# M4C-EDC-05 Project-Scoped Preview Service 日期：2026-07-08 项目：Mindraw / P2.mindrawforcodex 任务：`M4C-EDC-05` 计划：`P-20260707-signed-notarized-dmg` ## 用户目标 处理 CM1 上发现的跨项目 stale canvas blocker：在全新空项目执行 `Open the Mindraw canvas for this project.` 后，点击 `编辑 / Edit` 打开了上一轮实验遗留的有内容 `.mindraw`。要求只在 m4c plugin / sidebar / service 范围修复，不改 Mindraw 主 App、DMG、签名、公证或 release metadata，不实现 arbitrary target-link entry。 ## 已处理事项 - 将 Mindraw Codex plugin 提升到 `0.1.3+codex.20260708220005`，cachebuster 对应 `M4C-EDC-05`。 - m4c sidebar service URL 改为 project-scoped：`http://127.0.0.1:/?project=`。 - `/api/state`、`/api/preview`、`/api/open-edit` 校验 request project hash，不匹配时 fail-closed：`MINDRAW_PROJECT_CONTEXT_MISMATCH`。 - `/api/open-edit` 打开前校验 latest canvas canonical path 必须位于当前 project root 的 `MindrawCanvas/` 下。 - service 启动时通过 `/api/identity` 区分同项目 service 与其他项目 / 未知固定端口占用；其他项目占用 `43227` 时使用下一可用端口。 - `/Users/ar/plugins/mindraw` 保持 symlink adapter，source 与 installed cache、packaged install source 已对齐。 - 生成 M4C-EDC-05 candidate、报告、机器可读摘要和 Review Request。 ## 核心事实 / 变更快照 - 变更对象：Mindraw Codex plugin `mindraw-canvas-service.mjs`、`start-canvas.sh`、README、skill wording、plugin manifest。 - 事实来源： - Canonical source：`/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/` - Adapter：`/Users/ar/plugins/mindraw` - Installed cache：`/Users/ar/.codex/plugins/cache/personal/mindraw/0.1.3+codex.20260708220005` - Candidate root：`/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C2.builds/MEXP15-SignedNotarizedDMG/mindraw-plugin-0.1.3+codex.20260708220005-M4C-EDC-05-20260708221159/` - 变更前：sidebar service 默认固定端口 `43227`，API 未绑定 project context；Codex sidebar 复用旧 URL 时可能将新项目 `Edit` 发给旧项目 service。 - 变更后：service URL 和 API 均绑定 project hash；mismatched context 返回 409；open/edit 强制 latest canvas 在当前项目 `MindrawCanvas/` 下；启动遇到其他项目固定端口服务时跳到下一端口。 - 不变边界：不改 Mindraw 主 App，不写 `.mindraw` internals，不做 target-link entry，preview 继续 fail-closed。 - Candidate tarball SHA256：`deefeaab12a4949052c6b154ca23d9e7b14a2f85bed9809a84efd3dfaab672c2` - Source / packaged relative tree list file SHA256：`6e4371e50568d2f9030077f5de7a24d9ce54489abe6111ffea2dbe4805b268be` - Review Gate：`crg-7b229c2a68c8`，状态 `pending REVIEW-M4C-EDC-05`。 ## 文件变更 - Canonical plugin source： - `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/.codex-plugin/plugin.json` - `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/scripts/mindraw-canvas-service.mjs` - `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/scripts/start-canvas.sh` - `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/README.md` - `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/skills/mindraw-open-canvas/SKILL.md` - Process records： - `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-05-project-scoped-preview-service-check-20260708.md` - `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-05-project-scoped-preview-service-check-20260708.json` - `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-05-review-request-crg-7b229c2a68c8.md` - `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/INDEX.md` - `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/CODEGRAPH.md` - `/Users/ar/Projects/Mindraw/INDEX.md` - `/Users/ar/Projects/Mindraw/02-P/plan-progress.markdown` - Candidate package: - `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C2.builds/MEXP15-SignedNotarizedDMG/mindraw-plugin-0.1.3+codex.20260708220005-M4C-EDC-05-20260708221159/` ## 验证证据 - Source / installed / packaged validator、`npm run check`、smoke、HTTP、lifecycle、MCP、sidebar smoke 均退出 0。 - lifecycle smoke 覆盖 `project-scoped service avoids stale fixed-port project and rejects mismatched sidebar context`。 - HTTP smoke 覆盖 `open-edit fails closed when sidebar project context does not match the service project`。 - `shasum -a 256 -c SHA256SUMS.txt` 对 candidate root 通过。 - SkillSpector skill-dir：`SAFE / LOW / score=0`。 - SkillSpector plugin-root：`CAUTION / MEDIUM / score=21 / TM1 scripts/mindraw-canvas-service.mjs:6`，需 review 接受。 - Sensitive scan：无配置的 secret/key token pattern 命中。 ## 可复用命令 / Runbook 用途：复跑 M4C-EDC-05 m4c plugin project-scoped sidebar service 关键验证。 前置条件：当前 canonical source 为 `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin`；Playwright 依赖来自 Codex primary runtime。 设置和验证命令： ```bash npm run --prefix /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin check PYTHONPATH=/tmp/mindraw-m4c-validator-pyyaml python3 /Users/ar/.codex/skills/.system/plugin-creator/scripts/validate_plugin.py /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin node /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/scripts/mindraw-canvas-service.mjs smoke-lifecycle --report /Users/ar/Projects/Mindraw/P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-05-smoke-lifecycle-source-20260708.json node /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/scripts/mindraw-canvas-service.mjs smoke-http --report /Users/ar/Projects/Mindraw/P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-05-smoke-http-source-20260708.json PLAYWRIGHT_NODE_MODULES=/Users/ar/.cache/codex-runtimes/codex-primary-runtime/dependencies/node/node_modules node /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/scripts/mindraw-canvas-service.mjs smoke-sidebar --report /Users/ar/Projects/Mindraw/P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-05-smoke-sidebar-source-20260708.json --out /Users/ar/Projects/Mindraw/P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-05-sidebar-source shasum -a 256 -c /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C2.builds/MEXP15-SignedNotarizedDMG/mindraw-plugin-0.1.3+codex.20260708220005-M4C-EDC-05-20260708221159/SHA256SUMS.txt ``` 清理 / 恢复：candidate marketplace add/remove 证据已在 candidate `plugin/evidence/` 中保存；若本机需要回退 plugin，可重新安装上一版 M4C-EDC-04 install source 或按 candidate `plugin/rollback-plugin.md` remove-only 处理。 搜索关键词：`M4C-EDC-05`、`MINDRAW_PROJECT_CONTEXT_MISMATCH`、`project-scoped service`、`0.1.3+codex.20260708220005`、`crg-7b229c2a68c8`。 ## 未决问题 - `REVIEW-M4C-EDC-05` 尚未回写 `crg-7b229c2a68c8` 的通过或阻塞结论。 - CM1 真实路径需要在 review gate 处理后再安排复验。 - P2 `C1.source/mindraw-plugin/` 仍是既有 untracked source snapshot，长期 source freeze / clean archival 仍应由 PMO 后续收敛。 ## 后续建议 - PMO 先派代码审核员处理 `crg-7b229c2a68c8`。 - 复核通过后，再让 Owner / QA 在 CM1 关闭旧 sidebar tab、按新版 project-scoped URL 重新执行新空项目路径。