# Plugin Local H2 Delivery Rehearsal Implementation Plan

> **For agentic workers:** Implement task-by-task with tests first. Steps use checkbox (`- [ ]`) syntax for tracking.

**Goal:** Execute all six delivery rehearsal scenarios against an ephemeral local H2 target and persist integrity-verifiable evidence without enabling external MySQL.

**Architecture:** A control-plane coordinator persists Attempt and Receipt state through conditional MyBatis updates. `PluginDeliveryLocalH2Sandbox` creates one isolated MySQL-mode H2 database per Attempt and reuses the trusted SQL, permission, and menu JDBC Executors. The execution service runs ordered scenarios synchronously and verifies evidence on read.

**Tech Stack:** Java 8, Spring Boot 2.5, MyBatis, H2 MySQL mode, JUnit 4, Vue 2, Element UI.

### Task 1: Attempt And Receipt Ledger

- [x] Add `LOCAL_H2` Attempt and Scenario Receipt models.
- [x] Add control tables, unique identities, Run/Scenario foreign keys, and status indexes to all three schema scripts.
- [x] Add conditional start, finish, fail, and abort Mapper updates.
- [x] Bind every Attempt to the immutable parent Run fingerprints.

### Task 2: Local H2 Session

- [x] Package H2 at runtime without importing H2 APIs into production source.
- [x] Create a unique in-memory database and destroy it on Session close.
- [x] Seed only the parent menu, role, target Receipt, permission ownership, and menu ownership contracts required by the baseline.
- [x] Resolve all baseline content from installed trusted Plugin releases.
- [x] Reuse the production SQL, permission, and menu Executors.

### Task 3: Six Scenarios

- [x] Execute approval request/approval with separation evidence.
- [x] Execute request expiry and approval revocation.
- [x] Execute SQL, permission, and menu mixed apply.
- [x] Create a target Receipt failure and retry the exact same idempotency identity.
- [x] Execute menu, permission, and SQL compensation in reverse order.
- [x] Require all target state and Receipt assertions before a Scenario succeeds.

### Task 4: Recovery And Evidence

- [x] Persist canonical evidence and SHA-256 per terminal Receipt.
- [x] Verify ordered Scenario identity, evidence fingerprints, counts, and Attempt state on detail reads.
- [x] Permit replay links only from failed or aborted Attempts.
- [x] Permit manual abort only from pending or running Attempts.
- [x] Keep raw evidence JSON and all local connection details out of REST responses.

### Task 5: API And Workspace

- [x] Add start, list, detail, and abort endpoints under `generator:delivery:verify`.
- [x] Add Attempt history, progress, replay, abort, and evidence actions to the delivery report.
- [x] Render evidence in a responsive expandable table.
- [x] Keep external target selection absent.

### Task 6: Regression

- [x] Run 182 focused Plugin tests with no failures.
- [x] Run 825 generator tests: 807 pass and the exact 18 known baseline failures remain.
- [x] Run 38 admin tests and four frontend contract tests.
- [x] Run the production frontend build with only the three existing warning classes.
- [x] Confirm both development endpoints still return HTTP 200.