# Plugin Permission Target Executor Implementation Plan

> **For agentic workers:** Implement task-by-task with tests first. Steps use checkbox (`- [ ]`) syntax for tracking.

**Goal:** Deliver reviewed RuoYi permission contributions through a real, idempotent JDBC adapter with target ownership and conservative compensation.

**Architecture:** A strict JSON parser produces a semantic permission document. `permission-jdbc:v1` reuses the isolated target connection and durable lease receipt, while a dedicated repository owns fixed prepared statements for `sys_menu`, `sys_role_menu`, and target ownership tables.

**Tech Stack:** Java 8, Spring Boot 2.5, JDBC, Fastjson2, MySQL 5.7-compatible SQL, H2 MySQL mode, JUnit 4, Vue 2.

### Task 1: Permission Document Contract

**Files:**
- Create: `ruoyi-generator/src/main/java/com/ruoyi/generator/factory/plugin/execution/permission/PluginPermissionDocument.java`
- Create: `ruoyi-generator/src/main/java/com/ruoyi/generator/factory/plugin/execution/permission/PluginPermissionDocumentParser.java`
- Test: `ruoyi-generator/src/test/java/com/ruoyi/generator/factory/plugin/execution/permission/PluginPermissionDocumentParserTest.java`

- [x] Write failing tests for a valid document, canonical roles, unknown fields, invalid identifiers, duplicate roles, and contribution-key mismatch.
- [x] Implement strict bounded JSON parsing and semantic fingerprints.
- [x] Run parser tests.

### Task 2: Target Ownership Schema And Repository

**Files:**
- Modify: `sql/factory_plugin_sql_target.sql`
- Create: `ruoyi-generator/src/main/java/com/ruoyi/generator/factory/plugin/execution/permission/PluginPermissionTargetRepository.java`
- Test: `ruoyi-generator/src/test/java/com/ruoyi/generator/factory/plugin/PluginRegistrySchemaScriptTest.java`

- [x] Add permission and role-grant ownership tables with active/removed lifecycle state.
- [x] Write fixed prepared-statement apply and compensate operations.
- [x] Reject unowned permission collisions, identity drift, missing owned grants, child resources, and unmanaged grants.
- [x] Keep removed ownership tombstones for replay safety.

### Task 3: Real Permission Executor

**Files:**
- Create: `ruoyi-generator/src/main/java/com/ruoyi/generator/factory/plugin/execution/permission/PermissionJdbcPluginContributionTargetExecutor.java`
- Test: `ruoyi-generator/src/test/java/com/ruoyi/generator/factory/plugin/execution/permission/PermissionJdbcPluginContributionTargetExecutorTest.java`

- [x] Write failing H2 tests for apply/deduplication, compensation, collision rejection, and unmanaged-grant protection.
- [x] Support only `PERMISSION + backend + idempotent=true` and APPLY/ROLLBACK.
- [x] Reuse durable receipt leases and deterministic external receipts.
- [x] Sanitize every target failure.

### Task 4: First Permission Delivery Plugin

**Files:**
- Create: `ruoyi-generator/src/main/java/com/ruoyi/generator/factory/plugin/delivery/PreviewPermissionBaselinePlugin.java`
- Create: `ruoyi-generator/src/main/resources/plugin-delivery/preview-permission/generator-delivery-verify.json`
- Create: `ruoyi-generator/src/main/resources/plugin-delivery/preview-permission/rollback-generator-delivery-verify.json`
- Test: `ruoyi-generator/src/test/java/com/ruoyi/generator/factory/plugin/delivery/PreviewPermissionBaselinePluginTest.java`

- [x] Publish one trusted reversible permission contribution.
- [x] Prove Registry, Transition Plan, trusted content resolution, apply, duplicate delivery, role grant, and compensation end to end.

### Task 5: Probe And Admin Status

**Files:**
- Modify: `ruoyi-generator/src/main/java/com/ruoyi/generator/factory/plugin/execution/sql/PluginSqlTargetProbeService.java`
- Modify: `ruoyi-generator/src/main/java/com/ruoyi/generator/factory/plugin/model/PluginSqlTargetProbeStatus.java`
- Modify: `ruoyi-generator/src/test/java/com/ruoyi/generator/factory/plugin/execution/sql/PluginSqlTargetProbeServiceTest.java`
- Modify: `ruoyi-ui/src/views/generator/plugin/index.vue`
- Modify: `ruoyi-ui/test/pluginRegistryView.test.mjs`

- [x] Require permission ownership tables only when `permission-jdbc:v1` is configured.
- [x] Expose a non-secret permission-schema readiness state.
- [x] Treat SQL and permission JDBC routes as sharing isolated target readiness.
- [x] Run probe, static UI tests, and production build.

### Task 6: Documentation And Regression

**Files:**
- Modify: `docs/superpowers/specs/2026-07-10-ai-software-factory-roadmap.md`
- Modify: `docs/superpowers/plans/2026-07-11-plugin-permission-target-executor.md`

- [x] Document activation, schema ownership, compensation boundaries, and remaining menu adapter work.
- [x] Run focused Plugin/permission/SQL/Outbox tests.
- [x] Run generator full regression against the 18 known baseline failures.
- [x] Run admin critical tests, frontend static tests, and production build.
- [x] Confirm EasyCode and RuoYi UI endpoints return HTTP 200.