# Task: Implement ML-02 plugin policy registry

## Identity

- Task ID: 20260827-plugin-ml02-policy-registry-3f7b2c91
- Mode: Feature
- Branch: codex/20260827-plugin-ml02-policy-registry-3f7b2c91-plugin-ml02-policy-registry
- Worktree: D:\Datas\OthersProjects\makelore-plugin-ml02-policy-registry-3f7b2c91
- Base commit: d9c9a2b0dd8fd495c6aa5a0994598192ad9c8e58
- Owner: codex-ml02
- Status: Ready for Integration

## Scope

- Implement ML-02 from exact frontier `d9c9a2b0dd8fd495c6aa5a0994598192ad9c8e58`:
  - strict policy catalog client with exact parsing, join, coalesced refresh, and
    current/stale/unavailable state;
  - capability registry and trusted `makelore-capability.v1` envelope;
  - in-process Data Service adapter and generic Pi product-tool delegation;
  - bounded capability/billing/conversation contracts and ten-tool regression
    coverage.
- Owned product/test files are exactly the ML-02 ticket list, plus the one-time
  coordinator-approved ownership transfer for the envelope display branch in
  `src/pages/Chat/CodingConversationTimeline.tsx`; this task record is the only
  project-document file owned by this task.

## Intent And Constraints

- Follow implementation spec sections 5.3 and 7.1, 7.3-7.4 and ticket ML-02.
- Consume ML-01 exported definitions/project-service seams and the frozen WS-02
  catalog DTO. Do not modify worker materialization/CLI, Host routes, preview
  sessions, other Renderer files, or files owned by other tickets. The
  coordinator explicitly transferred only the `ToolDetails` envelope
  discriminator/display branch in `CodingConversationTimeline.tsx` to ML-02.
- Preserve typed Data Service routes and Main-owned identity/credentials. No
  generic invoke/config/ledger, P1 paid policy, Plugin Credits, marketplace,
  arbitrary code/MCP/hooks, or publication coupling.
- Use `runId` + `resourceId` for deterministic Pi request IDs with no UUID fallback;
  client code cannot manufacture server billing receipts and included calls make
  no Token Point transaction.

## Project Context Loaded

- Concurrent Task Gate passed after `check_project_docs.py`; task identity,
  isolated worktree, branch, owner, and base match the Git-common owner record.
- Planning Gate passed. Required entry, positioning, integrated state, decisions,
  architecture/data-flow, domain, evidence, reflection, commitments, and stale
  context were read. The positioning file is still the repository template, and
  integrated memory predates this plugin feature; the accepted implementation
  spec, ticket graph, ML-01 peer record, and coordinator frontier are authoritative
  for this task.
- Other same-repository active scopes are the client coordinator and ML-01 source
  task. ML-01 is ready for integration and owns package/selection files only;
  client coordinator owns integration and later tickets. The initial Renderer
  ownership conflict was explicitly resolved by a one-file, one-branch transfer
  from the coordinator; no remaining semantic conflict or file overlap exists.
- Cross-repository WS-02 is consumed as a frozen input: schema version 1, one
  `makelore.data-service` plugin, three capabilities/fourteen operations, and
  `platform_metered` unavailable projected as `billing_unavailable`.

## Implementation Plan

1. Inspect existing Data Service/Pi/conversation seams and ML-01 definitions.
2. Add contract types, strict parser/client state, registry/adaptor, and generic
   Pi delegation with tests first where practical.
3. Migrate conversation detail/result unions and the transferred timeline
   consumer to the bounded capability envelope while preserving
   `data-service.v1` only as the payload schema and retaining whitelisted context.
4. Run owned focused tests, relevant existing regressions, typecheck, scoped/full
   lint, diff/doc gates; update this record and produce one implementation commit.

## Outcome

- Implemented the strict Plugin Policy catalog client with exact DTO parsing,
  coalesced refresh, and current/stale/unavailable state preservation.
- Implemented the bundled capability registry with exact policy joins,
  package/selection/Skill/role/policy admission and invoke revalidation, child
  plugin-empty behavior, and trusted `makelore-capability.v1` envelopes.
- Added the in-process Data Service adapter for all ten contract operations and
  moved Pi product-tool delegation to the registry while preserving core tools
  and the compatibility fallback.
- Added bounded billing receipts, result/conversation contracts, deterministic
  `pi:${runId}:${resourceId}` request IDs, domain-fault context handling, and
  focused regression coverage.
- No P1 paid policy, generic invoke/config/ledger, credits, marketplace,
  arbitrary code/MCP/hooks, publication coupling, or out-of-scope file changes
  were introduced. The coordinator-approved one-file Renderer ownership
  transfer was used only for the envelope discriminator/display adaptation.

## Verification

- Owned focused suite: 5 files, 38 passed.
- Transferred Renderer timeline focused suite: 1 file, 4 passed.
- Relevant existing regressions: 8 files, 62 passed, 2 skipped.
- Full test command: 193 files, 1,642 passed, 2 skipped; isolated pressure
  test: 1 passed.
- Owned-file ESLint (including the transferred timeline) and full `lint:check`:
  0 errors; full lint reports only
  the 5 pre-existing warnings in `src/pages/Home/index.tsx` and
  `src/pages/Makelore/index.tsx`.
- `git diff --check` passed.
- Typecheck passed after replacing the transferred Renderer consumer's stale
  `data-service.v1` discriminator with the bounded
  `makelore-capability.v1` envelope branch.
- Task-aware documentation drift check and `task_context complete` remain
  completion gates.

## Follow-ups

- No downstream follow-up remains for the transferred timeline branch: it now
  consumes `makelore-capability.v1`, while `data-service.v1` remains only the
  nested payload schema for the Data Service adapter.

## Promotion Candidates

- None. The implementation follows the accepted plugin-platform spec and
  frozen WS-02 catalog contract without proposing canonical project-memory
  changes.