edit | blame | history | raw

M4C-EDC-05 Project-Scoped Preview Service

日期：2026-07-08
项目：Mindraw / P2.mindrawforcodex
任务：M4C-EDC-05
计划：P-20260707-signed-notarized-dmg

用户目标

处理 CM1 上发现的跨项目 stale canvas blocker：在全新空项目执行 Open the Mindraw canvas for this project. 后，点击 编辑 / Edit 打开了上一轮实验遗留的有内容 .mindraw。要求只在 m4c plugin / sidebar / service 范围修复，不改 Mindraw 主 App、DMG、签名、公证或 release metadata，不实现 arbitrary target-link entry。

已处理事项

  • 将 Mindraw Codex plugin 提升到 0.1.3+codex.20260708220005，cachebuster 对应 M4C-EDC-05。
  • m4c sidebar service URL 改为 project-scoped：http://127.0.0.1:<port>/?project=<hash>。
  • /api/state、/api/preview、/api/open-edit 校验 request project hash，不匹配时 fail-closed：MINDRAW_PROJECT_CONTEXT_MISMATCH。
  • /api/open-edit 打开前校验 latest canvas canonical path 必须位于当前 project root 的 MindrawCanvas/ 下。
  • service 启动时通过 /api/identity 区分同项目 service 与其他项目 / 未知固定端口占用；其他项目占用 43227 时使用下一可用端口。
  • /Users/ar/plugins/mindraw 保持 symlink adapter，source 与 installed cache、packaged install source 已对齐。
  • 生成 M4C-EDC-05 candidate、报告、机器可读摘要和 Review Request。

核心事实 / 变更快照

  • 变更对象：Mindraw Codex plugin mindraw-canvas-service.mjs、start-canvas.sh、README、skill wording、plugin manifest。
  • 事实来源：
  • Canonical source：/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/
  • Adapter：/Users/ar/plugins/mindraw
  • Installed cache：/Users/ar/.codex/plugins/cache/personal/mindraw/0.1.3+codex.20260708220005
  • Candidate root：/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C2.builds/MEXP15-SignedNotarizedDMG/mindraw-plugin-0.1.3+codex.20260708220005-M4C-EDC-05-20260708221159/
  • 变更前：sidebar service 默认固定端口 43227，API 未绑定 project context；Codex sidebar 复用旧 URL 时可能将新项目 Edit 发给旧项目 service。
  • 变更后：service URL 和 API 均绑定 project hash；mismatched context 返回 409；open/edit 强制 latest canvas 在当前项目 MindrawCanvas/ 下；启动遇到其他项目固定端口服务时跳到下一端口。
  • 不变边界：不改 Mindraw 主 App，不写 .mindraw internals，不做 target-link entry，preview 继续 fail-closed。
  • Candidate tarball SHA256：deefeaab12a4949052c6b154ca23d9e7b14a2f85bed9809a84efd3dfaab672c2
  • Source / packaged relative tree list file SHA256：6e4371e50568d2f9030077f5de7a24d9ce54489abe6111ffea2dbe4805b268be
  • Review Gate：crg-7b229c2a68c8，状态 pending REVIEW-M4C-EDC-05。

文件变更

  • Canonical plugin source：
  • /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/.codex-plugin/plugin.json
  • /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/scripts/mindraw-canvas-service.mjs
  • /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/scripts/start-canvas.sh
  • /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/README.md
  • /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/skills/mindraw-open-canvas/SKILL.md
  • Process records：
  • /Users/ar/Projects/Mindraw/P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-05-project-scoped-preview-service-check-20260708.md
  • /Users/ar/Projects/Mindraw/P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-05-project-scoped-preview-service-check-20260708.json
  • /Users/ar/Projects/Mindraw/P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-05-review-request-crg-7b229c2a68c8.md
  • /Users/ar/Projects/Mindraw/P2.mindrawforcodex/INDEX.md
  • /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/CODEGRAPH.md
  • /Users/ar/Projects/Mindraw/INDEX.md
  • /Users/ar/Projects/Mindraw/02-P/plan-progress.markdown
  • Candidate package:
  • /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C2.builds/MEXP15-SignedNotarizedDMG/mindraw-plugin-0.1.3+codex.20260708220005-M4C-EDC-05-20260708221159/

验证证据

  • Source / installed / packaged validator、npm run check、smoke、HTTP、lifecycle、MCP、sidebar smoke 均退出 0。
  • lifecycle smoke 覆盖 project-scoped service avoids stale fixed-port project and rejects mismatched sidebar context。
  • HTTP smoke 覆盖 open-edit fails closed when sidebar project context does not match the service project。
  • shasum -a 256 -c SHA256SUMS.txt 对 candidate root 通过。
  • SkillSpector skill-dir：SAFE / LOW / score=0。
  • SkillSpector plugin-root：CAUTION / MEDIUM / score=21 / TM1 scripts/mindraw-canvas-service.mjs:6，需 review 接受。
  • Sensitive scan：无配置的 secret/key token pattern 命中。

可复用命令 / Runbook

用途：复跑 M4C-EDC-05 m4c plugin project-scoped sidebar service 关键验证。

前置条件：当前 canonical source 为 /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin；Playwright 依赖来自 Codex primary runtime。

设置和验证命令：

npm run --prefix /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin check
PYTHONPATH=/tmp/mindraw-m4c-validator-pyyaml python3 /Users/ar/.codex/skills/.system/plugin-creator/scripts/validate_plugin.py /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin
node /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/scripts/mindraw-canvas-service.mjs smoke-lifecycle --report /Users/ar/Projects/Mindraw/P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-05-smoke-lifecycle-source-20260708.json
node /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/scripts/mindraw-canvas-service.mjs smoke-http --report /Users/ar/Projects/Mindraw/P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-05-smoke-http-source-20260708.json
PLAYWRIGHT_NODE_MODULES=/Users/ar/.cache/codex-runtimes/codex-primary-runtime/dependencies/node/node_modules node /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/scripts/mindraw-canvas-service.mjs smoke-sidebar --report /Users/ar/Projects/Mindraw/P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-05-smoke-sidebar-source-20260708.json --out /Users/ar/Projects/Mindraw/P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-05-sidebar-source
shasum -a 256 -c /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C2.builds/MEXP15-SignedNotarizedDMG/mindraw-plugin-0.1.3+codex.20260708220005-M4C-EDC-05-20260708221159/SHA256SUMS.txt

清理 / 恢复：candidate marketplace add/remove 证据已在 candidate plugin/evidence/ 中保存；若本机需要回退 plugin，可重新安装上一版 M4C-EDC-04 install source 或按 candidate plugin/rollback-plugin.md remove-only 处理。

搜索关键词：M4C-EDC-05、MINDRAW_PROJECT_CONTEXT_MISMATCH、project-scoped service、0.1.3+codex.20260708220005、crg-7b229c2a68c8。

未决问题

  • REVIEW-M4C-EDC-05 尚未回写 crg-7b229c2a68c8 的通过或阻塞结论。
  • CM1 真实路径需要在 review gate 处理后再安排复验。
  • P2 C1.source/mindraw-plugin/ 仍是既有 untracked source snapshot，长期 source freeze / clean archival 仍应由 PMO 后续收敛。

后续建议

  • PMO 先派代码审核员处理 crg-7b229c2a68c8。
  • 复核通过后，再让 Owner / QA 在 CM1 关闭旧 sidebar tab、按新版 project-scoped URL 重新执行新空项目路径。