# Task: Implement curated plugin marketplace Release A client ## Identity - Task ID: 20260828-plugin-marketplace-client-5f8b3d72 - Mode: Feature - Branch: codex/20260828-plugin-marketplace-client-5f8b3d72-plugin-marketplace-client - Worktree: D:\Datas\OthersProjects\makelore-plugin-marketplace-client-5f8b3d72 - Base commit: 1ca8deb54b7b530ab8c5b6a5b7e613730c3b97ec - Owner: codex-root - Status: In Progress ## Scope - Coordinate the repository-local Marketplace Release A MakeLore unit from exact completed Plugin P0 evidence head `1ca8deb54b7b530ab8c5b6a5b7e613730c3b97ec`. - Deliver MLM-00 through MLM-06, the packaged-client half of XMA-01, dependency-ordered integration, fixed-base review/remediation, package proof, and exact final evidence on this isolated branch. - Own only this coordinator worktree/branch, coordinator task record, merger/package proof verification, and cross-repository acceptance ledger. ## Intent And Constraints - Implement Marketplace Release A only: schema-v2 declarative parsing, code-owned Ed25519 trust, Main-owned Works Marketplace/Library access, atomic Package Store, one effective plugin snapshot, and Marketplace/My Plugins/Project Plugins UI. - Keep acquisition, device installation, project selection, backend configuration, Agent assignment, authorization, invocation, and billing separate. No UI action may silently chain another state mutation. - Preserve the completed Plugin P0/Data Service behavior: exact bundled schema 1, project ID retention, ten typed tools, four preview operations, closed capability envelope, child-empty workers, and zero Token Point transactions. - Keep Release B closed: no hosted adapter, Provider endpoint/credential, Plugin Charges, Plugin Credits, arbitrary local code/scripts/native/hooks/LSP/stdio MCP, or generic invoke/config/ledger. - Product trust accepts only code-owned official public keys. Tests may inject ephemeral verifiers through service dependencies; no production private key or arbitrary runtime public-key override may be committed. - Use exact-frontier isolated implementers, disjoint ownership, one source commit per ticket, one repository-local merger, read-only fixed-range reviewers, and one remediation owner at a time. Implementers are not alone and must preserve others' work. - The user root `main` worktree, old P0 coordinator, live services, push, deployment, publication, and PR fabrication are outside authority. No PR is created for this local-only delivery. ## Project Context Loaded - Concurrent and Planning Gates passed in the registered isolated worktree. Task ID, owner, mode, branch, worktree, and exact base match the task-context owner record. - Fully read `AGENTS.md`, the implementation specification, ticket graph, accepted detailed design, project-memory startup set, relevant architecture/evidence/ commitment/stale material, completed Plugin P0 client record, and current manifest, registry, project selection, effective Pi, Host composition, Plugin Center, tests, and package scripts. - Exact Git facts: HEAD is `1ca8deb54b7b530ab8c5b6a5b7e613730c3b97ec`; reviewed product head `78fb7d730731a7b0ebadf12418ca4c2eb6ef3310` is an ancestor. The remaining base delta is P0 evidence only. User root `main` is not the source or implementation worktree. - The completed P0 coordinator is read-only evidence. Other same-topic local owners are completed implementers/remediators or read-only historical reviewers; no active peer owns this new branch or has a semantic conflict with the Release A DAG. - Canonical integrated memory predates the unintegrated P0 coordinator; its exact task evidence and this frozen base/spec control Marketplace work. - Likely modules are exactly the MLM-01 through MLM-04 ownership sets: schema-v2 and signature primitives; Marketplace client/account cache/Package Store; effective resolver/Main/Pi lifecycle; Renderer pages/stores/routes; and MLM-05 package proof. ## Ticket Ownership - MLM-00, MLM-05, MLM-06 coordination, and XMA-01 client evidence: this coordinator. - MLM-01 through MLM-04: exact-frontier isolated implementers in graph order. MLM-02 remains blocked until MLM-01 is integrated and the WSM-03/WSM-04 DTO is frozen. - MLM-06 Standards and Spec axes: independent read-only reviewers. Accepted root causes route to one isolated remediation implementer at a time before repeat review. - MLM-01 source task `20260828-plugin-mlm01-5c8d1e4f` was dispatched from exact coordinator frontier `4d8b1fcec0a751d2935effc7816c7e59f568ec65`, completed as source commit `352a3b7280bb48854beb5281d2b4923b76793367`, and was integrated without conflict as coordinator product commit `898e2b7bdde4bdd77a5659d7b4e294d0607656e3`. - MLM-02 source task `20260828-plugin-marketplace-mlm02-9b7c4e1a` was dispatched from exact post-MLM-01 frontier `c73fcf1d2d2e5dccea6f3b403a3b7c00bdc0b25a`, completed as source commit `1b6f5aaccaf55fc98657fc93824015471818f6e6`, and was integrated without conflict as coordinator product commit `4052fa85cc4c9bfb0bed5b529dd6209007a65ef3`. - Current client frontier contains the frozen MLM-02 Marketplace client/account cache/Package Store contract. MLM-03 may now start from the documentation checkpoint recorded after this integration. - MLM-03 task `20260828-plugin-marketplace-mlm03-4c8e1a7d` was dispatched from exact frontier `1d64b89499f68de721e0f1c845dad2c57f1a78ed`. Its original agent was interrupted after becoming unresponsive; a serial finisher resumed the same registered owner and preserved the dirty worktree with no concurrent writer. The completed source commit `7ad6b8c66d9ca64b5778690667c91c424aae456a` was integrated without conflict as coordinator product commit `05917a789a9b9f30ed9500f4cd1210ec72119646`. Coordinator-transferred Package Store ownership was limited to removing unconditional latest-Release protection while preserving account-snapshot and active-worker protection. - MLM-04 task `20260828-marketplace-mlm04-renderer-e4c7a2` completed from exact frontier `8b6824a8ba08d8df98fc75af17e170bf3d8ed630` as source commit `d61221d34da49f97dd4a9aeb1081fb3544cc6c86` and was integrated without conflict as coordinator product commit `97c9ad1aad2638609168a8e1901b61b5ba671def`. Three coordinator-approved seam transfers remained minimal: joined safe Library/installation projection, explicit project `unknownPluginIds`, and disable-only removal for an already selected unknown ID. No Main route, registry, Pi, or Package Store source was otherwise expanded. ## Outcome - MLM-00 completed. The coordinator unit is isolated from the exact accepted P0 evidence head, both documentation gates pass, semantic overlap is clear, and no client product file changed before opening MLM-01. - The official platform public key is not present and remains a production activation input; the parser/signature implementation and injected-key acceptance still proceed. - No push, PR, deployment, production key generation, or publication was attempted. - MLM-01 delivered schema-1 compatibility, closed schema-2 `skill_only` and declarative `platform_hosted` parsing, bounded JSON Schema validation, fixed release descriptor bytes, Ed25519 verification, compatibility/provenance checks, and a code-owned production trust seam. The official Ed25519 public key remains absent, so the production activation hold is preserved and the default trust store fails closed; no production private key or runtime key override was added. - MLM-02 delivered the bounded authenticated Marketplace client, session/account cache, and atomic immutable Package Store. Acquisition and download remain separate from project enablement, Agent assignment, runtime authorization, and billing; distributed packages are descriptor/signature/size/SHA/schema/client-range verified before an atomic index switch, and install failure preserves the previous release. Account A/B snapshots remain isolated and logout/account switch invalidates them. The official public key activation hold remains unchanged. - MLM-03 delivered one effective installed-plugin resolver, Main-owned Marketplace routes, and a frozen parent-worker snapshot shared across resource loading, Extension Host, tool declarations, CLI/context, and runtime authorization. Child workers remain empty; active Releases are registered for Package Store cleanup; old workers reject new plugin actions after invalidation. Unknown or uninstalled Skill assignments remain in project/Agent configuration but do not enter runtime projections, and automatically become effective again when the trusted package source returns. - MLM-04 delivered global Marketplace and My Plugins pages plus the joined Project Plugins state. The four user actions remain distinct and call only their matching Main route; fresh installation/account projection, stale/error states, retained unknown project IDs, typed Data Service settings, account/project generation, and mutation epochs are bounded in Renderer state. No account, filesystem path, Release Admission, token, or signed URL authority enters Renderer. ## Verification - `git rev-parse HEAD` returned exact `1ca8deb54b7b530ab8c5b6a5b7e613730c3b97ec`; ancestry of reviewed product head `78fb7d7...` passed. The only initial status entry was this task record. - `corepack pnpm --version` reported the repository-pinned `10.33.4`. - This fresh worktree lacked dependencies, so `corepack pnpm install --frozen-lockfile` restored the locked 997-package graph entirely from the package store; no source or lockfile changed. - `corepack pnpm run typecheck` passed. - The ten-file manifest/capability-policy/project-selection/Pi/Host/Plugin Center baseline passed `68 passed, 2 skipped` (`70` total) in 10.27 seconds with one worker. The two skips are the existing staged-runtime gates. - The run was proportionate: a type/parser/registry/Pi failure would have stopped MLM-01 because schema-v2 primitives cannot safely extend a broken claimed P0 base. - MLM-01 source verification passed the complete repository suite (`1713 passed`, `2 skipped`) plus the single-worker pressure case (`1 passed`), typecheck, lint, Vite build, documentation drift, and task-context completion. Source parent, clean status, changed-file ownership, and `ready_for_integration` status were independently verified before integration. - MLM-02 source verification passed focused `14`, adjacent parser/contract `43`, full Vitest `1727 passed, 2 skipped`, and the pressure case `1 passed`, plus typecheck, owned/full lint (zero errors and five pre-existing warnings), Vite build, diff/doc gates, and task-context completion. Its exact sole parent, five owned paths, clean status, and `READY_FOR_INTEGRATION` state were independently verified before cherry-pick. - MLM-03 verification passed 142 focused/adjacent tests with two staged-runtime skips, full Vitest `1738 passed, 2 skipped`, the pressure case, typecheck, lint with zero errors and five unchanged warnings, Vite build, Windows package, Windows and Pi artifact verification, publish-runtime verification, diff/doc gates, and task-context completion. The Windows installer embedded exact source HEAD `7ad6b8c...`; production signing, real Provider, macOS, and native Linux activation evidence remain explicit external/platform holds rather than passes. - MLM-04 verification passed 73 focused/adjacent tests across 12 files, typecheck, lint with zero errors and five unchanged warnings, Vite build, two Marketplace/ Project Plugins Electron Playwright cases, six Windows Electron Vitest cases, and documentation drift. Its task record also captured the actual interface-polish Before/After changes: bounded hit targets, explicit transitions, wrapping, and tabular dynamic values within the existing design system. ## Follow-ups - None recorded. ## Promotion Candidates - After MLM-06 review and XMA-01, promote the Marketplace Main/Package Store/effective resolver chain into `.project-docs/20-architecture/module-map.md` and `data-flow.md`, including account cache, immutable installation, frozen worker snapshot, and lifecycle invalidation. - Refresh `.project-docs/30-worklog/current-state.md` and `.project-docs/40-domain/business-rules.md` with the separation between Account Library, Device Installation, project enablement, Agent assignment, runtime authorization, and billing; retain the official public-key activation hold. - Add the final MLM-05/MLM-06/XMA-01 evidence to the evidence index only after live acceptance; repository package/tests must not be promoted as signed-in live proof.