semi implemented and features implemented save checkpoint

docs/features/unchecked/plugin/plugin-configuration-and-context.md

@@ -0,0 +1,25 @@
+# Plugin Configuration and Context
+
+## Module
+Plugin
+
+## Status
+IMPLEMENTED
+
+## Description
+Plugin configuration loading and context injection for runtime plugin behavior customization.
+
+## Implementation Details
+- **IPluginContext**: `src/Plugin/StellaOps.Plugin.Abstractions/Context/IPluginContext.cs` -- provides configuration, logging, and service access to plugins during initialization
+- **PluginContext**: `src/Plugin/StellaOps.Plugin.Host/Context/PluginContext.cs` -- implementation of IPluginContext with runtime services
+- **PluginConfiguration**: `src/Plugin/StellaOps.Plugin.Host/Context/PluginConfiguration.cs` -- loads plugin-specific configuration from host settings
+- **PluginLogger**: `src/Plugin/StellaOps.Plugin.Host/Context/PluginLogger.cs` -- IPluginLogger implementation wrapping host logging
+- **PluginServices**: `src/Plugin/StellaOps.Plugin.Host/Context/PluginServices.cs` -- service locator for plugin runtime dependencies
+- **PluginContextFactory**: creates PluginContext instances per plugin with trust level and shutdown token
+- **Source**: Feature matrix scan
+
+## E2E Test Plan
+- [ ] Verify plugin context provides correct configuration values for plugin-specific settings
+- [ ] Test plugin logger routes messages through host logging infrastructure
+- [ ] Verify plugin services resolve registered dependencies correctly
+- [ ] Test context creation includes trust level and cancellation token propagation

docs/features/unchecked/plugin/plugin-dependency-resolution.md

@@ -0,0 +1,23 @@
+# Plugin Dependency Resolution
+
+## Module
+Plugin
+
+## Status
+IMPLEMENTED
+
+## Description
+Plugin dependency resolution with resolver service, interface, and comprehensive tests.
+
+## Implementation Details
+- **PluginDependencyResolver**: `src/Plugin/StellaOps.Plugin.Host/Dependencies/PluginDependencyResolver.cs` -- topological sorting of plugin manifests for load order; cycle detection via DFS with CircularDependencyError reporting; version constraint parsing (>=, >, <=, <, =, ~pessimistic, ^compatible); AreDependenciesSatisfied/GetMissingDependencies for optional dependency support; reverse load order for unload sequence
+- **IPluginDependencyResolver**: `src/Plugin/StellaOps.Plugin.Host/Dependencies/IPluginDependencyResolver.cs` -- interface: ResolveLoadOrder, ResolveUnloadOrder, AreDependenciesSatisfied, GetMissingDependencies, ValidateDependencyGraph
+- **DependencyGraph**: `src/Plugin/StellaOps.Plugin.Host/Dependencies/DependencyGraph.cs` -- graph data structure with AddNode, AddEdge, HasNode, GetDependents
+- **Source**: Feature matrix scan
+
+## E2E Test Plan
+- [ ] Verify topological sort produces correct load order for a dependency chain
+- [ ] Test circular dependency detection reports correct cycle paths
+- [ ] Verify version constraint matching for all operators (>=, >, <=, <, =, ~, ^)
+- [ ] Test unload order is reverse of load order
+- [ ] Verify optional dependencies do not block loading when missing

docs/features/unchecked/plugin/plugin-discovery.md

@@ -0,0 +1,25 @@
+# Plugin Discovery (FileSystem and Embedded)
+
+## Module
+Plugin
+
+## Status
+IMPLEMENTED
+
+## Description
+Multi-strategy plugin discovery with filesystem scanning, embedded plugins, and composite discovery that combines both approaches.
+
+## Implementation Details
+- **CompositePluginDiscovery**: `src/Plugin/StellaOps.Plugin.Host/Discovery/CompositePluginDiscovery.cs` -- combines multiple IPluginDiscovery sources; deduplicates by plugin ID (first-wins); supports DiscoverAsync (bulk) and DiscoverSingleAsync (by PluginSource); routes FileSystem/Embedded source types to appropriate discoverer
+- **FileSystemPluginDiscovery**: `src/Plugin/StellaOps.Plugin.Host/Discovery/FileSystemPluginDiscovery.cs` -- scans filesystem directories for plugin assemblies and manifests
+- **EmbeddedPluginDiscovery**: `src/Plugin/StellaOps.Plugin.Host/Discovery/EmbeddedPluginDiscovery.cs` -- discovers plugins embedded in host assemblies
+- **IPluginDiscovery**: `src/Plugin/StellaOps.Plugin.Host/Discovery/IPluginDiscovery.cs` -- interface: DiscoverAsync, DiscoverSingleAsync
+- **PluginManifest**: `src/Plugin/StellaOps.Plugin.Abstractions/Manifest/PluginManifest.cs` -- manifest model with Info, Dependencies, Capabilities
+- **Source**: Feature matrix scan
+
+## E2E Test Plan
+- [ ] Verify filesystem discovery scans configured paths and finds plugin assemblies
+- [ ] Test embedded discovery locates plugins within host assemblies
+- [ ] Verify composite discovery deduplicates plugins by ID across sources
+- [ ] Test single plugin discovery routes to correct discoverer by source type
+- [ ] Verify error in one discoverer does not block others

docs/features/unchecked/plugin/plugin-host-with-assembly-isolation.md

@@ -0,0 +1,25 @@
+# Plugin Host with Assembly Isolation
+
+## Module
+Plugin
+
+## Status
+IMPLEMENTED
+
+## Description
+Plugin host with assembly-based loading, isolated AssemblyLoadContext, and configurable host options.
+
+## Implementation Details
+- **PluginHost**: `src/Plugin/StellaOps.Plugin.Host/PluginHost.cs` -- central coordinator implementing IPluginHost + IAsyncDisposable; manages discovery -> dependency validation -> load order -> assembly loading -> initialization -> health monitoring lifecycle; ConcurrentDictionary<string, LoadedPlugin> registry; events for state changes and health changes; auto-recovery of unhealthy plugins via reload; configurable initialization/shutdown timeouts
+- **PluginAssemblyLoadContext**: `src/Plugin/StellaOps.Plugin.Host/Loading/PluginAssemblyLoadContext.cs` -- collectible AssemblyLoadContext for plugin isolation; uses AssemblyDependencyResolver for plugin-local dependency resolution; WeakReference for GC tracking; supports unmanaged DLL loading; PluginLoadContextReference wrapper with IsCollected/Unload
+- **AssemblyPluginLoader**: `src/Plugin/StellaOps.Plugin.Host/Loading/AssemblyPluginLoader.cs` -- IHostPluginLoader implementation for assembly-based loading
+- **PluginHostOptions**: `src/Plugin/StellaOps.Plugin.Host/PluginHostOptions.cs` -- configures PluginPaths, BuiltInPluginIds, TrustedPluginIds, TrustedVendors, FailOnPluginLoadError, AutoRecoverUnhealthyPlugins, InitializationTimeout, ShutdownTimeout
+- **IPluginHost**: `src/Plugin/StellaOps.Plugin.Host/IPluginHost.cs` -- interface: StartAsync, StopAsync, LoadPluginAsync, UnloadPluginAsync, ReloadPluginAsync, GetPluginsWithCapability<T>, GetPlugin, GetCapability<T>
+- **Source**: Feature matrix scan
+
+## E2E Test Plan
+- [ ] Verify plugin host loads plugins in dependency order and transitions through lifecycle states
+- [ ] Test assembly isolation prevents plugin assemblies from conflicting with host assemblies
+- [ ] Verify collectible AssemblyLoadContext allows plugin unloading and GC collection
+- [ ] Test auto-recovery reloads unhealthy plugins when enabled
+- [ ] Verify trust level determination routes BuiltIn/Trusted/Untrusted correctly

docs/features/unchecked/plugin/plugin-sandbox.md

@@ -0,0 +1,25 @@
+# Plugin Sandbox (Process Isolation)
+
+## Module
+Plugin
+
+## Status
+IMPLEMENTED
+
+## Description
+Process-level plugin sandboxing with gRPC communication bridge for secure out-of-process plugin execution.
+
+## Implementation Details
+- **PluginTrustLevel**: `src/Plugin/StellaOps.Plugin.Abstractions/PluginTrustLevel.cs` -- enum: BuiltIn (in-process full access), Trusted (isolated monitored), Untrusted (sandboxed restricted)
+- **PluginHost trust routing**: `src/Plugin/StellaOps.Plugin.Host/PluginHost.cs` -- DetermineTrustLevel routes plugins to BuiltIn (matching BuiltInPluginIds), Trusted (matching TrustedPluginIds/TrustedVendors), or Untrusted (default); trust level passed to loader and context factory for execution environment selection
+- **PluginLifecycleManager**: `src/Plugin/StellaOps.Plugin.Host/Lifecycle/PluginLifecycleManager.cs` -- manages state transitions with PluginStateMachine
+- **PluginStateMachine**: `src/Plugin/StellaOps.Plugin.Host/Lifecycle/PluginStateMachine.cs` -- enforces valid lifecycle state transitions
+- **PluginHealthMonitor**: `src/Plugin/StellaOps.Plugin.Host/Health/PluginHealthMonitor.cs` -- periodic health checks with HealthChanged events
+- **Source**: Feature matrix scan
+
+## E2E Test Plan
+- [ ] Verify untrusted plugins execute in sandboxed process with restricted capabilities
+- [ ] Test trusted plugins run isolated but with monitoring
+- [ ] Verify built-in plugins run in-process with full access
+- [ ] Test health monitoring detects unhealthy sandboxed plugins
+- [ ] Verify process isolation prevents sandbox escape

docs/features/unchecked/plugin/unified-plugin-architecture-with-trust-based-execution-model.md

@@ -0,0 +1,30 @@
+# Unified Plugin Architecture with Trust-Based Execution Model
+
+## Module
+Plugin
+
+## Status
+IMPLEMENTED
+
+## Description
+Complete unified plugin system reworking seven disparate plugin patterns (Crypto, Auth, LLM, SCM, Scanner, Router, Concelier) into a single IPlugin interface with trust-based execution (Built-in=in-process, Untrusted=sandboxed), capability composition (11 capability interfaces including ICryptoCapability, IAuthCapability, ILlmCapability, IScmCapability), database-backed PostgreSQL registry with health tracking, process-based sandbox with gRPC bridge/resource limits/filesystem isolation/secret pr
+
+## Implementation Details
+- **IPlugin**: `src/Plugin/StellaOps.Plugin.Abstractions/IPlugin.cs` -- core interface: Info (PluginInfo), TrustLevel (BuiltIn/Trusted/Untrusted), Capabilities (PluginCapabilities), State (PluginLifecycleState), InitializeAsync(IPluginContext), HealthCheckAsync; extends IAsyncDisposable
+- **Capability interfaces**: `src/Plugin/StellaOps.Plugin.Abstractions/Capabilities/` -- IAnalysisCapability, IAuthCapability, IConnectorCapability, ICryptoCapability, IFeedCapability, ILlmCapability, IScmCapability, ITransportCapability
+- **PluginAttribute**: `src/Plugin/StellaOps.Plugin.Abstractions/Attributes/PluginAttribute.cs` -- assembly attribute for plugin discovery
+- **PluginCapabilities**: `src/Plugin/StellaOps.Plugin.Abstractions/PluginCapabilities.cs` -- flags enum for capability composition
+- **PluginInfo**: `src/Plugin/StellaOps.Plugin.Abstractions/PluginInfo.cs` -- ID, version, vendor metadata
+- **PluginHost**: `src/Plugin/StellaOps.Plugin.Host/PluginHost.cs` -- full lifecycle coordinator with discovery, dependency validation, assembly isolation, initialization, health monitoring, auto-recovery
+- **HelloWorldPlugin**: `src/Plugin/Samples/StellaOps.Plugin.Samples.HelloWorld/HelloWorldPlugin.cs` -- sample plugin implementation
+- **Tests**: `src/Plugin/Samples/StellaOps.Plugin.Samples.HelloWorld.Tests/HelloWorldPluginTests.cs`
+- **ServiceCollectionExtensions**: `src/Plugin/StellaOps.Plugin.Host/Extensions/ServiceCollectionExtensions.cs` -- DI registration for plugin host services
+- **Source**: SPRINT_20260110_100_000_INDEX_plugin_unification.md
+
+## E2E Test Plan
+- [ ] Verify IPlugin lifecycle transitions: Discovered -> Loading -> Initializing -> Active -> Stopping -> Stopped
+- [ ] Test trust-based execution: BuiltIn=in-process, Trusted=monitored, Untrusted=sandboxed
+- [ ] Verify capability composition allows multiple capabilities per plugin
+- [ ] Test GetPluginsWithCapability<T> returns only active plugins with matching capability
+- [ ] Verify plugin unload disposes and unloads AssemblyLoadContext
+- [ ] Test plugin reload preserves configuration after restart