2026-07-01 MEXP09B 像素消费

用户目标

以 Coder@m4c 身份完成 P-20260701-mexp09b-target-frame-pixel-payload 下的 M4C-MEXP09B-01：消费 Mindraw 已完成的 target Frame PNG pixel payload，把目标 Frame-only PNG 作为真实图片输入交给 vision-capable agent / model，同时保证 m4c 的 sanitized report 不泄漏 raw bytes、dataURL、token、endpoint、runtime path 或 Frame 外内容。

已完成事项

在 m4c m4c-frame-link-agent-resolver.mjs 中新增 resolve-pixel / smoke-pixel。
在 m4c MCP stdio server 中新增 tool：resolve_mindraw_target_frame_pixel_payload。
消费 Mindraw targetFramePixelPayload="read" 与 JSON-RPC mindraw.app.get_target_frame_pixel_payload。
校验 target Frame-only PNG payload 的 mimeType、尺寸、byteLength、SHA、pixelsIncluded=true、bytesIncluded=true 和 pixelScopeAudit。
将 raw PNG dataURL 仅作为内存 vision input 通道使用；sanitized package、MCP response、QA JSON 和长期文档只保存 metadata / SHA / scope audit / redacted placeholder。
补 m4c 正式 QA 清单、CODEGRAPH、INDEX、C3.tools README、K2 项目管理索引。
回写主项目统一台账，把 M4C-MEXP09B-01 标记为完成，并将下一步归属设为 PM-MEXP09B-GATE。

核心事实 / 变更快照

变更对象：m4c frame link resolver / MCP server。
事实来源：
/Users/ar/Projects/ExcalidrawX/p.mindrawforcodex/03-O/C3.tools/scripts/m4c-frame-link-agent-resolver.mjs
/Users/ar/Projects/ExcalidrawX/p.mindrawforcodex/03-O/C3.tools/scripts/m4c-frame-link-mcp-server.mjs
/Users/ar/Projects/ExcalidrawX/p.mindrawforcodex/03-O/K2.项目管理/联调QA/2026-07-01-M4C-MEXP09B-01TargetFramePixelPayload.md
变更前：m4c MEXP09 visual package 只能证明 frame-only scope 和 metadata-only visual package，不能证明 agent 实际收到 target Frame PNG 像素。
变更后：
CLI 入口：resolve-pixel
CLI smoke：smoke-pixel
MCP tool：resolve_mindraw_target_frame_pixel_payload
agent-facing package 包含 visionInput.channel="in-memory-data-url"、dataUrlAvailableForModel=true、dataUrlIncludedInSanitizedPackage=false。
raw dataURL / raw bytes 不进入长期报告。
验证证据：
m4c-mexp09b-01-pixel-payload-consumer.json
m4c-mexp09b-01-live-gate-attempt.json
m4c-mexp09b-01-mcp-stdio.jsonl
敏感扫描 findings=[]

文件变更

/Users/ar/Projects/ExcalidrawX/p.mindrawforcodex/03-O/C3.tools/scripts/m4c-frame-link-agent-resolver.mjs
/Users/ar/Projects/ExcalidrawX/p.mindrawforcodex/03-O/C3.tools/scripts/m4c-frame-link-mcp-server.mjs
/Users/ar/Projects/ExcalidrawX/p.mindrawforcodex/03-O/C3.tools/README.md
/Users/ar/Projects/ExcalidrawX/p.mindrawforcodex/03-O/C1.source/CODEGRAPH.md
/Users/ar/Projects/ExcalidrawX/p.mindrawforcodex/INDEX.md
/Users/ar/Projects/ExcalidrawX/p.mindrawforcodex/03-O/K2.项目管理/README.md
/Users/ar/Projects/ExcalidrawX/p.mindrawforcodex/03-O/K2.项目管理/联调QA/2026-07-01-M4C-MEXP09B-01TargetFramePixelPayload.md
/Users/ar/Projects/ExcalidrawX/02-P/plan-progress.markdown

可复用命令 / Runbook

用途：复跑 m4c target Frame pixel payload consumer、MCP stdio 和敏感信息扫描。

前置条件：Mindraw runtime 已刷新并暴露 targetFramePixelPayload="read"；若无 live runtime，可先跑 fixture / smoke。

node --check /Users/ar/Projects/ExcalidrawX/p.mindrawforcodex/03-O/C3.tools/scripts/m4c-frame-link-agent-resolver.mjs
node --check /Users/ar/Projects/ExcalidrawX/p.mindrawforcodex/03-O/C3.tools/scripts/m4c-frame-link-mcp-server.mjs
node /Users/ar/Projects/ExcalidrawX/p.mindrawforcodex/03-O/C3.tools/scripts/m4c-frame-link-agent-resolver.mjs smoke-pixel --report /Users/ar/Projects/ExcalidrawX/p.mindrawforcodex/02-P/MEXP09B-TargetFramePixelPayload/qa/m4c-mexp09b-01-pixel-payload-consumer.json
node /Users/ar/Projects/ExcalidrawX/p.mindrawforcodex/03-O/C3.tools/scripts/m4c-frame-link-agent-resolver.mjs resolve-pixel --input 'mindraw://localhost?documentId=mdoc_mexp09_gate_visual_context_20260701&elementId=frame_mexp09_gate_target' --out /Users/ar/Projects/ExcalidrawX/p.mindrawforcodex/02-P/MEXP09B-TargetFramePixelPayload/qa/m4c-mexp09b-01-live-gate-attempt.json

敏感扫描：

python3 - <<'PY'
from pathlib import Path
root=Path('/Users/ar/Projects/ExcalidrawX/p.mindrawforcodex/02-P/MEXP09B-TargetFramePixelPayload/qa')
needles=['data:image','base64,','Authorization:','Bearer ','127.0.0.1:','write-api.json','BEGIN PRIVATE KEY','.p12','api_key','app-specific password','payload.dataURL']
findings=[]
for p in root.glob('*'):
    if p.is_file():
        s=p.read_text(errors='ignore')
        for n in needles:
            if n in s:
                findings.append((str(p), n))
print({'files':len([p for p in root.glob('*') if p.is_file()]), 'findings':findings})
raise SystemExit(1 if findings else 0)
PY

未决问题 / 下一步

下一步归属 PM：执行 PM-MEXP09B-GATE。
PM Gate 仍需用用户节奏的真实截图任务验证 agent 是否能描述 UI 细节。
m4c worker 不自行收敛 Gate，不恢复 MEXP10 / release Gate。