makelore/.project-docs/30-worklog/tasks/20260827-plugin-ml07-remediation-5d8c2a71.md

Task: Remediate accepted MakeLore ML-07 review findings

Identity

• Task ID: 20260827-plugin-ml07-remediation-5d8c2a71
• Mode: Feature
• Branch: codex/20260827-plugin-ml07-remediation-5d8c2a71-plugin-ml07-remediation
• Worktree: D:\Datas\OthersProjects\makelore-plugin-ml07-remediation-5d8c2a71
• Base commit: 9407c67df2
• Owner: ml07-remediator
• Status: Ready for integration

Scope

• Remediate the ten accepted ML-07 fixed-range findings on exact reviewed head 9407c67df21c2f0f50bb0362c826fcff643d9d5f.
• Own only the product files and directly focused tests explicitly delegated by the coordinator: bundled plugin/Skill definitions, project/capability/Host projections, policy client, Pi product-tool seam, Renderer Plugin Center store and views, README, and focused package/runtime/conversation tests.
• Deliver one final remediation commit whose sole parent is the reviewed head.

Intent And Constraints

• Make the parsed fixed bundled package set the single production authority; preserve enablement, Agent assignment, backend configuration, and billing as independent states; join all three Data Service capabilities and fourteen operations exactly against policy.
• Remove the forbidden direct Data Service path from PiProductTools; keep the capability registry as the sole non-core invocation path and retain bounded stable request/fault semantics.
• Bound policy fetch plus body consumption, preserve preview/settings data on enable, prevent stale project-load commits, use the stable Coding Skill type, and update current-state README wording.
• Test first in focused behavior groups. Do not add generic plugin/P1 framework, compatibility layers, checksums, static fallback lists, or touch files outside the coordinator ownership list without stopping for an explicit transfer.
• Do not modify the user root worktree, push, open a PR, or spawn subagents.

Project Context Loaded

Task context:

• Task ID: 20260827-plugin-ml07-remediation-5d8c2a71
• Mode: Feature
• Branch: codex/20260827-plugin-ml07-remediation-5d8c2a71-plugin-ml07-remediation
• Worktree: D:\Datas\OthersProjects\makelore-plugin-ml07-remediation-5d8c2a71
• Base commit: 9407c67df21c2f0f50bb0362c826fcff643d9d5f
• Other active local tasks: the ML-07 Standards and Spec reviewers are read-only peers on the same head; ML-01 through ML-06 source tasks are ready for integration and the client coordinator owns only its integration branch/record.
• Overlap or semantic-conflict assessment: no unresolved conflict. This task is the coordinator-designated sole remediation owner; reviewers do not write product files and earlier ticket owners have completed their scopes.

Read:

• AGENTS.md; mandatory implement-spec and maintain-project-docs skills.
• .project-docs/05-agent-entry/{memory-index,read-before-planning,planning-gate}.md and the required project positioning/current state/decision/architecture/domain/ evidence/reflection/commitment/stale records.
• ADR-006, the active/coordinator/ML-01 through ML-07 peer task records, the plugin implementation spec §§3, 6-10.2, 12, ticket ML-07, and detailed design §§2, 5-9, 14, 17.

Relevant understanding:

• Project goal: preserve Pi as the sole Main-owned Coding runtime while adding one fixed first-party bundled plugin package with strict project and policy authority.
• Current integrated focus: canonical memory predates this unintegrated plugin branch; the frozen specification and exact reviewed head control this task.
• Active task scope: the ten accepted findings only, within the delegated file list.
• Active constraints: no generic invoke/config/ledger/marketplace/arbitrary code, no duplicated Skill/tool authority, no root-worktree writes.
• Decisions affecting this task: ADR-006 and the plugin spec require Main authority, dynamic worker resources, accepted/uncertain non-replay, and bounded product DTOs.
• Evidence, reflections, or commitments affecting this task: Windows package proof exists on the reviewed head; staged runtime skips and the historical unrelated E2E timeout must not be overstated as passes.
• Files or modules likely involved: the exact delegated shared definitions, manifest/registry/project service, policy client, composition/product services, Pi product-tools, Renderer plugin store/page/configuration selector, README, and directly corresponding unit/E2E tests.
• Unknowns, stale docs, or conflicts: the generic positioning template is stale; current-state memory does not include this branch. Neither changes the frozen contract. No semantic peer conflict is known.

Gate result:

• Passed on 2026-08-27.

Plan

1. Add red tests for startup parsed-definition authority, normalized equality, disabled retained Skill availability, exact policy join, and removal of the direct Data Service product-tool path; implement the smallest shared/Main fix.
2. Add red tests for stable request identity/fault propagation and bounded policy fetch+body deadline; change production only where failures expose defects.
3. Add red tests for ready-instance retention on enable, stable Skill typing, and out-of-order Renderer loads; implement the bounded lifecycle/UI fixes.
4. Update README inventory/enablement wording, run affected focused regressions, typecheck, lint, build, package proof, and broader relevant suites.
5. Record exact results, run documentation drift/completion gates, create one clean commit directly on the reviewed base, and return the test ledger/deviations.

Outcome

• Electron Main composition now synchronously loads and validates the fixed bundled package roots, freezes the parsed outer definition set, and injects that same set into project, capability, and package-Skill projections. Production no longer falls back to the shared duplicated definition catalog or a hard-coded package Skill path.
• Package operation ownership now includes the code-owned data-service.preview get/list/put/delete operations. The policy projection joins exactly three capabilities and fourteen operations; preview operations remain non-tool SDK operations, and Renderer displays each operation's joined billing/tool metadata.
• Plugin Skill availability is explicit across Product contracts, Host commands, worker runtime context, and the Agent selector. Disabled unassigned Skills are hidden, retained assignments remain selected/persisted but ineffective, and re-enable restores availability without a new assignment implicitly enabling the plugin. The genuine first-read legacy assignment migration remains intact.
• PiProductTools has no Data Service option, adapter, configure method, ten-name fallback, or fabricated billing envelope. All non-core tools use the capability registry. ProductCodingSkill and commands use CodingSkillId without the old unsafe cast.
• Policy refresh now places fetch, headers, and bounded body consumption under the existing deadline/abort seam and retains unknown/stale fallback semantics. Plugin Center loads use latest-generation commit guards, and enabling an already ready Data Service inspects before one atomic state commit while retaining its actual instance usage/settings.
• README now describes four core Skill roots plus the package-owned Data Service Skill and distinguishes project enablement from Agent assignment.

Verification

• Test-first red evidence initially exposed five failures: missing fourteen-operation normalization, stale A/B store success, missing ready-enable inspection, and unbounded never-settling policy headers/body. Later focused tests also exposed Host plugin-ID/Skill-ID mapping, command/runtime availability, and the unfrozen parsed outer definition set; all were fixed at their existing seams.
• Focused final suite: 10 files, 60 tests passed. It covers normalized sync/async package equality and freezing; exact three-capability/fourteen-operation mixed policy projection; Host/Renderer disabled-retained/re-enable behavior; ready instance retention; policy headers/body deadlines; A/B load ordering; and legacy assignment versus new assignment behavior.
• Request/fault evidence: a repeated registry invocation with the same run/resource (representing reconnect/event replay) preserves pi:run-a:resource-a; a real DataServiceCloudClient authoritative 401, one forced token refresh, operations, adapter, and registry invocation preserves that same ID. All ten Data Service tools route representative DataServiceOperations faults through the real adapter and registry into productToolDetailsOfResult, including quota context, actual/limit, current_revision, and retry_after_seconds.
• corepack pnpm test: 201 files / 1,679 passed / 2 skipped, followed by the pressure file 1 file / 1 passed (202 files / 1,680 passed / 2 skipped total).
• corepack pnpm run typecheck: passed.
• corepack pnpm exec eslint .: passed with zero errors and five pre-existing warnings in non-owned src/pages/Home/index.tsx and src/pages/Makelore/index.tsx.
• corepack pnpm run build: passed through Renderer/Main/Preload/utility builds, Pi runtime bundle, Windows unpacked artifact, and NSIS installer.
• node scripts/verify-pi-product-artifact.mjs --app-exe release/win-unpacked/Makelore.exe --samples 1 --timeout-ms 10000: result pass; package proof reports four core Skills and package-owned Data Service with ten tools and five package files. An earlier invocation used an unsupported --project-root argument and failed before verification; rerunning with the documented interface passed without a source/script change.

Follow-ups

• Coordinator will rerun the required integration ledger on the integrated commit.
• No full external-provider verification is claimed; the artifact verifier reports its existing Phase-0 platform/provider waivers separately from this remediation.

Promotion Candidates

• None recorded.