browser/openspec/changes/implement-real-game-plugin-lifecycle-proof/tasks.md

1. Plugin Lifecycle Contract

• 1.1 Extend the local proof plugin manifest to declare platform-mediated lifecycle actions for create/install/start/stop/status/log/artifact operations.
• 1.2 Add plugin manifest validation tests that accept declared lifecycle capabilities and reject direct run URLs, raw sockets, host paths, bearer credentials, passwords, raw AI keys, and undeclared transport details.
• 1.3 Extend plugin SDK/example bridge envelopes so lifecycle requests carry only logical plugin, server, action, config, log, artifact, and AI capability references.
• 1.4 Run cd plugins && npm run typecheck && npm run test && npm run validate:manifest and record evidence.

2. Platform-Mediated Lifecycle API

• 2.1 Add or repair platform DTOs, validators, domain types, repository/service methods, and API handlers for plugin-mediated multi-instance create/install/start/stop/status operations.
• 2.2 Ensure platform owns authorization, server instance persistence, plugin installation checks, lifecycle job creation, state projection, audit events, and safe response DTOs.
• 2.3 Add platform tests proving one installed plugin can create at least two server instances with distinct IDs, names, lifecycle states, plugin associations, and operation histories.
• 2.4 Add negative platform tests proving browser/plugin payloads cannot expose or submit raw host paths, direct run sockets, bearer tokens, passwords, raw AI keys, or undeclared lifecycle actions.
• 2.5 Run cd platform && go test ./... -count=1 and record evidence.

3. Run Lifecycle Execution Proof

• 3.1 Add or repair run-side lifecycle handling for plugin-mediated install/start/stop jobs using scoped logical templates under RUN_WORKSPACE_ROOT.
• 3.2 Ensure run acknowledges lifecycle jobs, reports bounded progress/result metadata, preserves per-instance isolation, and rejects unsafe command templates, absolute paths, parent traversal, shell launchers, credentials, and direct sockets.
• 3.3 Add run tests proving start/stop on one instance does not mutate sibling instance state or block job result submission.
• 3.4 Run cd run && go test ./... -count=1 and record evidence.

4. Platform Web Proof Surface

• 4.1 Update platform_web API types/client methods, schemas, route/page contracts, and components needed to trigger plugin-mediated lifecycle actions from server management or plugin detail surfaces.
• 4.2 Preserve the magical-girl crystal-moonlight console style and avoid generic opaque SaaS restyling while adding lifecycle controls and operation status.
• 4.3 Add frontend tests for API-backed plugin lifecycle controls, two-instance separation, operation history rendering, role access, and unsafe-field redaction.
• 4.4 Run cd platform_web && npm run typecheck && npm test && npm run build and record evidence.

5. Local Full-Stack Proof

• 5.1 Start a local API-backed proof stack and record exact commands, including platform, run worker, and frontend commands such as PLATFORM_ADDR=127.0.0.1:18080 PLATFORM_STORAGE_BACKEND=file PLATFORM_DATA_DIR=/private/tmp/browser-platform-lifecycle-proof PLATFORM_METADATA_PATH=/private/tmp/browser-platform-lifecycle-proof/metadata.json PLATFORM_LOG_BODY_BACKEND=file PLATFORM_LOG_DIR=/private/tmp/browser-platform-lifecycle-proof/logs go run ./cmd/platform, RUN_MODE=worker RUN_PLATFORM_URL=http://127.0.0.1:18080 RUN_WORKSPACE_ROOT=/private/tmp/browser-run-lifecycle-proof/workspaces RUN_SPOOL_ROOT=/private/tmp/browser-run-lifecycle-proof/spool go run ./cmd/run, and cd platform_web && PLATFORM_API_PROXY=http://127.0.0.1:18080 VITE_PLATFORM_API_BASE_URL=/api/v1 npm run dev -- --port 5173.
• 5.2 Verify platform health, run registration/heartbeat, plugin installation data, and API-backed login before browser walkthrough; record exact curl or test commands used.
• 5.3 In a browser with a real API-backed platform administrator session, open 首页、服务器管理、插件市场、用户管理、AI 提供商管理 and confirm the session is not local fallback.
• 5.4 In the browser, use one installed local game management plugin to create two server instances, start one, verify the sibling remains stopped, stop the targeted instance, and inspect per-instance operation history.
• 5.5 In the browser, inspect plugin marketplace/detail, server list/detail, operation history, log/artifact references, and plugin bridge output to verify no raw host paths, run credentials, direct sockets, bearer tokens, raw AI keys, or plugin-owned transport details are visible.

6. Final Verification and Stream Handoff

• 6.1 Record implementation evidence in this tasks file only after each command or walkthrough has actually run.
• 6.2 Run scripts/check-structure.sh and record evidence.
• 6.3 Run openspec validate implement-real-game-plugin-lifecycle-proof --strict and record evidence.
• 6.4 Update openspec/changes/architecture-delivery-stream/delivery-plan.md to mark fix-env-profile-settings complete, mark implement-real-game-plugin-lifecycle-proof complete only after evidence exists, and leave the next queue item pending.
• 6.5 Update openspec/changes/architecture-delivery-stream/NEXT_CHANGE.md with the next implementation/generator handoff after this change closes.

Evidence

• Plugin contract:

  • cd plugins && npm run typecheck passed.
  • cd plugins && npm run test passed: tests/manifest-validation.test.ts passed 11 tests.
  • cd plugins && npm run validate:manifest passed after escalation for tsx IPC pipe creation: validated examples/dev-game-plugin/manifest.json.
  • plugins/examples/dev-game-plugin/manifest.json declares install/start/stop/restart/status lifecycle actions, jobs.dispatch, log/file/artifact/AI bridge actions, and platform-mediated permissions.
  • plugins/sdk/index.ts includes PluginLifecycleDispatchPayload and createLifecycleDispatchRequest(...) for jobs.dispatch lifecycle envelopes containing only logical plugin/server/action/capability/config/idempotency references.
  • plugins/tests/manifest-validation.test.ts asserts lifecycle dispatch envelopes do not contain direct http://, unix://, /Users/, Bearer , or sk- content.

• Platform lifecycle API:

  • cd platform && GOCACHE=/private/tmp/browser-go-build-cache go test ./api -run TestPluginBridgeExecuteAPI -count=1 passed.
  • cd platform && GOCACHE=/private/tmp/browser-go-build-cache go test ./... -count=1 passed for api, config, domain, dto, model, repo, service, and validator.
  • platform/service/server_lifecycle_test.go includes TestCoreServicePluginLifecycleManagesMultipleInstancesIndependently, creating server-alpha and server-beta from one plugin, starting/stopping only alpha, and verifying beta remains unchanged.
  • platform/api/resource_handlers_test.go includes jobs.dispatch lifecycle bridge execution coverage, action/capability mismatch denial, unsafe payload rejection, and forbidden-fragment response checks.

• Run lifecycle execution:

  • Initial sandbox run of cd run && GOCACHE=/private/tmp/browser-go-build-cache go test ./... -count=1 was blocked by httptest loopback bind permissions.
  • Escalated rerun of cd run && GOCACHE=/private/tmp/browser-go-build-cache go test ./... -count=1 passed for api, config, protocol, runtime, and spool.
  • run/runtime/lifecycle_test.go includes scoped template execution, unsafe template rejection, workspace escape rejection, cancellation, and sibling workspace isolation.

• Platform web proof surface:

  • cd platform_web && npm run typecheck passed.
  • cd platform_web && npm test passed: 11 files, 49 tests.
  • cd platform_web && npm run build passed: Vite built dist/index.html, CSS, and JS assets.
  • platform_web/pages/ServerDetailPage.test.tsx verifies plugin lifecycle controls call startServerInstance / stopServerInstance, skip install/restart/status controls, avoid generic process.start / process.stop job creation, and keep bridge/lifecycle output on platform-owned references.

• Controlled local full-stack proof:

  • Used controlled stack after an existing 127.0.0.1:18080 process became unreachable despite still holding the port.
  • Platform command run from platform/: PLATFORM_ADDR=127.0.0.1:18082 PLATFORM_STORAGE_BACKEND=file PLATFORM_DATA_DIR=/private/tmp/browser-platform-lifecycle-proof-controlled PLATFORM_METADATA_PATH=/private/tmp/browser-platform-lifecycle-proof-controlled/metadata.json PLATFORM_LOG_BODY_BACKEND=file PLATFORM_LOG_DIR=/private/tmp/browser-platform-lifecycle-proof-controlled/logs GOCACHE=/private/tmp/browser-go-build-cache go run ./cmd/platform.
  • Run worker command run from run/: RUN_MODE=worker RUN_PLATFORM_URL=http://127.0.0.1:18082 RUN_WORKSPACE_ROOT=/private/tmp/browser-run-lifecycle-proof/workspaces RUN_SPOOL_ROOT=/private/tmp/browser-run-lifecycle-proof/spool RUN_POLL_INTERVAL_MS=250 RUN_HEARTBEAT_INTERVAL_MS=1000 RUN_MAX_JOBS=4 GOCACHE=/private/tmp/browser-go-build-cache go run ./cmd/run.
  • Frontend command run from platform_web/: PLATFORM_API_PROXY=http://127.0.0.1:18082 VITE_PLATFORM_API_BASE_URL=/api/v1 npm run dev -- --port 5175.
  • Health/login/run checks passed with curl against 127.0.0.1:18082: /healthz returned {"service":"platform","status":"ok","version":"0.1.0-dev"}, /api/v1/run/endpoints returned online run-local with process.install, process.start, and process.stop, and /api/v1/auth/login authenticated operator.local@example.test / operator-local as user-admin.
  • Registered installed proof plugin game.lifecycle-proof@0.1.1 with lifecycle actions install/start/stop/restart/status, bridge actions server.instances.read/jobs.dispatch/logs.query/artifacts.open/files.request/ai.invoke, declared permissions for lifecycle/files/logs/artifacts/AI, and run-required capabilities narrowed to worker-real process.install, process.start, process.stop.
  • Created two server instances through platform workflow: proof-alpha and proof-beta; both install jobs completed via run worker and both reached ready.
  • Browser walkthrough on http://127.0.0.1:5175/ logged in with the API-backed platform administrator session and opened 首页、服务器管理、插件市场、用户管理、AI 提供商管理. Each page reported hasLocalFallback: false and no visible forbidden fragments among /Users/, /private/, unix://, tcp://, Bearer , sk-, password=, apiKeyRef, or rawApiKey.
  • Browser server detail walkthrough opened #/servers/proof-alpha, confirmed Proof Alpha was ready with start enabled, clicked 启动, confirmed the dialog, and observed a visible process.start queued operation.
  • API proof after UI start showed proof-alpha state running, proof-beta state ready, alpha start job server-lifecycle:proof-alpha:start:3981de20495ff68b succeeded with process.start completed, and beta had only its install job.
  • Browser detail walkthrough then refreshed proof-alpha, confirmed it was running with stop enabled, clicked 停止, confirmed the dialog, and observed a visible process.stop queued operation.
  • API proof after UI stop showed proof-alpha state stopped, proof-beta still ready, alpha install/start/stop jobs all succeeded, and beta still had only its install job.
  • Browser walkthrough visible surfaces did not expose raw host paths, run credentials, direct sockets, bearer tokens, raw AI keys, or plugin-owned transport details.

• Final gates and stream handoff:

  • scripts/check-structure.sh passed with structure check passed.
  • openspec validate implement-real-game-plugin-lifecycle-proof --strict passed with Change 'implement-real-game-plugin-lifecycle-proof' is valid; the process exited 0. PostHog telemetry flush reported ENOTFOUND edge.openspec.dev, which did not affect validation.
  • openspec/changes/architecture-delivery-stream/delivery-plan.md now marks implement-real-game-plugin-lifecycle-proof complete and harden-log-artifact-channel-isolation active.
  • openspec/changes/architecture-delivery-stream/NEXT_CHANGE.md now points the next implementation chat at harden-log-artifact-channel-isolation.