[777genius]

Goal

Implement and verify Qoder project plugin installation as an isolated client stack for project feature #472.

Current checkpoint: native pre-code research

Before any mutation adapter code, obtain genuine pinned Qoder version/help and empty-list evidence on a disposable GitHub-hosted runner. The local verified binary could not launch in this sandbox; its crash is preserved as a limitation, not a successful observation.

The research plan and source each passed two independent review/fix rounds. The runner imports the existing hosted guard unchanged and checks it before acquisition/output creation. It validates exact official archive and binary digests, bounds download, archive expansion and process output, uses a fresh credential-free profile and DEVNULL stdin, and invokes only six version/help/empty-list commands. It never installs/uninstalls a plugin, changes trust, authenticates, invokes a model, or runs an MCP server.

Seven inert research safety tests and the 54 existing native safety tests pass. Genuine hosted evidence is pending. An empty list alone does not establish nonempty project record identity; the subsequent adapter gate remains explicit.

Next steps

Inspect the hosted artifacts, complete the approved native project identity research, implement the scoped lifecycle and public E2E, obtain two independent implementation reviews, then merge only into the project feature branch after applicable CI. This draft is deliberately published early so the real hosted research can run. No main merge or release is authorized by this PR.

Delivered in #499

Delivered by #499, merged into main as 3b93148c. The integrated source 3386c72a91e7e9b3574f12ce0613b399227a1ada passed all 74 check runs and 24 PR workflows; the actual merge tree is identical to that validated source.

This PR's reviewed head 2bc16cfcfa134bdae53fa16531ff4e2a8c704f5a is preserved by ancestry in the integrated source and the main merge. Closing as incorporated; no separate merge into the earlier stacked base is needed.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}