feat(panorama-viewer): make Registry the sole release source

README.md

@@ -84,6 +84,7 @@ See the working example in
 [`packages/plugins/hello-convax`](packages/plugins/hello-convax), then read:
 
 - [`docs/plugin-authoring.md`](docs/plugin-authoring.md) for the sandbox and host protocol;
+- [`docs/panorama-viewer.md`](docs/panorama-viewer.md) for the Panorama Viewer source-ownership and built-in migration boundary;
 - [`docs/skill-authoring.md`](docs/skill-authoring.md) for safe, portable Skills;
 - [`docs/packaging.md`](docs/packaging.md) for ZIP and release rules;
 - [`docs/registry-spec.md`](docs/registry-spec.md) for the client contract;

README.zh-CN.md

@@ -68,6 +68,7 @@ Agent Skills 的客户端使用。由于同一份源码会同时改变两个压
 [`packages/plugins/hello-convax`](packages/plugins/hello-convax)，然后参考：
 
 - [`docs/plugin-authoring.md`](docs/plugin-authoring.md)：沙箱和宿主协议；
+- [`docs/panorama-viewer.md`](docs/panorama-viewer.md)：全景图预览的唯一源码归属与旧内置迁移边界；
 - [`docs/skill-authoring.md`](docs/skill-authoring.md)：安全、可移植的技能规范；
 - [`docs/packaging.md`](docs/packaging.md)：ZIP 和发布规则；
 - [`docs/registry-spec.md`](docs/registry-spec.md)：客户端 Registry 协议；

docs/panorama-viewer.md

@@ -0,0 +1,38 @@
+# Panorama Viewer ownership and release
+
+`packages/plugins/panorama-viewer` is the only source tree for the Panorama
+Viewer product. Its HTML, CSS, JavaScript, WebGL renderer, manifest, localized
+title, toolbar commands, tests, package metadata, and release ZIP all live in
+this repository.
+
+Convax Desktop owns only generic host capabilities used by this and other
+Plugins:
+
+- bounded reads of directly connected managed Canvas images;
+- `canvas.image.create` for one validated PNG;
+- managed Project asset admission and rollback;
+- revision-checked Canvas image-node creation and connection;
+- sandboxed Plugin frames, fullscreen policy, and manifest-driven text toolbar
+  buttons.
+
+Desktop must not carry a second Panorama Viewer static bundle or reserve
+`panorama-viewer` as a built-in id. Hosts that previously installed the trusted
+built-in verify and remove only its host-authored provenance marker, preserving
+the package as an ordinary installation. Version `0.2.1` is intentionally newer
+than the final built-in `0.2.0`, so the normal Registry update transaction can
+replace those preserved bytes with this repository's licensed release package.
+
+## Verification
+
+Run the repository's complete release gate:
+
+```sh
+bun install --frozen-lockfile --ignore-scripts
+bun run check
+```
+
+The Panorama package tests additionally assert that the ZIP inventory is static
+and offline, the manifest requests only the documented capabilities, and current
+viewport capture calls `canvas.image.create`. End-to-end Electron acceptance must
+install the packed `0.2.1` artifact through a validated Registry entry and verify
+that the installed summary does not contain `trustedBuiltin`.

docs/plugin-authoring.md

@@ -331,6 +331,10 @@ a failed optional view effect; do not report that as a reverted mutation.
 `canvas.image.create` accepts a bounded PNG data URL and a portable display name;
 the host owns asset admission, node placement, the connection from the Plugin node,
 persistence, and rollback if the Canvas commit fails.
+The canonical production example is
+[`panorama-viewer`](../packages/plugins/panorama-viewer); its complete Web surface
+and manifest live in this repository, while Convax Desktop owns only these generic
+host operations.
 
 ## Forbidden behavior
 

packages/plugins/panorama-viewer/convax-package.json

@@ -4,7 +4,7 @@
   "id": "panorama-viewer",
   "name": "全景图预览",
   "description": "预览等距柱状投影 360° 全景图，支持拖拽环视、滚轮缩放、自动旋转、全屏、本地文件及画布连接图片。",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "license": "MIT",
   "compatibility": {
     "pluginSchema": "convax.plugin/1",

packages/plugins/panorama-viewer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@microvoid/convax-plugin-panorama-viewer",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "private": true,
   "type": "module",
   "scripts": {

packages/plugins/panorama-viewer/package/manifest.json

@@ -3,7 +3,7 @@
   "id": "panorama-viewer",
   "name": "全景图预览",
   "description": "预览等距柱状投影 360° 全景图，支持拖拽环视、滚轮缩放、自动旋转、全屏、本地文件及画布连接图片。",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "entry": "index.html",
   "capabilities": [
     "canvas.connectedImages.read",

registry/config.json

@@ -1,4 +1,4 @@
 {
-  "sequence": 28,
+  "sequence": 29,
   "yanked": []
 }

tooling/panorama-viewer.test.js

@@ -31,7 +31,7 @@ describe("panorama-viewer package", () => {
       id: "panorama-viewer",
       name: "全景图预览",
       description: manifest.description,
-      version: "0.2.0",
+      version: "0.2.1",
       license: "MIT",
       compatibility: {
         pluginSchema: "convax.plugin/1",

tooling/registry.test.js

@@ -110,7 +110,7 @@ describe("source packages", () => {
       entry: "index.html",
       name: "全景图预览",
       schema: "convax.plugin/1",
-      version: "0.2.0",
+      version: "0.2.1",
     }))
     expect(panorama.metadata.compatibility).toEqual({
       pluginHost: "convax.plugin-host/1",