# MD-EDC-01 外部分发 App 候选

日期：2026-07-06
项目：Mindraw
角色：Coder@mindraw

## 用户目标

PMO 派发 `MD-EDC-01`，要求处理 Mindraw App 外部分发候选。起点是 MEXP13 本机成功基线 `1.2.3 / Build202607042351`、source checkpoint tag `mindraw-freeze-20260706-mexp13-1.2.3-user-accepted` 和 MD-BUNDLE-07 验证记录。

边界：不改 m4c plugin；不把未 notarized 包称为正式公开版本；不删除旧 build 或用户成功证据；如出现代码 / 构建 / 配置 diff，必须登记 Review Gate。

## 已完成事项

- 按派工顺序读取 `AGENTS.md`、`INDEX.md`、`02-P/plan-progress.markdown` 的 MEXP14 计划项、MEXP14 Round Spec、角色派工简报的 `MD-EDC-01`、`CODEGRAPH.md`。
- 补读 `release-versioning.md`、`code-governance.md`、`delivery-gate.md` 和本轮会话记忆规则。
- 判断旧 `Build202607042351` 不能直接作为外部分发 App 候选，需要新 clean build。
- 从 checkpoint 派生临时 clean worktree：`/private/tmp/mindraw-md-edc-01-clean-build-202607061547`。
- 创建 source branch：`codex/md-edc-01-mexp14-manifest`。
- 提交最小构建脚本修正：`b694a42d46fd02dcd6873e1f3f2406d3166fb28a`，只让 `scripts/package-mindraw.sh` 识别 `mexp14-external-distribution-candidate` manifest class。
- 创建 candidate tag：`v1.2.3-build20260706.1556-mexp14-edc`。
- 生成 App candidate：`1.2.3 / Build202607061556`。
- 回写验证记录、review request、统一台账、`INDEX.md`、`CODEGRAPH.md`、`03-O/C2.builds/README.md`。

## 核心事实 / 变更快照

变更对象：Mindraw App 外部分发候选。

变更前：

- 本机成功基线：`1.2.3 / Build202607042351`
- DMG SHA256：`5c8041288a61f8c09e7bf0ca8a0bcd68b55d17e5aaa1079eb8d7864a952481b5`
- 边界：MEXP13 本机体验成功基线，dirty manifest，不是外部分发 App 候选。

变更后：

- Candidate：`1.2.3 / Build202607061556`
- DMG：`03-O/C2.builds/releases/Build202607061556/Mindraw_1.2.3_aarch64-Build202607061556.dmg`
- DMG SHA256：`3b17b89461374621c80d127e6475e6de502031486201f672f7fc4fde57e744a8`
- Manifest：`03-O/C2.builds/releases/Build202607061556/release-manifest.json`
- Manifest SHA256：`70108e18eb8ea39c729c29a6e8a00cb15aa4cef81d535db1cc1d48cf5793afe7`
- Build info SHA256：`1c2706d177bc72a7d192b272077b359ade297682bd2d1a730dace20aeff8ccf0`
- Source branch：`codex/md-edc-01-mexp14-manifest`
- Source commit：`b694a42d46fd02dcd6873e1f3f2406d3166fb28a`
- Base checkpoint tag：`mindraw-freeze-20260706-mexp13-1.2.3-user-accepted`
- Candidate tag：`v1.2.3-build20260706.1556-mexp14-edc`
- Review Gate ID：`crg-b694a42d46fd`
- PM_NOTIFY_READY：`no`

范围边界：

- 不改 m4c plugin。
- 不改 App runtime 行为。
- `CHANGELOG.md` 未更新，理由是版本仍为 `1.2.3`，用户可见 App 行为未变化，本轮只有 build manifest classification。
- App ad-hoc signed，DMG unsigned，notarization not requested。
- fresh machine / clean profile 验证仍是后续独立步骤。

## 文件变更

主项目文档 / 证据：

- `02-P/plan-progress.markdown`
- `INDEX.md`
- `CODEGRAPH.md`
- `03-O/C2.builds/README.md`
- `02-P/MEXP14-ExternalDistributionCandidate/qa/md-edc-01-app-candidate-check-20260706.md`
- `02-P/MEXP14-ExternalDistributionCandidate/qa/md-edc-01-app-candidate-check-20260706.json`
- `02-P/MEXP14-ExternalDistributionCandidate/review/md-edc-01-review-request-crg-b694a42d46fd.md`

构建产物：

- `03-O/C2.builds/releases/Build202607061556/Mindraw_1.2.3_aarch64-Build202607061556.dmg`
- `03-O/C2.builds/releases/Build202607061556/build-info.txt`
- `03-O/C2.builds/releases/Build202607061556/release-manifest.json`

源码分支：

- Branch：`codex/md-edc-01-mexp14-manifest`
- Commit：`b694a42d46fd02dcd6873e1f3f2406d3166fb28a`
- Changed file：`scripts/package-mindraw.sh`

## 验证证据

均为 exit 0：

- `npm run test:run -- src/lib/mindrawProjectCanvasPreview.test.ts src/lib/mindrawAppApiTransport.test.ts src/lib/mindrawAppReadApi.test.ts`
- `CARGO_TARGET_DIR=/tmp/mindraw-md-edc-01-cargo-target-202607061547 cargo check --manifest-path src-tauri/Cargo.toml`
- `CARGO_TARGET_DIR=/tmp/mindraw-md-edc-01-cargo-target-202607061547 cargo test --manifest-path src-tauri/Cargo.toml preview`
- `CARGO_TARGET_DIR=/tmp/mindraw-md-edc-01-cargo-target-202607061547 cargo test --manifest-path src-tauri/Cargo.toml app_api_transport`
- `npm run build`
- `CARGO_TARGET_DIR=/tmp/mindraw-md-edc-01-package-target-202607061556 BUILD_ID=202607061556 MINDRAW_BUILD_AGENT=codex-md-edc-01 MINDRAW_RELEASE_CLASS=mexp14-external-distribution-candidate npm run package:mindraw`
- `hdiutil verify`
- mounted App metadata check
- `codesign --verify --deep --strict`
- `npm run doctor:mindraw -- --app ... --pretty`
- `git diff --check`

Doctor caveat：App metadata 针对 mounted candidate；App API runtime section 读取当前用户 runtime capability file，不证明 mounted App 已启动。

## 可复用命令 / Runbook

用途：从 MEXP13 checkpoint 派生 MEXP14 App 外部分发候选，使用 fresh Cargo target，生成 DMG、manifest、SHA 和 review request 输入。

前置条件：

- 当前仓库包含 tag `mindraw-freeze-20260706-mexp13-1.2.3-user-accepted`。
- 不在主 dirty worktree 中直接打包。
- 构建目标为 macOS arm64 Tauri App。

```bash
git worktree add --detach /tmp/mindraw-md-edc-01-clean-build-YYYYMMDDHHMM mindraw-freeze-20260706-mexp13-1.2.3-user-accepted
cd /tmp/mindraw-md-edc-01-clean-build-YYYYMMDDHHMM
git switch -c codex/md-edc-01-mexp14-manifest
npm install --no-package-lock --no-audit --no-fund
npm run test:run -- src/lib/mindrawProjectCanvasPreview.test.ts src/lib/mindrawAppApiTransport.test.ts src/lib/mindrawAppReadApi.test.ts
CARGO_TARGET_DIR=/tmp/mindraw-md-edc-01-cargo-target-YYYYMMDDHHMM cargo check --manifest-path src-tauri/Cargo.toml
CARGO_TARGET_DIR=/tmp/mindraw-md-edc-01-cargo-target-YYYYMMDDHHMM cargo test --manifest-path src-tauri/Cargo.toml preview
CARGO_TARGET_DIR=/tmp/mindraw-md-edc-01-cargo-target-YYYYMMDDHHMM cargo test --manifest-path src-tauri/Cargo.toml app_api_transport
npm run build
CARGO_TARGET_DIR=/tmp/mindraw-md-edc-01-package-target-BUILDID BUILD_ID=BUILDID MINDRAW_BUILD_AGENT=codex-md-edc-01 MINDRAW_RELEASE_CLASS=mexp14-external-distribution-candidate npm run package:mindraw
hdiutil verify /Users/ar/Projects/Mindraw/03-O/C2.builds/releases/BuildBUILDID/Mindraw_1.2.3_aarch64-BuildBUILDID.dmg
shasum -a 256 /Users/ar/Projects/Mindraw/03-O/C2.builds/releases/BuildBUILDID/Mindraw_1.2.3_aarch64-BuildBUILDID.dmg /Users/ar/Projects/Mindraw/03-O/C2.builds/releases/BuildBUILDID/release-manifest.json /Users/ar/Projects/Mindraw/03-O/C2.builds/releases/BuildBUILDID/build-info.txt
```

验证 mounted App：

```bash
rm -rf /tmp/mindraw-md-edc-01-mount-BUILDID
mkdir -p /tmp/mindraw-md-edc-01-mount-BUILDID
hdiutil attach -nobrowse -readonly -mountpoint /tmp/mindraw-md-edc-01-mount-BUILDID /Users/ar/Projects/Mindraw/03-O/C2.builds/releases/BuildBUILDID/Mindraw_1.2.3_aarch64-BuildBUILDID.dmg
plutil -p /tmp/mindraw-md-edc-01-mount-BUILDID/Mindraw.app/Contents/Info.plist
codesign --verify --deep --strict --verbose=2 /tmp/mindraw-md-edc-01-mount-BUILDID/Mindraw.app
npm run doctor:mindraw -- --app /tmp/mindraw-md-edc-01-mount-BUILDID/Mindraw.app --pretty
hdiutil detach /tmp/mindraw-md-edc-01-mount-BUILDID
```

搜索关键词：`MD-EDC-01`、`Build202607061556`、`crg-b694a42d46fd`、`mexp14-external-distribution-candidate`、`v1.2.3-build20260706.1556-mexp14-edc`。

## 未决问题 / 后续建议

- 代码审核员需对 Review Gate `crg-b694a42d46fd` 回写 `PASS` / `CHANGES_REQUESTED` / `BLOCKED`。
- Review Gate 未通过前，不请求 PMO 进入后续 Gate。
- fresh machine / clean profile 验证仍需后续角色执行。
- m4c plugin candidate 和 `crg-ce3b411d6cca` 是独立链路。