# Plugin Manifest Resolution Core Plan

**Goal:** Upgrade `ProjectSpec.plugins` from unverified strings to a trusted, versioned release graph with deterministic dependency resolution and generation fingerprints.

## Task 1: Plugin Release Contract

- [x] Add the `FeaturePlugin` SPI.
- [x] Add a versioned manifest covering provider, trust, dependencies, capabilities, conflicts, Adapter compatibility, ProjectSpec schema compatibility, DSL extensions, migrations, templates, resources, validators, quality checks, permissions, menus, and configuration keys.
- [x] Add resolved release and execution-plan models.

## Task 2: Registry And Version Constraints

- [x] Register multiple releases of the same plugin code.
- [x] Reject duplicate, malformed, self-dependent, or untrusted releases.
- [x] Support exact SemVer, caret, tilde, and comparator range constraints.
- [x] Keep release ordering deterministic and fingerprint every manifest.

## Task 3: Dependency Resolver

- [x] Resolve direct and transitive dependencies against exact Adapter and ProjectSpec schema releases.
- [x] Backtrack when a later dependency constraint invalidates an earlier candidate.
- [x] Detect plugin-code and capability conflicts in both directions.
- [x] Reject dependency cycles and undeclared configuration keys.
- [x] Produce dependency-first, stable execution order and a canonical plan fingerprint.

## Task 4: Generation Integration

- [x] Add plugin resolution failures to ProjectSpec validation as `PLUGIN_RESOLUTION_FAILED`.
- [x] Stop generation before invoking the Adapter when the plugin graph cannot resolve.
- [x] Replace selection-only plugin fingerprints with resolved release graph fingerprints.
- [x] Include manifest identity, transitive releases, direct configuration, and execution order in the fingerprint.

## Task 5: Verification And Boundary

- [x] Add Registry, SemVer, resolver, validation, generation, and fingerprint tests.
- [x] Run the focused suite, full Generator baseline, Admin tests, formatting checks, and local frontend health check.
- [x] Record that database-backed plugin publishing and administration remain P2-D1b.