Review Summary

Verdict: APPROVE

Findings

• [WARNING] ScopedStateStore.__getattr__ transparently delegates any non-underscore attribute to the inner StateStore. If future write helpers are added to StateStore (e.g. bulk update, delete), they would silently bypass the capability check for read-only/state-only plugins. Consider an explicit allow-list of read methods instead of a catch-all delegator.
• [NOTE] ScopedActionRegistry.run is permitted for state-only (only read-only is denied), but the module docstring says state-only has "no orchestrator access" and cannot register actions "which by definition drive orchestrator commands." Allowing state-only to invoke actions is mildly inconsistent with that framing — either tighten run to full-only or clarify the docstring.
• [NOTE] load_plugins type hint uses Union[str, PluginSpec] while the rest of the file uses PEP 604 X | Y syntax; minor style inconsistency.

Correctness, tests, and capability enforcement look good. Settings parsing covers string, module:capability shorthand, and dict forms with validation. No security issues spotted.