic - invoke/config/ledger, publication, deployment, XMA-01, production key material, - or server change was introduced. - -## Verification - -- Recovery baseline: the inherited focused set produced 43 passes / 15 failures. - Thirteen failures were an expired fixed Admission fixture; the remaining product - reds proved the missing archive rejection, Project `client_incompatible` state, - and no-version My Plugins action. Correcting the fixture and implementing the - owned seams turned those boundaries green. -- Explicit uninstall edge RED: when an old Release was protected but current was - not, the old implementation returned `kept` and retained current. The focused - regression is green after explicit/background cleanup separation. -- Direct final focused: 6 files / 73 tests passed. -- Marketplace/Pi/Project Plugins/Data Service adjacent regression: 28 files / 229 - tests passed. -- Full unit run: 208 files / 1,799 passed / 2 skipped; dedicated pressure run 1/1 - passed. -- `pnpm typecheck`: passed. -- `pnpm run lint:check`: 0 errors; exactly five pre-existing out-of-scope warnings - remain (`Home` one hook warning, `Makelore` four Fast Refresh warnings). -- `pnpm run build:vite`: passed (Renderer 2,261 modules; Main 193; Preload 1; - utility worker 9). Existing dynamic-import and chunk-size warnings remain. -- The first clean-source `pnpm run package:win` passed through Python/uv staging, - Pi runtime bundling, win-unpacked, and NSIS. The first real - `verify:artifact:pi` correctly went RED because Vite's minified - `import{...}from"..."` edge was not traversed and the reachable graph could not - prove Renderer catalog/Library markers. A matching realistic ASAR unit fixture - failed 1/13; after accepting minified static ESM syntax it passed 13/13 and the - same real app.asar verifier returned overall `result: pass`, Marketplace - `result: pass`, Data Service 10 tools, Pi 0.84.2 closure complete, and only the - inherited real-Provider/cross-platform `partial-pass` waivers. -- `pnpm run test:electron:windows`: 2 files / 6 tests passed. -- Marketplace E2E bootstrap diagnosis: the original focused scenario failed 3/5, - and the direct-localStorage hypothesis failed 4/5 and was reverted. Waiting for - initial Renderer bootstrap before handler replacement passed 5/5; the original - Marketplace + Project Plugins target then passed 3/3. -- Full Electron E2E: 28 passed / 1 known baseline failure. The sole failure remains - `tests/e2e/pi-coding-first-chat.spec.ts:575`, where the current-conversation model - combobox is disabled and `selectOption` times out; both Marketplace tests and the - Project Plugins test pass in the same run. -- `git diff --check`: passed before documentation finalization. -- After the source commit is amended with the minified-ESM regression, the client - coordinator reruns clean-HEAD `package:win`, `verify:artifact:pi`, - `verify:artifact:win`, and `verify:publish-runtime` so embedded Git evidence names - the final source. Exact hashes belong to the repository-local integration - checkpoint and remain a handoff condition. - -## Follow-ups - -- The client coordinator must integrate only the single source commit, record the - clean-HEAD Windows/package verifier ledger, then start fresh fixed-range R4 - Standards and Spec reviews. XMA-01 stays closed until both repositories pass. -- Production Marketplace activation remains on hold until the official Ed25519 - public key is supplied. Release B remains deferred until a named Provider contract - exists. - -## Promotion Candidates - -- None recorded. diff --git a/.project-docs/30-worklog/tasks/20260828-plugin-marketplace-client-5f8b3d72.md b/.project-docs/30-worklog/tasks/20260828-plugin-marketplace-client-5f8b3d72.md index 96c4638..00eac77 100644 --- a/.project-docs/30-worklog/tasks/20260828-plugin-marketplace-client-5f8b3d72.md +++ b/.project-docs/30-worklog/tasks/20260828-plugin-marketplace-client-5f8b3d72.md @@ -126,6 +126,15 @@ conflict as coordinator product commit `11d0af01663ad5b35a86fbe037c9277a5283f9a3`; the source/product trees are identical after excluding the task-scoped handoff record. +- MLM-06 R3 review found eight actionable roots. After the user explicitly approved + recovery of the unresponsive owner, the coordinator force-released that owner and + adopted the existing task/worktree without stash, reset, clean, branch replacement, + or loss of its intermediate diff. Task + `20260828-marketplace-mlm06-r3-remediation-9e4c2a71` completed from exact frontier + `57962591de71fc0a9f142dbcd130e3308754e423` as sole source commit + `34341b932ac3a74788658bc0ed0a2732e140f72e`. It was integrated without + conflict as coordinator product commit + `3df794c2e736bde2c797c99aa8ad55b967e89ea6`. ## Outcome @@ -177,6 +186,15 @@ the current channel version, Renderer reports a truthful channel-change/unavailable state without inventing a yanked field. Unknown assignments and incompatible packages remain persisted but do not enter a new effective worker snapshot. +- MLM-06 R3 remediation reserves bundled Data Service and all other non-Marketplace + Skill IDs before Marketplace resolution; binds queued Package Store work to the + originating account; separates Library/device Renderer intents; distinguishes + explicit uninstall from background cleanup; enforces the canonical Skill-only + archive contract; projects client incompatibility and no-version unavailable + installations truthfully; and binds packed proof to package-main-reachable Main, + HTML, minified ESM, dynamic Renderer, and Marketplace chunks. No config/assignment + rewrite, hidden acquisition/enablement, Token Point path, Release B runtime, or + production trust override was added. ## Verification @@ -248,10 +266,41 @@ through the real Windows app.asar with native entry separators; Marketplace trust remains official-key-absent fail-closed with no private-key material. XMA-01 was not run and no full-E2E pass beyond the targeted Marketplace file is claimed here. +- MLM-06 R3 source verification passed six focused files / 73 tests, 28 adjacent + files / 229 tests, full Vitest `1799 passed, 2 skipped` plus pressure `1 passed`, + typecheck, lint with zero errors and five unchanged warnings, Vite builds, six + Windows Electron tests, and Marketplace/Project Plugins E2E 3/3. Full E2E passed + 28/29; the sole failure is the same unchanged + `pi-coding-first-chat.spec.ts:575` disabled-model-combobox timeout. The Marketplace + auth test's own old-page/new-page bootstrap race was diagnosed from a 3/5 failing + loop and stabilized to 5/5 before the original target reran. +- The first real package proof exposed a genuine verifier gap: Vite's + `import{...}from"..."` edge was missing from the reachable graph. A realistic + ASAR unit went red 1/13 and green 13/13; the same real app.asar then verified + Marketplace trust/routes/Renderer assets successfully. Final x64 staging and + electron-builder/NSIS ran from clean source HEAD. The aggregate download wrapper + was retried after GitHub `ECONNRESET` and connect timeout; already verified x64 + Python/uv were restored from the first successful package, then final x64 staging + and builder passed without changing tracked files. +- Final `verify:artifact:pi` passed with Marketplace `result: pass`, Data Service ten + tools, Pi 0.84.2, no closure gaps, and only the inherited real-Provider/cross- + platform partial-pass waivers. `verify:artifact:win` embedded exact source + `gitCommit`/`verificationHead` + `34341b932ac3a74788658bc0ed0a2732e140f72e`; installer size is 208,238,894 + bytes and SHA-256 is + `1531A3ACA2AB3387870606ADA54EE40DA9079DB9E2864DE7B8FFEBAF47A453D3`. + Python, uv 0.10.0, npm 11.6.2, native addons, Unicode copy, and publish-runtime all + passed. The official Ed25519 public key is still absent, so production activation + remains fail-closed HOLD rather than a claimed production release. ## Follow-ups -- None recorded. +- Run fresh fixed-range MLM-06 R4 Standards and Spec reviews from the post-R3 + coordinator documentation checkpoint. Use one remediation owner only if a + supported Release A finding remains. +- Keep XMA-01, production activation, deployment, publication, push/PR, and every + Release B/Provider/hosted ticket closed until both repository reviews pass and the + required external inputs exist. ## Promotion Candidates