docs(34): re-verification passes, presentations ledger counts
This commit is contained in:
Jakub Zych
@@ -257,4 +257,4 @@ None beyond the plan's threat model. T-34-07 and T-34-08 are mitigated by the ge
|
||||
- **Framework fix 87921c2, `fix(kiosk)`:** these repositories are developed inside applications. Their go.mod replaces point at an application mount (`../../../../summercms.go`, and `sm-user-plugin => ../user`). kiosk resolves required plugins with `GOWORK=off`. Next to the framework, `../user` does not exist, so feedback and quizzes derived `golem15.user: ""`, while inside sm-demo-app they derived `v0.1.0`. TestPluginManifest could not pass in both layouts. kiosk now fetches a required module whose local replace directory is missing at the version go.mod requires, so both layouts give `v0.1.0`. The fix has a regression test (TestDeriveMissingReplace, offline file:// proxy), and the 21 existing manifests stayed fresh.
|
||||
- **Local build setup:** each clone has an untracked `go.work` listed in `.git/info/exclude`. It uses `.`, replaces the framework with `../summercms.go`, and, where the plugin requires the user plugin, replaces it with `../sm-demo-app/plugins/golem15/user`. The committed go.mod replaces are unchanged, and tidy ran with them pointed at those paths only temporarily.
|
||||
- **Checks:** for golem, feedback, quizzes and presentations, TestPluginManifest, `go vet ./...`, `go test -short ./...` (green before and after the change), `summer plugin:manifest --check` and anonymous `git ls-remote` over HTTPS all pass. The drift guard was demonstrated on feedback and presentations. `go mod tidy` removed the fang leftovers (note 3) and added framework v0.6.0's indirect requires. No direct require was removed or downgraded.
|
||||
- **Mounted in apps:** sm-demo-app mounts golem, feedback, quizzes and presentations. sm-bm-app mounts quizzes and presentations. fonoteka.go mounts golem and feedback. The eight pointer bumps are in 34-release-log.md. All are fast-forwards: golem, feedback and quizzes sit one commit on top of the app's pointer, and presentations is 12 commits after sm-demo-app's v0.1.1 and 2 after sm-bm-app's 30a47ac.
|
||||
- **Mounted in apps:** sm-demo-app mounts golem, feedback, quizzes and presentations. sm-bm-app mounts quizzes and presentations. fonoteka.go mounts golem and feedback. The eight pointer bumps are in 34-release-log.md. All are fast-forwards: golem, feedback and quizzes sit one commit on top of the app's pointer, and presentations is 13 commits after sm-demo-app's v0.1.1 and 2 after sm-bm-app's d205cd7.
|
||||
|
||||
@@ -1,33 +1,24 @@
|
||||
---
|
||||
phase: 34-plugin-marketplace
|
||||
verified: 2026-10-29T23:40:00Z
|
||||
status: gaps_found
|
||||
score: 51/52 must-haves verified
|
||||
verified: 2026-10-30T11:38:52Z
|
||||
status: human_needed
|
||||
score: 52/52 must-haves verified
|
||||
covered_files: [".planning/phases/34-plugin-marketplace/34-01-PLAN.md", ".planning/phases/34-plugin-marketplace/34-01-SUMMARY.md", ".planning/phases/34-plugin-marketplace/34-02-PLAN.md", ".planning/phases/34-plugin-marketplace/34-02-SUMMARY.md", ".planning/phases/34-plugin-marketplace/34-03-PLAN.md", ".planning/phases/34-plugin-marketplace/34-03-SUMMARY.md", ".planning/phases/34-plugin-marketplace/34-04-PLAN.md", ".planning/phases/34-plugin-marketplace/34-04-SUMMARY.md", ".planning/phases/34-plugin-marketplace/34-05-PLAN.md", ".planning/phases/34-plugin-marketplace/34-05-SUMMARY.md", ".planning/phases/34-plugin-marketplace/34-06-PLAN.md", ".planning/phases/34-plugin-marketplace/34-06-SUMMARY.md", "README.md", "admin/src/api/schema.d.ts", "admin/src/api/types.ts", "admin/src/app/pageTitle.ts", "admin/src/app/router.ts", "admin/src/components/shell/AppShell.vue", "admin/src/components/shell/Breadcrumbs.vue", "admin/src/components/shell/PluginRail.vue", "admin/src/state/useSettings.ts", "admin/src/views/PluginsView.vue", "cmd/summer/main.go", "cmd/summer/plugin_commands_test.go", "docs/architecture/go-modules-and-workspaces.md", "docs/architecture/introduction.md", "docs/backend/admin-spa.md", "docs/backend/users-and-permissions.md", "docs/console/scaffolding.md", "docs/plugins/marketplace.md", "internal/build/build.go", "internal/build/build_test.go", "internal/build/fixtures_test.go", "internal/build/install.go", "internal/build/install_smoke_test.go", "internal/build/install_test.go", "internal/build/manifest.go", "internal/build/manifest_append_test.go", "internal/build/new.go", "internal/build/plugindirs.go", "internal/build/plugindirs_test.go", "internal/build/plugininfo_smoke_test.go", "internal/build/rollback.go", "internal/build/scaffold.go", "internal/build/source.go", "internal/build/testdata/new-no-plugin/plugins.gen.go.golden", "internal/build/testdata/new/main.go.golden", "internal/build/testdata/new/plugins.gen.go.golden", "internal/build/update.go", "modules/cabana/README.md", "modules/cabana/admin_openapi.go", "modules/cabana/backend_screens.go", "modules/cabana/http.go", "modules/cabana/navigation.go", "modules/cabana/openapi_conformance_test.go", "modules/cabana/plugins.go", "modules/cabana/plugins_smoke_test.go", "modules/cabana/plugins_test.go", "modules/cabana/security_coverage_test.go", "modules/cabana/token_routes_test.go", "modules/kiosk/README.md", "modules/kiosk/check.go", "modules/kiosk/checkt_test.go", "modules/kiosk/client.go", "modules/kiosk/client_test.go", "modules/kiosk/derive.go", "modules/kiosk/derive_test.go", "modules/kiosk/example_test.go", "modules/kiosk/identity.go", "modules/kiosk/identity_test.go", "modules/kiosk/kiosk.go", "modules/kiosk/manifest.go", "modules/kiosk/manifest_smoke_test.go", "modules/kiosk/manifest_test.go", "modules/kiosk/registry.go", "modules/kiosk/testdata/consts/README.md", "modules/kiosk/testdata/consts/go.mod", "modules/kiosk/testdata/consts/ids/ids.go", "modules/kiosk/testdata/consts/nested/README.md", "modules/kiosk/testdata/consts/nested/plugin.go", "modules/kiosk/testdata/consts/plugin.go", "modules/kiosk/testdata/consts/vendor.go", "modules/kiosk/testdata/framework/go.mod", "modules/kiosk/testdata/literal/README.md", "modules/kiosk/testdata/literal/go.mod", "modules/kiosk/testdata/literal/plugin.go", "modules/kiosk/testdata/literal/plugin.yaml", "modules/kiosk/testdata/other/README.md", "modules/kiosk/testdata/other/go.mod", "modules/kiosk/testdata/other/plugin.go", "modules/kiosk/version.go", "modules/kiosk/version_test.go", "modules/party/README.md", "modules/party/info.go", "modules/party/info_test.go", "modules/phrasebook/backend/lang/en/lang.yaml", "modules/phrasebook/backend/lang/pl/lang.yaml", "scripts/check-phase34.sh"]
|
||||
covered_digest: "v2:sha256:0c6a14151d83c6cc9f8421f1e375f9768ea6efd43bdcc426ac498ec1c2c3de87"
|
||||
covered_digest: "v2:sha256:01016fc71594bebe540451815ae35eec027afefb9e5b250f9a4dc3840ce6b00e"
|
||||
behavior_unverified: 0
|
||||
overrides_applied: 0
|
||||
gaps:
|
||||
- truth: "ROADMAP SC-1: Every public sm-*-plugin repo carries a plugin.yaml manifest (ID, module path, name, description, required framework version, required plugins) that the framework validates, and anyone can fetch the repo anonymously."
|
||||
status: partial
|
||||
reason: "The 20 sibling-checkout repositories carry a generated, checked plugin.yaml and fetch anonymously. Four further public Go SummerCMS plugin repositories on git.golem15.com (golem15/sm-feedback-plugin, golem15/sm-golem-plugin, golem15/sm-presentations-plugin, golem15/sm-quizzes-plugin; all private=false, all with a go.mod module path) have no plugin.yaml. 34-02-PLAN scoped them out as 'user decision 5' (no sibling checkout), but no verification override records that narrowing of the roadmap contract, and no later phase picks them up."
|
||||
artifacts:
|
||||
- path: "https://git.golem15.com/golem15/sm-feedback-plugin"
|
||||
issue: "public plugin repo, no plugin.yaml, no TestPluginManifest"
|
||||
- path: "https://git.golem15.com/golem15/sm-golem-plugin"
|
||||
issue: "public plugin repo, no plugin.yaml, no TestPluginManifest"
|
||||
- path: "https://git.golem15.com/golem15/sm-presentations-plugin"
|
||||
issue: "public plugin repo, no plugin.yaml, no TestPluginManifest"
|
||||
- path: "https://git.golem15.com/golem15/sm-quizzes-plugin"
|
||||
issue: "public plugin repo, no plugin.yaml, no TestPluginManifest"
|
||||
missing:
|
||||
- "Either: clone the four repositories next to the framework and repeat the 34-02 rollout (summer plugin:manifest, manifest_test.go with kiosk.CheckT, framework v0.6.0 require), add them to PLUGIN_REPOS in scripts/check-phase34.sh and to the release ledger"
|
||||
- "Or: record user decision 5 as a verification override in this file (suggested YAML in the report) so SC-1 reads 'every public plugin in the launch set'"
|
||||
re_verification:
|
||||
previous_status: gaps_found
|
||||
previous_score: 51/52
|
||||
gaps_closed:
|
||||
- "34-06: 34-release-log.md lists every plugin commit waiting for push or tag and the pending submodule pointer bumps. sm-presentations-plugin README and manifest rebased onto sm-bm-app's theme commit d205cd7 (cfa0c40, 3eb4de7). d205cd7, 5bcbaaf (v0.1.1, sm-demo-app pointer) and 30a47ac are ancestors of 3eb4de7, so both bumps are fast-forwards. Ledger rows 24, 206 and 207 and 34-02-SUMMARY name 3eb4de7. Plugin tree clean, vet/short tests/manifest --check pass, gate --plugins PASS over 24 repositories"
|
||||
gaps_remaining: []
|
||||
regressions: []
|
||||
human_verification:
|
||||
- test: "After the user-gated deploy, open https://summercms.io/marketplace: list, a search, a category link and a plugin detail page, in light and dark themes"
|
||||
expected: "Plugins from the registry with install command, README and versions; search and category filter work; layout matches the summercms.io look"
|
||||
why_human: "Visual check against the live deployed site; the code is covered by pnpm test:marketplace and the Node SSR smoke against the real binary"
|
||||
- test: "Production ingest on rome: registry-add the fourteen launch URLs, run summercms:registry-ingest, curl /api/registry/v1/plugins (CORS, 401 on POST ingest, 403 on POST plugins)"
|
||||
- test: "Production ingest on rome: registry-add the launch URLs, run summercms:registry-ingest, curl /api/registry/v1/plugins (CORS, 401 on POST ingest, 403 on POST plugins)"
|
||||
expected: "Each repository ingested from its new plugin.yaml tag; API answers as in the release log step 7"
|
||||
why_human: "Needs pushed tags, git on the server and the deployed binary"
|
||||
- test: "Admin Settings -> System -> Plugins in an application built against the live registry, light and dark themes: Installed tab (versions, sources, update badge with copy) and Marketplace tab (search, category, install command with copy, no install button)"
|
||||
@@ -44,9 +35,34 @@ human_verification:
|
||||
# Phase 34: Plugin marketplace Verification Report
|
||||
|
||||
**Phase Goal:** People browse the public Golem15 plugins at summercms.io/marketplace and add one to their application with a single command, `summer plugin:install <id>`. The same command installs private plugins straight from a git URL without contacting summercms.io. The admin SPA gains a read-only Plugins screen listing installed plugins and searching the marketplace, which shows the install command with a copy button. v1 has no paid plugins, no developer registration and no installs from the admin panel.
|
||||
**Verified:** 2026-10-29T23:40:00Z
|
||||
**Status:** gaps_found
|
||||
**Re-verification:** No — initial verification
|
||||
**Verified:** 2026-10-30T11:38:52Z
|
||||
**Status:** human_needed
|
||||
**Re-verification:** Yes, after gap closure (previous: gaps_found, 51/52, verified 2026-10-30T11:31:46Z)
|
||||
|
||||
## Re-verification summary
|
||||
|
||||
| Item | Previous | Now | Evidence |
|
||||
|------|----------|-----|----------|
|
||||
| 34-06 release ledger (sm-bm-app presentations row) | ✗ PARTIAL | ✓ VERIFIED | Plugin history rebased onto d205cd7; ancestry, clean tree, tests, manifest check and gate all pass; ledger rows name 3eb4de7 (details below) |
|
||||
| SC-1 (24 public plugin repos with plugin.yaml) | ✓ | ✓ (regression check) | Gate `--plugins`: `phase34 plugins passed (24 repositories)`, 25 `manifest: ... fresh` lines |
|
||||
| Other 50 items | ✓ | ✓ (regression check) | No framework code changed since the previous run: the only commit after it is c739a7d (planning docs). `git diff ba39bb1..HEAD` outside `.planning` is `scripts/check-phase34.sh` (65e0cdd, presentations added to `PLUGIN_REPOS`), exercised by the gate run |
|
||||
|
||||
### Gap closure evidence (presentations)
|
||||
|
||||
| Check | Command | Result |
|
||||
|-------|---------|--------|
|
||||
| History | `git log --format='%h %p %s'` in `../sm-presentations-plugin` | 3eb4de7 (manifest) parent cfa0c40 (README) parent d205cd7 (sztab theme) parent 30a47ac = `origin/master`. Linear, 3 ahead, 0 behind |
|
||||
| Same commit as the sm-bm-app mount | `git rev-parse d205cd7` in both | `d205cd718563b390a0dcf678e41119fa0ca90976` in both; sm-bm-app HEAD 9929195 gitlink = d205cd7, mount worktree at d205cd7 |
|
||||
| (a) Fast-forward from sm-bm-app | `git merge-base --is-ancestor d205cd7 3eb4de7` | true (2 commits) |
|
||||
| (a) Fast-forward from sm-demo-app | `git merge-base --is-ancestor 5bcbaaf 3eb4de7` | true; 5bcbaaf = tag v0.1.1, sm-demo-app gitlink, `v0.1.1..3eb4de7` = 13 commits, matching ledger row 24 |
|
||||
| The rebase changed only the base | `git diff --stat d205cd7 3eb4de7` | README.md, go.mod, go.sum, manifest_test.go, plugin.yaml (same five files as before). d205cd7 touches only `controllers/presentations_test.go`, `lang/{en,pl}/lang.yaml`, `models/presentations/fields.yaml`, none of the manifest inputs |
|
||||
| (b) Clean tree | `git status --porcelain` | empty |
|
||||
| (b) Vet and short tests | `go vet ./... && go test -short -count=1 ./...` | exit 0, 7 packages ok |
|
||||
| (b) Manifest | `summer plugin:manifest --check .` (scratchpad binary) | `plugin.yaml is up to date`, exit 0; `golem15.presentations`, framework v0.6.0, requires `golem15.user: v0.1.0` |
|
||||
| No tag yet | `git tag --points-at HEAD` | none (tagging is in the user-gated release) |
|
||||
| (c) Stale SHAs | `grep -rn 'b6247aa\|bb81f4d' .planning/phases/34-plugin-marketplace/` | only this report's history (now removed). None in the release log or SUMMARYs |
|
||||
| (c) Ledger rows | `34-release-log.md` rows 24, 206, 207; 34-02-SUMMARY table | row 24: 3eb4de7, 13 commits, v0.1.1 -> v0.1.2; sm-demo-app 5bcbaaf -> v0.1.2 (3eb4de7); sm-bm-app d205cd7 (committed in 9929195) -> v0.1.2 (3eb4de7); note dated 2026-10-30 to push the plugin master; SUMMARY row names 3eb4de7 after cfa0c40. All agree with git |
|
||||
| (d) Gate | `bash scripts/check-phase34.sh --plugins` | `phase34 plugins passed (24 repositories)`, exit 0, 25 fresh manifests (sm-user-plugin TestRegisterCORSPath skip, pre-existing) |
|
||||
|
||||
## Goal Achievement
|
||||
|
||||
@@ -54,102 +70,87 @@ human_verification:
|
||||
|
||||
| # | Truth | Status | Evidence |
|
||||
|---|-------|--------|----------|
|
||||
| SC-1 | Every public sm-*-plugin repo carries a validated plugin.yaml and fetches anonymously | ✗ PARTIAL (gap) | 20/20 sibling repos: plugin.yaml + manifest_test.go (`kiosk.CheckT(t, ".")`) tracked, framework v0.6.0, `summer plugin:manifest --check` passes (gate `--plugins` PASS), anonymous `git ls-remote` OK for all 20. Forge API lists 4 more public Go plugin repos (feedback, golem, presentations, quizzes) without plugin.yaml; scoped out by "user decision 5" in 34-02-PLAN with no override |
|
||||
| SC-2 | summercms.io ingests manifest/README/versions on tag, serves registry API, renders /marketplace list/search/category/detail; presentation fields edited in admin | ✓ VERIFIED (code) | `registry/ingest.go` (bare partial clone, `kiosk.Parse`/`kiosk.Validate`, `breakwater.Render` README), `routes_registry.go` (GET plugins, {id}, versions with `cors:` profile; POST ingest separate group), `controllers/api/registry.go` (kiosk envelopes, Cache-Control, ETag), `schedule.go` hourly `--queue`, `models/plugin/fields.yaml` (category, featured, sort_order, icon, screenshots editable; facts preview-only), vue `pages/marketplace/index.vue` + `[vendor]/[name].vue`. Docker suites TestRegistrySmoke/APIShapes/IngestEndpoint pass. Live deploy is a human item |
|
||||
| SC-3 | `plugin:install golem15.<name>` (module; `--source` submodule) and `plugin:install <git-url>` (submodule) register like plugin:add and check requirements | ✓ VERIFIED | `cmd/summer/main.go` wires `build.PlanInstall`/`ApplyInstall`/`Update`; `install.go` uses `EffectiveFramework` + `kiosk.NewestCompatible`, `--yes` rule; `source.go` submodule + git URL + go.work edits; TestInstallSmoke (Docker stage) passes incl. module, source, giturl, giturl_offline, nogit, urls, update, rollback |
|
||||
| SC-4 | Admin Plugins screen: installed plugins with versions and updates; Marketplace tab searches registry, install command with copy | ✓ VERIFIED | `cabana/http.go` GET `/plugins`, `/plugins/marketplace` only (no install endpoint); `plugins.go` uses `party.Installed`, `kiosk.RegistryURL/NewClient/NewestCompatible/Newer`; `PluginsView.vue` Installed + Marketplace tabs, copy buttons, tab hidden when `registry.enabled` false; route `/system/plugins`; dist rebuilt (`check-admin-dist.sh` PASS) |
|
||||
| SC-5 | New code has unit tests in the last plan | ✓ VERIFIED | kiosk, build, cabana, party, cmd/summer, admin, site plugin, changelog-post and vue tests exist and pass; gate stages all PASS |
|
||||
| SC-1 | Every public sm-*-plugin repo carries a validated plugin.yaml and fetches anonymously | ✓ VERIFIED | Anonymous forge API (`/orgs/golem15/repos`, `/repos/search?q=sm-` and `?q=plugin`) lists 24 public golem15 `sm-*-plugin` repos; all 24 are in `PLUGIN_REPOS` and have a sibling checkout. The four gap repos each have a tracked `plugin.yaml` + `manifest_test.go` (`kiosk.CheckT(t, ".")`), `require .../summercms v0.6.0`, a clean tree and no tag at HEAD; golem, feedback and quizzes are 1 commit ahead of origin, presentations 3 (sztab theme d205cd7, README cfa0c40, manifest 3eb4de7). `check-phase34.sh --plugins` re-run this time: `phase34 plugins passed (24 repositories)`, 25 `manifest: ... fresh` lines (pgstripe nested). `git ls-remote https://git.golem15.com/golem15/<repo>.git` without credentials returned refs for all four in the previous run. See the note on `jakub/sm-bm-plugin` below |
|
||||
| SC-2 | summercms.io ingests manifest/README/versions on tag, serves registry API, renders /marketplace list/search/category/detail; presentation fields edited in admin | ✓ VERIFIED (code) | Unchanged since a9237c8 (no site or vue commit in either gap closure). Live deploy is a human item |
|
||||
| SC-3 | `plugin:install golem15.<name>` (module; `--source` submodule) and `plugin:install <git-url>` (submodule) register like plugin:add and check requirements | ✓ VERIFIED | Unchanged; `internal/build` and `cmd/summer` untouched since a9237c8; short suite green in the previous run, no code change since |
|
||||
| SC-4 | Admin Plugins screen: installed plugins with versions and updates; Marketplace tab searches registry, install command with copy | ✓ VERIFIED | Unchanged; cabana and admin untouched since a9237c8 |
|
||||
| SC-5 | New code has unit tests in the last plan | ✓ VERIFIED | Plus `TestDeriveMissingReplace` for 87921c2 |
|
||||
|
||||
**Note on `jakub/sm-bm-plugin`.** The anonymous search also returns `jakub/sm-bm-plugin` (public, a Go plugin with `go.mod` and `plugin.go`, no `plugin.yaml`). It sits in a personal namespace, uses vendor `jz` and is mounted only in `sm-bm-app` (`plugins/jz/bm`). The phase goal covers "the public Golem15 plugins", and the previous verifications used the same golem15-organisation scope, so it is recorded here as information, not a gap. If it is not meant to be public, making it private settles the question.
|
||||
|
||||
### Plan must-haves (summary)
|
||||
|
||||
| Plan | Truths | Status | Notes |
|
||||
|------|--------|--------|-------|
|
||||
| 34-01 kiosk, plugin:manifest, PluginInfo | 10 | 10 ✓ | `scaffold.go:368` delegates to `kiosk.ReadIdentity`; generated main calls `party.Describe` before `party.Activate` (`build.go:139`); `plugin:manifest` calls `kiosk.Check/Generate/Write`; README table lists kiosk; docs checker passes |
|
||||
| 34-02 plugin.yaml rollout | 7 | 7 ✓ (as scoped) | 21 manifests in 20 repos (pgstripe/subscriptions nested), chatbots requires chat v0.1.3 (no v0.0.0), all unpushed (ahead >= 1), no tags at HEAD. Scope vs roadmap: see SC-1 gap |
|
||||
| 34-03 registry and /marketplace | 9 | 9 ✓ | WR-05/07/08/09 fixes present; changelog-post registry token only (WR-04, docs follow-up 997585b) |
|
||||
| 34-04 plugin:install / plugin:update | 9 | 9 ✓ | `registryFor` reads `plugins.registry_url`, empty disables; fetchguard client with cap/timeout; CR-01, CR-02, WR-02, WR-03, WR-11 fixes and tests present |
|
||||
| 34-05 admin Plugins screen | 6 | 6 ✓ | `PermissionViewPlugins = "backend.view_plugins"`; settings entry gated; openapi `--check` PASS; WR-06 bounded cache (256), WR-10 compatibility |
|
||||
| 34-06 tests, gate, ledger | 6 | 6 ✓ | `scripts/check-phase34.sh --self-test` detectors PASS; 34-release-log.md complete with Executed steps empty; 34-VALIDATION per-task map filled, Wave 0 ticked |
|
||||
| 34-01 kiosk, plugin:manifest, PluginInfo | 10 | 10 ✓ | 87921c2 changes `kiosk/identity.go` (see below); README and docs updated in the same commit; docs checker passes |
|
||||
| 34-02 plugin.yaml rollout | 7 | 7 ✓ | 25 manifests in 24 repos, all fresh (gate `--plugins`, re-run) |
|
||||
| 34-03 registry and /marketplace | 9 | 9 ✓ | No change |
|
||||
| 34-04 plugin:install / plugin:update | 9 | 9 ✓ | No change |
|
||||
| 34-05 admin Plugins screen | 6 | 6 ✓ | No change |
|
||||
| 34-06 tests, gate, ledger | 6 | 6 ✓ | Gate `PLUGIN_REPOS` has 24 entries and passes; release log rows 21-24 list the four new tags (golem v0.1.2, feedback v0.1.2, quizzes v0.1.1, presentations v0.1.2 on 3eb4de7) and eight pointer bumps; all eight current pointers match the committed gitlinks and every target is a descendant of them. One prose sentence below the pointer table still carries the old counts (warning below) |
|
||||
|
||||
**Score:** 51/52 truths verified (5 roadmap SCs + 47 plan truths; 0 present-but-behavior-unverified)
|
||||
**Score:** 52/52 truths verified (5 roadmap SCs + 47 plan truths; 0 present-but-behavior-unverified)
|
||||
|
||||
### 87921c2: fetch a required module whose replace directory is missing
|
||||
|
||||
`resolver.list` (`modules/kiosk/identity.go`) now marks a `go list -m -e -json` entry as `fallback` when it has a `Dir`, no `Error` and the directory does not exist, and clears `Dir`/`GoMod` so `download` fetches it at the go.mod-required version. `minimums` downloads fallbacks in their own `go mod download` batch, after the framework-requiring candidates, and after the download skips a fallback whose go.mod does not require the framework.
|
||||
|
||||
- **Correctness:** `TestDeriveMissingReplace` (file:// proxy, offline) PASS: with `../user` absent, `acme.user` gets `v0.1.2`; with a version the proxy lacks, the minimum is `""` and there is one "not matched" warning.
|
||||
- **Real layout:** in `sm-feedback-plugin`, with a temporary go.work that replaces only the framework (so go.mod's `replace sm-user-plugin => ../user` points at a directory that does not exist), `summer plugin:manifest --check .` prints `plugin.yaml is up to date` (`golem15.user: v0.1.0`). The manifest is the same in both layouts, as the commit claims.
|
||||
- **No regression:** an existing replace directory, or a module-cache module, keeps its `Dir`, so the path is unchanged. A fallback at `v0.0.0` or without a version is dropped as before (the old code read a missing go.mod and skipped it). Gate `--plugins` reports all manifests fresh; `go test -short ./...` is green.
|
||||
- **Info:** all fallbacks share one download, so one unfetchable fallback version drops the minimums of the other fallbacks too, with a warning. The commit message says "one unfetchable version does not hold up the others", which is true only of fallbacks against candidates. A standalone checkout whose sibling replace is missing now reaches the module proxy (network) in `TestPluginManifest`.
|
||||
|
||||
### Required Artifacts
|
||||
|
||||
| Artifact | Status | Details |
|
||||
|----------|--------|---------|
|
||||
| `modules/kiosk/{manifest,identity,check,registry,version,client}.go` | ✓ VERIFIED | 23-621 lines each, all contain the required symbols |
|
||||
| `modules/party/info.go` | ✓ VERIFIED | `Describe`, `Installed`; used by generated main and cabana |
|
||||
| `internal/build/{plugindirs,install,source,update,rollback}.go` | ✓ VERIFIED | `EffectiveFramework`, `PlanInstall`, `go work edit`, `Update`, snapshot/undo |
|
||||
| `modules/cabana/plugins.go` | ✓ VERIFIED | 599 lines, wired in `http.go:345-346` |
|
||||
| `admin/src/views/PluginsView.vue` + `admin/tests/views/PluginsView.test.ts` | ✓ VERIFIED | Routed in `router.ts:76`, built into `modules/boardwalk/dist` |
|
||||
| `../sm-*-plugin/plugin.yaml`, `manifest_test.go` (20 repos) | ✓ VERIFIED | Tracked, clean, up to date |
|
||||
| site plugin `registry/ingest.go`, `controllers/api/registry.go`, `updates/202610300001_*`, `registry_smoke_test.go` | ✓ VERIFIED | Docker tests pass |
|
||||
| vue `changelog/app/pages/marketplace/index.vue`, `composables/useRegistry.ts` | ✓ VERIFIED | Types mirror kiosk JSON tags |
|
||||
| `../sm-summercmsio-app/scripts/changelog-post.py` | ✓ VERIFIED | manifest check and ingest-now; 51 unittest cases in gate `--site` |
|
||||
| `scripts/check-phase34.sh` | ✓ VERIFIED | Fail-closed stages, self-test |
|
||||
| `modules/kiosk/{manifest,identity,check,registry,version,client}.go` | ✓ VERIFIED | identity.go +40/-9 (87921c2), substantive |
|
||||
| `modules/kiosk/derive_test.go` | ✓ VERIFIED | `TestDeriveMissingReplace`, `writeProxyModule` |
|
||||
| `../sm-{golem,feedback,quizzes,presentations}-plugin/{plugin.yaml,manifest_test.go}` | ✓ VERIFIED | Tracked, generated header, `framework: v0.6.0`; feedback/quizzes/presentations `requires: golem15.user: v0.1.0`; golem no requires; overrides block where `--name` was used |
|
||||
| `../sm-presentations-plugin/README.md` | ✓ VERIFIED | cfa0c40 (rebased), H1 "Presentations" + summary paragraph that the manifest's name and description come from |
|
||||
| `scripts/check-phase34.sh` | ✓ VERIFIED | `PLUGIN_REPOS` 24 entries |
|
||||
| `34-release-log.md` | ✓ VERIFIED | Rows 21-24, eight pointer rows and the 2026-10-30 presentations note match git; one stale prose sentence (warning) |
|
||||
| All other artifacts | ✓ VERIFIED | Unchanged since the previous run |
|
||||
|
||||
### Key Link Verification
|
||||
|
||||
| From | To | Via | Status |
|
||||
|------|----|-----|--------|
|
||||
| kiosk/identity.go | build/scaffold.go | `kiosk.ReadIdentity` | WIRED |
|
||||
| build/build.go | party/info.go | `party.Describe(app, PluginInfo, FrameworkVersion)` before `party.Activate` | WIRED |
|
||||
| cmd/summer/main.go | kiosk/check.go | `kiosk.Check/Generate/Write` | WIRED |
|
||||
| cmd/summer/main.go | build/install.go | `build.PlanInstall` then `build.ApplyInstall` | WIRED |
|
||||
| build/install.go | kiosk/client.go | `kiosk.NewestCompatible` vs `EffectiveFramework` | WIRED |
|
||||
| cabana/plugins.go | party/info.go | `app.Lookup[party.Installed]()` | WIRED |
|
||||
| cabana/plugins.go | kiosk/client.go | `kiosk.RegistryURL`, `NewClient`, `NewestCompatible`, `BaseVersion` | WIRED |
|
||||
| PluginsView.vue | cabana/plugins.go | `api.GET('/plugins')`, `api.GET('/plugins/marketplace')` | WIRED |
|
||||
| site ingest.go | kiosk/manifest.go | `kiosk.Parse` + `kiosk.Validate` | WIRED |
|
||||
| site controllers/api/registry.go | kiosk/registry.go | `kiosk.ListResponse/DetailResponse/VersionsResponse/ErrorResponse` | WIRED |
|
||||
| sm-*-plugin/manifest_test.go | kiosk/check.go | `kiosk.CheckT(t, ".")` | WIRED (20/20) |
|
||||
| check-phase34.sh | phase tests | required names in go test -json | WIRED |
|
||||
|
||||
### Data-Flow Trace (Level 4)
|
||||
|
||||
| Artifact | Data | Source | Real data | Status |
|
||||
|----------|------|--------|-----------|--------|
|
||||
| PluginsView Installed tab | `overview.plugins` | cabana `/plugins` <- `party.Installed` <- generated `PluginInfo` from plugin.yaml + git describe at build | Yes | ✓ FLOWING |
|
||||
| PluginsView Marketplace tab | `market.data` | cabana `/plugins/marketplace` <- kiosk.Client <- registry API | Yes | ✓ FLOWING |
|
||||
| /marketplace pages | `registry.list/detail/versions` | useRegistry -> /api/registry/v1 -> registry/query.go (DB) <- ingester | Yes | ✓ FLOWING |
|
||||
| sm-*-plugin/manifest_test.go | kiosk/check.go | `kiosk.CheckT(t, ".")` | WIRED (24/24 repos, 25 packages) |
|
||||
| kiosk `minimums` | kiosk `download` | fallback batch then `requiresFramework` | WIRED |
|
||||
| check-phase34.sh `--plugins` | 24 sibling repos | `PLUGIN_REPOS`, `summer plugin:manifest --check` | WIRED |
|
||||
| sm-bm-app / sm-demo-app presentations gitlinks | sm-presentations-plugin 3eb4de7 | fast-forward (ancestry) | WIRED (d205cd7 and 5bcbaaf both ancestors) |
|
||||
| All other links | | | WIRED (unchanged) |
|
||||
|
||||
### Behavioral Spot-Checks
|
||||
|
||||
| Behavior | Command | Result | Status |
|
||||
|----------|---------|--------|--------|
|
||||
| go vet + short suite | `go vet ./... && go test -short ./...` | exit 0 | ✓ PASS |
|
||||
| Manifest check on a plugin and a nested plugin | `summer plugin:manifest --check ../sm-faq-plugin`, `../sm-pgstripe-plugin/subscriptions` | "is up to date", rc=0 | ✓ PASS |
|
||||
| Commands registered | `summer list` | plugin:add/install/manifest/update listed | ✓ PASS |
|
||||
| Review-fix regression tests | `go test -short ./internal/build -run 'TestUpdatePseudoVersion|TestInstallSharedModule|TestLegacyFramework|TestResolveInstall'`; cabana `TestPluginsEndpoints|TestPluginsScreenSmoke`; kiosk all | ok | ✓ PASS |
|
||||
| Anonymous fetch | `git ls-remote https://git.golem15.com/golem15/<repo>.git` x20 | refs returned for all | ✓ PASS |
|
||||
| Nothing tagged | `git tag --points-at HEAD` in 20 repos; `tag -l 'v0.6*'` | empty | ✓ PASS |
|
||||
| go vet + short suite (framework) | `go vet ./... && go test -short -count=1 ./...` | exit 0 in the previous run; no framework code changed since | ✓ PASS |
|
||||
| New kiosk test | `go test -short ./modules/kiosk -run TestDeriveMissingReplace -v` | PASS (previous run) | ✓ PASS |
|
||||
| Fallback layout | `GOWORK=<framework-only go.work> summer plugin:manifest --check .` in sm-feedback-plugin | "plugin.yaml is up to date" | ✓ PASS |
|
||||
| Anonymous fetch (4 new) | `git -c credential.helper= ls-remote https://git.golem15.com/golem15/<repo>.git` | refs returned | ✓ PASS |
|
||||
| Forge scope | anonymous `/api/v1/orgs/golem15/repos`, `/repos/search?q=sm-`, `?q=plugin` | 24 public golem15 sm-*-plugin repos, all in PLUGIN_REPOS | ✓ PASS |
|
||||
| Presentations plugin (this run) | `go vet ./... && go test -short -count=1 ./...`; `summer plugin:manifest --check .` | exit 0; up to date | ✓ PASS |
|
||||
| Ledger pointers vs gitlinks (this run) | `git ls-tree HEAD plugins/golem15/presentations` in sm-bm-app and sm-demo-app; `merge-base --is-ancestor` | d205cd7 and 5bcbaaf, as in the ledger; both ancestors of 3eb4de7 | ✓ PASS |
|
||||
|
||||
### Probe Execution
|
||||
|
||||
| Probe | Command | Result | Status |
|
||||
|-------|---------|--------|--------|
|
||||
| `scripts/check-phase34.sh --all` | `bash scripts/check-phase34.sh --all` | self-test, go, plugins (sm-user-plugin TestRegisterCORSPath skip printed), site, admin, docs, marker, additive PASS; docker FAIL on `modules/wristband` TestOIDCSubjectIsRandomSmoke (`sub = "30badada-..."`; the test rejects a random UUID containing "ada") | see next row |
|
||||
| `scripts/check-phase34.sh --docker` (rerun) | `bash scripts/check-phase34.sh --docker` | `phase34 docker passed` (framework `go test ./...`, TestInstallSmoke, site TestRegistrySmoke/APIShapes/IngestEndpoint); the wristband test passes alone | PASS |
|
||||
| `scripts/check-phase34.sh --plugins` | `bash scripts/check-phase34.sh --plugins` (this run) | `phase34 plugins passed (24 repositories)`, exit 0, 25 fresh manifests (sm-user-plugin TestRegisterCORSPath skip note, pre-existing) | PASS |
|
||||
| `scripts/check-phase34.sh --go --docs` | same (previous run) | `PASS go`, `PASS docs`, exit 0 | PASS |
|
||||
| `scripts/check-phase34.sh --self-test --marker --additive` | same (previous run) | all PASS, exit 0 | PASS |
|
||||
|
||||
The wristband failure is a pre-existing flake outside the phase (no wristband change since v0.5.3): `oidc_security_test.go:150` fails whenever the random v4 UUID happens to contain "ada" (about 0.7% of runs).
|
||||
Only `--plugins` was re-run: since the previous verification the only commit is c739a7d (planning docs) plus the plugin-repo rebase, which `--plugins` covers. The site, admin and docker stages passed in earlier runs and nothing they cover has changed.
|
||||
|
||||
### Requirements Coverage
|
||||
|
||||
REQUIREMENTS.md has no IDs for Phase 34 ("Requirements: TBD"). Phase-local IDs from plan frontmatter:
|
||||
|
||||
| ID | Plans | Status | Evidence |
|
||||
|----|-------|--------|----------|
|
||||
| SC-1 | 01, 02, 06 | ✗ PARTIAL | see gap |
|
||||
| SC-2 | 03, 06 | ✓ SATISFIED | registry, API, admin, pages, tests |
|
||||
| SC-3 | 04, 06 | ✓ SATISFIED | install/update + TestInstallSmoke |
|
||||
| SC-4 | 01, 05, 06 | ✓ SATISFIED | cabana endpoints + PluginsView |
|
||||
| SC-5 | 06 | ✓ SATISFIED | unit tests, gate |
|
||||
| D-01..D-05 | 01, 02, 06 | ✓ SATISFIED | generated manifest, const reader, overrides block, `--check`/CheckT, Go-style minimums |
|
||||
| D-06, D-07 | 01, 05 | ✓ SATISFIED | PluginInfo baked, git describe / build-info versions |
|
||||
| D-08..D-12 | 04, 06 | ✓ SATISFIED | newest compatible, transitive deps + `--yes`, plugin:update, git URL submodule-only, `--offline` |
|
||||
| D-13..D-16 | 03, 06 | ✓ SATISFIED | pull ingester + ingest-now, curated listing, version rows, public API v1 |
|
||||
| D-17, D-18 | 04, 05 | ✓ SATISFIED | SPA talks only to cabana; `plugins.registry_url` (empty disables) |
|
||||
| D-19 | 05 | ✓ SATISFIED | `backend.view_plugins`, superusers pass |
|
||||
| SC-1 | 01, 02, 06 | ✓ SATISFIED | 24/24 public golem15 plugin repos |
|
||||
| SC-2..SC-5 | | ✓ SATISFIED | unchanged |
|
||||
| D-01..D-19 | | ✓ SATISFIED | unchanged; D-05 (Go-style minimums) extended by 87921c2 |
|
||||
|
||||
No orphaned IDs.
|
||||
|
||||
@@ -157,37 +158,36 @@ No orphaned IDs.
|
||||
|
||||
| File | Line | Pattern | Severity | Impact |
|
||||
|------|------|---------|----------|--------|
|
||||
| (phase files, 3 repos) | - | TBD/FIXME/XXX | - | none found |
|
||||
| internal/build/build_test.go | 1137 | "TODO: run summer make:model" | ℹ️ Info | expected scaffold output in a test, not a debt marker |
|
||||
| modules/wristband/oidc_security_test.go | 150 | random UUID substring check | ℹ️ Info | flaky (outside phase), failed one `--all` docker run |
|
||||
| 87921c2 files, the four new plugin files, c739a7d | - | TBD/FIXME/XXX | - | none found |
|
||||
| `34-release-log.md` | 209 | stale counts: "presentations 12 commits after sm-demo-app's v0.1.1 and 2 after sm-bm-app's 30a47ac" | ⚠️ Warning | Now 13 after v0.1.1 (row 24 already says 13) and 2 after sm-bm-app's d205cd7 (3 after 30a47ac). The fast-forward claim itself is true; the table rows two lines above and the closing note are correct, so following the ledger does the right thing. The previous gap asked for this sentence to be corrected and c739a7d did not touch it |
|
||||
| `34-02-SUMMARY.md` | 260 | same stale sentence ("12 commits after sm-demo-app's v0.1.1 and 2 after sm-bm-app's 30a47ac") | ⚠️ Warning | Same correction |
|
||||
| `34-release-log.md` | 241 | "the three of the SC-1 gap closure" followed by four URLs | ℹ️ Info | Wording from 211be60; should say four |
|
||||
| `modules/kiosk/identity.go` | minimums | fallbacks share one download batch | ℹ️ Info | one unfetchable fallback hides the others' minimums (with a warning) |
|
||||
| `../sm-oauthserver-plugin/go.work` | - | tracked file modified since 2026-10-23 | ℹ️ Info | pre-existing, outside the phase |
|
||||
| `../sm-demo-app/plugins/golem15/oauthserver` | - | worktree at b6a9586, committed gitlink 8bbec72 | ℹ️ Info | both are ancestors of d600e2c, so the bump is still a fast-forward |
|
||||
| `../sm-bm-app/plugins/golem15/presentations` | - | mount master ahead 1 of origin (d205cd7) | ℹ️ Info | expected until `../sm-presentations-plugin` master is pushed, as the ledger note says |
|
||||
|
||||
### Advisory (New Scope, Unevidenced)
|
||||
|
||||
None.
|
||||
|
||||
### Human Verification Required
|
||||
|
||||
1. **Live /marketplace:** after the deploy, list, search, category and detail pages in light and dark themes.
|
||||
2. **Production ingest:** registry-add the fourteen launch URLs, ingest, curl the API (release log step 7).
|
||||
2. **Production ingest:** registry-add the launch URLs, ingest, curl the API (release log step 7).
|
||||
3. **Admin Plugins screen:** Installed and Marketplace tabs against the live registry, light and dark themes, copy to clipboard.
|
||||
4. **Real-terminal installs:** `summer plugin:install golem15.faq`, `--source`, a private git URL over ssh/https, and `summer plugin:update` with the interactive prompt.
|
||||
5. **Fix semantics:** CR-01, CR-02 and WR-10 version and compatibility rules (34-REVIEW-FIX.md flags them); their regression tests pass.
|
||||
|
||||
These are user-gated by design (deploy, push, tags, a real browser and terminal), so the status is human_needed rather than passed.
|
||||
|
||||
### Gaps Summary
|
||||
|
||||
One gap, and it is about scope rather than code. The machinery for SC-1 is complete and verified: the framework generates and validates plugin.yaml, and 20 public plugin repositories carry a generated, checked manifest and can be fetched anonymously. But git.golem15.com has four more public SummerCMS plugin repositories with no plugin.yaml: sm-feedback-plugin, sm-golem-plugin, sm-presentations-plugin and sm-quizzes-plugin. 34-02-PLAN left them out under "user decision 5" because they have no sibling checkout. That narrows the roadmap's "every public sm-*-plugin repo", and nothing records the narrowing as an override. No later phase covers them.
|
||||
No gaps remain. The release-ledger regression is closed. In `../sm-presentations-plugin` the README and manifest commits now sit on top of d205cd7, the same commit sm-bm-app points at. Both app pointers (sm-bm-app d205cd7, sm-demo-app 5bcbaaf = v0.1.1) are ancestors of 3eb4de7, so both bumps are fast-forwards and v0.1.2 carries the sztab theme. The plugin tree is clean, its tests, vet and manifest check pass, and the phase gate passes over all 24 repositories. The ledger rows and 34-02-SUMMARY name the new SHAs, and no b6247aa/bb81f4d reference is left in the phase docs.
|
||||
|
||||
**This looks intentional.** To accept the deviation, add to this file's frontmatter:
|
||||
|
||||
```yaml
|
||||
overrides:
|
||||
- must_have: "Every public sm-*-plugin repo carries a plugin.yaml manifest (ID, module path, name, description, required framework version, required plugins) that the framework validates, and anyone can fetch the repo anonymously."
|
||||
reason: "User decision 5 (2026-10-29): the launch set is the public plugins checked out next to the framework; sm-feedback, sm-golem, sm-presentations and sm-quizzes get plugin.yaml later"
|
||||
accepted_by: "Jakub"
|
||||
accepted_at: "<ISO timestamp>"
|
||||
```
|
||||
|
||||
The other route is to repeat the 34-02 rollout for the four repositories, which is a small, mechanical change.
|
||||
|
||||
Everything else is in place. No code change of the phase was found missing, stubbed or unwired. All 13 code-review fixes are committed with regression tests. The release (v0.6.0 tag, plugin tags, pointer bumps, deploy) is user-gated in 34-release-log.md, and nothing is pushed or tagged.
|
||||
One warning remains. The fast-forward sentence below the pointer table (release log line 209, repeated in 34-02-SUMMARY line 260) still says "12 commits after sm-demo-app's v0.1.1 and 2 after sm-bm-app's 30a47ac". It should say 13, and 2 after sm-bm-app's d205cd7. This is a two-number edit. The sentence's claim is still true and the rows are correct, so it does not block.
|
||||
|
||||
---
|
||||
|
||||
_Verified: 2026-10-29T23:40:00Z_
|
||||
_Verified: 2026-10-30T11:38:52Z_
|
||||
_Verifier: Claude (msd-verifier)_
|
||||
|
||||
@@ -206,7 +206,7 @@ Pending gitlinks (from 34-02 and 34-03; "tag" is the tagged commit):
|
||||
| sm-demo-app | plugins/golem15/presentations | 5bcbaaf | v0.1.2 (3eb4de7) |
|
||||
| sm-bm-app | plugins/golem15/presentations | d205cd7 (committed in 9929195) | v0.1.2 (3eb4de7) |
|
||||
|
||||
40 plugin gitlinks plus the vue app link (the last eight rows come from the SC-1 gap closure). Every non-chat bump is a fast-forward (checked in 34-02; the gap-closure targets are fast-forwards of the commit each app points at today: golem, feedback and quizzes one commit on top, presentations 12 commits after sm-demo-app's v0.1.1 and 2 after sm-bm-app's 30a47ac). No application mounts chatvideo, forum, herald or userfriends: those need only their tag. sm-grzybyfunkcjonalne-app (1) and fonoteka.go (39) already carry unpushed commits of their own; sm-summercmsio-app's working tree already shows its two gitlinks modified (left uncommitted by 34-03 and 34-06 on purpose).
|
||||
40 plugin gitlinks plus the vue app link (the last eight rows come from the SC-1 gap closure). Every non-chat bump is a fast-forward (checked in 34-02; the gap-closure targets are fast-forwards of the commit each app points at today: golem, feedback and quizzes one commit on top, presentations 13 commits after sm-demo-app's v0.1.1 and 2 after sm-bm-app's d205cd7). No application mounts chatvideo, forum, herald or userfriends: those need only their tag. sm-grzybyfunkcjonalne-app (1) and fonoteka.go (39) already carry unpushed commits of their own; sm-summercmsio-app's working tree already shows its two gitlinks modified (left uncommitted by 34-03 and 34-06 on purpose).
|
||||
|
||||
For sm-summercmsio-app the framework bump is already committed (97c0c08 `chore: require summercms v0.6.0`); `scripts/build.sh dev` regenerates `main.go` and `plugins.gen.go`, which 34-03 restored to the committed versions: commit the regeneration in step 3.
|
||||
|
||||
@@ -238,7 +238,7 @@ From `../sm-summercmsio-app/DEPLOY.md`, "Plugin marketplace (the release that br
|
||||
https://git.golem15.com/golem15/sm-user-plugin.git
|
||||
```
|
||||
|
||||
`sudo -u summercms ./bin/summercms-io summercms:registry-add <the fourteen URLs>` then `summercms:registry-ingest` (first ingest, one line per repository). Only tags carrying a `plugin.yaml` are listed, so each repository publishes from its new tag; older tags are noted and skipped. The six repositories tagged for the first time here (chatchannels, chatvideo, forum, herald, userfriends, chatbots) can be added the same way when Jakub wants them listed, and so can the three of the SC-1 gap closure (`https://git.golem15.com/golem15/sm-golem-plugin.git`, `sm-feedback-plugin.git`, `sm-quizzes-plugin.git`, `sm-presentations-plugin.git`), which already had releases.
|
||||
`sudo -u summercms ./bin/summercms-io summercms:registry-add <the fourteen URLs>` then `summercms:registry-ingest` (first ingest, one line per repository). Only tags carrying a `plugin.yaml` are listed, so each repository publishes from its new tag; older tags are noted and skipped. The six repositories tagged for the first time here (chatchannels, chatvideo, forum, herald, userfriends, chatbots) can be added the same way when Jakub wants them listed, and so can the four of the SC-1 gap closure (`https://git.golem15.com/golem15/sm-golem-plugin.git`, `sm-feedback-plugin.git`, `sm-quizzes-plugin.git`, `sm-presentations-plugin.git`), which already had releases.
|
||||
7. Curl the API:
|
||||
|
||||
```sh
|
||||
|
||||
Reference in New Issue
Block a user