fix(arch-008,arch-009): canonical 2-segment permission schema enforced; fix dead role wildcard patterns

app/plugins/manifest.py

@@ -191,6 +191,25 @@ class PluginManifest(BaseModel):
     permissions: list[str] = Field(
         default_factory=list, description="Required permissions for this plugin"
     )
+
+    @field_validator("permissions")
+    @classmethod
+    def _validate_permission_format(cls, v: list[str]) -> list[str]:
+        """Enforce the canonical 2-segment permission schema (ARCH-008/009).
+
+        Canonical form is ``module:action`` with ``*`` wildcards allowed in
+        either segment (e.g. ``contacts:read``, ``contacts:*``, ``*:read``,
+        ``*:*``). 3-segment names like ``core:contacts:read`` never match
+        the runtime matcher and are rejected at manifest load time.
+        """
+        for perm in v:
+            parts = perm.split(":")
+            if len(parts) != 2 or not all(parts):
+                raise ValueError(
+                    f"Invalid permission {perm!r}: use 2-segment 'module:action' "
+                    f"(wildcards '*' allowed), e.g. 'contacts:read' or '*:*'"
+                )
+        return v
     is_core: bool = Field(
         default=False, description="Whether this is a core plugin that cannot be deactivated"
     )
@@ -423,7 +442,7 @@ MANIFEST_SCHEMA_DOC = ManifestSchemaResponse(
         routes=[],
         events=["contact.created"],
         migrations=["0001_initial.sql"],
-        permissions=["contacts.read"],
+        permissions=["contacts:read"],
         menu_items=[
             FrontendMenuItem(
                 label_key="nav.examplePlugin",