browser/openspec/changes/implement-production-operations-governance/tasks.md

1. OpenSpec and Architecture

• 1.1 Create proposal, design, spec, and task artifacts for production operations governance.
• 1.2 Run openspec validate implement-production-operations-governance --strict before implementation.

2. Platform Capacity, Alerts, and Lifecycle

• 2.1 Add domain/DTO/validator/model/repo/service support for production capacity governance and safe admission decisions.
• 2.2 Add durable alert records with acknowledge, resolve, scoped retry, audit linkage, deduplication, and safe diagnostic text.
• 2.3 Add complete plugin lifecycle installation state, compatibility gates, idempotency fences, upgrade/rollback/retire operations, and job/audit/alert integration.
• 2.4 Add real AI Provider client integration plus redacted provider failure handling and alert/audit evidence.
• 2.5 Add AI config diff preview/approval persistence and dispatch gating before run-side config write jobs.
• 2.6 Update Platform API routes, route docs, protocol docs, and tests.

3. Plugin SDK and Bridge

• 3.1 Extend manifest schema and examples with production lifecycle and AI purpose declarations.
• 3.2 Extend SDK/bridge contracts to request lifecycle/AI through Platform-mediated capabilities only.
• 3.3 Add validation/typecheck/tests proving unsafe lifecycle input and raw credential/direct Run fields are rejected.

4. Run Protocol and Runtime

• 4.1 Extend Run protocol capacity reports and job metadata with bounded pressure/lifecycle fields only.
• 4.2 Update Run runtime capacity reporting and lifecycle handling without blocking control/job/log/artifact channels.
• 4.3 Add Run tests for capacity sanitization, channel isolation under backlog, and lifecycle metadata validation.

5. platform_web Console

• 5.1 Add typed API/contracts for capacity governance, alerts, plugin lifecycle, AI diff preview, and approval.
• 5.2 Surface alerts and capacity on overview, server detail, maintenance, and operation history with confirmation, busy state, scoped retry, persisted responses, and failure recovery.
• 5.3 Surface full plugin lifecycle and AI diff approval in existing first-party pages using shared themed surfaces.
• 5.4 Add tests for permissions, duplicate prevention, failed recovery, forbidden-field omission, and 390px theme-safe rendering.

6. Verification

• 6.1 Run platform Go tests.
• 6.2 Run independent Run Go tests.
• 6.3 Run plugins typecheck, tests, and manifest validation.
• 6.4 Run platform_web typecheck, tests, and production build.
• 6.5 Run browser acceptance for the five first-party areas, server detail, alerts, plugin lifecycle, AI diff approval, desktop and 390px, black-mecha and magical-girl.
• 6.6 Scan rendered outputs for raw key/token/secret/base URL secret/path/PID/socket/credential/DSN/RCON/direct Run endpoint fragments.
• 6.7 Run scripts/check-structure.sh, openspec validate implement-production-operations-governance --strict, and both repository git diff --check.
• 6.8 Record real verification evidence in this file before marking verification tasks complete.

Verification Evidence

• 2026-07-18 19:02 CST: cd platform && go test ./... passed for all Platform packages; cd /Users/tasia/Desktop/code/run && go test ./... passed for the independent Run repository.
• cd plugins && npm run typecheck, npm test -- --run, and npm run validate:manifest passed: 1 test file / 19 tests and all three example manifests validated. The manifest command was rerun outside the filesystem sandbox because tsx requires a local IPC pipe.
• cd platform_web && npm run typecheck, npm test -- --run, and npm run build passed: 26 test files / 135 tests, 1,829 production modules transformed, and the production bundle completed successfully.
• scripts/local-debug-smoke.sh and npm --prefix platform_web run acceptance:browser passed against the real local Platform and independent Run stack rooted at /private/tmp/browser-local-debug-acceptance-10o. node --check platform_web/acceptance/browser-acceptance.mjs and bash -n scripts/local-debug-env.sh scripts/local-debug-smoke.sh scripts/local-debug-start.sh also passed.
• Capacity evidence recorded a persisted denied admission with bounded queue.limit and capability.missing pressure codes plus a linked durable alert and audit event. Alert cancellation preserved active; confirmed acknowledgement persisted acknowledged, actor, timestamp, and audit linkage.
• Plugin lifecycle install and enable each produced durable Platform jobs. The persisted installation reached the requested enabled state with linked job and audit IDs; browser scans passed after the lifecycle interactions.
• AI diff cancellation preserved pending; explicit approval persisted approved and dispatched exactly one config.write job. Independent Run completed that job as succeeded with a safe file.write result at version 2 and an atomic compare-and-swap file write audit summary; Platform configuration advanced from version 1 to 2 before the subsequent real process.stop request.
• Browser acceptance covered 首页、服务器管理、插件市场、用户管理、AI 提供商管理, server detail, maintenance/operation history, alert closure, plugin lifecycle, and AI diff approval in four scenarios: 1440x960 and 390x844 for mecha-black and magical-girl. All 38 route/interaction checks reported zero horizontal overflow, zero overlapping controls, and no tiny visible text boxes.
• API and rendered-output scans passed for raw key/token/secret/base URL secret, host path, PID, socket, credential, DSN, RCON, session/direct Run endpoint, and plugin-owned transport fragments. Confirm/cancel, busy duplicate prevention, persisted terminal state, real failure recovery, and scoped retry evidence are included in the structured artifact.
• scripts/check-structure.sh, openspec validate implement-production-operations-governance --strict, the main repository git diff --check, and the independent Run repository git diff --check passed. These gates were rerun after recording this evidence.
• Structured browser evidence: /private/tmp/browser-local-debug-acceptance-10o/browser-acceptance/browser-acceptance-evidence.json and /private/tmp/browser-local-debug-acceptance-10o/browser-acceptance/item-10-evidence.json. Durable Platform/Run result snapshot: /private/tmp/browser-local-debug-acceptance-10o/platform/metadata.json.