External/open-design
1
0
Fork 0
mirror of https://github.com/nexu-io/open-design.git synced 2026-10-27 09:51:12 +01:00
Code Issues Packages Projects Releases Wiki Activity

docs(plugins): record K-series — bound-API-token + Helm + surface.component + ghcr CI

Browse Source 
CHANGELOG.md ## Unreleased gets a new bullet block summarising:
  - Phase 5 bound-API-token guard (startServer refusal + bearer
    middleware on /api/*).
  - Helm chart templates (Deployment / Service / Secret / ConfigMap /
    PVCs / Ingress / NOTES).
  - od.genui.surfaces[].component manifest field + capability gate.
  - GitHub Actions multi-arch image push to ghcr.io.

docs/plans/plugins-implementation.md §6 / §9 flipped:
  - Phase 5 bound-API-token guard, CI push, Helm templates → shipped.
  - Phase 4 surface.component manifest upgrade → shipped (substrate;
    web sandbox loader stays scheduled).
  - §9 Status snapshot updated; head of the queue is now the
    composeSystemPrompt rewiring + the web custom-component sandbox
    loader + ProjectStorage S3 adapter + DaemonDb Postgres adapter +
    per-cloud values-<cloud>.yaml override files + Phase 6 / 7 / 8.

Final gates: pnpm guard ✓, daemon 1496 tests ✓, web 586 tests ✓,
contracts 12 tests ✓, agui-adapter 9 tests ✓, plugin-runtime 21 tests ✓.

Co-authored-by: Tom Huang <1043269994@qq.com>
This commit is contained in:
Cursor Agent
2026-05-09 13:42:54 +00:00
co-authored by Tom Huang
parent 708f37dddb
commit d0dbc7314f
2 changed files with 13 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/plans/plugins-implementation.md
+7 -7
View File
@@ -452,7 +452,7 @@ Deliverables
- [x] CLI parity remainder: `od skills/design-systems/craft/atoms list/show`, `od status`, `od version`, `od marketplace search`, `od doctor`, `od config get/set/list/unset`.
- [x] Optional `plugins/_official/atoms/<atom>/SKILL.md` extraction (spec §23.3.2 patch 2) — entry slice ships four atom SKILL.md fragments + the bundled boot walker; the system.ts → SKILL.md prompt-composer rewiring stays open.
- [x] `@open-design/agui-adapter` package; `GET /api/runs/:runId/agui` SSE endpoint emits AG-UI canonical events.
- [ ] Plugin manifest upgrade: `od.genui.surfaces[].component` (capability gate `genui:custom-component`).
- [x] Plugin manifest upgrade: `od.genui.surfaces[].component` (capability gate `genui:custom-component`) — schema accepts the field; doctor flags missing-capability + path-traversal; web sandbox loader stays scheduled.
Validation
@@ -464,9 +464,9 @@ Validation
Deliverables
- [x] `linux/amd64` + `linux/arm64` Dockerfile per spec §15.1 (`deploy/Dockerfile`; entry-slice base is `node:24-alpine` with `NODE_IMAGE` build-arg override → `node:24-bookworm-slim`; bundled atom plugins ship inside the image).
- [ ] CI pushes `:edge` on main, `:<version>` on tag.
- [x] `tools/pack/docker-compose.yml`, `tools/pack/helm/` (entry slice — values + Chart shipped; templates pending).
- [ ] Bound-API-token guard: daemon refuses to bind `OD_BIND_HOST=0.0.0.0` without `OD_API_TOKEN`; bearer middleware on `/api/*` skipped only on loopback.
- [x] CI pushes `:edge` on main, `:<version>` on tag — `.github/workflows/docker-image.yml`.
- [x] `tools/pack/docker-compose.yml`, `tools/pack/helm/` — chart templates (Deployment / Service / Secret / ConfigMap / PVCs / Ingress / NOTES) shipped.
- [x] Bound-API-token guard: daemon refuses to bind `OD_BIND_HOST=<non-loopback>` without `OD_API_TOKEN`; bearer middleware on `/api/*` skipped only on loopback peers and on the open probes (`/api/health`, `/api/version`, `/api/daemon/status`).
- [ ] `ProjectStorage` adapter for S3-compatible blob stores.
- [ ] `DaemonDb` adapter for Postgres.
- [x] **Snapshot retention enforcement job (PB2).** Landed early (§3.A5): periodic worker (`OD_SNAPSHOT_GC_INTERVAL_MS`, default 6 h) deletes expired rows. Referenced-row TTL via `OD_SNAPSHOT_RETENTION_DAYS` stays opt-in. CLI escape hatch: `od plugin snapshots prune --before <ts>`.
@@ -540,10 +540,10 @@ Plus repo-wide gates
| Field | Value |
| --- | --- |
| Current phase | Phase 2A + 1 + 1.5 + 2B + 2C entry slice + 3 (full) + 4 (scaffold + export + publish + atoms doc + library/status/version CLI + doctor + config + bundled atoms + pipeline-into-startChatRun + AG-UI adapter + atom-block renderer) + 5 entry slice (docker-compose + Helm values + bundled-atom Dockerfile bake) |
| Next planned PR | composeSystemPrompt() reads atom prompt fragments from `loadAtomBodies()` instead of inline `system.ts` constants (spec §23.3.2 patch 2 — substrate slice landed; the rewiring itself is the next PR); `od.genui.surfaces[].component` plugin manifest upgrade (Phase 4 / spec §10.3.5 Phase 4 column); CI: GitHub Actions push `:edge` / `:<version>` to ghcr.io; Phase 5 bound-API-token guard + Postgres + S3 adapters |
| Current phase | Phase 2A + 1 + 1.5 + 2B + 2C entry slice + 3 (full) + 4 (full minus the composeSystemPrompt rewiring + the web custom-component sandbox loader) + 5 (full minus pluggable storage / Postgres / S3) |
| Next planned PR | composeSystemPrompt() reads atom prompt fragments from `loadAtomBodies()` instead of inline `system.ts` constants (spec §23.3.2 patch 2 — substrate landed); web GenUISurfaceRenderer custom-component sandbox loader (consumes `od.genui.surfaces[].component`); Phase 5 `ProjectStorage` S3-compatible + `DaemonDb` Postgres adapters; per-cloud Helm `values-<cloud>.yaml` overrides; Phase 6 / 7 / 8 native scenarios |
| Open spec push-backs | none — PB1 / PB2 resolved (see §7) |
| Last sync against `docs/plugins-spec.md` | 2026-05-09 (Phase 4 AG-UI adapter + renderActiveStageBlock + atom body loader + Phase 5 docker-compose / Helm entry slice landing) |
| Last sync against `docs/plugins-spec.md` | 2026-05-09 (Phase 5 bound-API-token guard + Helm chart templates + ghcr.io CI workflow + surface.component manifest field landing) |
Update this table on every plugin-system PR merge. When the value of "Current phase" advances, also flip the matching deliverables in §6 and the modules in §3.