# Plugin Contribution Artifact Execution Plan

**Goal:** Execute preflighted Feature Plugin database migration, permission, and menu contributions as deterministic generated artifact files, while preserving exact output identity in the Generation Run plugin plan.

## Task 1: Trusted Structured Payload

- [x] Add a typed contribution payload with type, stable key, target, relative output path, and content.
- [x] Allow only the installed trusted plugin implementation matching the resolved release fingerprint to supply payloads.
- [x] Require payload identity to match the preflight plan exactly and reject undeclared extra payloads.

## Task 2: Adapter Execution

- [x] Carry the exact resolved Plugin Execution Plan from the Kernel into the Adapter request.
- [x] Merge contribution payloads into selected Adapter target ZIP archives.
- [x] Reject unselected targets, unsafe paths, duplicate archive paths, missing content, and oversized entries.
- [x] Preserve original archive bytes when the contribution plan has no steps.

## Task 3: Execution Trace

- [x] Mark completed steps as `EXECUTED` with target, output path, and file SHA-256.
- [x] Produce a canonical contribution execution fingerprint.
- [x] Return the executed plan from the Adapter through the Kernel.
- [x] Persist the executed plan in Generation Run `plugin_plan_json` and include contributed files in target and aggregate artifact manifests.

## Task 4: Verification

- [x] Verify real SQL, backend permission, and admin menu files are written to separate ZIP targets.
- [x] Verify empty plans preserve Adapter archive bytes.
- [x] Verify Kernel rejects Adapters that silently skip non-empty contribution plans.
- [x] Verify Legacy Adapter invokes the executor and returns the same executed plan.
- [x] Run the full generator baseline and admin critical-path regression.