# 2026-07-08 M4C-EDC-04 ## 用户目标 处理 MEXP15 / CM1 fresh-machine 首次创建路径 blocker：在 Owner 全新 CM1 上执行 `Open the Mindraw canvas for this project.` 后，m4c sidebar 显示 `No project canvas` / `MINDRAW_CANVAS_CREATE_API_REQUIRED`，点击 `编辑 / Edit` 不启动 Mindraw，也没有 preview。任务范围限定为 m4c create bootstrap / sidebar / skill / service 路径，不改 Mindraw App、DMG、签名、公证或 release metadata。 ## 已处理事项 - 读取并对齐 `M4C-EDC-04` 派工、CM1 blocker 证据、QA-EDC-05、MD-EDC-03、M4C-EDC-03 和 review request。 - 在 canonical source plugin 增加 create bootstrap fallback：runtime capability file 缺失导致 create path 不可用时，macOS 下通过 LaunchServices cold-launch Mindraw，等待 `createBlankPackage` capability 后重试 Mindraw App API create。 - 保留 fail-closed 边界：capability file 存在但不含 create method 时仍返回 `MINDRAW_CANVAS_CREATE_API_REQUIRED`；preview source-required 继续 409；不显示 stale READY。 - 同步安装到 installed cache `0.1.2+codex.20260708194340`，并生成 MEXP15 EDC-04 候选包。 - 补齐 source / installed / packaged validator、`npm run check`、smoke、HTTP、lifecycle、MCP、sidebar、SkillSpector、敏感扫描、tarball、hash、marketplace add/remove 证据。 - 写入 P2 主报告、JSON、review request，并更新 P2 INDEX、P2 CODEGRAPH、主项目 INDEX、统一台账和 PMO_INBOX。 ## 核心事实 / 变更快照 - 任务：`M4C-EDC-04` - 终态口令：`PM_NOTIFY_READY M4C-EDC-04 RESULT=M4C_FIX_READY` - Review Gate：`crg-9f1b6d5a4c28`，状态 pending `REVIEW-M4C-EDC-04` - Plugin version / cachebuster：`0.1.2+codex.20260708194340` - Canonical source：`/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin` - Adapter：`/Users/ar/plugins/mindraw` symlink to canonical source - Installed cache：`/Users/ar/.codex/plugins/cache/personal/mindraw/0.1.2+codex.20260708194340` - Candidate root：`/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C2.builds/MEXP15-SignedNotarizedDMG/mindraw-plugin-0.1.2+codex.20260708194340-M4C-EDC-04-20260708194915` - Candidate tarball SHA256：`6b454025d4ce23bf0862e638cdc7b0ca9a9930901a9039fdeb97efa0bfca9795` - Source / packaged relative tree list SHA256：`52a2c81465252da65b9a90b1ae5b0994125a695e142957289f25295d3921fa16` - 关键行为变更： - 变更前：首次无 canvas 且 runtime capability file 缺失时，create path 直接停在 `MINDRAW_CANVAS_CREATE_API_REQUIRED`。 - 变更后：仅在 runtime 不可用类错误下，macOS 启动 Mindraw、等待 `createBlankPackage` capability、重试 `mindraw.app.create_blank_package`。 - 保留边界：不写 `.mindraw` internals；不做 target-link entry；preview 仍 fail-closed。 ## 文件变更 - `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/lib/project-canvas.mjs` - `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/scripts/mindraw-canvas-service.mjs` - `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/README.md` - `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/skills/mindraw-open-canvas/SKILL.md` - `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/.codex-plugin/plugin.json` - `/Users/ar/.codex/plugins/cache/personal/mindraw/0.1.2+codex.20260708194340` - `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C2.builds/MEXP15-SignedNotarizedDMG/mindraw-plugin-0.1.2+codex.20260708194340-M4C-EDC-04-20260708194915/` - `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-04-create-bootstrap-fallback-check-20260708.md` - `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-04-create-bootstrap-fallback-check-20260708.json` - `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-04-review-request-crg-9f1b6d5a4c28.md` - `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/INDEX.md` - `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/CODEGRAPH.md` - `/Users/ar/Projects/Mindraw/INDEX.md` - `/Users/ar/Projects/Mindraw/02-P/plan-progress.markdown` - `/Users/ar/Projects/Mindraw/02-P/PMO_INBOX.md` ## 可复用命令 / Runbook 用途：复跑 M4C-EDC-04 source / installed / packaged 验证，或在 review 前核对 candidate hash 和 install-source 语法。 前置条件： - Canonical source 路径存在：`/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin` - Installed cache 路径存在：`/Users/ar/.codex/plugins/cache/personal/mindraw/0.1.2+codex.20260708194340` - Candidate root 路径存在：`/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C2.builds/MEXP15-SignedNotarizedDMG/mindraw-plugin-0.1.2+codex.20260708194340-M4C-EDC-04-20260708194915` - Playwright 依赖使用 bundled runtime：`/Users/ar/.cache/codex-runtimes/codex-primary-runtime/dependencies/node/node_modules` 核心验证： ```bash npm run --prefix /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin check npm run --prefix /Users/ar/.codex/plugins/cache/personal/mindraw/0.1.2+codex.20260708194340 check diff -qr /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin /Users/ar/.codex/plugins/cache/personal/mindraw/0.1.2+codex.20260708194340 shasum -a 256 /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C2.builds/MEXP15-SignedNotarizedDMG/mindraw-plugin-0.1.2+codex.20260708194340-M4C-EDC-04-20260708194915/plugin/mindraw-plugin-0.1.2+codex.20260708194340-M4C-EDC-04-20260708194915.tar.gz ``` HTTP / sidebar smoke： ```bash node /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/scripts/mindraw-canvas-service.mjs smoke-http --report /Users/ar/Projects/Mindraw/P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-04-smoke-http-source-20260708.json PLAYWRIGHT_NODE_MODULES=/Users/ar/.cache/codex-runtimes/codex-primary-runtime/dependencies/node/node_modules node /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/scripts/mindraw-canvas-service.mjs smoke-sidebar --report /Users/ar/Projects/Mindraw/P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-04-smoke-sidebar-source-20260708.json --out /Users/ar/Projects/Mindraw/P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-04-sidebar-source ``` Candidate install-source syntax: ```bash codex plugin marketplace add /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C2.builds/MEXP15-SignedNotarizedDMG/mindraw-plugin-0.1.2+codex.20260708194340-M4C-EDC-04-20260708194915/plugin/install-source --json codex plugin marketplace remove mindraw-mexp15-m4c-edc-04-20260708194915 --json ``` 验证点： - HTTP smoke 中 `first-run create bootstraps Mindraw app when createBlankPackage capability file is unavailable` 为 `ok=true`，fallback method 为 `macos.open.bundle.app`。 - HTTP smoke 中 `preview source-required state fails closed without READY or stale image` 为 `ok=true`，preview HTTP status 为 `409`。 - `diff -qr` source / installed 无输出。 - tarball SHA256 等于 `6b454025d4ce23bf0862e638cdc7b0ca9a9930901a9039fdeb97efa0bfca9795`。 清理 / 恢复： - 若临时添加了 candidate marketplace，使用： ```bash codex plugin marketplace remove mindraw-mexp15-m4c-edc-04-20260708194915 --json ``` ## 未决问题 - `crg-9f1b6d5a4c28` 尚未由代码审核员回写 PASS 或等效结论。 - CM1 fresh-machine 或 clean-user recheck 必须等 review handling 后由 PMO / QA / Owner 安排，当前记录不代表真实 GUI 路径复测结论。 - Plugin-root SkillSpector 仍为 `CAUTION / MEDIUM / score 21 / TM1`，需 reviewer 按 smoke harness 上下文接受或要求修改。 ## 后续建议 - PMO 派发 `REVIEW-M4C-EDC-04`，Review Gate ID 使用 `crg-9f1b6d5a4c28`。 - Review handling 后，再基于 candidate `0.1.2+codex.20260708194340` 安排 CM1 或 clean macOS user recheck。