Repository navigation
feat(catalog): add curated catalog and lightweight submission workflow - #5
Merged
Merged
Conversation
Lucas1479
marked this pull request as ready for review
October 22, 2026 16:05
Lucas1479
added a commit
to Code-Amadeus/Amadeus
that referenced
this pull request
Oct 22, 2026
## Behavior and ownership Adds a functional plugin-store prototype to the existing installer: official catalog browsing/details, progress/cancellation, manual updates, HTTPS mirror downloads, withdrawal, durable blocking/unblocking and damage recovery. The empty catalog remains visible as a preview. Authors use a minimal hashed static-check environment and one submission PR; maintainers use the official reproducible generation/review/publication tools in the companion repository. Electron main owns source resolution, artifact hashes, install transactions and durable security facts. Renderer requests package ID/version only. No new runtime capabilities, automatic updates or rollback guarantee. Admission restrictions remain separate from the runtime contract. Display-cache damage cannot erase known bans; ambiguous settings/backup damage fails closed. Mirrors never replace the official index. ## Integrated review fixes - Merged the already-landed UI/icon and bundled-dictionary mainline while preserving both store and installed-package journeys. Four status colors remain unchanged by user decision; dictionary stays rc2. - Package all `server/extensions/*.schema.json`. Test the actual packaged helper with real v0 and v1 wheel contents, including a negative missing-schema check in isolated staging. - Adapt lifecycle probes to package-scoped card switches, details/removal and sidebar navigation. Keep enable intent separate from configuration drafts. Retain focus using the existing artifact drawer keyboard contract. - Use `catalog/v1/index.json`, locked wallpaper restore and streamed downloads with backpressure/stall timeout. Keep source identity checks strict. - Protocol [Amadeus-Extensions PR #4](Code-Amadeus/Amadeus-Extensions#4) and [PR #5](Code-Amadeus/Amadeus-Extensions#5) are merged. Trusted catalog admission is a separate isolated workflow and now a strict required check on protocol main. A negative then positive real PR qualification was run and closed without merge. Checker SHA `1840c8e4` is retained by `extension-catalog-checker-d1`. - Upgrade only transitive `opentelemetry-api` from 1.44.0 to 1.45.1 after fresh CI audit reported CVE-2026-114603; no new audit ignore. ## Validation Local integration evidence: 603 Electron tests; 158 plugin Python tests (7 existing conditional skips); 31 author/icon/package tests (1 existing conditional skip); 42 packaging/release/dictionary tests (2 existing conditional skips); actual code-only Windows build; actual bundled v0/v1 validation; 27 store UI checks and 12 installed-settings UI checks. Dependency audit and environment consistency pass after the narrow lock update. Complete local source qualification passed 15 desktop + 14 plugin + 18 fault/recovery checks; actual packaged qualification passed 15 + 15 + 18. The official-tool packaged Git/HTTPS roundtrip passed 15 desktop + 27 lifecycle checks across six publications, four app restarts and five installed Notes MCP contract runs. Final merge remains gated on new-head CI. The construction record distinguishes the source run's pre-commit dirty identity from clean cd3f36f packaged/publication starts. Windows CI now executes the complete official-tool local Git/HTTPS publication flow against the packaged desktop, including updates, withdrawal, bans, unblock, restart and NUL damage recovery. Reports distinguish simulated damage from physical power loss and native MCP/TTS contracts from model turns. [Integration record](docs/verification/extensions/community-preview-batch12-2026-10-23.md) · [Repeatable demo](docs/extension_store_demo.md) · [Companion Extensions #5](Code-Amadeus/Amadeus-Extensions#5) No plugin packages or Releases are published by this PR. The fixed historical catalog checker continues to exclude v1 icon packages until a separate mainline checker/manifest-version compatibility qualification. The public runtime itself supports v0 and v1. Historical dated plans and Pi qualification changes are retained as reviewed development evidence.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
Defines the first curated catalog and a lightweight contribution path: an author runs one preflight command and opens one PR; maintainers review the exact wheel and use protected-base tooling to generate and verify an immutable publication. This supplies the distribution contract for the companion Host store without changing the runtime manifest or SDK.
The draft adds catalog schema/policy, ownership and per-digest review records, a public review checklist, a short submission template, deterministic generation/checks, wheel-content diffs, fresh candidate/live delivery verification and Windows CI pinned to a specific Host checker and Python version.
Boundaries
Validation
Windows / Python 3.12.10, explicit historical Host checkout and minimal hashed checker environment: 132 passed, 1 existing Windows symlink-privilege skip for the complete protocol suite.
The companion Host's fresh publisher-only Git/loopback-HTTPS exercise passed all 6 phases and 12 candidate/live validations, using real reference wheels and these tools. Wrong-digest submission is rejected before a same-submission revision proceeds; altered generated output and dropped safety facts remain rejected. Review identities/approved refs are synthetic, not GitHub approval evidence.
Earlier Windows/Linux SDK byte reproducibility and local full desktop results remain historical evidence. The existing proposal/SDK Actions checks passed on head 52578c1; real protected admission and repository governance/delivery remain separate acceptance gates. See verification, submission, and review checklist.
Audit fixes and bootstrap trust boundary
The public index is now catalog/v1/index.json. Its format never changes in place;
supported older clients continue receiving safety updates there. New formats use
new paths. The immutable checker SHA is retained by the annotated Git tag
extension-catalog-checker-d1 (not a Release).
Trusted admission moved out of the proposal test job into a separate read-only
pull_request_target workflow defined by protected base. It creates fresh private
environments, installs only base/Host hashed requirements, and executes only
base-approved code. Proposal tests, requirements, .pth and sitecustomize never run
there; no proposal-job cache/artifacts or checkout credentials are reused.
Local reproduction confirmed -I alone executes an injected .pth. Fresh admission
accepted valid empty data, ignored hostile proposal executable files and rejected
invalid safety data. Complete protocol suite remained 132 passed / 1 existing
conditional skip; fresh six-phase publication roundtrip passed.
First bootstrap is not self-certifying: the trusted workflow does not exist on
main yet. This empty bootstrap requires human workflow review; after it lands,
configure catalog-admission as a required check and exercise a deliberately invalid
proposal before accepting any package/publication PR. Current proposal CI and local
simulation do not close that governance gate. Repository settings are unchanged.
Companion and icon compatibility
Companion: Code-Amadeus/Amadeus#256. Its branch is pushed first so the unchanged fixed Host checker 1840c8e is available for this CI. The client catalog-policy pin remains unchanged; newer submission tools are maintainer-side.
The user selected a new manifest schema for parallel icon PR #4 / Host #255. They remain independently owned; the current fixed Host checker rejects icon. After that contract and the Host icon implementation are integrated, update/qualify the checker and dependent pins with a real icon-bearing wheel. Do not infer catalog eligibility from the new schema alone. Host UI/UX #255 also needs combined store/icon journey verification.
Keep this PR draft. No merge, public index/artifact release, branch-protection change or publishing credentials are requested.