Plugin host: circuit breaker with auto-deactivation after repeated trips

[tayebmokni]

Summary

Plugin reliability protector. If a plugin trips its runtime limits or returns errors more than N times per minute (default 5), it is circuit-broken: marked degraded, hooks skipped for 60s, then re-tried. After 3 consecutive circuit-break cycles in an hour the plugin is auto-deactivated, an admin event is fired, and the operator is notified.

Design reference

• docs/02-plugin-system.md §4.5 (last paragraph)

Acceptance criteria

• CircuitBreaker struct with Allow(slug) bool, RecordFailure(slug, err), RecordSuccess(slug)
• Sliding window: 5 failures in 60 seconds opens the breaker for 60 seconds
• Half-open probe after the cool-down; one trial dispatch decides whether to re-close
• After 3 consecutive open cycles within 1 hour: plugin transitions to failed state, auto-deactivated, audit event fired, admin notification dispatched
• Per-slug metrics: plugin_breaker_state{slug}, plugin_breaker_trips_total{slug}, plugin_breaker_auto_deactivations_total{slug}
• Hook bus consults breaker.Allow(slug) before invoking, skips handler if breaker open (filter: value unchanged; action: skip silently)
• Unit tests cover: window-based opening, half-open probe success/failure, auto-deactivation after N cycles

Dependencies

#15 (limits), depends on lifecycle issue for failed state transitions

Complexity

M

[tayebmokni]

Closing — shipped in the merged Wave PR. Auto-close only fires for first ref.