wangxuming/makelore
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
898e2b7bdde4bdd77a5659d7b4e294d0607656e3
makelore/.project-docs/30-worklog/tasks/20260828-plugin-mlm01-5c8d1e4f.md

8.2 KiB
Raw Blame History

Task: Marketplace MLM-01 package selection and signature trust

Identity

  • Task ID: 20260828-plugin-mlm01-5c8d1e4f
  • Mode: Feature
  • Branch: codex/20260828-plugin-mlm01-5c8d1e4f-mlm01-package-trust
  • Worktree: D:\Datas\OthersProjects\makelore-plugin-marketplace-client-mlm01-5c8d1e4f
  • Base commit: 4d8b1fcec0
  • Owner: codex-mlm01
  • Status: Ready for Integration

Scope

  • Implement ticket MLM-01 from the exact Marketplace Release A client frontier: schema-v2 declarative package parsing, bounded hosted/skill-only definitions, fixed release-descriptor serialization, Ed25519 verification, strict SemVer client-range checks, and the code-owned production trust-store seam.
  • Own only shared/coding-plugins.ts, electron/coding-plugins/manifest.ts, the new descriptor/signature/trusted-key modules, focused fixtures/tests for those modules, and this task record.
  • Do not touch marketplace/network clients, Package Store, account/project services, Pi/Host/Renderer consumers, server/Operations code, hosted runtime, billing, or Release B tickets.

Project Context Loaded

  • Concurrent Task Gate passed after check_project_docs.py; task_context.py start and status --json match this task ID, owner, isolated worktree, branch, mode, and exact base.
  • Planning Gate passed after reading AGENTS.md, the mandatory project-memory startup set, relevant architecture/domain/evidence/reflection/commitment/stale records, the Marketplace implementation spec sections 1-6, 10.1, 13.2-13.3, the full ticket graph MLM-01, the accepted Marketplace design sections 6, 11.2-11.5, 14, and 18.3, and peer task records for the coordinator and prior P0 package/policy/runtime work.
  • Current integrated memory is a historical snapshot and predates Marketplace; the exact implementation spec, ticket graph, design authority, and coordinator frontier are authoritative. The prior P0 parser is the compatibility baseline, not a source branch to merge or modify.
  • Other active local owners are the Marketplace client coordinator and historical P0/review tasks in separate worktrees. Their records identify no semantic conflict with this isolated parser/trust scope. The coordinator owns only integration/documentation and later Marketplace tickets; MLM-02 owns the network/Package Store files after this handoff.

Intent And Constraints

  • Preserve schema-1 bundled compatibility exactly, including code-owned adapter, settings, and preview privilege allowlists; schema-2 packages cannot name any such privilege and cannot narrow arbitrary strings into code-owned IDs.
  • Accept only the closed schema-2 vocabulary: skill_only with empty tools and grants, or declarative platform_hosted with protocol makelore-hosted.v1, namespaced permissions, closed bounded input/output schemas, and projectWriteLease=false. Parsing does not execute package files or implement hosted runtime.
  • Reject unknown object fields/components/paths, malformed or unbounded JSON Schema, duplicate tool/capability mappings, unsupported local execution, invalid identifiers, and schema-v2 adapter/settings/preview claims with stable validation failures.
  • Build the exact compact, fixed-order release descriptor bytes from the closed shape and verify descriptor identity, artifact size/SHA-256, Ed25519 signature, known key ID, and MakeLore compatibility range. No generic canonicalizer is introduced.
  • Production trust is code-owned and fail-closed when the official public key is absent. No environment/runtime public-key override and no production private key are allowed. Ephemeral keys may be injected only through test/service dependencies.
  • Keep parsed definitions immutable and distinguish trusted Package Store provenance from manifest self-assertion. Do not add network, install, index, account, project, registry, Pi, Host, Renderer, billing, or Release B behavior.

Implementation Plan

  1. Inspect the exact base parser, shared contracts, package-resource path helpers, and existing test conventions; identify compatibility seams without editing.
  2. Add red focused tests for schema-v2 golden/invalid cases, bounded schema validation, immutable provenance, descriptor byte order/identity and digest, compatibility ranges, key lookup/fail-closed trust, and Ed25519 failure modes.
  3. Implement the smallest cohesive shared definitions and parser/descriptor/ signature/trusted-key modules within the ownership boundary.
  4. Run the owned focused suite, relevant existing manifest/package regressions, typecheck, scoped/full lint, and diff/doc gates; investigate only failures attributable to this ticket.
  5. Update this record with the actual outcome and verification ledger, run task-aware drift, complete task_context.py, and return one clean source commit whose sole parent is the exact dispatch base.

Outcome

  • Implemented MLM-01 from the exact 4d8b1fcec0a751d2935effc7816c7e59f568ec65 frontier. Schema 1 remains bundled/Data Service compatible while schema 2 now parses immutable skill_only and declarative platform_hosted definitions, including the closed bounded JSON Schema subset, hosted permission namespace, tool/operation uniqueness, and trusted package metadata.
  • Added the fixed compact release descriptor serializer/parser, strict SemVer range comparison, Ed25519 descriptor verifier, and a code-owned fail-closed signing-key loader. Injected key stores remain an explicit test/service seam; no environment key override or production private key was added.
  • The official MakeLore Ed25519 public key has not been supplied. Production signing activation therefore remains an explicit hold represented by the empty code-owned trust table and PLUGIN_SIGNING_KEY_ACTIVATION_HOLD; injected-key verification is covered and is not presented as production activation.
  • No network, Package Store, account/project, registry, Pi/Host, Renderer, billing, hosted runtime, server, Operations, or Release B code was changed.

Verification

  • Before each check, the concrete failure and follow-up action were defined:
    • check_project_docs.py: detect malformed/missing project-docs concurrency assets; PASS before planning and implementation.
    • task_context.py status --json: detect owner/base/worktree/branch drift; PASS for this task and exact dispatch base.
    • Initial focused red run: detect missing contract modules; it failed as expected before implementation, then became green after the modules landed.
    • vitest run tests/unit/coding-plugin-marketplace-contract.test.ts: detect schema/descriptor/trust regressions; PASS, 19 tests.
    • Existing manifest/Data Service/Pi resource suite: detect schema-1 and packaged-resource regressions; PASS, 4 files/46 tests.
    • Registry/adapter/Pi extension host/bundle/tool suite: detect shared contract projection regressions; PASS, 5 files/39 tests.
    • pnpm run typecheck: detect TypeScript contract/import errors; PASS.
    • Scoped ESLint: one empty-interface error was fixed in the task-owned manifest options type; rerun PASS with no errors.
    • pnpm run lint:check: detect repository lint errors; PASS with five pre-existing React warnings and zero errors.
    • pnpm run build:vite: detect renderer/Electron build regressions from the shared contract changes; PASS with only the repository's existing chunk and dynamic-import warnings.
    • pnpm test: detect cross-repository client unit regressions; PASS, 202 test files/1713 passed/2 skipped, followed by pressure suite 1/1.
    • git diff --check: detect whitespace/boundary corruption; PASS.
  • Final task-aware check_doc_drift.py and task_context.py complete are the remaining handoff gates and will be run before the source commit.

Follow-ups

  • Supply the official platform Ed25519 public key through the code-owned release resource before production activation; keep the deployment private key only in the Works Square deployment secret.
  • MLM-02 may consume these primitives after this single source commit is merged into the client coordinator frontier; its Package Store must compare requested Release metadata before atomically installing bytes.

Promotion Candidates

  • None. This feature task did not modify canonical project memory or accepted decisions.