Redeon.SuperSiteEngineCore.Web.Eltheon.Core.Features.Plugins

Manifest-v3-only plugin runtime, installation operations, Admin cockpit, diagnostics, migrations, and recovery for Eltheon.

Runtime Model

• PluginManifestV3 at manifest/plugin.manifest.json is the only accepted package manifest.
• The persistent plugins Storage space owns packages, plans, operations, registry, migration ledgers, and recovery metadata.
• Verified packages are materialized below Runtime/plugins/materialized/... as reconstructable runtime snapshots.
• IPluginV3RuntimeCatalog is the host-facing source for active plugins, assemblies, navigation, permissions, workloads, and assembly ownership.
• Loader selection, service registration, Razor application parts, localization, endpoint policies, static assets, diagnostics, and template navigation use the same active snapshot selection.
• ConfigureServices and OnHostBuilt execute once through PluginV3RuntimeStartupActivationBootstrapper and PluginV3RuntimeStartupActivationCoordinator.

The production classes use .v3 namespaces. The namespace now matches the only productive runtime and package manifest generation.

Stable Plugin ABI

The runtime keeps IEltheonPlugin, IPluginMetadata, PluginBase, and plugin-specific navigation, permission, database, and health contracts. The old PluginManifest, IPluginManager, registry, descriptor, and v1 loader surfaces have been removed.

Plugin workloads and isolation

Active manifest workloads are projected into the canonical workload catalog with plugin ownership and DefaultActive availability. Deactivation and uninstall stop that plugin's worker generations and block new job admissions. Jobs admitted before deactivation are allowed to finish; this avoids terminating work after it has crossed a durable boundary.

In-process contributions use keyed IEltheonJob or IEltheonWorker implementations. Isolated contributions use the authenticated worker protocol:

• job.execute, job.cancel
• worker.start, worker.stop, worker.restart, worker.status

Commands carry opaque command, execution, generation, and correlation IDs. Cancellation acknowledges the exact execution. Unknown or retired messages fail closed, and exceptions are reduced to stable reason codes.

Host Registration

var startup = PluginV3RuntimeStartupActivationBootstrapper.Prepare(
    builder.Services,
    configuration,
    environment,
    runtimePaths,
    loggerFactory);

builder.Services.AddEltheonPluginHost(runtimePaths.RuntimeRoot);
PluginV3ApplicationPartRegistrar.Register(builder.Services, startup.RuntimeAssemblies);

After builder.Build(), the same startup activation coordinator completes OnHostBuilt, contribution projection, operation completion, and snapshot promotion.

Static Assets

UseEltheonPluginV3StaticFiles() publishes files only for active snapshots that declare a StaticAsset extension. An undeclared wwwroot directory is never exposed.

Store and Operations

The Store protocol is /api/v1/plugins; the HTTP protocol version is independent of the manifest version. Admin install, update, reinstall, activation, deactivation, uninstall/KeepData, and rollback use IPluginV3OperationService. Runtime Control retains the granular expert commands and stable plugins.list and plugins.health keys, now projected exclusively from v3 state.

Legacy Diagnostics

Known old locations are scanned read-only for exact manifest.json files. Legacy content is never loaded, materialized, converted, or mutated. Diagnostics expose only aggregate counts and stable reason codes. Retired install/remove boot tasks complete without plugin file mutations and emit PLUGIN_LEGACY_BOOT_TASK_RETIRED.

Migration and Recovery

Provider-specific migrations execute from the selected target snapshot. Success requires exact target migration verification. Database updates require verified recovery backup support before mutation; recovery and operation payloads remain secret-safe.

Destructive Lifecycle

UninstallKeepData remains the default. UninstallDropData requires a dedicated high-risk permission, anti-forgery validation, exact plugin-id confirmation, PluginOwned database contexts, a verified provider backup, migration to target 0, and owner-validated Storage destruction. Prune removes only unreferenced terminal snapshots and reconstructable artifacts; it rejects unsafe Runtime paths and leaves a secret-safe tombstone.

For repository guidance, see:

• docs/plugins/current-plugin-architecture.md
• docs/Eltheon_Phase_4_14_12_Plugins_v3_Runtime_Loader_and_Storage_Install_Pipeline.md
• docs/Eltheon_Phase_4_14_14_Plugins_v3_Compatibility_and_Upgrade_Rules.md