wangxuming/makelore
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

merge: integrate remote and local main histories

Browse Source 
# Conflicts:
#	.project-docs/20-architecture/module-map.md
#	.project-docs/30-worklog/current-state.md
#	.project-docs/50-evidence/evidence-index.md
#	src/pages/MyPlugins/index.tsx
#	tests/unit/pi-agent-server-process-real.test.ts
#	tests/unit/pi-managed-worker-opener.test.ts
#	tests/unit/plugin-marketplace-pages.test.tsx
This commit is contained in:
inman
2026-09-03 10:44:04 +08:00
parent 301c1496b0 28e1690038
commit d25ed08aae
122 changed files with 10866 additions and 436 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
.project-docs/20-architecture/data-flow.md
View File

@@ -6,7 +6,10 @@
|---|---|---|---|
| Marketplace catalog and Account Library | Signed-in Renderer intent | bounded Host API → Main Marketplace client/cache → Works Square catalog, Library, resolve, Admission, and download APIs | Main binds requests to the current Account and response generation. Free acquisition changes only Account Library; it does not install, enable a project, assign an Agent Skill, or authorize runtime execution. |
| Marketplace device installation | Account Library entry and explicit channel | Main resolve/Admission/download → descriptor/signature/archive/client compatibility verification → immutable Package Store index switch | Stable and explicit Beta remain distinct even when they resolve to the same immutable Release. Failed install/update retains the previous current release; explicit uninstall waits only for protecting worker/account references and completes after the final worker exits. |
| Effective Plugin worker snapshot | Installed trusted package + project selection + Agent assignments + current server policy | effective resolver → Registry/resource loader/Extension Host/tool catalog → parent Pi worker | One frozen snapshot supplies Skills, tools, package roots, and runtime authorization. Disable, account/project switch, logout, Renderer crash, Main shutdown, or worker generation change invalidates future actions without mutating persisted unknown assignments; child workers receive no Plugin projection. |
| Official bundled hosted Plugin acquisition | Account Library entry for Game Resource | server stable bundled Release/Admission + MakeLore resource package | Free acquisition changes Library only. No device download, update, Beta, signature, or device-uninstall action exists for this exact code-owned identity. Historical Hosted Web Search entries are ignored by current clients. |
| Selected-model Web Search | Parent Pi turn with an explicitly supported selected model | `makelore_web_search` core tool → frozen model/provider/credential request with provider-native forced search → ordinary model response/usage | No Marketplace Release, Account Library, Admission, Hosted Web Search client, Plugin Charge, or `agent_browser` fallback participates. Unsupported selected models expose no tool; child workers receive none. |
| Conversation-driven Device Package install | Agent tool inspects npm/Git/absolute local Plugin/loose Skill source | Main preview → distinct later user confirmation → immutable device-package generation → new/idle parent worker resources | Renderer has no install picker. Lifecycle scripts never run. Confirmation explicitly states that Pi extensions execute with desktop-user authority. Active workers retain their frozen generation until the turn settles; child workers remain empty. |
| Effective Plugin worker snapshot | Installed trusted package or acquired official bundled definition + project selection + Agent assignments + current server policy | effective resolver → Registry/resource loader/Extension Host/tool catalog → parent Pi worker | One frozen snapshot supplies Skills, tools, package roots, and runtime authorization. Disable, account/project switch, logout, Renderer crash, Main shutdown, or worker generation change invalidates future actions without mutating persisted unknown assignments; child workers receive no Plugin projection. |
| Hosted Game Resource operation | Eligible parent `makelore.game-resource` tool call plus explicit confirmation | frozen Plugin adapter → capability Registry → Main `GameResourceClient` → fixed Works Square game-resource route → provider-neutral receipt/result | Server policy owns pricing, payer, Admission and receipt state. Stable logical operation identity survives response loss/Main restart; `submission_unknown` is not replayed as a fresh request. Result saving uses a bounded project-relative path and the existing project write lease. |
| 桌面认证生命周期 | Renderer 登录、刷新与注销请求 | Host API → Main Works Session → Works Square `/api/auth/{login,mobile-login,refresh,logout}` → one-feel auth | Main 加密持有并先持久化轮换 token；客户端不携带 OAuth client secret；连续 7 天未使用才清除会话，终止性 `400`/`401` fail closed |
| 用户模块入口策略 | 会话恢复 / 登录 / 刷新 | Electron Main → Works `/api/auth/me` → 四布尔安全投影 → Renderer auth store → 卡片/路由/provider gate | 缺失对象或字段默认 `true`；`design` 映射 `painting`；终止性 `401` 清理 Main/Renderer 会话；全局 `/settings` 不受 Code gate |

8
.project-docs/20-architecture/module-map.md
View File

@@ -4,11 +4,13 @@
| Path | Responsibility | Owner Notes |
|---|---|---|
| `electron/coding-plugins/manifest.ts`, `release-descriptor.ts`, `signature-verifier.ts`, and `trusted-keys.ts` | Closed Plugin package/descriptor parsing, compatibility checks, canonical archive validation, and Ed25519 trust | Schema 1 bundled compatibility and schema 2 `skill_only`/declarative `platform_hosted` are parsed fail closed. The production trust store accepts no Marketplace package until the official public key is built in. |
| `electron/coding-plugins/manifest.ts`, `release-descriptor.ts`, `signature-verifier.ts`, and `trusted-keys.ts` | Closed Plugin package/descriptor parsing, fixed code-owned resource roots, compatibility checks, canonical archive validation, and Ed25519 trust | Data Service plus exact Game Resource roots are code-owned. Other schema-2 `skill_only`/`platform_hosted` packages remain signed Marketplace artifacts and fail closed without the official public key. Hosted Web Search is not a current Plugin root. |
| `electron/coding-plugins/account-plugin-cache.ts`, `marketplace-client.ts`, and `package-store.ts` | Main-owned Account Library cache, authenticated server client, and atomic immutable device installation store | Account acquisition and device installation are separate. Package bytes switch atomically only after descriptor, signature, archive, client-range, and provenance checks; failed updates preserve the prior current release. |
| `electron/coding-plugins/effective-resolver.ts`, `registry.ts`, `project-service.ts`, and `electron/coding-runtime/pi/**` | One effective installed-plugin projection and frozen parent logical-thread runtime snapshot | Project enablement and Agent Skill assignment are preserved independently. Only trusted, compatible, installed, policy-admitted resources enter a new parent logical thread; child workers remain empty and active threads retain frozen bytes until disposal. |
| `electron/coding-plugins/effective-resolver.ts`, `registry.ts`, `project-service.ts`, and `electron/coding-runtime/pi/**` | Effective official Plugin projection, selected-model tools, Device Package resources, and frozen parent logical-thread runtime snapshot | Project enablement and Agent Skill assignment are preserved independently. Trusted Marketplace artifacts, exact acquired official bundled definitions, and immutable local Device Package generations enter through distinct authorities. Child workers remain empty; active threads retain frozen resources until settlement/disposal. |
| `electron/coding-runtime/pi/model-tools/**` and `shared/model-tools.ts` | Closed selected-model tool registry and provider-specific Web Search request shaping | The frozen selected model capability controls whether `makelore_web_search` exists. The tool uses that model/provider/credential and normal model billing; no Hosted Plugin adapter, Admission, Plugin Charge, or browser fallback exists. |
| `electron/coding-packages/**`, `electron/api/routes/device-packages.ts`, `shared/device-packages.ts`, and `src/stores/device-packages.ts` | Main-owned conversation install preview/confirmation/commit, immutable local package generations, safe Renderer projection, and parent-worker refresh | Sources are npm, Git, absolute local Plugin directories, or loose `SKILL.md`. Lifecycle scripts are disabled; executable extensions run with desktop-user authority after explicit confirmation. Device packages never join Account Library, Marketplace Package Store, Release, Channel, or Admission state. |
| `electron/coding-plugins/adapters/game-resource.ts` and `electron/services/game-resource-client.ts` | Provider-neutral `makelore.game-resource` hosted tool adapter and Main-owned Works Square transport | Tools materialize only from an eligible frozen `platform_hosted` parent snapshot. Metered mutations require explicit confirmation and stable logical operation identity; Renderer/Pi never receive Provider URLs, credentials, balances, raw responses, or Provider job IDs. |
| `electron/api/routes/plugin-marketplace.ts`, `src/stores/plugin-marketplace.ts`, `src/components/plugins/PluginServices.tsx`, `src/lib/plugin-services.ts`, `src/pages/ProjectConfiguration/`, `src/pages/PluginMarketplace/`, `src/pages/MyPlugins/`, and `src/pages/ProjectPlugins/` | Bounded Main routes and one Project Configuration Plugin Services surface for catalog, Library, device, and project actions | Renderer receives no Account token, filesystem path, Admission, package bytes, or signed download URL. Discover/mine/project are URL-backed sheet tabs; former standalone routes only redirect to those tabs. Catalog/Library/device/project generations prevent stale A/B or cross-action results from replacing current state. |
| `electron/api/routes/plugin-marketplace.ts`, `src/stores/plugin-marketplace.ts`, `src/components/plugins/PluginServices.tsx`, `src/lib/plugin-services.ts`, `src/pages/ProjectConfiguration/`, `src/pages/PluginMarketplace/`, `src/pages/MyPlugins/`, `src/pages/ProjectPlugins/`, and `src/stores/device-packages.ts` | Bounded Main routes and one Project Configuration Plugin Services surface for Marketplace catalog, Account Library, official package-device state, local Device Packages, and project actions | Renderer receives no Account token, filesystem path, Admission, package bytes, signed download URL, or install-source picker. Discover/mine/project are URL-backed sheet tabs; former standalone routes only redirect to those tabs. My Plugins separates official Plugins from locally installed Device Packages. Catalog/Library/device/project generations prevent stale A/B or cross-action results from replacing current state. |
| `src/components/works/ProjectPublishAction.tsx` | 可发布项目的一键提交、云构建轮询与用户可理解状态 | 只通过 Renderer API 提交非敏感元数据；绑定告警不终止轮询 |
| `src/lib/works-square.ts` | Renderer 侧 Works Square Host API 契约与安全错误映射 | 不接触 Token、ZIP、本地绝对路径或自动部署状态 |
| `electron/api/routes/works.ts` | Works Host API、Renderer capability 门禁、上游安全投影 | 发布凭据、打包、上传与本地绑定均在 Main 内完成 |

13
.project-docs/20-architecture/system-overview.md
View File

@@ -21,8 +21,10 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
| Makelore Code Workspace | project/Agent/Conversation schema v2、产品中立 Snapshot/Patch、Composer 与时间线 | Conversation 本地创建且不等待 worker；旧 OpenCode 会话备份后不再继续，Renderer 不导入 Pi RPC/event 类型 |
| Coding Host API & Composition | 唯一 `/api/coding/*` composition、202 acceptance/dedupe、SSE、附件/文件/交互/诊断 | Electron Main 拥有 project/Conversation 服务、选中目标、认证和错误脱敏；SSE 公开面只有 Snapshot 与 `patch-batch` |
| Pi Conversation Runtime | 一个长驻 Pi `0.84.2` Agent Server 承载每条 active/warm Conversation 的隔离逻辑 Runtime/Session/JSONL channel | 严格 LF JSONL RPC、generation recovery、Snapshot hydration；top-level 逻辑 turn 并发 4、warm idle LRU 8；Server 退出统一使旧 channel 失效并按需单实例重启 |
| Pi Provider & Managed Resources | Provider catalog、thread-local secret projection、model/resource revision、Prompt/Skill/extension materialization | 父凭据只进入选中逻辑线程的内存 credential store，child 凭据只进入该短命进程；不扫描项目或用户的 `.pi/.agents/.codex`，不把 secret 放进 argv、catalog 或 Renderer |
| Pi Provider & Managed Resources | Provider catalog、thread-local secret projection、model/resource revision、Prompt/Skill/extension materialization、selected-model tools | 父凭据只进入选中逻辑线程的内存 credential store，child 凭据只进入该短命进程；Works `model_capabilities` 由 Main 严格归一化并作为安全 Provider metadata 持久化。Web Search 仅在精确 capability 存在时随冻结的 selected model/provider/credential 进入 parent tool catalog，并走普通模型计费；不回退 `agent_browser` 或独立 Hosted Provider。服务端 reasoning levels 优先于本地 profile，缺字段则清理 override 并回退；不扫描项目或用户的 `.pi/.agents/.codex`，不把 secret 或原始响应放进 argv、catalog 或 Renderer |
| Pi Extension, Subagents & Lifecycle | 唯一显式 Makelore extension、UI interaction、ephemeral child、write lease 与 background run lease | child 并发 4、单次最多 8、禁止递归；active/uncertain run 不因页面隐藏或 confirmation timeout 被停止，replacement/stop 必须可解释并清理所有 ownership |
| Official Hosted Plugins | Acquired code-owned bundled Game Resource package → effective parent snapshot → code-owned Main adapter → fixed Works Square hosted route | 无设备下载、更新、Beta 或签名步骤；Renderer/Package/Pi 不持有 Provider key、model 或 URL。每次计费操作要求显式确认，child 不继承 hosted tool。历史 Hosted Web Search 不再进入当前客户端。 |
| Device Packages | Conversation install tools → Main-owned inspect/preview/confirm/commit → immutable local generation → parent Skill/Pi-extension resources | 支持 npm、Git、绝对本地 Plugin 目录与 loose `SKILL.md`；没有可见安装入口、Account Library、Release、Admission 或 Marketplace Package Store。可执行 extension 拥有桌面用户权限且生命周期脚本禁用。新/idle parent 自动刷新，active parent 在 turn settled 后刷新，child 始终为空。 |
| AI Design Workspace & Living Form | 一个 Workspace 的当前 Direction、Current Specification、持久 Agent Session、conversation timeline、Tasks 与 Assets | Living Form 是服务端 Current Specification 的投影；Renderer 只持有草稿和已接受投影 |
| AI Design Input & Reconciliation | Chat、字段/集合编辑、decision、proposal、lock、Asset binding 与 restore | 全部进入同一 `design.input.apply` reducer；稳定 command/operation ID 支持 unknown-result 重放，revision conflict 刷新权威状态 |
| AI Design Gateway Routing | Main-owned Works Square V2 adapter 与 Direction event stream | Main 持有 Works Token、stream ticket、WebSocket、重试分类和错误脱敏；事件顺序与 Task progress 不构成 Specification 真值 |
@@ -56,6 +58,11 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
- Renderer 只消费共享的产品中立 project/Conversation/Snapshot/Patch DTO，并经 `src/lib/host-api.ts` 或 `src/lib/api-client.ts` 访问 Main。Pi RPC、event、Provider credential 和本地 runtime 路径保持 Main-private。
- accepted/uncertain Coding mutation 不得自动重放；RPC confirmation timeout 后仍保留 target run permit、process ownership 和 background lease，直到迟到 success/failure/exit/abort 权威收敛。其他 Conversation 必须继续可用。
- selected Provider credential 只投影到目标父逻辑线程的内存 credential store 或目标 child 进程；跨账号模型变化必须重建目标逻辑线程。确定性 Works user-context 缺失是 Provider-auth failure：失效缓存 credential、fail fast、固定脱敏提示，不得归类为 Pi crash。
- Works 下发的 per-model reasoning capability 是可选 Main-owned metadata，不是
Renderer 或 one-api 的权威。存在时只接受受支持的安全形状并覆盖目标模型的
本地 effort map；缺失时移除旧 override 并使用已验证本地 profile。`off` 在 Pi
wire 上表示 `thinking.type=disabled` 且不发送 `reasoning_effort`，启用档位保持
provider 原生值，当前 DeepSeek 产品投影为 `off`/`low`/`high`/`max`。
- Guided Hotspot Binding is implemented behind a Main-owned capability that is true by default; exact `NIANCODE_AI_HARDWARE_GUIDED_HOTSPOT_BINDING=0` disables it, while capability-read failure falls back to direct six-digit Binding. The guided state is process-local, opener failures expose only the same fixed address for manual copy, and Binding conflicts refresh the safe account overview.
- Robot hotspot scanning and connection are local Main operations that return before Works credentials/upstream access. Renderer may submit only an opaque candidate ID from the latest bounded scan; Main alone filters open printable `Xiaozhi-*` SSIDs, performs platform association, and verifies the exact current SSID.
- Hotspot discovery and connection do not authenticate a Robot. BSSID, interface/profile details, native diagnostics, location data, and Wi-Fi credentials never cross the Main boundary; permission or platform failure keeps the system-settings/manual path available.
@@ -87,8 +94,8 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
## Related Decisions
- 当前长期边界记录于 README、ADR-002 至 ADR-007（ADR-001 已由 ADR-007 supersede）及各 Integration Gate；后续如改变唯一入口、凭据所有权、构建执行边界、Living Form/Specification 状态归属、Pi 单 runtime/worker/lease 边界、Learning/Marketplace 分发边界、Robot 配网边界或重新引入客户端部署协调器，应新增 ADR。
- 当前长期边界记录于 README、ADR-002 至 ADR-007（ADR-001 已由 ADR-007 supersede）及各 Integration Gate；后续如改变唯一入口、凭据所有权、构建执行边界、Living Form/Specification 状态归属、Pi 单 runtime/worker/lease 边界、Learning/Marketplace/Web Search 分发边界、Robot 配网边界或重新引入客户端部署协调器，应新增 ADR。
## Last Updated
2026-08-31
2026-09-01

194
.project-docs/30-worklog/current-state.md
View File

@@ -35,6 +35,198 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
and collapsed process previews remain anchored to their first displayable
line. Historical source `b1f51be` remains explicitly excluded because
ADR-005 continues to retire the OpenMAIC Learning Player packaging chain.
- Youth-facing AI Design client source
`0fd32a2d49045a8f9e7f2e19ba6477f48f93e30c` is integrated over Model Tools
frontier `7552cf59526449c29d663a769c0fb62d84a1a759` through merge
`16157388afc2f6103aaee0bfd3c4e4e80c8fec48` with startup correction
`c5447ae90c434c06dbafa724b229d8459cb829d0` by task
`20260902-design-youth-client-integration-7a6d3c92`. Canvas now defaults to
conversation plus one compact “我的创作” card for creators aged 8-16, with
contextual “精细调整” instead of an always-visible professional field matrix.
The card remains a pure projection of the canonical V2 Current Specification;
direct choices use typed commands, Quote blockers follow Specification revision,
terminal blocked Quotes settle pending operations, and code-based Chinese copy
prevents raw compiler/Provider text from reaching the youth UI. Video editing
preserves stable canonical Shot identities and all hidden production metadata for
up to 24 Shots. No database, DTO/API, pricing, Provider route, or compatibility
path changed. Integration verification passed 40 focused youth tests, 5 Device
Package tests, typecheck, scoped lint, production build, and 2 Electron E2E flows.
The Electron run also exposed and closed an existing current-frontier startup crash:
the ESM-only Pi package manager is now loaded only when remote Device Package
installation needs it. No package, deployment, publication, push, or paid request
is claimed.
- Model Tools and Device Packages client cutover is implemented by task
`20260902-model-tools-client-integration-5d8b2f73`. Web Search is now a parent-only
core tool of the frozen selected model/provider/credential; it no longer depends on
Marketplace acquisition, Release, Admission, the hosted client, or Plugin Token Point
receipts, and it never falls back to `agent_browser`. Electron Main also owns a
conversation-only Device Package manager for npm, Git, local Plugin directories, and
loose `SKILL.md` sources. Preview and a distinct confirmation turn precede immutable
local commit; lifecycle scripts stay disabled; new and idle parent workers refresh
automatically while active workers switch after settlement; child workers remain
empty. My Plugins now separates Official Plugins from Device Installed packages and
exposes no visible install picker. Packaged Skill/Pi-extension installation and real
selected-model search remain external acceptance gates; no paid Provider request,
production install, publish, push, or PR is claimed.
- Windows titlebar Logo-overlap correction source
`99a210e244731d1cdc923e9dd4adf6e09e64c2a4` from task
`20260901-windows-titlebar-logo-overlap-5100e298` is integrated onto local
`main` through product commit `e800d42595484389432fd08b11c2202074a7009e`
by task `20260902-windows-titlebar-integration-afc9e259`. The shared
`ProductTitleBar` now uses one 148 px Windows caption-control region (three
44 px buttons plus 8 px padding on each side) both to size the control wrapper
and to inset the Makelore Logo. Canvas and Coding Electron geometry checks
confirm that the Logo ends before the minimize button; macOS keeps its zero
inset and native traffic-light behavior. Focused 11-test, full 1,788-test plus
pressure, typecheck, scoped/full lint, Vite build, and two Electron E2E checks
passed. No package, deployment, publication, backend contract, or unrelated
product layout changed.
- Web Search unavailable-Release diagnostic correction source
`2e093bd22c0a3c46cc08b8eede8c1bc02afd690b` from task
`20260901-web-search-runtime-stale-r2-6f4a2d91` is integrated on local `main`
through product commit `93e3143` by task
`20260902-web-search-client-integration-a4c8e291`. When the server resolve API
explicitly returns `action='unavailable'` for `plugin_release_not_ready` or
`plugin_client_incompatible`, Electron Main now preserves the existing typed
`plugin_release_unavailable` result instead of mislabeling it as the unrelated
frozen-worker `plugin_runtime_stale` error. Exact Release, Account/project, policy,
Admission, Provider, confirmation, billing, and child-isolation gates are unchanged.
The current installed client still predates this diagnostic correction, and actual
usability still requires Works Square to deploy/apply the missing official bundled
Release and compatibility migrations; no package, restart, deployment, publication,
or paid Provider request occurred.
- Web Search frozen-worker stale-Library correction source
`3620cdc277fa0a99757c57a549008f9ecd380558` from task
`20260901-web-search-stale-resources-8b4e2c71` is integrated onto local `main`
through product commit `40e1912` by task
`20260901-web-search-stale-integration-9c5f3d82`. Live client evidence showed an
eligible parent worker with the official Web Search Skill, tool, Release and policy
failing `409 plugin_runtime_stale` because invocation re-ran full materialization and
treated one transient Account Library refresh as permanent worker invalidation. New
workers still require a current Library; a previously frozen worker may now use the
last verified Library projection only long enough to obtain the server-owned exact
Release Admission. Account/session change, project disable, acquisition removal,
runtime suspension, Release/version change, policy/billing gates and child isolation
remain fail closed. Focused 19, adjacent 55, full 1,786 plus pressure, typecheck and
scoped lint passed. The currently running installed binary predates this source fix;
no restart, package, deploy, publication or paid Provider call was performed.
- Web Search Agent-assignment catalog fix source
`612794463de1b14fd748202a00115c6f93c7346b` from task
`20260901-web-search-tool-routing-fix-6f9d3b82` is integrated onto local `main`
through product commit `adc28db7855f8b1770f1c1d46af77b7cc88cfa1a` by task
`20260901-web-search-tool-routing-integration-7a4e1c93`. The unscoped partner
Skill picker now lists every project-enabled Plugin Skill before first assignment
and does not invoke runtime Admission resolution; Agent-scoped/runtime projections
still use only the resolver-approved effective subset. This closes the confirmed
circular state where an enabled Web Search Skill was hidden until already assigned,
leaving the actual Pi worker with only `agent_browser`. Focused 45-test, full
1,785-test plus pressure, typecheck, and scoped-lint verification passed. Existing
workers remain frozen; the affected local Agent assignment was corrected separately
and takes effect on a new Conversation.
- Official bundled Plugin client cutover is integrated on local `main` through product
commit `1530ac774091c7083dbff19e0fbd69e929ac8718` by task
`20260901-official-bundled-plugins-client-integration-b8d5f3a2`. Game Resource and
Web Search now ship as exact schema-2 resource packages with MakeLore; their acquired
Library entries resolve through the server Admission path without Package Store
download, update, Beta, signature, or device-uninstall state. Project enablement,
Agent assignment, parent-only materialization, Provider policy, confirmation, and
Token Point billing remain enforced. The verified Windows installer embeds source
`b1657300f29f9744551f31029eb192ee82f01b92`, is 208,297,578 bytes, and has SHA-256
`449288AF079E030F3F700F0FF1701971F7AB4806E0366CE989F4E8F2FE33ACA3`.
- Conversation abort reconciliation source
`d2ef37bc4d7d3609cec0a55c4ae8ffb2734696d5` from task
`20260901-conversation-abort-stall-6f4c2a91` is merged into local `main` as
`85900717906713d8343c2087eade904aead8f111` through verified candidate
`599d1847f73a590690cbac2ee1c5bf36e8cd83f1` by task
`20260901-merge-abort-main-a83d4c71`.
Both visible abort actions now call the Main-owned abort route and then silently
reload only the target Conversation's authoritative Snapshot. This closes the
installed 1.2.1 case where Pi had already recorded bash results and a final
assistant `stop`, but Renderer missed the terminal SSE patch and a later valid
abort no-op left the UI showing an executing turn. Pi `0.84.2`, Host API,
replay, recovery, and background-lifecycle contracts are unchanged. Focused
35-test, 1,780-test full-suite plus pressure, typecheck, lint, production-build,
and Electron E2E verification passed. The existing 1.2.1 artifact predates this
fix; a newly versioned package and installed-client acceptance remain pending.
- Agent Server background-sleep race fix source
`12d7588b3ebd4d192c2e14ae285d4f6ddebeeb42` from task
`20260901-agent-received-stall-8b6d4c21` is merged into local `main` as
`c2137c9f3f2e05441064cc90bfeed115363ac04e` by task
`20260901-integrate-agent-stall-4f2c8a91`. Background sleep now rechecks
active Coding work after asynchronous worker cleanup before stopping the shared
Agent Server, and a server start racing an in-flight stop waits for that stop and
creates one fresh process. This closes the confirmed lifecycle windows that can
leave a locally accepted prompt optimistic with no live Agent Server or Pi session
write; accepted/uncertain prompts are still never auto-replayed. Source tests and
a real Electron-Node Agent Server race test pass. The currently installed binary
predates this integration; a rebuilt/reinstalled Windows package and repetition of
the reported interaction remain pending release evidence.
- Works-provisioned model-reasoning capability source
`ae7936174208a1d13cdfd260d5c6f2b70b450b60` from task
`20260901-server-model-capabilities-9e31b6c4` is merged into local `main` as
`6a8ebe1b671ca24150c2226b9111b9d07174e37b` by task
`20260901-integrate-model-capabilities-9b3e7c1a`, paired with Works Square source
`9e1b6886b360175f1ca1596fb07f71e3bf86c894`. Electron Main now strictly
normalizes and persists the optional safe `model_capabilities` metadata, removes a
stale override when the field is absent, and includes it in Provider runtime-shape
invalidation. Server levels override the verified local reasoning map; old servers
and direct Providers retain the local fallback. DeepSeek exposes
`off`/`low`/`high`/`max`: Pi disables thinking without `reasoning_effort` for
`off`, and sends the exact enabled effort otherwise. Native `max` reaches project
persistence, Snapshot/Patch, Host API, runtime, and the composer label `最高`.
Pi remains `0.84.2`; no one-api, dependency, package, deployment, or real Provider
acceptance is claimed.
- Marketplace weak-ETag interoperability fix source
`b3cfe7e1ceb7da65ccc99214db09102b4fc1cace` from task
`20260901-plugin-catalog-load-client-7d4a8c21` is promoted to local `main` by
task `20260901-plugin-catalog-main-integration-8e5c2a91` through product commit
`38f2358`. The Main-owned Marketplace client now accepts both strong and valid
weak composite catalog ETags, preserves the exact received validator for the next
`If-None-Match`, and retains catalog-generation and Token Point pricing identity
checks. This closes the installed-client failure where the production gateway's
compressed `W/"plugins-..."` response was incorrectly surfaced as
`plugin_backend_unavailable`; it does not add a local fallback catalog or change
server, Provider, trust, pricing, or billing authority. The rebuilt Windows 1.2.0
installer embeds verification head `6083de6aee8942a78191ed18a00bfd9f4ba0902d`,
is 294,864,542 bytes with SHA-256
`1301AE189BCBD44AA0E373982981E80B324EC45CDDF8F30415C2810F68319C06`,
and was installed over the prior 1.2.0 at the existing user-selected location.
The signed-in installed client then loaded the deployed generation-2 catalog and
rendered exactly Data Service, Game Resource, and Web Search without the unavailable
catalog error. At that checkpoint Game Resource and Web Search still showed no stable
Release; the official bundled cutover recorded above supersedes that delivery model.
- Packaged Pi Agent Server resolver fix source `7df245af5a04f62be48980831ff41987ba686009`
from task `20260901-local-runtime-unavailable-8b42c7f1` is promoted to local
`main` by task `20260901-promote-local-runtime-main-a7c4e291` through verified
integration candidate `42ea83c0cbad52432eca99e4161e0360bef3e219` and source merge
`96402551f46d875ba3db0a2f625397aba2f332fb`. Electron Main now starts only the
shared Agent Server with Node's `import.meta.resolve` parent-URL capability enabled,
so the unchanged server script resolves `@earendil-works/pi-ai` from the explicit
packaged `pi-runtime` root instead of the sibling `resources/resources` directory.
A production-shaped sibling-layout test reproduces the installed failure before the
fix and initializes successfully through Electron Node after it; Pi remains pinned at
`0.84.2`, and no bundle layout, Provider, Renderer, or recovery contract changed.
The currently installed application predates this source integration; a rebuilt and
verified Windows artifact plus first-Conversation acceptance remain pending.
- Native Web Search client tickets MLW-01 through MLW-03 are integrated by source
coordinator `20260831-web-search-client-integration-7d2f5b94` and promoted to local
`main` by task `20260901-web-search-client-main-merge-5a9d3b82` from reviewed
coordinator closure `ae81949a49d7df3be4859e6c111235a991a504e4` through product commit
`49de82c4860fd0b377070279b6411237dc6b9564`; the final fixed-range Standards and
Spec reviews passed at `4de3feefe451dc34dc46b323e2ea5e0b4e4840e8` with zero
actionable findings, against frozen Works Square DTO frontier
`a49c696ebc4213e3d62ece780961efbe17576f8e`. MakeLore now reuses the shared
hosted Admission resolver, calls the single fixed Web Search typed route from
Electron Main, materializes the signed Marketplace Skill/tool only in an eligible
frozen parent Pi snapshot, and renders the closed billing receipt without parsing
Web Search payloads in Renderer. The packaged Windows app proves that the route
and receipt parser are main-reachable while OpenAI Provider authority is absent.
The exact reviewed Windows package passed artifact verification; installer SHA-256
is `2492F88BB6F813834ECD24B392EB8337220E131E746547851393E4885C4B5BEF` and
`app.asar` SHA-256 is `27EFABBB741F0A62CB58452801DD1D8893B8E5131EA1D30F74D610DEAD3F7A1D`.
Real PostgreSQL and paid OpenAI acceptance remain external HOLDs; production
activation still requires the official Ed25519 key, OpenAI key/model, price, and
privacy copy. No deployment, publication, push, or PR occurred.
- Human-authorized takeover task `20260831-promote-main-merge-5e9c7a31` completed
the already-started local `main` merge as
`03a9e866d4366e0a1cb416e26b424fe981071310`, recorded the transfer in
@@ -240,7 +432,7 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
客户端面向非专业用户提供“创建小游戏或小程序 → 项目配置中一键提交 → Main 本地 npm/Vite 构建 → Electron 双视口预检最终产物 → 上传 source+built 双归档与 contract → 运营审核”的唯一创建者链路。Main 对安全源码快照运行安装包内固定 npm 11.6.2 的 `npm ci --ignore-scripts`，再显式调用项目 `package-lock.json` 锁定的 Vite；Vite config/plugins 以当前桌面用户权限执行，因此只适用于用户信任的本地项目，不是 sandbox。预检由 Main 以临时 loopback origin 和 Electron WebContents/CDP 检查与最终 `built_archive` 相同的内存文件字节，覆盖桌面/移动视口、运行错误、白屏和外域访问；不使用 Playwright。该检查仍可由非官方客户端绕过，不产生可信 receipt，也不复刻生产 opaque-origin。服务端不再替客户端运行项目 Vite，而是把源码、构建归档和 contract 视为不可信输入，逐字节重算与校验并固化不可变 Release；人工审核仍不可绕过。自定义和缺少类型字段的旧项目不提供该入口。已发布作品优先使用安全投影后的 `play_url`，`runtime_url` 仅保留一个客户端版本的兼容回退。
AI Design Canvas 现在是持续可见的双栏 Living Form 工作区。一个 Workspace 公开一个 current Direction、一个 persistent Agent Session 和一个 Current Specification；conversation timeline 只记录交互历史。Chat、direct edits、decision responses、proposal acceptance、locks、Asset binding 与 restore 都通过 `design.input.apply` 进入同一服务端 reducer，Renderer drafts 在 accepted 前保持本地。Main 持有 Works Token、stream ticket、WebSocket、request deadline、stable command/operation IDs 与错误脱敏；unknown result 只能复用原 identity，结构化业务错误不得重放。Generation 由服务端对 exact Specification revision 编译 immutable Quote，客户端只展示 public output plan、warnings、expiry 与 Token Points，并以 Quote ID 调用 `design.generation.confirm`；Provider Prompt、model、route、storage 和 billing atoms 不进入 Renderer。Task/Asset events 独立收敛 Workspace resources，不改写 Living Form。Development 与 packaged builds 均使用 Works Square V2，V1 DTO、local semantic adapter、mutable Quote PATCH 与 editable provider Prompt 已移除。
AI Design Canvas 现在默认以对话和一张持续可见的“我的创作”卡服务 8-16 岁创作者；专业字段矩阵收进按需打开的“精细调整”，移动端保持对话优先并只挂载一个卡片/底部面板。Creation Card、精细调整、Quote、Task 与结果提示都只投影权威状态，已知问题按 code 转成通俗中文，未知服务端或 Provider 文本不会直接显示。一个 Workspace 仍只公开一个 current Direction、一个 persistent Agent Session 和一个 Current Specification；conversation timeline 只记录交互历史。Chat、direct edits、decision responses、proposal acceptance、locks、Asset binding 与 restore 都通过 `design.input.apply` 进入同一服务端 reducer，Renderer drafts 在 accepted 前保持本地。Main 持有 Works Token、stream ticket、WebSocket、request deadline、stable command/operation IDs 与错误脱敏；unknown result 只能复用原 identity，结构化业务错误不得重放。Generation 由服务端对 exact Specification revision 编译 immutable Quote，客户端只展示 public output plan、warnings、expiry 与 Token Points，并以 Quote ID 调用 `design.generation.confirm`；Provider Prompt、model、route、storage 和 billing atoms 不进入 Renderer。Task/Asset events 独立收敛 Workspace resources，不改写 Living Form。Development 与 packaged builds 均使用 Works Square V2，V1 DTO、local semantic adapter、mutable Quote PATCH 与 editable provider Prompt 已移除。
Canvas 侧栏提供“获取灵感”进入 Prompt Museum。列表、筛选、分页、详情、作者/来源/许可证和图片地址全部由服务端经 Main-owned Host API 提供，客户端不打包静态数据集；服务端相对媒体只允许固定 `/api/image-prompt-museum/{entry}/media/{thumbnail|number}` 形状，并由 Main 注入 Works Bearer、执行一次 401 刷新、可信 raster MIME 与 10 MiB 上限后转为 Renderer data URL；credential-free HTTPS CDN 图片保持直连。图片失败只显示卡片内占位，不阻断卡片或详情；缺少来源 URL 时显示纯文本。“使用此 Prompt”只把原文带回当前 Canvas 输入框，不自动发送。该模块不是投稿、点赞、评论或排行榜社区。客户端契约已就绪，但不据此宣称 Works Square 内容后台和生产数据已经部署。`pnpm run dev` 现在默认使用云端 Canvas 适配器，本地适配器只能通过显式开发命令启用；产品 UI 只保留中文。

70
.project-docs/30-worklog/tasks/20260831-makelore-web-search-client-inspection-6b4d2e81.md Normal file
View File

@@ -0,0 +1,70 @@
# Task: Inspect MakeLore Web Search Plugin seams
## Identity
- Task ID: 20260831-makelore-web-search-client-inspection-6b4d2e81
- Mode: Feature
- Branch: main
- Worktree: D:\Datas\OthersProjects\makelore
- Base commit: bf32fecd6013101485434b1977a73beb8b6a1fe3
- Owner: codex-root
- Status: Ready for Integration
## Scope
- Inspect the exact MakeLore Main, Marketplace Package Store, effective plugin resolver,
capability registry, Pi worker, conversation-envelope, and Renderer seams needed by a
future `makelore.web-search` hosted Plugin.
- Record client ownership and acceptance requirements in the server-side task-owned Web
Search design/spec. Do not implement product code in this client root.
## Intent And Constraints
- The installed schema-2 package remains declarative; only a code-owned Main adapter may
call the fixed Works Square typed route. Pi and Renderer never receive Provider secrets
or arbitrary endpoints.
- A tool is materialized only for an acquired, installed, compatible, project-enabled,
Agent-assigned, admitted and currently supported Release, parent worker only. Existing
account/project/logout/worker invalidation and stable logical-operation identity apply.
- Preserve the generic Marketplace/My Plugins surfaces and
`makelore-capability.v1` conversation parser. P0 needs no plugin-specific Renderer panel.
- Concurrent Task Gate: PASS. This clean root was claimed at exact base
`bf32fecd6013101485434b1977a73beb8b6a1fe3`; no other active writer owns this semantic
slice and only this task record is changed.
- Planning Gate: PASS after loading AGENTS, project memory, current plugin source and
tests. The project-positioning document is still a template and is therefore recorded
as stale context; AGENTS, current-state, exact source, and tests are the implementation
authority for this inspection.
## Outcome
- Completed a read-only client seam inspection and fed exact ownership/acceptance
requirements into the server task's detailed design and implementation Spec.
- Confirmed Web Search can remain a signed schema-2 `platform_hosted` package with one
code-owned Main adapter; no static Pi allowlist, third-party executable, Provider
secret/model, generic invoke route, or Plugin-specific results page is required.
- Identified one necessary generic UI change: the conversation timeline may render the
closed billing union, while `web-search.v1` answer/sources remain tool payload used by
the Agent and preserved by conversation details.
- No client product file was changed.
## Verification
- Inspected current Package Store, Marketplace client, effective resolver, capability
registry, Game Resource hosted adapter, Pi worker materialization, conversation parser,
timeline, composition and their focused tests at exact base
`bf32fecd6013101485434b1977a73beb8b6a1fe3`.
- Confirmed `CapabilityBillingReceiptV1` currently has no Main transport-ambiguity
variant and the generic timeline currently shows only operation/outcome; both changes
are explicitly owned by MLW-02/MLW-03 rather than silently assumed.
- Final `check_project_docs` and task-aware `check_doc_drift` pass.
## Follow-ups
- Start client implementation only after the server WSW-03 typed DTO is frozen, then
follow MLW-01 -> MLW-02 -> MLW-03 and fixed-range review from the current integrated
client frontier.
## Promotion Candidates
- None recorded.

58
.project-docs/30-worklog/tasks/20260901-integrate-agent-stall-4f2c8a91.md Normal file
View File

@@ -0,0 +1,58 @@
# Task: Integrate Agent Server sleep restart fix
## Identity
- Task ID: 20260901-integrate-agent-stall-4f2c8a91
- Mode: Integration
- Branch: main
- Worktree: D:\Datas\OthersProjects\makelore
- Base commit: 738eda14300b18beff826d87e0e043317ec5bb7d
- Owner: codex
- Status: Completed
## Scope
- Merge exact feature commit `12d7588c` into local `main`.
- Preserve the already-integrated model-reasoning capability behavior.
- Record the integration in canonical current state without changing Pi, Provider, packaging, or replay contracts.
## Intent And Constraints
- Pi `0.84.2` remains the sole Coding runtime and one Main-owned Agent Server remains the parent topology.
- Background sleep must not stop work that begins during cleanup, and start racing stop must create one fresh server after stop settles.
- Accepted and uncertain prompts must never be replayed automatically.
- Stop on any merge conflict or semantic conflict; do not choose by merge order.
- Do not package, install, deploy, push, or change dependencies in this integration task.
## Plan
1. Verify the exact source commit and a conflict-free merge tree against current `main`.
2. Merge the source branch with an explicit merge commit.
3. Record the integrated behavior and remaining installed-package gate in canonical current state.
4. Run focused lifecycle tests, typecheck, lint, production build, and documentation drift checks.
5. Commit integration memory, complete the task, and release ownership from a clean worktree.
## Outcome
- Verified source commit `12d7588b3ebd4d192c2e14ae285d4f6ddebeeb42` and conflict-free merge tree `63750df00cda0da00304725b6f0a8c17dd5e09b0` against current `main`.
- Merged the exact source into local `main` as `c2137c9f3f2e05441064cc90bfeed115363ac04e` without conflict.
- Preserved the already-integrated model-reasoning capability changes and the Pi `0.84.2` single-Agent-Server architecture.
- Recorded the background-sleep recheck and serialized stop/start behavior in canonical current state.
- No package, installation, deployment, push, dependency, Provider, or replay-contract change was performed.
## Verification
- `git merge-tree --write-tree HEAD 12d7588` returned conflict-free tree `63750df00cda0da00304725b6f0a8c17dd5e09b0` before merge.
- Merged-main focused lifecycle run: 4 files / 9 tests passed.
- `pnpm run typecheck`: passed.
- `pnpm run lint:check`: zero errors and the repository's existing five warnings.
- `pnpm test`: 216 files passed; 1,780 tests passed and 2 skipped.
- `pnpm run build:vite`: Renderer, Electron Main, Preload, and utility production builds passed with existing build warnings only.
## Follow-ups
- Build, verify, and reinstall a Windows package from integrated `main`, then repeat the reported prompt-after-idle interaction. The currently installed application still contains the old lifecycle code.
## Promotion Candidates
- Resolved: recorded the exact source and merge commits, lifecycle behavior, no-replay invariant, and remaining installed-package gate in `.project-docs/30-worklog/current-state.md`. No ADR or architecture rewrite was needed because the fix enforces ADR-006.

84
.project-docs/30-worklog/tasks/20260901-integrate-model-capabilities-9b3e7c1a.md Normal file
View File

@@ -0,0 +1,84 @@
# Task: Integrate model reasoning capabilities
## Identity
- Task ID: 20260901-integrate-model-capabilities-9b3e7c1a
- Mode: Integration
- Branch: main
- Worktree: D:\Datas\OthersProjects\makelore
- Base commit: a30053c30e48a0da8639f13e117168f5afd7532e
- Owner: codex
- Status: Completed
## Scope
- Merge exact source commit `ae7936174208a1d13cdfd260d5c6f2b70b450b60`
into local `main` without changing the reviewed product behavior.
- Promote the paired Works-to-Main capability normalization and Pi precedence
contract into canonical architecture/current state memory.
- Do not package, deploy, push, change Pi/one-api dependencies, or add a second
runtime or compatibility layer.
## Intent And Constraints
- Electron Main remains the sole owner of Works model config, Provider metadata,
credentials, and Pi wire values; Renderer receives only product-neutral levels.
- Server capability metadata overrides the verified local reasoning map when present;
an older server falls back locally, and persisted user choice remains intact.
- Integrate only the reviewed source commit. Any merge conflict or semantic conflict
with current `main` stops integration for explicit reconciliation.
- Pair the client merge with Works Square source
`9e1b6886b360175f1ca1596fb07f71e3bf86c894`; no one-api change is required.
## Plan
1. Verify source identity, worktree cleanliness, and a conflict-free merge tree.
2. Merge the exact source branch into `main` with a merge commit.
3. Promote the Main-owned capability normalization/precedence boundary into canonical
project memory.
4. Run focused serializer/UI/contract tests, typecheck, lint, Vite build, diff checks,
and documentation drift checks.
5. Commit the integration record, complete the task, and release ownership only from
a clean `main` worktree.
## Outcome
- Merged exact reviewed source `ae7936174208a1d13cdfd260d5c6f2b70b450b60`
into local `main` as merge commit
`6a8ebe1b671ca24150c2226b9111b9d07174e37b`; the merge was conflict-free.
- Promoted the Main-owned Works capability normalization/persistence/precedence and
Pi wire boundary into canonical current-state and architecture memory.
- Confirmed paired Works Square source
`9e1b6886b360175f1ca1596fb07f71e3bf86c894` is merged into local server `master` as
`ef73b9c97997942996ddd3ed3cd3bf4e29120bd0`.
- Kept the reviewed scope: Pi remains `0.84.2`; no one-api, dependency, package,
deployment, push, second runtime, or compatibility layer was added.
## Verification
- `git merge-tree --write-tree` returned conflict-free tree
`94c573f77dd11931750a255d537c800c6f5d09c9` before merge.
- Focused merged-tree Vitest run: 8 files / 111 tests passed, covering Works
capability import and cleanup, model/profile precedence, project/Snapshot/route/UI
`max` propagation, Pi runtime behavior, and actual off/low/high/max serializer output.
- `pnpm run typecheck`: passed.
- `pnpm run lint:check`: passed with zero errors and the repository's existing five
warnings.
- `pnpm run build:vite`: passed for Renderer, Electron Main, Preload, and utility
output; existing Browserslist, dynamic-import, and chunk-size warnings remain.
- `git diff --check`: passed.
- Paired server merged-tree verification passed 11 focused tests and focused Ruff.
## Follow-ups
- Release the paired Works Square API and Makelore client when release owners are
ready. Deployment order remains tolerant: an older server uses the local DeepSeek
profile and an older client ignores the optional server field. Real Provider and
final installed-package acceptance remain separate release evidence.
## Promotion Candidates
- Resolved: promoted the safe Works-to-Provider metadata contract, missing-field
cleanup/fallback, server-over-local precedence, and Pi `off`/enabled wire behavior
into `.project-docs/20-architecture/system-overview.md`; recorded the integration
in `.project-docs/30-worklog/current-state.md`.

91
.project-docs/30-worklog/tasks/20260901-merge-abort-main-a83d4c71.md Normal file
View File

@@ -0,0 +1,91 @@
# Task: Merge conversation abort reconciliation into main
## Identity
- Task ID: 20260901-merge-abort-main-a83d4c71
- Mode: Integration
- Branch: main
- Worktree: D:\Datas\OthersProjects\makelore
- Base commit: ebc46c679da3907fd337e51b54c2da9f72c02755
- Owner: codex-root
- Status: Completed
## Scope
- Merge exact verified candidate `599d184` into local `main` after the
human-authorized closure of packaging task `20260901-package-121-7a3c`.
- Preserve the candidate's product implementation and canonical current-state
reconciliation while retaining the packaging task's committed record.
- Verify the merged product tree, exact ancestry, focused behavior, documentation
boundaries, and clean task state. Do not package, install, publish, deploy, or push.
## Intent And Constraints
- Preserve ADR-006: Pi `0.84.2` remains the only production Coding runtime;
Electron Main remains the Host API authority; accepted or uncertain work is never
replayed; recovery remains target-only Snapshot/Patch convergence.
- The existing 1.2.1 installer was built from pre-fix source and must not be
overwritten or represented as containing this change.
- The user explicitly authorized takeover of the known packaging task. That task was
closed in commit `ebc46c6` and released cleanly before this Integration Gate began.
- Concurrent and Planning Gates passed on exact base `ebc46c6`: the active record,
candidate/source outcomes, accepted decision, canonical memory, and all 210 peer
records were read. No semantic conflict or competing integration owner exists.
## Plan
1. Verify the candidate ancestry and conflict-free merge tree against current `main`.
2. Merge candidate `599d184` with an explicit integration commit, preserving both
the packaging closure and verified abort-reconciliation history.
3. Run the focused abort UI regression plus typecheck and production build, then
verify exact candidate product-tree parity and repository documentation gates.
4. Record the actual merge and verification outcome, commit the integration ledger,
complete the task, and release `main` from a clean state.
## Outcome
- Verified a conflict-free merge tree
`06a1e65143c10c67c4eda1b9ee277e13210bf01f` between current `main` and
candidate `599d184`; their common base was `143aaec`, with one `main`-only and
two candidate-only commits.
- Merged the exact candidate into local `main` as
`85900717906713d8343c2087eade904aead8f111`, preserving both packaging closure
`ebc46c6` and the feature/integration history `d2ef37b` / `599d184`.
- Omitted the two source-owned task-record copies from the final `main` file tree
after the task-aware drift gate correctly rejected them. Their unchanged records
remain reachable in source/candidate commits and merge history; product code,
tests, and canonical current state remain integrated.
- Canonical current state now records the actual local-main merge rather than a
prepared promotion. No ADR, architecture, domain, README, dependency, package,
installed data, deployment, publication, or remote branch was changed.
## Verification
- Post-merge product tree exactly matched verified candidate `599d184`; no non-doc
path differs, and the candidate is an ancestor of `main`.
- Focused post-merge regression passed: 5 files / 35 tests.
- `pnpm run typecheck` passed.
- `pnpm run lint:check` passed with 0 errors and the same 5 existing warnings in
`src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`.
- `pnpm run build:vite` passed for Renderer, Electron Main, Preload, and release
utility bundles with existing build warnings only.
- Post-merge Electron E2E passed: targeted `PI feature UI` scenario 1/1, including
the missed-terminal-SSE abort reconciliation and both controls unlocking.
- Source full-suite evidence remains applicable because the merged product tree is
byte-identical to the candidate: 215 files / 1,780 tests with 2 skips, plus the
isolated pressure test 1/1.
- Task-aware documentation drift, project-document structure, merge ancestry,
product-tree parity, whitespace, and clean-status checks are rerun before release.
## Follow-ups
- Increment the application version, build and verify a new Windows installer,
install it, and repeat the reported interaction before claiming installed-client
acceptance. The existing 1.2.1 installer remains valid historical evidence but
does not contain this fix.
## Promotion Candidates
- Resolved: `.project-docs/30-worklog/current-state.md` records the exact source,
verified candidate, local-main merge, unchanged contracts, and pending release
gate. No further canonical promotion is proposed.

47
.project-docs/30-worklog/tasks/20260901-official-bundled-plugins-client-integration-b8d5f3a2.md Normal file
View File

@@ -0,0 +1,47 @@
# Task: Integrate official bundled Plugins into MakeLore main
## Identity
- Task ID: 20260901-official-bundled-plugins-client-integration-b8d5f3a2
- Mode: Integration
- Branch: main
- Worktree: D:\Datas\OthersProjects\makelore
- Base commit: 52e2a97a12ffaf838c3218795ff33e7fb91940cf
- Owner: codex-root
- Status: Ready for Integration
## Scope
- Integrate product commit `b1657300f29f9744551f31029eb192ee82f01b92` onto client `main`.
- Record bundled optional Plugin delivery in canonical project memory and verify the exact integrated tree.
- Preserve the unrelated untracked `20260901-package-122-c5e8` task record byte-for-byte.
## Intent And Constraints
- Preserve account acquisition/removal, project enablement, Agent assignment, hosted Admission, and Token Point billing.
- Keep third-party signed Artifact installation unchanged and keep Provider secrets out of the client.
- Do not publish, deploy, or overwrite the existing user-owned task record.
## Outcome
- Product source `b1657300f29f9744551f31029eb192ee82f01b92` was cherry-picked onto local `main` as `1530ac774091c7083dbff19e0fbd69e929ac8718`.
- Game Resource and Web Search package manifests, Skills, and tool catalogs now ship under fixed MakeLore resource roots and resolve without Package Store installation.
- My Plugins and Project Plugins project the official bundled model: Account remove/project enable/Agent assignment remain, while download/update/Beta/device-delete and “not downloaded” states are absent.
- The foreign feature task record was removed only from the integrated branch; its isolated source branch remains intact. The unrelated untracked `20260901-package-122-c5e8.md` file was preserved.
- Canonical architecture, data-flow, domain rules, and current-state memory now describe the bundled optional Plugin boundary.
## Verification
- Exact integrated focused run: 61 passed across manifest, effective resolver, hosted Admission, resource loader, Marketplace UI, and product artifact verifier tests.
- `pnpm exec tsc --noEmit`: pass.
- Source evidence: broader adjacent 133 passed; full diagnostic 1,781 passed/2 skipped with two transient Windows `spawn EBUSY` tests passing 3/3 alone; pressure 1/1; Vite all targets pass.
- Windows NSIS package and `verify:artifact:win`/`verify:artifact:pi` pass from source `b1657300f29f9744551f31029eb192ee82f01b92`. Installer: 208,297,578 bytes; SHA-256 `449288AF079E030F3F700F0FF1701971F7AB4806E0366CE989F4E8F2FE33ACA3`.
## Follow-ups
- Install the rebuilt client; the currently running installed binary cannot gain bundled resources from a source merge alone.
- Pair it with a server deployment at migration 0078. Provider/pricing readiness remains server-owned and is not implied by catalog usability.
## Promotion Candidates
- None recorded.

53
.project-docs/30-worklog/tasks/20260901-package-121-7a3c.md Normal file
View File

@@ -0,0 +1,53 @@
# Task: Build 1.2.1 from newest main
## Identity
- Task ID: 20260901-package-121-7a3c
- Mode: Feature
- Branch: main
- Worktree: D:\Datas\OthersProjects\makelore
- Base commit: 143aaec3d6770dd263bf1e418e89bf722989caef
- Owner: codex
- Status: Completed
## Scope
- Build and verify the Windows x64 1.2.1 installer from the latest local `main` commit (`143aaec3d6770dd263bf1e418e89bf722989caef`). No source changes are in scope; the deliverable is the packaged artifact and its verification evidence.
## Intent And Constraints
- Use the pinned pnpm toolchain and frozen lockfile. Produce the unsigned Windows x64 NSIS installer, preserving the repository's existing Electron/Pi runtime packaging contracts and current main-branch behavior.
- On 2026-09-01 the human explicitly authorized `codex-root` to take over this
completed task solely to preserve and commit its known untracked task record,
then release the occupied `main` worktree for the separately verified
Conversation-abort integration. Do not rebuild, relabel, overwrite, or otherwise
change the existing 1.2.1 artifact during this closure.
## Outcome
- Produced `release\Makelore-1.2.1-win-x64.exe` from `main` at `143aaec3d6770dd263bf1e418e89bf722989caef` (295,115,852 bytes).
- Packaged artifact contains version `1.2.1`, Learning code, Web Search and Marketplace code, `.makelore/project.json` integration, and no legacy `learning-player` files.
- Pi product artifact verification passed for Pi `0.84.2`, 130 packages, 6 assets, packaged plugin/runtime closure, and resolver/runtime checks.
- Human-authorized closure preserved the task record on `main` without changing
product source, dependencies, release output, installed data, or artifact bytes.
## Verification
- `pnpm install --frozen-lockfile` passed.
- `pnpm run package:stage:win-x64` passed.
- Electron Builder Windows x64 build passed.
- `pnpm run verify:publish-runtime` passed (npm `11.6.2`).
- `pnpm run verify:artifact:win -- --allow-dirty --installer .\\release\\Makelore-1.2.1-win-x64.exe` passed; Electron `43.4.0`, Node `24.18.1`, Python/uv/npm resources and native modules verified.
- `pnpm run verify:artifact:pi -- --app-exe .\\release\\win-unpacked\\Makelore.exe --samples 2` passed; final result `pass` with cold/warm readiness and packaged closure evidence.
- ASAR inspection passed: version `1.2.1`, `learningEnabled=true`, Web Search/Marketplace/config markers present, `legacyLearningPlayerFiles=false`.
- Installer SHA-256: `3578A3643BF715C57EF924D75819240D97D2387DB7300546735384DA06B26E49`; Authenticode status `NotSigned` (local unsigned build).
- `smoke:pi:real` and `perf:pi:release` were not rerun; their existing harness still asserts two parent process IDs while current main intentionally uses one long-lived parent Agent Server with logical runs/leases.
## Follow-ups
- External code signing and publication remain follow-ups if a distributable signed release is required.
- Align the Pi smoke/performance harness assertion with the one-parent Agent Server architecture before claiming those checks as passing.
## Promotion Candidates
- None recorded.

60
.project-docs/30-worklog/tasks/20260901-plugin-catalog-main-integration-8e5c2a91.md Normal file
View File

@@ -0,0 +1,60 @@
# Task: Integrate and package Marketplace weak-ETag fix
## Identity
- Task ID: 20260901-plugin-catalog-main-integration-8e5c2a91
- Mode: Integration
- Branch: main
- Worktree: D:\Datas\OthersProjects\makelore
- Base commit: 5e8b7266c2a8297c9d307b576256886659d44780
- Owner: codex-root
- Status: Ready for Integration
## Scope
- Integrate the completed weak-ETag Marketplace client fix from source commit `b3cfe7e1ceb7da65ccc99214db09102b4fc1cace` into local `main`.
- Reconcile the accepted fact into current project state without changing Marketplace architecture or authority boundaries.
- Rebuild and verify the Windows 1.2.0 artifact, then replace the currently installed client and verify the Plugin Center against the deployed catalog.
## Intent And Constraints
- The user explicitly authorized release/takeover of completed root task `20260901-package-120-4c7e`, integration, rebuild, and installation.
- Preserve the released task's untracked record `.project-docs/30-worklog/tasks/20260901-package-120-4c7e.md` byte-for-byte; to satisfy the Integration Gate it was moved without modification to `C:\Users\7brot\AppData\Local\Temp\codex-task-recovery-20260901-package-120-4c7e\20260901-package-120-4c7e.md` and remains outside this task's commit.
- Source task promotion candidates are empty and its sole parent is the exact current `main` base, so no semantic conflict or merge choice exists.
- Do not push, publish, deploy, mutate the Works Square catalog, or weaken trust/Provider/billing fail-closed behavior.
- Installation may stop the running MakeLore process, but must target only the exact generated MakeLore installer/application.
## Plan
1. Cherry-pick the exact source fix and remove only the duplicate source task record from the integration history.
2. Update canonical current state and run focused/full source verification from the integrated tree.
3. Build and verify the Windows artifact, stop MakeLore, install the exact artifact, and smoke the Plugin Center.
4. Record artifact/install evidence, complete project-document gates, and leave `main` clean except the preserved foreign task record.
## Outcome
- Product source commit `b3cfe7e1ceb7da65ccc99214db09102b4fc1cace` was integrated as local `main` commit `38f2358`; canonical integration checkpoint is `6083de6aee8942a78191ed18a00bfd9f4ba0902d`.
- A Windows 1.2.0 artifact was rebuilt from that exact checkpoint, verified, installed over the prior 1.2.0 at `D:\Tools\泥土\niancode\Makelore`, and restarted with the existing signed-in session.
- The installed Plugin Center now renders exactly three deployed official Plugins—Data Service, Game Resource, and Web Search—and no longer shows `plugin_backend_unavailable`.
- Game Resource and Web Search are listed but still show no stable Release. That is the existing production signing/publication activation hold, not a catalog-loading regression; this task did not bypass it.
## Verification
- Source commit sole parent equals integration base `5e8b7266c2a8297c9d307b576256886659d44780`; cherry-pick completed without conflict.
- Integrated focused Marketplace suite: 4 files / 68 tests passed; `pnpm run typecheck` passed.
- `pnpm run package:stage:win-x64` and electron-builder with `--config.extraMetadata.version=1.2.0` passed. The first aggregate download attempt stopped before build on an external GitHub `ECONNRESET`; staging reused the previous verified uv 0.10.0 binary (SHA-256 `5E559E322AD2F2E25E7D9C3CB51E3891AB0676A7E7B59EA250A021E4CB2F6E31`) and did not change tracked source.
- `pnpm run verify:publish-runtime`: passed with npm 11.6.2.
- `pnpm run verify:artifact:win -- --installer .\release\Makelore-1.2.0-win-x64.exe`: passed with embedded `gitCommit`/`verificationHead` `6083de6aee8942a78191ed18a00bfd9f4ba0902d`, Electron 43.4.0, Node 24.18.1, Python, uv, npm, native modules, and Unicode proof.
- `pnpm run verify:artifact:pi -- --app-exe .\release\win-unpacked\Makelore.exe --samples 2`: passed; Pi 0.84.2 closure, Marketplace markers, Web Search route/receipt authority, and bundled Data Service ten-tool catalog were present.
- Final installer: 294,864,542 bytes; SHA-256 `1301AE189BCBD44AA0E373982981E80B324EC45CDDF8F30415C2810F68319C06`.
- Final `app.asar`: 136,144,898 bytes; SHA-256 `5024322B112DC1839E306EB45953D216A4622149341A89E6BEE35018EDABEB1B`; the active Main bundle contains the optional weak `W/` composite ETag prefix and is selected by `dist-electron/main/index.js`.
- Silent installer exit code was 0. Installed `Makelore.exe` and `app.asar` hashes exactly matched `release/win-unpacked`; installed version remained 1.2.0.
- Signed-in installed-client UI smoke opened Code → Plugin Center and displayed `3 个插件`: Data Service, 游戏资源生成, and 联网搜索, with no catalog-unavailable error. Screenshot: `C:\Users\7brot\AppData\Local\Temp\makelore-plugin-center-installed-fixed.png`.
## Follow-ups
- If Game Resource and Web Search must become acquirable rather than merely listed, complete the separate official signing key, signed stable Release, and production publication activation gate. Do not infer that authority from this client transport fix.
## Promotion Candidates
- None recorded.

72
.project-docs/30-worklog/tasks/20260901-promote-local-runtime-main-a7c4e291.md Normal file
View File

@@ -0,0 +1,72 @@
# Task: Promote packaged Pi runtime fix to main
## Identity
- Task ID: 20260901-promote-local-runtime-main-a7c4e291
- Mode: Integration
- Branch: main
- Worktree: D:\Datas\OthersProjects\makelore
- Base commit: 7f0e9310a7f394249fab3cadc5c82d70f91cbfeb
- Owner: codex
- Status: Ready for Integration
## Scope
- Fast-forward the exact verified packaged Pi Agent Server resolver candidate
`42ea83c0cbad52432eca99e4161e0360bef3e219` from local `main` base
`7f0e9310a7f394249fab3cadc5c82d70f91cbfeb`.
- Preserve the candidate's product tree and accepted canonical facts while keeping
source and intermediate integration task records on their owning branches.
- Complete the task-aware documentation gate and release `main` ownership from a clean
worktree; do not push, publish, package, or deploy.
## Intent And Constraints
- Pi `0.84.2` remains the only production Coding runtime; Electron Main remains the
Agent Server owner, and the bundle layout, Provider/Renderer contracts, recovery
behavior, and public APIs remain unchanged.
- The currently installed client predates this fix. Local source integration must not
be represented as a rebuilt or installed-package acceptance result.
- Concurrent Task Gate passed after the previous clean, ready feature owner of `main`
was released non-forcibly. This task exclusively owns `main` and the Integration Lock.
- Planning and Integration Gates passed using the source outcome, verified candidate,
current-state, ADR-006, evidence index, commitment ledger, and exact Git ancestry;
no semantic conflict or human product-direction decision was present.
## Outcome
- Fast-forwarded local `main` from `7f0e9310a7f394249fab3cadc5c82d70f91cbfeb`
to verified integration candidate `42ea83c0cbad52432eca99e4161e0360bef3e219`
with no merge conflict or replay.
- Promoted the packaged Pi Agent Server resolver fix and production-shaped regression
to local `main`; canonical current state and evidence now identify this promotion task.
- Omitted the duplicate intermediate integration task record from the promotion tip;
it remains recoverable unchanged at candidate `42ea83c0cbad52432eca99e4161e0360bef3e219`,
while the source task record remains at source `7df245af5a04f62be48980831ff41987ba686009`.
## Verification
- Pre-promotion ancestry check passed: local `main` was an ancestor of the candidate,
with `0` main-only and `3` candidate-only commits.
- `git merge --ff-only` succeeded and placed `main` at exact candidate `42ea83c` before
this promotion ledger commit.
- Candidate verification carried forward unchanged: 4 focused files / 24 tests passed;
typecheck passed; lint passed with 0 errors and 5 pre-existing warnings; Vite/Electron
Main/Preload/utility build passed. Source full suite passed 215 files / 1,761 tests with
2 conditional skips.
- At promotion ledger `e1e4b570f98a5c159a01fda740222ce3cd1d755e`, the product tree
exactly matched verified candidate `42ea83c`, the candidate remained an ancestor,
task-aware drift and project-docs structure checks passed, the net task diff contained
only the two product files plus canonical/own-task memory, and `git status` was clean.
- This closure changes only this task's status and verification record; the same drift,
structure, ancestry, product-tree, and clean-status checks are rerun before release.
## Follow-ups
- Rebuild and install the Windows artifact, run the publish/runtime/artifact/final
packaged proof, and confirm the first Coding Conversation no longer reports local
runtime unavailable.
## Promotion Candidates
- None recorded.

90
.project-docs/30-worklog/tasks/20260901-reasoning-effort-client-diagnosis-b6c4e1a2.md Normal file
View File

@@ -0,0 +1,90 @@
# Task: Diagnose reasoning-effort client capability
## Identity
- Task ID: 20260901-reasoning-effort-client-diagnosis-b6c4e1a2
- Mode: Feature
- Branch: main
- Worktree: D:\Datas\OthersProjects\makelore
- Base commit: 850947c092892cb647c4191b6d8bbf37a763e1ad
- Owner: codex
- Status: Ready for integration
## Scope
- Diagnose why the current AI Programming model menu exposes only one reasoning
strength for a model that is expected to support multiple strengths.
- Trace the committed Makelore chain from model/provider capability metadata through
Conversation state, Pi runtime mapping, Snapshot projection, and Renderer options.
- Build and run a deterministic focused reproduction for the exact menu symptom.
- Report the verified boundary and the smallest coordinated repair scope; do not
modify product behavior unless the user separately asks for a fix.
## Intent And Constraints
- Treat the current Pi 0.84.2 hard-cutover architecture and Main-owned Provider
boundary as authoritative; do not restore OpenCode or add a compatibility layer.
- Distinguish committed source behavior, deployed/model-provider behavior, and
unverified assumptions. The screenshot proves the visible symptom only.
- Keep credentials, real user data, and upstream payloads out of diagnostics.
- Preserve concurrent task ownership. The potentially related historical model-parity
peer has no defined scope, so this task remains read-only outside its own record.
- The one-api repository is separately gated; do not inspect its occupied worktree or
initialize missing project-doc assets without authorization.
## Outcome
- Confirmed the direct cause in `shared/imported-model-profile.ts`: the
`deepseek-v4-pro` profile marks `off`, `minimal`, `low`, and `medium` as
unsupported (`null`) and maps only product `high` to provider `high`.
- Confirmed Pi 0.84.2 filters every `null` level and exposes `xhigh`/`max` only when
those keys exist. The committed profile therefore deterministically projects the
single level `['high']`.
- Confirmed the Main/runtime and Renderer chain is behaving as designed: provider
config copies the profile map, the Pi session reports its supported levels, and
the composer renders only levels in that runtime list. The Renderer is not
dropping additional options.
- Confirmed the local AI proxy forwards the original JSON request body to one-api;
it does not remove `reasoning_effort`.
- A one-variable diagnostic map exposed `off`, `low`, `medium`, and `high`, and the
real Pi serializer emitted provider values `low`, `high`, and `max` for product
`low`, `medium`, and `high` respectively. This proves the repair seam without
changing production behavior.
- The product contract currently has only `off|minimal|low|medium|high`; literal
`xhigh`/`max` menu labels require a separate contract/UI expansion. Mapping the
existing product `high` to provider `max` avoids that expansion if those product
semantics are accepted.
- No product code or canonical project documentation was changed. Temporary
diagnostic tests were removed after use.
## Verification
- Deterministic red reproduction, run three times:
`pnpm exec vitest run tests/unit/diagnostic-deepseek-v4-reasoning.test.ts --maxWorkers=1`
-> each run failed with expected `['off','low','medium','high']` versus actual
`['high']`.
- One-variable causal test using only a replacement level map -> passed and returned
`['off','low','medium','high']`.
- Real Pi payload serialization diagnostic -> `3 passed`; product
`low -> low`, `medium -> high`, and `high -> max`, with thinking enabled.
- Focused proxy diagnostic with `reasoning_effort: 'max'` -> passed; the temporary
assertion was reverted.
- Final existing-suite check:
`pnpm exec vitest run tests/unit/imported-model-profile.test.ts tests/unit/pi-provider-config.test.ts tests/unit/coding-feature-ui.test.tsx tests/unit/ai-proxy-routes.test.ts --maxWorkers=1`
-> `4` files and `50` tests passed.
## Follow-ups
- Update the `deepseek-v4-pro` profile and its focused tests after confirming the
desired product labels. The smallest compatible map is expected to expose product
low/medium/high while translating to provider low/high/max.
- If the UI must display literal `max` (or `xhigh`) rather than translating the
existing `high`, extend `ThinkingLevel`, IPC/runtime contracts, labels, and tests
as one coordinated change.
- A server-owned capability descriptor can reduce future profile staleness, but is
a larger ownership change and is not needed for the immediate fix.
## Promotion Candidates
- None. Promote a durable capability-ownership rule only with an implemented repair
or accepted server/client contract design.

69
.project-docs/30-worklog/tasks/20260901-web-search-client-main-merge-5a9d3b82.md Normal file
View File

@@ -0,0 +1,69 @@
# Task: Merge reviewed Web Search client to main
## Identity
- Task ID: 20260901-web-search-client-main-merge-5a9d3b82
- Mode: Integration
- Branch: codex/20260901-web-search-client-main-merge-5a9d3b82-web-search-client-main-merge
- Worktree: D:\Datas\OthersProjects\makelore-web-search-main-merge-5a9d3b82
- Base commit: 0a86ec825a5803bf7e037d3b23c39be23238c43d
- Owner: web-search-client-main-merger
- Status: Ready for Integration
## Scope
- Promote the complete reviewed native Web Search client chain from released coordinator
closure `ae81949a49d7df3be4859e6c111235a991a504e4` onto local `main` from exact clean
base `0a86ec825a5803bf7e037d3b23c39be23238c43d`.
- Preserve product-tree equality with the reviewed coordinator, replace only the
coordinator-owned ledger copy with this main-merge audit record, and retain package
evidence plus all XWS, paid OpenAI, PostgreSQL and production-activation HOLDs.
## Intent And Constraints
- Concurrent Task Gate: Passed. This integration task owns its isolated worktree,
branch, exact base and the repository integration lock. No other active integration
writer exists; the completed root inspection and review/source tasks are read-only.
- Planning Gate: Passed after reading client AGENTS, the maintain-project-docs workflow,
project agent-entry/startup memory, architecture/decisions, the released Web Search
coordinator outcome, and the user-authorized main-merge boundary.
- Integration plan: verify ancestry and root cleanliness; fast-forward only to the
released coordinator closure; remove only the duplicated released coordinator task
record while preserving its source branch; record the main landing here/current-state;
verify product-tree equality, docs drift, diff, clean status and reviewed client tree;
then fast-forward local `main`, complete and release this task.
- Never reset, stash, clean, push, create a PR, deploy, publish, run paid OpenAI, or
represent the external PostgreSQL/XWS groups as passed.
## Outcome
- The isolated merge branch fast-forwarded from exact root base
`0a86ec825a5803bf7e037d3b23c39be23238c43d` to released coordinator closure
`ae81949a49d7df3be4859e6c111235a991a504e4` with no conflict or semantic replay.
- The duplicate coordinator task record is removed only from this promotion branch;
its released source branch remains intact. Canonical current state now attributes the
local `main` landing to this integration task while retaining source/product/review,
exact package evidence, and external HOLD facts.
## Verification
- Root `main` was clean at `0a86ec825a5803bf7e037d3b23c39be23238c43d`;
that commit is an ancestor of coordinator closure `ae81949a49d7df3be4859e6c111235a991a504e4`.
- The merge branch reached the exact coordinator closure by `git merge --ff-only`.
- All non-`.project-docs` paths are exact-equal to released coordinator closure
`ae81949a49d7df3be4859e6c111235a991a504e4`; only canonical/task ledger paths differ.
- `check_project_docs`, task-aware `check_doc_drift`, fixed-range `git diff --check`,
and clean worktree checks passed. Exact product-tree equality adopts the reviewed
`1,759 passed / 2 skipped`, pressure `1/1`, typecheck, lint, Windows package and
artifact verification evidence without rebuilding an unchanged product tree.
- No live PostgreSQL or OpenAI command was run.
## Follow-ups
- Complete the final root `main` fast-forward only if it is still clean at the exact
recorded base, then complete and release this main-merge task. Keep XWS/PostgreSQL,
paid OpenAI and production activation on HOLD.
## Promotion Candidates
- None recorded.

84
.project-docs/30-worklog/tasks/20260901-web-search-stale-integration-9c5f3d82.md Normal file
View File

@@ -0,0 +1,84 @@
# Task: Integrate Web Search frozen worker stale-Library fix
## Identity
- Task ID: 20260901-web-search-stale-integration-9c5f3d82
- Mode: Integration
- Branch: codex/20260901-web-search-stale-integration-9c5f3d82
- Worktree: D:\Datas\OthersProjects\makelore-web-search-stale-integration-9c5f3d82
- Base commit: 697c68974de8bf43c7094e67372a03123c449343
- Owner: codex-root
- Status: Ready for Integration
## Scope
- Integrate sole source commit `3620cdc277fa0a99757c57a549008f9ecd380558`
from completed feature task `20260901-web-search-stale-resources-8b4e2c71`
onto exact local `main` base `697c68974de8bf43c7094e67372a03123c449343`.
- Preserve the source task record on its source branch, remove only its duplicate copy
from this integration checkpoint, update this integration record and canonical
current state, and fast-forward local `main` after verification.
## Intent And Constraints
- Concurrent Task Gate: passed in the isolated integration worktree created from exact
`main`; this task holds the integration lock. The root worktree's two unrelated
untracked package records remain untouched.
- Planning Gate: passed after loading the required project memory earlier in the
diagnostic task, then re-reading the current integrated state, Integration Gate,
completed source record, and active-owner registry for this exact promotion.
- Semantic comparison found no conflict. The source fix preserves the accepted frozen
worker and server Admission boundaries: new workers still require current Library;
only invocation revalidation may use the last verified stale Library projection.
- Integrate only the sole source commit. Do not restart the running installed client,
package, push, deploy, publish, call paid Web Search, or alter server/pricing/Provider
authority.
## Project Context Loaded
- Integration task/worktree/branch/base identity matches the task registry exactly.
- Source commit has sole parent equal to this integration base and is
`READY_FOR_INTEGRATION`; its focused, adjacent, typecheck, lint, full-unit, pressure,
diff, and documentation gates passed.
- The old Web Search coordinator/reviewer registrations are historical at earlier
frontiers and do not own this product range. The root's package records are unowned
and intentionally excluded by isolated integration.
- Canonical current state already records frozen Web Search worker materialization,
assignment, Admission, and installed-binary limitations. This landing adds only the
diagnosed stale-Library invocation correction and its evidence.
- Gate result: passed; cherry-pick and canonical integration writes may proceed.
## Outcome
- Cherry-picked sole source commit `3620cdc277fa0a99757c57a549008f9ecd380558`
onto the exact integration base as product commit
`40e1912`. The four product/test paths are byte-identical to the completed source.
- Removed only the duplicated source task record from this integration checkpoint; its
source branch/worktree/record remain intact. Recorded the landed behavior and limits
at the top of canonical `current-state.md`.
- The fix keeps new hosted workers fail closed on stale Library data while letting an
already verified frozen worker continue to the server-owned exact Release Admission.
The project, account, acquisition, suspension, Release/version, policy, billing,
confirmation and parent-only checks were not bypassed.
- Local `main` can be fast-forwarded after this documentation checkpoint. Its two
unrelated untracked package records remain untouched. The running installed MakeLore
binary was not restarted or replaced and therefore does not yet contain this source.
## Verification
- Source task evidence adopted: focused 19, adjacent 55, full 215 files / 1,786 passed /
2 skipped plus pressure 1/1, typecheck, scoped lint, diff, and task documentation
gates passed.
- Integration product/test tree equality against source commit: passed.
- Integration rerun: focused resolver/registry 2 files / 19 tests passed; `pnpm run
typecheck` passed.
- No paid Web Search, package, restart, push, deploy, publication, server or Provider
action was performed.
## Follow-ups
- None recorded.
## Promotion Candidates
- None recorded.

70
.project-docs/30-worklog/tasks/20260901-web-search-tool-routing-integration-7a4e1c93.md Normal file
View File

@@ -0,0 +1,70 @@
# Task: Integrate Web Search Agent assignment catalog fix
## Identity
- Task ID: 20260901-web-search-tool-routing-integration-7a4e1c93
- Mode: Integration
- Branch: codex/20260901-web-search-tool-routing-integration-7a4e1c93
- Worktree: D:\Datas\OthersProjects\makelore-web-search-tool-routing-integration-7a4e1c93
- Base commit: 08099ea1c2ea24efc10c20f878fc25a557ea9d90
- Owner: codex-root
- Status: Ready for Integration
## Scope
- Integrate sole source commit `612794463de1b14fd748202a00115c6f93c7346b`
from completed feature task `20260901-web-search-tool-routing-fix-6f9d3b82`
onto exact local `main` base `08099ea1c2ea24efc10c20f878fc25a557ea9d90`.
- Preserve the source task record as read-only evidence, update only this integration
task record and the canonical integrated-state ledger, and fast-forward local
`main` after verification.
## Intent And Constraints
- Concurrent Task Gate: Passed in a dedicated integration worktree/branch from the
exact current `main`; the repository integration lock is held by this task.
- Planning Gate: Passed after loading the required memory entry points, current
state, decision index, architecture/data flow/domain rules, evidence, reflection,
commitments and stale items, plus the completed source task record.
- Semantic comparison found no conflict: the fix preserves the accepted separation
between project enablement, Agent assignment, and effective frozen worker state.
It only restores enabled plugin Skills to the unscoped assignment catalog.
- Source product/test/task files are integrated as one exact commit. No server,
policy, billing, Provider, package version, deployment, publication, or current
worker hot-swap is in scope. The two unrelated untracked packaging records in the
user root must remain untouched.
## Outcome
- Cherry-picked the sole completed source commit as product commit
`adc28db7855f8b1770f1c1d46af77b7cc88cfa1a`; its product/test files are
unchanged. The duplicate foreign source task record is retained on the source
branch and omitted from this integration checkpoint as required by the
project-document ownership boundary.
- Integrated the assignment-catalog correction without changing the accepted
project-enable → Agent-assignment → effective-worker gates. Unscoped Skill
discovery now uses project-enabled Plugin IDs and avoids Admission resolution;
Agent-scoped discovery remains resolver-authoritative.
- Updated the canonical current-state ledger with the source/product commits,
verified behavior, and existing-worker freeze boundary. No promotion candidate,
semantic conflict, or ADR/architecture change was required.
## Verification
- Adopted the exact-tree source evidence: focused 5 files / 45 tests, full 215 files /
1,785 passed / 2 skipped plus pressure 1/1, TypeScript, and scoped ESLint passed.
- Re-ran the integrated tree's focused 5 files / 45 tests and `pnpm run typecheck`;
both passed.
- Exact product/test diff equality, exact parent base, `git diff --check`, task-aware
project-doc drift, clean-worktree, and local `main` fast-forward are final gates.
## Follow-ups
- The running installed 1.2.3 binary predates the assignment-picker source fix.
The reported project's exact Agent assignment has been corrected separately;
a new Conversation is required because existing Pi workers intentionally freeze
their Skill/tool snapshot.
## Promotion Candidates
- None recorded.

136
.project-docs/30-worklog/tasks/20260902-design-youth-client-integration-7a6d3c92.md Normal file
View File

@@ -0,0 +1,136 @@
# Task: Integrate youth-facing AI Design client changes
## Identity
- Task ID: 20260902-design-youth-client-integration-7a6d3c92
- Mode: Integration
- Branch: codex/20260902-design-youth-client-integration-7a6d3c92-design-youth-client-integration
- Worktree: D:\Datas\OthersProjects\makelore-design-youth-integration-7a6d3c92
- Base commit: 7552cf59526449c29d663a769c0fb62d84a1a759
- Owner: codex-root
- Status: Ready for Integration
## Scope
- Integrate reviewed Design Youth source commit
`0fd32a2d49045a8f9e7f2e19ba6477f48f93e30c` onto the current client frontier
`7552cf59526449c29d663a769c0fb62d84a1a759`.
- Replace the default professional field matrix with conversation plus one compact
“我的创作” card for creators aged 8-16, while retaining contextual “精细调整”.
- Preserve the V2 Current Specification reducer, immutable Quote confirmation,
Task/Asset reconciliation, stable operation identities, and Main-owned transport.
- Own the integration record, canonical current-state reconciliation, cross-frontier
verification, and safe promotion to local `main`.
- Correct the current frontier's eager CommonJS load of the ESM-only Pi package
manager, which the integrated Electron E2E exposed before any Design page opened.
## Intent And Constraints
- One understandable default serves creators aged 8-16; there is no separate age or
expert mode. Advanced controls remain progressive disclosure over canonical state.
- Direct choices use existing typed commands. Renderer drafts, assistant deltas,
Quote/Task events, and localized copy never become Specification authority.
- Known compiler/Task issues render code-based youth-facing Chinese copy; unknown
messages use a fixed safe fallback rather than raw server or Provider text.
- Do not add or change a database migration, DTO/API, semantic store, compatibility
layer, Provider route, pricing path, deployment, publication, push, or paid request.
- Keep the Pi package-manager correction limited to loading its existing dependency
on demand for remote Device Package installation; do not change package semantics.
- Preserve the two user-owned untracked records in the root checkout exactly as-is:
`20260901-package-122-c5e8.md` and `20260901-package-123-d7f3.md`.
- The source task record is read-only evidence. The integrated default branch will
retain this integration task and canonical memory, not import a second active task
ownership record.
## Concurrent Task Gate
- Task ID: `20260902-design-youth-client-integration-7a6d3c92`
- Mode: Integration
- Branch: `codex/20260902-design-youth-client-integration-7a6d3c92-design-youth-client-integration`
- Worktree: `D:\Datas\OthersProjects\makelore-design-youth-integration-7a6d3c92`
- Base commit: `7552cf59526449c29d663a769c0fb62d84a1a759`
- Ownership result: Claimed in an independent linked worktree. The preceding Model
Tools integration lock is complete and released; its exact client frontier is this
task's base commit.
- Other local state: root `main` contains only the two allowlisted user-owned untracked
task records. They are outside the source commit's changed paths and remain untouched.
- Gate result: Passed.
## Project Context Loaded
Read:
- the startup memory set, memory index, project positioning, success criteria,
decision index, current state, system overview, business rules, and ADR-007;
- source task `20260902-design-youth-client-7c5e3a82`, its exact commit boundary,
verification evidence, follow-ups, and promotion candidates;
- current Model Tools integration record and its released frontier.
Relevant understanding:
- The Current Specification remains the only semantic authority. The Creation Card
and Fine Tune drawer are projections/editors over the existing V2 reducer.
- Main remains the only Works Square transport and secret owner. Generation confirms
only an immutable Quote ID; public copy must not expose Provider internals.
- Youth readiness language may offer to check a production plan, but must not claim
server readiness before concrete Quote blockers have been evaluated.
- Source verification already covers responsive composition, direct edit, chat,
Quote/Task flow, stable Shot identities up to 24, terminal Quote-blocked settlement,
safe issue copy, typecheck, lint, build, broad tests, and Electron E2E.
- The new frontier changes Coding model tools/device packages and canonical memory,
not the ImageCanvas product/test files. Canonical documentation must be reconciled
in this integration task rather than overwritten from the older source base.
- Planning Gate result: Passed.
## Outcome
- Integrated reviewed source `0fd32a2d49045a8f9e7f2e19ba6477f48f93e30c`
onto the exact released Model Tools frontier with merge
`16157388afc2f6103aaee0bfd3c4e4e80c8fec48` and no source conflict.
- Canvas now presents one conversation-first “我的创作” card, A/B/C youth choices,
“你帮我选”, responsive single mounting, and contextual “精细调整” while the
server-owned Current Specification remains the only semantic authority.
- Quote blockers are revision-bound and terminal blocked responses/events settle
pending operations. Compiler and Task issues use code-based youth-facing Chinese
copy with fixed unknown fallbacks instead of raw technical messages.
- Fine Tune preserves stable Shot ids, timing/camera/framing/motion/focus/transition
metadata, supports the full 24-Shot server contract, and treats a cleared beat as
explicit deletion rather than submitting an invalid null value.
- The integrated Electron check exposed a pre-existing current-frontier startup
blocker before the Design page opened: Vite externalized an ESM-only static Pi
package-manager import as top-level CommonJS `require`. Commit
`c5447ae90c434c06dbafa724b229d8459cb829d0` now dynamically imports that existing
module only for remote Device Package installation; package semantics are unchanged.
- Removed the imported source task record from default-branch ownership scope; this
integration record and canonical current state contain the promoted evidence.
- No database migration, public DTO/API, second semantic store, compatibility layer,
Provider activation, paid generation, package, deployment, publication, push, or
PR was added or performed.
## Verification
- `corepack pnpm exec vitest run tests/unit/youth-form-projection.test.ts tests/unit/youth-creation-card.test.tsx tests/unit/youth-issue-copy.test.ts tests/unit/fine-tune-drawer.test.tsx tests/unit/image-workspace-store.test.ts tests/unit/image-canvas-page.test.tsx` — 6 files / 40 tests passed on the integrated frontier.
- `corepack pnpm exec vitest run tests/unit/device-package-manager.test.ts` — 5 tests
passed after the ESM loading correction.
- `corepack pnpm run typecheck` — passed before and after the correction.
- Scoped ESLint over all Design Youth source/tests and the corrected Device Package
manager — passed.
- `corepack pnpm run build:vite` — passed; only existing chunk-size and mixed
static/dynamic import warnings were reported. The active Main chunk contains the
expected dynamic Pi import and no eager Pi package-manager `require`.
- The first Electron run deterministically failed 2/2 at app launch with
`ERR_PACKAGE_PATH_NOT_EXPORTED`, before either test reached Canvas. After
`c5447ae`, the identical
`corepack pnpm exec playwright test tests/e2e/image-workspace-v2.spec.ts` run passed
2/2 in 3.8 seconds, covering Prompt Museum isolation plus desktop/375 px/768 px
Design conversation, direct edit, Quote confirmation, and Task flow.
- `check_project_docs.py` and task-aware `check_doc_drift.py` — passed after the
imported source task record was removed from the final integration tree.
## Follow-ups
- Run moderated usability sessions with creators aged 8-16 after packaging.
- Production package/deployment and real-account Design V2 smoke remain separate
release gates; paid Provider activation still requires explicit authorization.
## Promotion Candidates
- None recorded.

148
.project-docs/30-worklog/tasks/20260902-model-tools-client-integration-5d8b2f73.md Normal file
View File

@@ -0,0 +1,148 @@
# Task: Model Tools and Device Packages client integration
## Identity
- Task ID: 20260902-model-tools-client-integration-5d8b2f73
- Mode: Integration
- Branch: codex/20260902-model-tools-client-integration-5d8b2f73-model-tools-client-integration
- Worktree: D:\Datas\OthersProjects\makelore-model-tools-integration-5d8b2f73
- Base commit: 841273b43354b2237a52a7081a9fceb647ef4e3f
- Owner: codex-root
- Status: Ready for Integration
## Scope
- Implement the MakeLore half of the accepted Model Tools and Device Packages
specification from exact base `841273b43354b2237a52a7081a9fceb647ef4e3f`.
- Add the closed selected-model `web_search` tool, a Main-owned conversation-driven
Device Package manager, immutable parent-worker resource materialization, and a
split Official Plugins / Device Installed view in My Plugins.
- Remove the old hosted Web Search client/package path only after the new model-tool
composition is working; keep Game Resource and other official plugins unchanged.
- Own the client integration record and final canonical-memory reconciliation.
## Intent And Constraints
- There is no visible install/source-picker entry. Installation is initiated by
conversation tools, requires a preview and a distinct later user-confirmation
turn, and accepted packages default to enabled for the next parent generation.
- Device Packages are local to this OS user and never join Account Library,
Admission, Release, Channel, or Marketplace Package Store state.
- Executable Pi extensions run with desktop-user authority; the confirmation must
state that plainly. P0 does not claim a sandbox or load packages into child agents.
- Web Search uses the frozen selected model/provider/credential and never falls back
to `agent_browser`, a separate model, hosted Web Search client, or Plugin Charges.
- The two user-owned untracked files in `D:\Datas\OthersProjects\makelore` remain
untouched; all product work occurs in this linked worktree.
- No live paid Provider request, production install, publish, push, or PR is
authorized by this implementation task.
## Concurrent Task Gate
- Task ID: `20260902-model-tools-client-integration-5d8b2f73`
- Mode: Integration
- Branch: `codex/20260902-model-tools-client-integration-5d8b2f73-model-tools-client-integration`
- Worktree: `D:\Datas\OthersProjects\makelore-model-tools-integration-5d8b2f73`
- Base commit: `841273b43354b2237a52a7081a9fceb647ef4e3f`
- Ownership result: Claimed in an independently created linked worktree; the client
integration lock belongs to this task.
- Other local registry entries are historical isolated planning/ready tasks; none
owns this worktree or the planned model-tool/device-package files. The two
untracked root records were neither copied as changes nor claimed.
- Gate result: Passed.
## Project Context Loaded
Read:
- `.project-docs/05-agent-entry/{read-before-coding,concurrent-task-gate,planning-gate,memory-index}.md`
- project positioning/success criteria, current state, decision index, architecture,
data flow, business rules/glossary, evidence/reflection indexes, commitments and
stale-items registry
- the accepted server-repository design and implementation Spec, proposal, and
completed design task for the three-domain cutover
- current Pi worker/resource loading, official Plugin resolver/Package Store,
atomic JSON utilities, product composition, model capability parser, My Plugins,
and their focused tests identified by the Spec
Relevant understanding:
- Project goal: Electron Main owns credentials, local package bytes, effective
resources, and worker generations; Renderer and Agent inputs receive only closed
projections.
- Current focus: make Web Search a selected-model core tool and let conversation
install local Skills/Pi extensions that appear under Device Installed.
- Active constraints: Pi `0.84.2`, explicit `--extension`/`--skill` loading with
discovery disabled, atomic durable index, no lifecycle scripts, parent-only P0,
and safe refresh after the current turn.
- Decisions affecting this task: no visible installer, automatic post-confirmation
loading, Official/Device inventory split, no Web Search Marketplace card, and no
dual hosted/model-tool runtime.
- Evidence/commitments: current Pi runtime and Marketplace boundaries are already
integrated; exact packaged and live Provider acceptance remains a later gate.
- Likely modules: imported model/profile parsing, Pi provider/runtime composition,
new `electron/coding-packages/**`, effective resources/worker lifecycle, Main-local
management routes, My Plugins store/page, conversation protocol and artifact tests.
- Unknowns/conflicts: provider-native Web Search must remain unavailable for any
selected model lacking a proven closed capability; a third-party package manifest
alone is not evidence that its tool supports Bailian/DeepSeek.
- Planning Gate result: Passed.
## Outcome
- Added a closed parent-only `makelore_web_search` model tool. Its registry reads the
frozen selected-model capability, keeps the same provider/credential/model, emits the
verified provider-native forced-search request shape, and never falls back to
`agent_browser`, a second model, the removed hosted client, or Plugin Charges.
- Added a Main-owned Device Package deep module with conversation tools for
inspect/preview, confirm/install, list, enable/disable, and uninstall. It accepts npm,
Git, absolute local Plugin directories, and loose `SKILL.md` sources; lifecycle scripts
are disabled and executable extensions require the explicit desktop-authority warning.
- Device packages commit as immutable generations, default enabled, and automatically
refresh new/idle parent workers. Active workers retain the frozen generation until
settlement, and child workers receive no Device Package resources.
- My Plugins now separates Official Plugins and Device Installed. It exposes no visible
installer/source picker. Device state does not enter Account Library, Release, Channel,
Admission, Marketplace Package Store, project enablement, or Agent assignment.
- Removed the old Hosted Web Search package definition, Main client/adapter, conversation
envelope cases, artifact authority, and associated tests while preserving Game Resource
and generic Marketplace behavior.
## Verification
- TDD and focused model-tool/device-package/resource/route/Renderer tests passed; final
focused Device Package slice: 4 files / 15 tests.
- Full unit suite: 218 files, 1,786 passed, 2 skipped; pressure test 1 passed. One initial
run saw two unchanged real-Pi `spawn EBUSY` failures; the isolated retry passed 3/3 and
the full suite then passed.
- `pnpm typecheck` passed. Full lint passed with 0 errors and 5 unchanged warnings in
Home/Makelore.
- Vite Renderer/Main/Preload/utility production build and Pi win32-x64 runtime staging
passed; Renderer transformed 2,275 modules and the staged Pi closure contains 130
packages / 6 assets.
- Windows Electron lifecycle suite passed 6/6 on clean retry. The first run's six tests
passed but Electron returned a transient Windows access-violation exit code afterward.
- `git diff --check` passed.
- Exact committed-head Windows packaging passed from
`0c54d874cf3d21f6694b9a246e3d11b68817234a`. The first aggregate wrapper reached
the external GitHub `uv` download and failed with `ECONNRESET`; the already verified
local `uv 0.10.0` binaries were then reused, after which staging, electron-builder,
NSIS signing, `verify:artifact:win`, and `verify:artifact:pi` all passed.
- The installer is 208,279,484 bytes with SHA-256
`7F9AA7DC598256673D13C1FA103C1BEE173691F4A329B6F73BCBDA34CFF6C335`.
Artifact metadata records both `gitCommit` and `verificationHead` as the exact
committed head. The packaged Plugin inventory is exactly Data Service + Game
Resource; selected-model Web Search and Device Package authority are both proven
reachable from `app.asar`, with no Hosted Web Search Provider authority.
## Follow-ups
- HOLD: packaged signed-in conversation acceptance for one loose Skill, one fixture Pi
extension, and a live `npm:pi-web-search` install with network access.
- HOLD: real selected-model Web Search through the deployed AI Gateway requires explicit
paid-Provider authorization and a supported credential/model.
- Independent fixed-range Standards and Spec reviews remain the next gate after the
paired commits are integrated.
## Promotion Candidates
- Keep the model-tools/device-packages proposal pending until packaged install and live
model-search acceptance satisfy its promotion criteria.

100
.project-docs/30-worklog/tasks/20260902-web-search-client-integration-a4c8e291.md Normal file
View File

@@ -0,0 +1,100 @@
# Task: Integrate Web Search unavailable-release diagnostics
## Identity
- Task ID: 20260902-web-search-client-integration-a4c8e291
- Mode: Integration
- Branch: main
- Worktree: D:\Datas\OthersProjects\makelore
- Base commit: 2c5b60ea78e014a712a47bdbb9efd156f52f3a1d
- Owner: codex-root
- Status: Ready for Integration
## Scope
- Integrate exact source commit `2e093bd22c0a3c46cc08b8eede8c1bc02afd690b`
from completed feature task `20260901-web-search-runtime-stale-r2-6f4a2d91`.
- Preserve the two pre-existing untracked package task records byte-for-byte and keep
all other client product, package, installed application, and runtime state unchanged.
- Record the integrated diagnostic boundary in canonical current state and run the
source-focused verification plus Integration Documentation Gate.
## Intent And Constraints
- The source commit changes only the mapping of an explicit Marketplace
`action='unavailable'`: it must surface `plugin_release_unavailable`, not the
unrelated `plugin_runtime_stale` snapshot error.
- Do not weaken frozen worker, exact Release, Account/project, policy, Admission,
Provider, confirmation, or billing checks. Do not install/package/restart the running
application, mutate Account/Library/project state, deploy, publish, or invoke a paid
Provider.
- User authorization to take over the client root while preserving unowned files was
applied through `--adopt-existing`; the exact pre-existing files remain outside this
task's ownership:
`.project-docs/30-worklog/tasks/20260901-package-122-c5e8.md` and
`.project-docs/30-worklog/tasks/20260901-package-123-d7f3.md`.
- Concurrent Task Gate: PASS. Integration lock and exact root identity are held for
task `20260902-web-search-client-integration-a4c8e291` on `main` at base
`2c5b60ea78e014a712a47bdbb9efd156f52f3a1d`; no other task owns this worktree.
## Project Context Loaded
- Project goal: Electron Main remains the authenticated Marketplace and hosted-Plugin
authority; Renderer/Pi receive only closed projections from an exact frozen parent
worker.
- Current integrated focus: official bundled Game Resource/Web Search already use
account acquisition plus server Release Admission without device package download.
- Active task scope: integrate one reviewed diagnostic correction and its two-reason
regression, then update canonical integrated state.
- Active constraints: no silent state advancement; no hot swap; no child inheritance;
no client-side bypass of Release, Provider, or Token Point authority.
- Decisions affecting this task: ADR-006 single Pi runtime and logical-thread resource
ownership; Marketplace Library, project selection, Agent assignment, Admission, and
billing remain distinct states.
- Evidence/reflections/commitments: the installed `1.2.4` artifact and fresh Pi manifest
proved correct tool materialization; live public Marketplace detail proved the server
Stable Release was absent. Paid Provider and production deployment remain external.
- Files involved: hosted Admission resolver, its focused test, source task record,
this integration record, and canonical current state only.
- Other active local tasks: many historical isolated feature/review owners remain in
the registry, but none owns this root or the changed hosted-Admission files at the
current frontier. The completed source feature is the only semantic input.
- Unknowns/conflicts: current production Web Search Provider Config/model is not
revalidated by this client integration; no semantic conflict or promotion decision
is present.
- Gate result: Passed.
## Outcome
- Cherry-picked the exact completed source as product commit
`93e3143e8a427829efc1894317f188868c21803c` on local `main`; source and integrated
product trees match for the resolver/test/source-record change.
- Canonical current state now records the corrected unavailable-Release diagnostic and
keeps the server migration/Provider readiness requirements explicit.
- The feature task record remains on its isolated source branch and was removed from
the root integration history checkpoint, as required by the Integration Gate.
- The two pre-existing untracked package records remain present and unmodified. No
installed application, project, Account Library, server, package, or external state
was changed.
## Verification
- Source evidence adopted: focused 3 files / 25 tests, TypeScript typecheck, scoped
ESLint, diff gate, and feature task documentation gate passed.
- Post-integration rerun on exact `main`: the same 3 files / 25 tests passed;
`pnpm exec tsc --noEmit`, scoped ESLint, and `git diff --check` passed.
- Integration task-aware document drift passed, and `task_context complete` returned
`READY_FOR_INTEGRATION`.
## Follow-ups
- Deploy Works Square commits containing migrations `0078` and `0079`, run Alembic to
exact `20260901_official_plugin_compat_0079`, and verify Web Search public detail has
Stable Release `00000000-0000-4000-8000-000000000204`.
- Revalidate the server-owned Web Search Provider Config/model and deployment secret,
then reopen the worker. A rebuilt client is needed only to display the improved typed
error; reinstalling cannot replace the missing server Release migration.
## Promotion Candidates
- None recorded.

63
.project-docs/30-worklog/tasks/20260902-windows-titlebar-integration-afc9e259.md Normal file
View File

@@ -0,0 +1,63 @@
# Task: Integrate Windows titlebar logo fix
## Identity
- Task ID: 20260902-windows-titlebar-integration-afc9e259
- Mode: Integration
- Branch: main
- Worktree: D:\Datas\OthersProjects\makelore
- Base commit: d83757a115b12a68ea69d5acfb4a0e8b5783216c
- Owner: codex
- Status: Ready for Integration
## Scope
- Integrate source commit `99a210e` from task `20260901-windows-titlebar-logo-overlap-5100e298` onto local `main`.
- Re-run proportionate verification against the current integrated tree.
- Record the integration in canonical current state without promoting new architecture, domain, or product-direction claims.
## Intent And Constraints
- Preserve the source change exactly unless the current `main` requires an explicit, reviewed conflict resolution.
- Keep the fix limited to Windows titlebar control spacing and its focused regression coverage; macOS/Linux behavior remains unchanged.
- Do not push, deploy, package, publish, or alter application identity, protocols, backend contracts, or unrelated layout.
- Preserve the pre-existing untracked package task records `20260901-package-122-c5e8.md` and `20260901-package-123-d7f3.md` byte-for-byte and exclude them from all commits.
- Treat the source task record and its supporting evidence as read-only integration inputs.
## Project Context Loaded
- Project goal: preserve Makelore's four-module cross-platform Electron product and single light visual system.
- Current integrated focus: local `main` already contains the latest Web Search correction; this task is an independent Renderer-shell integration.
- Active task scope: integrate one completed Windows titlebar spacing correction, verify it on the current default branch, and record the exact integration frontier.
- Active constraints: no macOS/Linux behavior change, no unrelated layout or contract change, and no push, deployment, packaging, or publication.
- Decisions affecting this task: no accepted ADR or product-direction change is required; the Renderer/Main ownership boundary remains unchanged.
- Evidence, reflections, or commitments: the source task contains a deterministic pre-fix Electron reproduction and complete local verification; no reflection or future commitment is introduced.
- Files involved: shared TitleBar component, focused unit/Electron tests, source task record, this integration record, and canonical current state.
- Other active local tasks: all 207 peer task records were readable; only the completed source task shares titlebar semantics.
- Unknowns or conflicts: `project-positioning.md` remains a template placeholder, but AGENTS guidance, system overview, and current state provide the applicable product boundary. No unresolved semantic conflict exists.
- Gate result: Passed.
## Outcome
- Cherry-picked source commit `99a210e244731d1cdc923e9dd4adf6e09e64c2a4` without conflict as product commit `e800d42595484389432fd08b11c2202074a7009e` on local `main`.
- The shared Windows TitleBar now reserves the same 148 px region for both the custom controls and the Logo inset, eliminating the Canvas and Coding overlap while retaining the existing macOS/Linux behavior.
- Canonical current state records the exact source and product commits; no architecture, ADR, domain rule, backend contract, application identity, package, deployment, or publication changed.
- The two pre-existing untracked package task records remain outside this task and outside all commits.
## Verification
- Source evidence adopted: deterministic pre-fix Electron reproduction; focused 11/11; 214 files / 1,759 tests plus pressure; typecheck; scoped/full lint; Vite build; and two focused Electron E2E checks passed.
- Post-integration focused unit: `tests/unit/title-bar.test.tsx` passed 11/11.
- Post-integration `pnpm run typecheck` and scoped ESLint passed.
- Post-integration `pnpm run build:vite` passed; existing Browserslist, mixed dynamic/static import, and chunk-size warnings remain non-blocking.
- Post-integration Windows Canvas and Coding Electron titlebar E2E checks passed 1/1 each.
- Post-integration `pnpm run lint:check` passed with 0 errors and the same 5 pre-existing warnings in untouched Home and Makelore pages.
- Post-integration `pnpm test` passed 215 files / 1,788 tests with 2 skipped; pressure suite passed 1/1.
## Follow-ups
- None.
## Promotion Candidates
- None. This integration records a local Renderer layout correction and does not alter canonical architecture, domain rules, or product direction.

21
.project-docs/40-domain/business-rules.md
View File

@@ -19,6 +19,11 @@
- System-included Data Service ships with MakeLore and has no Library acquisition,
Admission, download, update, or device-uninstall action. Users may still enable it
per project and assign its Skill to an Agent.
- Code-owned Game Resource is the optional bundled hosted Plugin. Its exact schema-2
manifest, Skill, and tools ship with MakeLore, so it has no device download, update,
Beta, signature, or device-uninstall state. Account Library acquisition/removal,
project enablement, Agent assignment, current server policy, immutable Admission,
explicit confirmation, and Token Point billing remain distinct.
- Production Marketplace trust fails closed while the official Ed25519 public key is
absent. Test-only/integration keys and packaged unknown-key rejection are evidence,
not authority to activate production. Generic `platform_hosted` client execution is
@@ -38,6 +43,22 @@
not expose Provider credentials, URLs, credit balances, raw responses, or Provider job
IDs. Saving a hosted result must use bounded project-relative paths and the existing
project write lease.
- Native Web Search is a selected-model capability, not a Marketplace Plugin. Only an
exact verified capability may place `makelore_web_search` in a frozen parent worker;
it uses that worker's current model/provider/credential and ordinary model billing.
Unsupported models expose no tool, child workers receive none, and the implementation
must not switch models, call the retired hosted client, create a Plugin Charge, or
fall back to `agent_browser`.
- Device Packages are local Main-owned installations created only through conversation.
Inspect/preview and a distinct later confirmation precede commit; there is no visible
install/source-picker UI. Accepted npm, Git, absolute local Plugin-directory, and loose
`SKILL.md` sources become immutable generations and default enabled. Lifecycle scripts
never run. Pi extensions execute with desktop-user authority after that fact is shown
in confirmation. New and idle parent workers refresh automatically, active parents
switch only after settlement, and child workers never inherit Device Package resources.
- Device Packages appear separately from Official Plugins in My Plugins and never enter
Account Library, Marketplace Package Store, Release, Channel, Admission, project
enablement, Agent assignment, or server billing state.
- 面向用户的 AI 编程新建流程必须在 `mini_game`、`mini_program`、`custom` 中选择；`ProjectType` 是产品类型，创建后不能通过 UI 或 Host API 修改，未传类型的兼容 API 调用按 `custom` 处理。
- 新建小游戏和小程序会生成平台固定版本的受控 Vite 发布模板，并可使用项目配置中的单一“提交审核”入口；`custom` 和缺少类型字段的旧项目不提供一键发布。
- `ProjectType` 不等于 `BuildPreset`：第一期两个可发布产品类型都映射到内部受控 Vite preset；本地 `projectType` 不是授权边界，Main-owned 安全打包、Host API 和服务端包体校验仍必须执行。

1
.project-docs/50-evidence/evidence-index.md
View File

@@ -6,6 +6,7 @@ Use this index for searchable, traceable evidence records.
|---|---|---|---|---|
| 2026-09-02 | Makelore Code Pi write-leased tool-batch deadlock fix | Integrated locally; source and production-build verification passed; no installer produced | Source `49112b6`, merge `55bf80e`, source task `20260902-fix-bash-tool-bridge-9c4e7a12`, integration task `20260902-integrate-bash-tool-bridge-e81a5c6d` | Live evidence showed every assistant response emitting two Bash calls; Pi prepared both hooks before execution, so the first acquired the project write lease and the second waited before the first could run or release it. The five-minute delay was the managed-extension HTTP idle timeout, not a missing dependency. Built-in `bash`/`edit`/`write` and dynamically declared lease-requiring tools are now sequential within a batch while read-only batches remain parallel. The pre-fix real-process regression reproduced `fetch failed`; the source passed 3 focused files / 9 tests, 213 full files / 1,733 tests with 3 skipped, typecheck, lint with 0 errors / 5 existing warnings, and the Renderer/Main/Preload/utility production build. |
| 2026-09-02 | Makelore Code missing terminal-settlement recovery | Integrated locally; live pre-fix stall diagnosed and automated regression coverage passed | Source `f1fd13a`, merge `e76a1e1`, source task `20260901-fix-session-settlement-a47d2e91`, integration task `20260902-integrate-session-settlement-6e41c8b2` | Live evidence showed Pi had persisted its final assistant response while Main retained run ownership because no effective `agent_settled` arrived. The fix preserves normal settlement authority and no-replay semantics, reports post-accept prompt rejection, and after a bounded grace period probes only the target thread: exact idle evidence hydrates and settles once; contradictory state fails that target explicitly. The source passed 68 focused tests, 1,732 full tests / 3 skipped, typecheck, lint, and Vite build; the integrated tree repeated focused runtime/process tests, typecheck, and Vite build. |
| 2026-09-01 | Makelore Code packaged Agent Server Pi AI resolver fix | Integrated on local `main`; rebuilt Windows artifact and installed-client acceptance pending | Source `7df245a`, source task `20260901-local-runtime-unavailable-8b42c7f1`, merge `9640255`, verified candidate `42ea83c`, main promotion task `20260901-promote-local-runtime-main-a7c4e291` | The installed Electron Node process reproduced `ERR_MODULE_NOT_FOUND` for the present `@earendil-works/pi-ai@0.84.2` because the optional `import.meta.resolve` parent URL was inactive and lookup began beside `resources/resources/pi-agent-server.mjs`. Enabling that capability only for the Main-owned Agent Server made the exact differential pass without changing the runtime closure. A production-shaped sibling-layout Electron test went red before and green after; 24 focused tests, 1,761 full unit tests / 2 conditional skips, typecheck, lint with 0 errors, and Renderer/Main/Preload/utility build passed. This does not claim that the currently installed old package is fixed or that a rebuilt final artifact has passed release proof. |
| 2026-08-30 | MakeLore AI Design Living Form V2 hard cutover | Integrated locally with matching server source; production data cutover and Provider activation pending | Client source `b0b5a602b501308a23eb27e2f51a5169b9e46b1e`, server source `b5351d54f595ce8eb873593e462e4a556bea0b05`, integration task `20260830-integrate-marketplace-design-client-main-9d5f3b82`, ADR-007 | Replaces nested V1 Conversations, Briefs, editable provider Prompt, mutable Quote PATCH, and local semantic fallback with one current Direction, one Living Form/Specification authority, stable operations, immutable Quote confirmation, and Main-owned V2 transport. Client source passed typecheck, lint with zero errors, 1,425 unit tests, Vite/Electron build, and 2 Electron E2E tests. Server source passed 2,626 tests / 31 skipped under UTF-8 mode. No production database cutover, real paid Provider request, deployment, or publication occurred. |
| 2026-08-30 | MakeLore curated Plugin Marketplace Release A | Integrated locally; XMA-01 live acceptance PASS; production trust activation HOLD | Source `40df677a31ff7651f962151eb84b925987781c03`, source task `20260828-plugin-marketplace-client-5f8b3d72`, integration task `20260830-integrate-plugin-marketplace-client-6e3b9d82` | R7 Standards/Spec passed with zero findings. XMA-01 passed 12/12 using real PostgreSQL, signed-in packaged MakeLore, Operations-published temporary-key packages, A/B account isolation, immutable install/update/freeze/rollback, project/Agent/Pi materialization, lifecycle invalidation, pricing-only ETag change, Data Service 10 tools/14 operations and zero Token Point transactions. Final Windows installer was 208,235,670 bytes with SHA-256 `738A2F6573C502281787F418EA666C6E62C287CA0EC13C6EB22369DAB0B3FFFA`. The official Ed25519 public key was not supplied, so the production trust store correctly remains fail closed; no deployment or production publication occurred. |
| 2026-08-26 | Makelore Code Pi hard cutover、后台运行 ownership 与 Works user-context Provider 修复 | 本地 `main` 已集成；Windows 最终安装包与 packaged proof Pass；真实 Provider/macOS/native Linux 非 Pass | 集成交付 `48a9189`、实现 `a098266`、任务 `20260826-fix-pi-model-provider-8d4c2a71` / `20260826-integrate-pi-provider-fix-6e4c2a91`、`docs/pi-runtime-release-runbook.md` | OpenCode production runtime/package/plugin/fallback 已删除，Pi `0.84.2` 是唯一 runtime。未解析 Conversation 现在 validate→persist resolved model→prepare；exact Works `works square AI gateway did not return one-api user context` 会失效缓存 credential、以非重试 Provider-auth failure 结束且不自动 replay，`agent_end willRetry:false` 不再被 `agent_settled` 覆盖成 completed。聚焦 47/47、related 54/54、projector 12/12、181 files / 1541 full unit + pressure、typecheck、lint、Vite build、Windows Electron 4/4、publish/runtime/artifact/Pi/subagent/final packaged proof 通过。NSIS 208,162,564 bytes，SHA-256 `A02F79FCD3273FB0B013450492DC788B6E5ED7BBC1007468FB83BE949B8CB30D`，未签名；final app.asar SHA-256 `A8394D0F7324B27D2C95469ABD4E2A39C739EABCC6D8B41E1D65BA4B41FB9D39`。真实 Provider 是 Explicitly Waived / Accepted Risk 且 `realTurnVerified=false`；macOS x64/arm64 与 native non-WSL Linux 未验收。 |

2
.project-docs/80-commitments/commitments.md
View File

@@ -13,7 +13,7 @@ Track future-facing memory: promised follow-ups, unfinished loops, timed checks,
| 2026-08-16 | 验收 Prompt Museum 与 Canvas 删除/重报价的真实服务端链路 | 发布包含 `26b52d7` Canvas 行为的安装包前 | 客户端/服务端集成 | Pending | 使用真实 Works 账号核对 Museum 列表/详情/分页/筛选/署名/CDN/Prompt 回填，并确认固定相对媒体路径可经 Main Bearer 代理、401 刷新、10 MiB/可信 raster MIME 边界后在 Renderer 展示；核对最终 Prompt/options 重报价和确认设计点；删除 Workspace 后确认软删除可见性、未提交任务取消/预留积分释放、已运行任务结算。保留 Main 错误脱敏和严格 DTO/HTTPS 投影，不以客户端回归替代服务端验收 |
| 2026-08-16 | 验收 default-on Robot Guided Hotspot Binding 的 Windows/macOS 真实设备链路 | 下一份包含页面内热点连接行为的安装包发布前 | 客户端/硬件/服务端集成 | Pending | 核对精确出货固件与固定 Portal、六位码发行/消费语义；执行 Windows Robot 真机扫描/连接、签名 macOS x64/arm64 CoreLocation/CoreWLAN/worker/ASAR/Koffi smoke，以及真实 Host/native Electron 端到端配网+Binding；保留 `NIANCODE_AI_HARDWARE_GUIDED_HOTSPOT_BINDING=0` 回滚并记录支持矩阵 |
| 2026-08-10 | 完成客户端提交到 App `play_url` 播放的真实生产整链验收 | source+built+contract 服务端协议、OSS immutable Release、CDN/Edge 与 App 消费链成组集成后 | 客户端/服务端集成 | Pending | 使用真实账号执行小游戏和小程序创建、客户端本地构建与同字节预检、双归档提交、服务端逐字节校验/不可变 Release 固化、运营批准、CDN 发布、App 播放与监控核对；如需不可绕过 runtime gate，另行设计可信 verifier |
| 2026-08-12 | Windows 发布流水线保留固定 npm/Pi 运行时产物门禁 | 每次生成正式 Windows 安装器时 | 客户端发布 | Pending | 运行 `pnpm verify:publish-runtime`、`pnpm verify:artifact:win`、`pnpm verify:artifact:pi` 与 final packaged proof。当前 208,162,564-byte / SHA-256 `A02F79FCD3273FB0B013450492DC788B6E5ED7BBC1007468FB83BE949B8CB30D` 安装器为本地未签名证据，尚未 push、发布或安装。 |
| 2026-08-12 | Windows 发布流水线保留固定 npm/Pi 运行时产物门禁 | 每次生成正式 Windows 安装器时 | 客户端发布 | Pending | 运行 `pnpm verify:publish-runtime`、`pnpm verify:artifact:win`、`pnpm verify:artifact:pi` 与 final packaged proof；启动最终 `resources/resources/pi-agent-server.mjs` 并确认它从相邻 `pi-runtime` 初始化，再用安装后的首个 Conversation 确认不出现 runtime-unavailable 投影。当前 208,162,564-byte / SHA-256 `A02F79FCD3273FB0B013450492DC788B6E5ED7BBC1007468FB83BE949B8CB30D` 安装器早于 `7df245a` 修复，为本地未签名历史证据，尚未 push、发布或安装。 |
| 2026-08-10 | 删除客户端 `runtime_url` 兼容回退 | 一个客户端兼容版本结束，且服务端与存量数据稳定提供 `play_url` | 客户端 | Pending | 删除类型字段、读取分支和对应回归测试 |
| 2026-08-11 | 部署并验收 AI 绘画多 Conversation 服务端契约 | 发布包含多会话客户端之前 | 客户端/服务端集成 | Pending | 确认迁移 `0033`、Conversation list/create/read/turn/confirm API、持久 Agent Session 与事件字段已上线 |
| 2026-08-12 | 复核 AI 编程 Provider 错误与重试投影 | 升级 Pi、Works gateway 或上游 Provider 错误格式时 | 客户端/Pi/provider 集成 | Pending | 重新验证确定性 Works user-context 缺失仍会 expire credential、非重试 fail fast、固定脱敏为 `CODING_PROVIDER_AUTH_REQUIRED`，并且不会被后续 `agent_settled` 改写为 completed；不得把其他 401/429/5xx 扩大归类。 |