docs(marketplace): record client r4 integration
This commit is contained in:
@@ -135,6 +135,16 @@
|
||||
`34341b932ac3a74788658bc0ed0a2732e140f72e`. It was integrated without
|
||||
conflict as coordinator product commit
|
||||
`3df794c2e736bde2c797c99aa8ad55b967e89ea6`.
|
||||
- MLM-06 R4 fixed-range Standards and Spec review found three deduplicated roots:
|
||||
trusted stale Library disabled local `skill_only`, content-derived resolve identity
|
||||
prevented later channel/Admission progress, and Skill-owner collision remained
|
||||
invisible to Project Plugins. The sole remediation task
|
||||
`20260829-marketplace-mlm06-r4-remediation-b7e3c921` completed from exact frontier
|
||||
`d04b031040a1c109a0c2c5ede2584bb0b75a3bb2` as source commit
|
||||
`4465beabee4f6ff9e24a83e3e2a109a60fe37d1e`. It was integrated without
|
||||
conflict as coordinator product commit
|
||||
`227b8214a820e6a0a2b6758f89fb3bbfa65faf83`; the foreign task record remains
|
||||
only on its source branch.
|
||||
|
||||
## Outcome
|
||||
|
||||
@@ -195,6 +205,12 @@
|
||||
HTML, minified ESM, dynamic Renderer, and Marketplace chunks. No config/assignment
|
||||
rewrite, hidden acquisition/enablement, Token Point path, Release B runtime, or
|
||||
production trust override was added.
|
||||
- MLM-06 R4 remediation keeps verified local `skill_only` resources effective under
|
||||
trusted stale Library while hosted/server-backed definitions fail closed; separates
|
||||
resolve content digest from per-logical-sync identity with explicit replay support;
|
||||
and projects bundled/core/Marketplace Skill-owner collision as closed
|
||||
`skill_owner_conflict`/`unavailable` state. Project and Agent assignments remain
|
||||
preserved, and no new authority, compatibility layer, or Release B path was added.
|
||||
|
||||
## Verification
|
||||
|
||||
@@ -292,10 +308,24 @@
|
||||
Python, uv 0.10.0, npm 11.6.2, native addons, Unicode copy, and publish-runtime all
|
||||
passed. The official Ed25519 public key is still absent, so production activation
|
||||
remains fail-closed HOLD rather than a claimed production release.
|
||||
- MLM-06 R4 source verification began with six exact red assertions and finished with
|
||||
three owned files / 46 focused tests, 17 adjacent Marketplace/Main/Pi/Renderer files
|
||||
/ 143 tests, full Vitest `1803 passed, 2 skipped` plus pressure `1 passed`, typecheck,
|
||||
scoped/full lint (zero errors and the unchanged five warnings), Vite builds, and six
|
||||
Windows Electron tests passing. Target Marketplace/Project Plugins E2E first ran
|
||||
2/3 with the known auth-bootstrap ordering failure before Library fetch; that sole
|
||||
case reran 1/1 passed. Final x64 staging, Electron/NSIS builder, packaged Pi/
|
||||
Marketplace proof, Windows runtime proof, and publish runtime all passed from clean
|
||||
source `4465beabee4f6ff9e24a83e3e2a109a60fe37d1e`. Windows proof embedded that exact
|
||||
`gitCommit`/`verificationHead`; installer size is 208,238,992 bytes and SHA-256 is
|
||||
`F407F2319408F60E8BEFCDC304A72CB4022F764FA44F40210774CDBE1C190483`.
|
||||
The aggregate wrapper's only failure was an external GitHub `ECONNRESET` while
|
||||
downloading unused win32-arm64 uv after x64 Python/uv had succeeded; the reviewed
|
||||
x64 build/proof is complete and tracked files remained clean.
|
||||
|
||||
## Follow-ups
|
||||
|
||||
- Run fresh fixed-range MLM-06 R4 Standards and Spec reviews from the post-R3
|
||||
- Run fresh fixed-range MLM-06 R5 Standards and Spec reviews from the post-R4
|
||||
coordinator documentation checkpoint. Use one remediation owner only if a
|
||||
supported Release A finding remains.
|
||||
- Keep XMA-01, production activation, deployment, publication, push/PR, and every
|
||||
|
||||
@@ -1,103 +0,0 @@
|
||||
# Task: MakeLore Curated Plugin Marketplace Release A R4 Remediation
|
||||
|
||||
## Identity
|
||||
|
||||
- Task ID: 20260829-marketplace-mlm06-r4-remediation-b7e3c921
|
||||
- Mode: Feature
|
||||
- Branch: codex/20260829-marketplace-mlm06-r4-remediation-b7e3c921-marketplace-mlm06-r4-remediation
|
||||
- Worktree: D:\Datas\OthersProjects\makelore-plugin-marketplace-mlm06-r4-remediation-b7e3c921
|
||||
- Base commit: d04b031040a1c109a0c2c5ede2584bb0b75a3bb2
|
||||
- Owner: marketplace-client-coordinator-r4-remediator
|
||||
- Status: Ready for Integration
|
||||
|
||||
## Scope
|
||||
|
||||
- Remediate the three accepted MLM-06 R4 fixed-range findings from exact reviewed
|
||||
head `d04b031040a1c109a0c2c5ede2584bb0b75a3bb2`:
|
||||
1. keep installed local `skill_only` effective when the trusted Library cache is
|
||||
stale, while server-backed runtime remains fail-closed;
|
||||
2. scope Marketplace resolve request identity to one logical sync operation so a
|
||||
later sync can select a new Release and create a fresh Admission;
|
||||
3. project bundled/core Skill ownership collisions as an explicit unavailable
|
||||
reason instead of silently presenting the Marketplace plugin as ready.
|
||||
- Product ownership is limited to the existing Marketplace client/Package Store,
|
||||
effective resolver, Main project projection, their closed shared vocabulary when
|
||||
required, and focused tests. No Server, Operations, Renderer redesign, Release B,
|
||||
hosted execution, Token Point, deployment, publication, or production key work.
|
||||
|
||||
## Intent And Constraints
|
||||
|
||||
- `maintain-project-docs` Concurrent and Planning Gates: Passed. Task-context owner,
|
||||
branch, worktree, and base match exactly; the only initial worktree change is this
|
||||
task record. Relevant coordinator and R4 review tasks are the same implementation
|
||||
topic; reviewers are read-only and no concurrent writer owns these files.
|
||||
- `implement-spec` remediation rule applies: one writer, test-first natural
|
||||
boundaries, one source commit, repository-local integration, then fresh fixed-base
|
||||
Standards and Spec review. The user root worktree remains untouched.
|
||||
- Plan:
|
||||
1. Add failing effective-resolver tests for stale Library local-vs-hosted behavior.
|
||||
2. Add failing logical-sync identity tests for same-operation retry stability and
|
||||
later-operation Release/Admission progress; make the identity explicit at the
|
||||
Package Store boundary rather than content-global.
|
||||
3. Add failing collision snapshot/projection tests; introduce one closed reason and
|
||||
map it to unavailable without fabricating a Skill owner.
|
||||
4. Run focused and adjacent Marketplace/Pi/Project Plugins regressions, typecheck,
|
||||
lint, build/package proof as affected, full required verification, doc/diff
|
||||
gates, then commit once and complete the task context.
|
||||
|
||||
## Outcome
|
||||
|
||||
- The effective resolver now distinguishes trusted stale Library state by runtime
|
||||
kind: an already installed/acquired/enabled/assigned `skill_only` keeps its local
|
||||
immutable Release and Skill, while a server-backed definition remains
|
||||
`library_unavailable` and contributes no worker resources.
|
||||
- Resolve content digest and logical operation identity are separated. A new
|
||||
Marketplace/Package Store sync gets a new `makelore-resolve-<uuid>` ID; a caller
|
||||
can persist and replay an explicit ID for the same logical operation, and the
|
||||
internal authenticated retry reuses the prepared identity. This lets later channel
|
||||
state and expired Admissions be resolved instead of replaying one content-derived
|
||||
request forever.
|
||||
- Marketplace packages that collide with a core, bundled (including Data Service),
|
||||
or earlier Marketplace Skill owner now emit closed reason
|
||||
`skill_owner_conflict`. They contribute no Release/Skill resources and Project
|
||||
Plugins projects them as `unavailable` rather than `ready`; assignments remain
|
||||
preserved.
|
||||
- No Server/Operations, project-file schema, package schema, Renderer page redesign,
|
||||
Release B, hosted runtime, Token Point, deployment, publication, or signing-key
|
||||
product changes were made.
|
||||
|
||||
## Verification
|
||||
|
||||
- TDD red boundaries:
|
||||
- resolver/client suites: 5 failures / 34 passes, exactly stale `skill_only`, two
|
||||
collision reasons, content-derived resolve identity, and missing Package Store
|
||||
operation identity;
|
||||
- Project Plugins projection: 1 failure / 5 passes, state was incorrectly `ready`.
|
||||
- Final owned focused: 3 files / 46 tests passed.
|
||||
- Marketplace/Main/Pi/Renderer adjacent regression: 17 files / 143 tests passed.
|
||||
- Full unit suite: 208 files / 1,803 passed / 2 skipped; pressure test 1/1 passed.
|
||||
- `pnpm run typecheck`: passed.
|
||||
- scoped ESLint: passed. Full `pnpm run lint:check`: 0 errors and the unchanged five
|
||||
out-of-scope warnings (Home one; Makelore four).
|
||||
- `pnpm run build:vite`: passed (Renderer 2,261; Main 193; Preload 1; utility 9).
|
||||
- Windows Electron Vitest: 2 files / 6 tests passed.
|
||||
- Marketplace + Project Plugins Electron E2E: first run 2/3 with the known auth
|
||||
bootstrap ordering failure before Library fetch; the sole failed case reran 1/1
|
||||
passed. No R4 product path appeared in the failure.
|
||||
- `package:stage:win-x64` and Windows Electron builder passed. Packaged
|
||||
`verify:artifact:pi` returned overall PASS: schema-2 Marketplace proof PASS,
|
||||
Data Service ten tools, Pi 0.84.2 closure, and only the inherited real-Provider /
|
||||
cross-platform partial-pass waivers.
|
||||
- `git diff --check`, project-doc structure, doc drift, task-context completion, clean
|
||||
source commit, and final clean-HEAD package proof are completed at handoff.
|
||||
|
||||
## Follow-ups
|
||||
|
||||
- Production Marketplace trust activation remains HOLD until the official Ed25519
|
||||
public key is supplied. No production private key was generated or committed.
|
||||
- Release B Provider/hosted execution and XMA-01 remain closed until fresh fixed-base
|
||||
Standards and Spec review both pass.
|
||||
|
||||
## Promotion Candidates
|
||||
|
||||
- None recorded.
|
||||
Reference in New Issue
Block a user