# REVIEW-EDC-04 代码复核

## 用户目标

以 Mindraw 代码审核员身份，按 `REVIEW-EDC-04` 对 `M4C-EDC-03` 的 m4c Codex plugin source / installed cache / candidate package 证据做正式代码复核，并对同一 Review Gate ID `crg-eda4493ea1b8` 回写 `PASS` / `CHANGES_REQUESTED` / `BLOCKED` 之一。

范围限定为 m4c/sidebar fallback 修复；不审 Mindraw App signed / notarized DMG artifact，不替代 fresh-machine 复测、PMO Gate、用户验收或公开分发判断。

## 已完成事项

- 读取并遵守入口和任务事实源：`AGENTS.md`、`INDEX.md`、`02-P/plan-progress.markdown` 中 `P-20260707-signed-notarized-dmg`、M4C-EDC-03 review request、自查 Markdown / JSON、P2 `INDEX.md`、P2 `03-O/C1.source/CODEGRAPH.md`。
- 复核 canonical source、installed cache、packaged candidate 三处的一致性和证据。
- 复核 `openCanvasInMindraw`、`/api/open-edit`、`/api/preview`、README、Skill 文案和 plugin manifest。
- 对 Review Gate `crg-eda4493ea1b8` 回写代码复核结论：`PASS`。
- 更新统一台账 `02-P/plan-progress.markdown` 的 MEXP15 任务卡和 Progress Log。

## 关键决策

- `crg-eda4493ea1b8=PASS`，仅代表代码 / 文档 / evidence 复核层面通过。
- SkillSpector plugin-root `CAUTION` / `TM1` 在本 review gate 中人工接受：命中点为 `scripts/mindraw-canvas-service.mjs:4` 的本地 smoke / report harness 文件操作 import；本轮新增 `chmod` 只用于临时 mock open command，不构成运行时任意文件写入入口。
- P2 `C1.source/mindraw-plugin/` 仍是既有 untracked source snapshot，`C2.builds/*` 被 `.gitignore` 忽略；这不阻塞本次行为复核，但仍是 source freeze / artifact archival 风险边界。

## 文件变更

- 修改：`/Users/ar/Projects/Mindraw/02-P/plan-progress.markdown`
  - MEXP15 状态更新为 `M4C-EDC-03 code review PASS / pending fresh-machine recheck`。
  - `M4C-EDC-03`、`REVIEW-EDC-04` 任务卡标记完成并注明 `crg-eda4493ea1b8=PASS`。
  - Progress Log 增加 `REVIEW-EDC-04` 正式复核记录。
- 新增：本会话记录 `/Users/ar/Projects/Mindraw/.codex-sessionhistory/2026-07-07-REVIEW-EDC-04.md`。
- 更新：命令索引 `/Users/ar/Projects/Mindraw/.codex-sessionhistory/COMMANDS.md`。

未修改 m4c plugin source、installed cache、candidate package、Mindraw App source、构建脚本、测试或产物。

## 核心事实 / 变更快照

- 变更对象：MEXP15 `REVIEW-EDC-04` / Review Gate `crg-eda4493ea1b8`。
- 事实来源：
  - `P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-03-review-request-crg-eda4493ea1b8.md`
  - `P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-03-sidebar-bootstrap-fallback-check-20260707.md`
  - `P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-03-sidebar-bootstrap-fallback-check-20260707.json`
  - `02-P/plan-progress.markdown`
- 变更前：`M4C-EDC-03` 为 `needs-code-review`，Review Gate `crg-eda4493ea1b8` pending；MEXP15 状态仍 blocked by fresh-machine sidebar bootstrap failure。
- 变更后：`M4C-EDC-03` 和 `REVIEW-EDC-04` 在代码复核层面完成，`crg-eda4493ea1b8=PASS`；MEXP15 仍需 fresh-machine 或 clean user 复测。
- 版本 / artifact：
  - Plugin version：`0.1.1+codex.20260707231339`
  - Candidate tarball SHA256：`9c196fdea953f316619ee321897e1ac4d2c4b030ef017737fc3597acd226d3ee`
  - Source / packaged relative tree list SHA256：`270cf4df0ceb80ff988db9e83956b6898003d2081a0f0e3b69cb52f941733a03`
- 范围边界：本 PASS 不等于 fresh-machine 复测、PMO Gate、QA PASS、用户验收或公开分发。
- 验证证据：source / installed / packaged `diff -qr` 无输出；`SHA256SUMS.txt` OK；三处 `npm run check` 和 plugin validator 退出 0；smoke / HTTP / lifecycle / MCP / sidebar 报告均 `ok=true`；敏感扫描无匹配 secret pattern。

## 未决问题

- PMO / QA / Owner 仍需执行 fresh-machine 或 clean user 复测，确认 `0.1.1+codex.20260707231339` 在真实普通用户路径下解除 sidebar bootstrap blocker。
- 若后续要声明 source freeze 或长期可回滚分发基线，需要 PMO / m4c 处理 P2 source snapshot、ignored artifact 和远端 / artifact storage 策略。

## 可复用命令 / Runbook

用途：复查 `REVIEW-EDC-04` 的 m4c plugin source / installed / packaged 一致性、候选 SHA、基础 syntax check、validator 和关键 smoke evidence。

前置条件：当前机器存在 canonical source、installed cache `0.1.1+codex.20260707231339` 和 candidate root。

```bash
diff -qr /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin /Users/ar/.codex/plugins/cache/personal/mindraw/0.1.1+codex.20260707231339
diff -qr /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C2.builds/MEXP15-SignedNotarizedDMG/mindraw-plugin-0.1.1+codex.20260707231339-M4C-EDC-03-20260707231839/plugin/install-source/plugins/mindraw
cd /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C2.builds/MEXP15-SignedNotarizedDMG/mindraw-plugin-0.1.1+codex.20260707231339-M4C-EDC-03-20260707231839 && shasum -a 256 -c SHA256SUMS.txt
npm run --prefix /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin check
npm run --prefix /Users/ar/.codex/plugins/cache/personal/mindraw/0.1.1+codex.20260707231339 check
npm run --prefix /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C2.builds/MEXP15-SignedNotarizedDMG/mindraw-plugin-0.1.1+codex.20260707231339-M4C-EDC-03-20260707231839/plugin/install-source/plugins/mindraw check
PYTHONPATH=/tmp/mindraw-m4c-validator-pyyaml /Users/ar/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/bin/python3 /Users/ar/.codex/skills/.system/plugin-creator/scripts/validate_plugin.py /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin
PYTHONPATH=/tmp/mindraw-m4c-validator-pyyaml /Users/ar/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/bin/python3 /Users/ar/.codex/skills/.system/plugin-creator/scripts/validate_plugin.py /Users/ar/.codex/plugins/cache/personal/mindraw/0.1.1+codex.20260707231339
PYTHONPATH=/tmp/mindraw-m4c-validator-pyyaml /Users/ar/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/bin/python3 /Users/ar/.codex/skills/.system/plugin-creator/scripts/validate_plugin.py /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C2.builds/MEXP15-SignedNotarizedDMG/mindraw-plugin-0.1.1+codex.20260707231339-M4C-EDC-03-20260707231839/plugin/install-source/plugins/mindraw
```

验证步骤：上述 `diff -qr` 应无输出；`SHA256SUMS.txt` 应全部 `OK`；`npm run check` 与 validator 应退出 0。

清理 / 恢复：无清理动作；上述命令均为只读或 syntax / validator 复核。

搜索关键词：`REVIEW-EDC-04`、`crg-eda4493ea1b8`、`M4C-EDC-03`、`0.1.1+codex.20260707231339`、`LaunchServices fallback`、`TM1`。