edit | blame | history | raw

REVIEW-M4C-EDC-04 代码复核

用户目标

PMO 派工 REVIEW-M4C-EDC-04，要求代码审核员只读复核 M4C-EDC-04 m4c plugin source / installed cache / packaged candidate，并对同一 Review Gate ID crg-9f1b6d5a4c28 回写 PASS / CHANGES_REQUESTED / BLOCKED 之一。

边界：不修改插件源码、installed cache、candidate package、Mindraw App DMG / 签名 / 公证产物；不替代 CM1 fresh-machine 复测、PMO Gate、用户验收或公开分发判断。

已完成事项

  • 读取并遵守 AGENTS.md、INDEX.md、02-P/plan-progress.markdown 中 P-20260707-signed-notarized-dmg、M4C-EDC-04 review request、自查 Markdown / JSON、P2 INDEX.md、P2 03-O/C1.source/CODEGRAPH.md 与 ~/.codex/rules/code-governance.md。
  • 只读核对 source / installed cache / packaged candidate 的关键源码、文档、manifest、smoke evidence、SkillSpector evidence、sensitive scan、candidate manifest / SHA、marketplace add/remove evidence。
  • 以 Review Gate ID: crg-9f1b6d5a4c28 回写代码复核结论：PASS。
  • 更新 /Users/ar/Projects/Mindraw/02-P/plan-progress.markdown 中 MEXP15 状态、M4C-EDC-04 / REVIEW-M4C-EDC-04 任务卡和 Progress Log。

核心事实 / 变更快照

  • 变更对象：M4C-EDC-04 m4c create bootstrap fallback 复核结论。
  • 事实来源：
  • Source root: /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin
  • Installed cache: /Users/ar/.codex/plugins/cache/personal/mindraw/0.1.2+codex.20260708194340
  • Candidate root: /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C2.builds/MEXP15-SignedNotarizedDMG/mindraw-plugin-0.1.2+codex.20260708194340-M4C-EDC-04-20260708194915/
  • Review request: /Users/ar/Projects/Mindraw/P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-04-review-request-crg-9f1b6d5a4c28.md
  • Self-check: /Users/ar/Projects/Mindraw/P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-04-create-bootstrap-fallback-check-20260708.md / .json
  • 变更前：P-20260707-signed-notarized-dmg 状态为 Blocked / CM1 fresh create API blocker / M4C-EDC-04 M4C_FIX_READY / REVIEW-M4C-EDC-04 active，Review Gate crg-9f1b6d5a4c28 等待代码复核。
  • 变更后：P-20260707-signed-notarized-dmg 状态为 Blocked / CM1 fresh create API blocker / REVIEW-M4C-EDC-04 PASS / pending CM1 recheck，Review Gate crg-9f1b6d5a4c28=PASS。
  • 关键结论：
  • Missing runtime capability file 时，create path 仅通过 macOS LaunchServices cold-launch Mindraw、等待 createBlankPackage capability 后重试 mindraw.app.create_blank_package。
  • Capability file 存在但缺少 create method 时，代码路径返回 MINDRAW_CANVAS_CREATE_API_REQUIRED，不走 wait / retry。
  • Preview source-required 在 source / installed / packaged HTTP smoke 中均为 409 fail-closed，不显示 stale READY。
  • /api/open-edit 仍限定 latest-created .mindraw，未引入 arbitrary target-link。
  • 未发现直接写 .mindraw package internals 的运行时路径；registry / smoke harness 写入不等同于 package internals 写入。
  • SkillSpector plugin-root TM1 at scripts/mindraw-canvas-service.mjs:4 已人工接受，理由是该 import 用于本地 smoke / report harness 的临时目录、mock runtime、mock open command 与报告文件操作，不暴露运行时任意文件写入口。
  • 范围边界：本 PASS 只代表代码 / 证据复核通过；不代表 CM1 fresh-machine 复测、QA PASS、PMO Gate、用户验收、source freeze 或公开分发通过。P2 C1.source/mindraw-plugin/ 仍是既有 untracked source snapshot，C2.builds/* 仍按边界被 .gitignore 忽略。

验证证据

  • diff -qr：source vs installed 无输出；source vs packaged install-source 无输出。
  • Candidate SHA256SUMS.txt 校验通过。
  • Candidate tarball SHA256：6b454025d4ce23bf0862e638cdc7b0ca9a9930901a9039fdeb97efa0bfca9795。
  • Source / packaged relative tree list SHA256：52a2c81465252da65b9a90b1ae5b0994125a695e142957289f25295d3921fa16。
  • Source / installed / packaged npm run check 均退出 0。
  • Source / installed / packaged plugin validator 均通过。
  • Source / installed / packaged smoke、HTTP smoke、lifecycle、MCP、sidebar 报告均 ok=true。
  • Sensitive scan：无匹配 secret/key token pattern。

可复用命令 / Runbook

用途：复核 M4C-EDC-04 source / installed / packaged 一致性、候选包 SHA、HTTP smoke 关键断言和 capability fail-closed 路径。

前置条件：候选根目录存在，installed cache 为 0.1.2+codex.20260708194340，source root 为 P2 canonical plugin source。

diff -qr /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin /Users/ar/.codex/plugins/cache/personal/mindraw/0.1.2+codex.20260708194340
diff -qr /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C2.builds/MEXP15-SignedNotarizedDMG/mindraw-plugin-0.1.2+codex.20260708194340-M4C-EDC-04-20260708194915/plugin/install-source/plugins/mindraw
cd /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C2.builds/MEXP15-SignedNotarizedDMG/mindraw-plugin-0.1.2+codex.20260708194340-M4C-EDC-04-20260708194915 && shasum -a 256 -c SHA256SUMS.txt
npm run --prefix /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin check
npm run --prefix /Users/ar/.codex/plugins/cache/personal/mindraw/0.1.2+codex.20260708194340 check
npm run --prefix /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C2.builds/MEXP15-SignedNotarizedDMG/mindraw-plugin-0.1.2+codex.20260708194340-M4C-EDC-04-20260708194915/plugin/install-source/plugins/mindraw check
jq -r 'input_filename as $f | "FILE \($f)", "top_ok=\(.ok)", (.checks[] | "check=\(.name) ok=\(.ok) status=\(.state.status // .initialState.status // "") previewHttpStatus=\(.previewHttpStatus // "") fallback=\(.opened.fallbackUsed // .initialState.createResult.bootstrap.fallbackUsed // "") method=\(.opened.method // .initialState.createResult.bootstrap.method // "") reason=\(.opened.fallbackReason.reason // .initialState.createResult.bootstrap.fallbackReason.reason // "")")' /Users/ar/Projects/Mindraw/P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-04-smoke-http-source-20260708.json /Users/ar/Projects/Mindraw/P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-04-smoke-http-installed-20260708.json /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C2.builds/MEXP15-SignedNotarizedDMG/mindraw-plugin-0.1.2+codex.20260708194340-M4C-EDC-04-20260708194915/plugin/evidence/smoke-http-packaged.json

针对 capability file 存在但缺少 create method 的 fail-closed 复核：

node --input-type=module -e 'import { mkdtemp, writeFile } from "node:fs/promises"; import { tmpdir } from "node:os"; import { join } from "node:path"; import { inspectProjectCanvas } from "/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/lib/project-canvas.mjs"; const root = await mkdtemp(join(tmpdir(), "m4c-edc-04-review-")); const capabilityPath = join(root, "capability.json"); await writeFile(capabilityPath, JSON.stringify({ endpoint: "http://127.0.0.1:9", token: "review-redacted", capabilities: { previewSnapshot: "read", openPackage: "write" }, methods: ["mindraw.app.get_preview_snapshot", "mindraw.app.open_package"] })); const state = await inspectProjectCanvas({ projectRoot: root, createNew: true, capabilityPath, launchFallbackCommand: "/usr/bin/false" }); console.log(JSON.stringify({ status: state.status, ok: state.ok, createBlocker: state.createBlocker && { code: state.createBlocker.code, requiredCapability: state.createBlocker.requiredCapability, requiredMethod: state.createBlocker.requiredMethod, reason: state.createBlocker.reason ?? null }, latestCanvas: state.latestCanvas }, null, 2));'

预期关键输出：status 为 BLOCKED_MINDRAW_CANVAS_CREATE_API_REQUIRED，requiredCapability 为 createBlankPackage，reason 为 null。

文件变更

  • 修改：/Users/ar/Projects/Mindraw/02-P/plan-progress.markdown
  • 新增：/Users/ar/Projects/Mindraw/.codex-sessionhistory/2026-07-08-REVIEW-M4C-EDC-04.md
  • 更新：/Users/ar/Projects/Mindraw/.codex-sessionhistory/COMMANDS.md

未决问题 / 后续建议

  • PMO / QA / Owner 需要基于 crg-9f1b6d5a4c28=PASS 决定是否续派 CM1 fresh-machine 或 clean user 复测。
  • PMO / m4c 后续仍需处理 P2 C1.source/mindraw-plugin/ untracked source snapshot 与 C2.builds/* ignored artifact 的 source freeze / 长期归档边界。
  • 本记录不构成 QA PASS、PMO Gate、用户验收或公开分发通过。