fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

- P0: hooks.py 3-tuple fix, trigger_dispatcher Contract, contacts/plugin unregister_actions_by_owner
- P0: 5 test files — check_permission mocks removed, hardcoded DB credential → env var
- P1: attachment_service DmsFile via Contract helper, restore_registry/history_hooks dedup
- P1: mail/plugin restore unregister, mcp_client datetime.now(UTC), saved_views/filters patterns
- P1: ProtectedRoute fail-closed, 13 test assertion fixes (bcrypt, DB-URLs, SECRET_KEYs)
- P2: deprecated notifications → post_system_message (3 files), forgejo Base, report_generator lazy import
- P2: webhooks permissions, deps.py/roles.py plugin perms removed, import_export default
- P2: address/tags/entity_links patterns removed, worker.py Contract-Umgehungen fixed
- P2: 28 frontend TODOs (hardcoded constants, deprecated notification API)
- P3: dead code, duplicates, deprecated imports, private attr, __import__ inline
- P3: 8 frontend TODOs (LucideIcons, inline styles, XSS, i18n)
- ruff: 838 → 0 (612 auto-fix + 246 manual + 27 F821 regression fix)
- F821: 30 → 0 (AutomationDefinition, DmsFile, user_id, Path, Any, String)
- Contract-Umgehungen: 2 neue gefunden (worker.py:169, worker.py:280) und gefixt

app/plugins/base.py

@@ -97,6 +97,29 @@ class BasePlugin(ABC):
         """
         return []
 
+    # ─── Job Modules ───
+
+    def get_job_modules(self) -> list[str]:
+        """Return list of ARQ job module paths to import for background workers.
+
+        Override in subclasses that register background jobs. The worker
+        imports each module so that register_job() calls fire.
+        Default: no job modules.
+        """
+        return []
+
+    # ─── Entity Models ───
+
+    def get_entity_models(self) -> dict[str, type]:
+        """Return entity_type → SQLAlchemy model class mapping for permission system.
+
+        Override in subclasses that own entities with OwnedMixin.
+        These models are registered in ENTITY_MODELS at activation time
+        so the permission system can resolve entity types dynamically.
+        Default: no entity models.
+        """
+        return {}
+
     # ─── Field Definitions ───
 
     def get_field_definitions(self) -> list[dict[str, str]]:

app/plugins/builtins/__init__.py

@@ -1,21 +1,9 @@
 """Built-in plugins directory.
 
 Each module in this package that exports a BasePlugin subclass will be
-discovered automatically by the plugin registry on application startup.
+discovered automatically by the plugin registry on application startup
+via pkgutil.iter_modules — no manual imports needed here.
 
-Subdirectory plugins (tags, permissions, entity_links, mail) export their plugin
-class via __init__.py so the registry can discover them as packages.
+Subdirectory plugins (tags, permissions, entity_links, mail, etc.) export
+their plugin class via __init__.py so the registry can discover them as packages.
 """
-
-from app.plugins.builtins.agent_memory import AgentMemoryPlugin
-from app.plugins.builtins.calendar import CalendarPlugin
-from app.plugins.builtins.dms import DmsPlugin
-from app.plugins.builtins.entity_links import EntityLinksPlugin
-from app.plugins.builtins.graph_rag import GraphRAGPlugin
-from app.plugins.builtins.mail import MailPlugin
-from app.plugins.builtins.report_generator import ReportGeneratorPlugin
-from app.plugins.builtins.permissions import PermissionsPlugin
-from app.plugins.builtins.tags import TagsPlugin
-from app.plugins.builtins.marketplace import MarketplacePlugin
-
-__all__ = ["AgentMemoryPlugin", "TagsPlugin", "PermissionsPlugin", "EntityLinksPlugin", "DmsPlugin", "CalendarPlugin", "MailPlugin", "ReportGeneratorPlugin", "GraphRAGPlugin", "MarketplacePlugin"]

app/plugins/builtins/agent_memory/plugin.py

@@ -34,6 +34,10 @@ class AgentMemoryPlugin(BasePlugin):
         contract_version="1.0.0",
     )
 
+    def get_entity_models(self) -> dict[str, type]:
+        from app.plugins.builtins.agent_memory.models import AgentMemory
+        return {"agent_memory": AgentMemory}
+
     async def on_deactivate(self, db, service_container, event_bus) -> None:
         """Deactivate plugin: unregister contract and event listeners."""
         from app.plugins.builtins.contracts import get_contract_registry

app/plugins/builtins/agent_memory/routes.py

@@ -13,7 +13,6 @@ from app.deps import get_current_user, require_permission
 from app.plugins.builtins.agent_memory.models import AgentMemory
 from app.plugins.builtins.agent_memory.schemas import (
     AgentMemoryCreate,
-    AgentMemoryRead,
     AgentMemoryUpdate,
 )
 from app.plugins.builtins.agent_memory.services import (

app/plugins/builtins/agent_memory/services.py

@@ -5,7 +5,8 @@ from __future__ import annotations
 import uuid
 from typing import Any
 
-from sqlalchemy import select, text as sql_text
+from sqlalchemy import select
+from sqlalchemy import text as sql_text
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.plugins.builtins.agent_memory.models import AgentMemory

app/plugins/builtins/ai_assistant/crm_api_tool.py

@@ -9,14 +9,9 @@ from __future__ import annotations
 
 import json
 import logging
-import uuid
 from typing import Any
 
 import httpx
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from app.config import get_settings
-from app.core.db import get_session_factory
 
 logger = logging.getLogger(__name__)
 

app/plugins/builtins/ai_assistant/external_api.py

@@ -11,7 +11,7 @@ import logging
 import uuid
 from typing import Any
 
-from fastapi import APIRouter, Depends, HTTPException, Query, Request
+from fastapi import APIRouter, Depends, HTTPException, Request
 from fastapi.responses import StreamingResponse
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -61,7 +61,7 @@ async def run_agent_external(
     try:
         aid = uuid.UUID(agent_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid agent ID")
+        raise HTTPException(status_code=400, detail="Invalid agent ID") from None
 
     # Find the agent
     from app.plugins.builtins.ai_assistant.models import AIAgent
@@ -79,8 +79,8 @@ async def run_agent_external(
         raise HTTPException(status_code=400, detail="Agent is not active")
 
     # Create or find a session for this external interaction
-    from app.plugins.builtins.ai_assistant.models import AIChatSession, AIChatMessage
-    from datetime import datetime, timezone
+
+    from app.plugins.builtins.ai_assistant.models import AIChatMessage, AIChatSession
 
     session = AIChatSession(
         user_id=uuid.UUID(current_user["user_id"]),
@@ -168,7 +168,7 @@ async def get_agent_status_external(
     try:
         aid = uuid.UUID(agent_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid agent ID")
+        raise HTTPException(status_code=400, detail="Invalid agent ID") from None
 
     from app.plugins.builtins.ai_assistant.models import AIAgent
 
@@ -183,9 +183,10 @@ async def get_agent_status_external(
         raise HTTPException(status_code=404, detail="Agent not found")
 
     # Get recent run stats
-    from app.plugins.builtins.automation.contracts import AutomationContract
     from sqlalchemy import func
 
+    from app.plugins.builtins.automation.contracts import AutomationContract
+
     recent_runs = await db.execute(
         select(func.count())
         .select_from(AutomationContract.AgentRun)
@@ -232,7 +233,7 @@ async def stream_agent_external(
     try:
         aid = uuid.UUID(agent_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid agent ID")
+        raise HTTPException(status_code=400, detail="Invalid agent ID") from None
 
     from app.plugins.builtins.ai_assistant.models import AIAgent
 

app/plugins/builtins/ai_assistant/models.py

@@ -3,11 +3,9 @@
 from __future__ import annotations
 
 import uuid
-from datetime import datetime
 
 from sqlalchemy import (
     Boolean,
-    DateTime,
     Float,
     ForeignKey,
     Index,
@@ -15,13 +13,13 @@ from sqlalchemy import (
     String,
     Text,
 )
-from sqlalchemy.dialects.postgresql import JSONB, UUID as PGUUID
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column
 
 from app.core.db import Base, TenantMixin
 from app.models.owned_mixin import OwnedMixin
 
-
 # --- Providers ---
 
 class AIProvider(Base, TenantMixin):

app/plugins/builtins/ai_assistant/plugin.py

@@ -6,7 +6,13 @@ import logging
 from typing import Any
 
 from app.plugins.base import BasePlugin
-from app.plugins.manifest import PluginManifest, PluginRouteDef, FrontendMenuItem, FrontendPageRoute, FrontendSettingsPage
+from app.plugins.manifest import (
+    FrontendMenuItem,
+    FrontendPageRoute,
+    FrontendSettingsPage,
+    PluginManifest,
+    PluginRouteDef,
+)
 
 logger = logging.getLogger(__name__)
 
@@ -71,6 +77,10 @@ class AIAssistantPlugin(BasePlugin):
 
         await seed_defaults(db)
 
+    def get_entity_models(self) -> dict[str, type]:
+        from app.plugins.builtins.ai_assistant.models import AIAgent, AIChatSession
+        return {"ai_agent": AIAgent, "ai_chat_session": AIChatSession}
+
     async def on_activate(self, db, service_container, event_bus) -> None:
         """Activate plugin: register CRM API tool and participant handler."""
         await super().on_activate(db, service_container, event_bus)

app/plugins/builtins/ai_assistant/routes.py

@@ -33,10 +33,8 @@ from app.plugins.builtins.ai_assistant.schemas import (
     AIPresetUpdate,
     AIProviderCreate,
     AIProviderUpdate,
-    ChatAttachmentResponse,
     ChatFolderCreate,
     ChatFolderUpdate,
-    ChatFolderResponse,
     ChatSendRequest,
     ChatSessionCreate,
     ChatSessionUpdate,
@@ -92,7 +90,7 @@ async def create_provider(
         existing = await db.execute(
             select(AIProvider)
             .where(AIProvider.tenant_id == tenant_id)
-            .where(AIProvider.is_default == True)
+            .where(AIProvider.is_default.is_(True))
         )
         for p in existing.scalars().all():
             p.is_default = False
@@ -129,7 +127,7 @@ async def update_provider(
         existing = await db.execute(
             select(AIProvider)
             .where(AIProvider.tenant_id == tenant_id)
-            .where(AIProvider.is_default == True)
+            .where(AIProvider.is_default.is_(True))
             .where(AIProvider.id != provider.id)
         )
         for p in existing.scalars().all():
@@ -717,8 +715,8 @@ async def delete_folder(
 
 # ─── Attachments ───
 
-import os
-from pathlib import Path
+import os  # noqa: E402
+from pathlib import Path  # noqa: E402
 
 ATTACHMENT_DIR = Path(os.environ.get("STORAGE_PATH", "/data/storage")) / "ai_attachments"
 MAX_ATTACHMENT_SIZE = 25 * 1024 * 1024  # 25MB

app/plugins/builtins/ai_assistant/schemas.py

@@ -7,7 +7,6 @@ from typing import Any
 
 from pydantic import BaseModel, ConfigDict, Field
 
-
 # ─── Providers ───
 
 class AIProviderCreate(BaseModel):

app/plugins/builtins/ai_assistant/services.py

@@ -10,16 +10,15 @@ from __future__ import annotations
 import json
 import logging
 import uuid
-from typing import Any, AsyncGenerator
+from collections.abc import AsyncGenerator
+from typing import Any
 
 import aiofiles
-
 import litellm
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.ai.llm_client import llm_complete
-
 from app.core.permissions import check_permission
 from app.plugins.builtins.ai_assistant.models import (
     AIAgent,
@@ -169,7 +168,7 @@ async def get_default_provider(db: AsyncSession, tenant_id: uuid.UUID) -> AIProv
     result = await db.execute(
         select(AIProvider)
         .where(AIProvider.tenant_id == tenant_id)
-        .where(AIProvider.is_default == True)
+        .where(AIProvider.is_default.is_(True))
         .limit(1)
     )
     return result.scalar_one_or_none()
@@ -209,7 +208,7 @@ async def get_default_agent(db: AsyncSession, tenant_id: uuid.UUID) -> AIAgent |
     result = await db.execute(
         select(AIAgent)
         .where(AIAgent.tenant_id == tenant_id)
-        .where(AIAgent.is_default == True)
+        .where(AIAgent.is_default.is_(True))
         .limit(1)
     )
     return result.scalar_one_or_none()
@@ -394,8 +393,9 @@ async def _extract_attachment_content(
                 text_content = content.decode("utf-8", errors="replace")
             elif mime == "application/pdf" or att.filename.endswith(".pdf"):
                 try:
-                    from pypdf import PdfReader
                     from io import BytesIO
+
+                    from pypdf import PdfReader
                     reader = PdfReader(BytesIO(content))
                     text_content = "\n".join(page.extract_text() or "" for page in reader.pages)
                 except ImportError:

app/plugins/builtins/ai_assistant/tool_registry.py

@@ -8,8 +8,8 @@ and an async handler. Tools can optionally require specific RBAC permissions.
 from __future__ import annotations
 
 import logging
-from dataclasses import dataclass, field
-from typing import Any, Awaitable, Callable, Protocol
+from dataclasses import dataclass
+from typing import Any, Protocol
 
 logger = logging.getLogger(__name__)
 

app/plugins/builtins/ai_proactive/context_tools.py

@@ -12,12 +12,10 @@ import logging
 import uuid
 from typing import Any
 
-from sqlalchemy import select, text
+from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.db import create_db_session
 from app.models.audit import AuditLog
-from app.models.contact import Contact
 from app.plugins.builtins.mail.contracts import Mail
 
 logger = logging.getLogger(__name__)
@@ -101,7 +99,9 @@ async def search_related_handler(arguments: dict[str, Any], context: dict[str, A
         entity_id = uuid.UUID(arguments["entity_id"])
         limit = arguments.get("limit", 5)
 
-        from app.plugins.builtins.unified_search.contracts import get_contract as get_search_contract
+        from app.plugins.builtins.unified_search.contracts import (
+            get_contract as get_search_contract,
+        )
         _search = get_search_contract()
         find_similar_all_types = _search.find_similar_all_types
 
@@ -165,8 +165,8 @@ async def get_open_tasks_handler(arguments: dict[str, Any], context: dict[str, A
 
         from app.plugins.builtins.calendar.contracts import get_contract as get_calendar_contract
         _cal = get_calendar_contract()
-        CalendarEntry = _cal.CalendarEntry
-        CalendarEntryLink = _cal.CalendarEntryLink
+        calendar_entry = _cal.calendar_entry
+        calendar_entry_link = _cal.calendar_entry_link
 
         db, tenant_id, _ = await _get_db_and_tenant(context)
         entity_type = arguments["entity_type"]
@@ -174,14 +174,14 @@ async def get_open_tasks_handler(arguments: dict[str, Any], context: dict[str, A
         now = datetime.now(UTC)
 
         result = await db.execute(
-            select(CalendarEntry)
-            .join(CalendarEntryLink, CalendarEntryLink.entry_id == CalendarEntry.id)
-            .where(CalendarEntryLink.entity_type == entity_type)
-            .where(CalendarEntryLink.entity_id == entity_id)
-            .where(CalendarEntry.tenant_id == tenant_id)
-            .where(CalendarEntry.start_at > now)
-            .where(CalendarEntry.status == "open")
-            .order_by(CalendarEntry.start_at.asc())
+            select(calendar_entry)
+            .join(calendar_entry_link, calendar_entry_link.entry_id == calendar_entry.id)
+            .where(calendar_entry_link.entity_type == entity_type)
+            .where(calendar_entry_link.entity_id == entity_id)
+            .where(calendar_entry.tenant_id == tenant_id)
+            .where(calendar_entry.start_at > now)
+            .where(calendar_entry.status == "open")
+            .order_by(calendar_entry.start_at.asc())
             .limit(20)
         )
         tasks = [_serialize(e) for e in result.scalars().all()]
@@ -194,7 +194,9 @@ async def get_open_tasks_handler(arguments: dict[str, Any], context: dict[str, A
 async def hybrid_search_handler(arguments: dict[str, Any], context: dict[str, Any]) -> str:
     """Perform hybrid search via unified_search search_engine."""
     try:
-        from app.plugins.builtins.unified_search.contracts import get_contract as get_search_contract
+        from app.plugins.builtins.unified_search.contracts import (
+            get_contract as get_search_contract,
+        )
         _search = get_search_contract()
         hybrid_search = _search.hybrid_search
 

app/plugins/builtins/ai_proactive/contracts.py

@@ -5,7 +5,13 @@ Exposes models, services, and job functions that other builtins plugins may need
 
 from __future__ import annotations
 
-from app.plugins.builtins.contracts import get_contract_registry
+from app.plugins.builtins.ai_proactive.context_tools import (
+    register_context_tools,
+)
+from app.plugins.builtins.ai_proactive.jobs import (
+    deep_analysis,
+    heartbeat,
+)
 from app.plugins.builtins.ai_proactive.models import (
     ContextLog,
     ProactiveSettings,
@@ -20,13 +26,7 @@ from app.plugins.builtins.ai_proactive.services import (
     mark_dismissed,
     push_suggestion,
 )
-from app.plugins.builtins.ai_proactive.context_tools import (
-    register_context_tools,
-)
-from app.plugins.builtins.ai_proactive.jobs import (
-    deep_analysis,
-    heartbeat,
-)
+from app.plugins.builtins.contracts import get_contract_registry
 
 
 class AiProactiveContract:

app/plugins/builtins/ai_proactive/jobs.py

@@ -10,23 +10,23 @@ Deep analysis job runs after context-change for deeper analysis:
 
 from __future__ import annotations
 
-import os
 import json
 import logging
+import os
 import uuid
+from datetime import UTC
 from typing import Any
 
-from app.ai.llm_client import llm_complete
 from sqlalchemy import select
 
+from app.ai.llm_client import llm_complete
 from app.core.db import create_db_session
 from app.core.notifications import create_notification
 from app.models.audit import AuditLog
 from app.models.contact import Contact
-from app.plugins.builtins.ai_proactive.models import ProactiveSuggestion, ProactiveSettings
+from app.plugins.builtins.ai_proactive.models import ProactiveSuggestion
 from app.plugins.builtins.ai_proactive.services import (
     _serialize_row,
-    generate_suggestion,
     get_user_settings,
     push_suggestion,
 )
@@ -175,9 +175,10 @@ async def deep_analysis(
 
         # Similar entities via unified_search
         try:
-            from app.plugins.builtins.unified_search.contracts import get_contract as get_search_contract
+            from app.plugins.builtins.unified_search.contracts import (
+                get_contract as get_search_contract,
+            )
             _search = get_search_contract()
-            hybrid_search = _search.hybrid_search
             find_similar_all_types = _search.hybrid_search  # alias
 
             extended_context["similar"] = await find_similar_all_types(
@@ -339,9 +340,10 @@ async def heartbeat(ctx: dict[str, Any], user_id: str, tenant_id: str) -> None:
 
         async with create_db_session(tid) as db:
             # Check if heartbeat is enabled and get configuration
-            from app.plugins.builtins.ai_proactive.models import ProactiveSettings
             from sqlalchemy import select as sa_select
 
+            from app.plugins.builtins.ai_proactive.models import ProactiveSettings
+
             settings_result = await db.execute(
                 sa_select(ProactiveSettings)
                 .where(ProactiveSettings.tenant_id == tid)
@@ -390,9 +392,9 @@ async def heartbeat(ctx: dict[str, Any], user_id: str, tenant_id: str) -> None:
             contact_count = contact_count_result.scalar() or 0
 
             # Build status message
-            from datetime import datetime, timezone
+            from datetime import datetime
 
-            now_str = datetime.now(timezone.utc).strftime("%H:%M:%S")
+            now_str = datetime.now(UTC).strftime("%H:%M:%S")
             status_content = (
                 f"**System aktiv** — überwacht {contact_count} Kontakte\n"
                 f"_Letztes Update: {now_str}_"
@@ -416,6 +418,6 @@ async def heartbeat(ctx: dict[str, Any], user_id: str, tenant_id: str) -> None:
 
 
 # Register all job functions with the job registry
-from app.core.job_registry import register_job
+from app.core.job_registry import register_job  # noqa: E402
 
 register_job("deep_analysis", deep_analysis)

app/plugins/builtins/ai_proactive/models.py

@@ -16,7 +16,8 @@ from sqlalchemy import (
     String,
     Text,
 )
-from sqlalchemy.dialects.postgresql import JSONB, UUID as PGUUID
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column
 
 from app.core.db import Base, TenantMixin

app/plugins/builtins/ai_proactive/plugin.py

@@ -11,7 +11,7 @@ import logging
 from typing import Any
 
 from app.plugins.base import BasePlugin
-from app.plugins.manifest import PluginManifest, PluginRouteDef, FrontendSettingsPage
+from app.plugins.manifest import FrontendSettingsPage, PluginManifest, PluginRouteDef
 
 logger = logging.getLogger(__name__)
 
@@ -56,16 +56,23 @@ class AIProactivePlugin(BasePlugin):
         super().__init__()
         self._proactive_handler = None
 
+    def get_entity_models(self) -> dict[str, type]:
+        from app.plugins.builtins.ai_proactive.models import ProactiveSuggestion
+        return {"proactive_suggestion": ProactiveSuggestion}
+
+    def get_job_modules(self) -> list[str]:
+        return ["app.plugins.builtins.ai_proactive.jobs"]
+
     async def on_activate(self, db, service_container, event_bus) -> None:
         """Register context tools, subscribe to events, and register as participant."""
         await super().on_activate(db, service_container, event_bus)
         try:
-            from app.plugins.builtins.ai_proactive.context_tools import (
-                register_context_tools,
-            )
             from app.plugins.builtins.ai_assistant.contracts import (
                 get_tool_registry,
             )
+            from app.plugins.builtins.ai_proactive.context_tools import (
+                register_context_tools,
+            )
 
             register_context_tools(get_tool_registry())
             logger.info("AI Proactive context tools registered")

app/plugins/builtins/ai_proactive/routes.py

@@ -15,8 +15,7 @@ from fastapi import APIRouter, Depends, HTTPException, Query
 from fastapi.responses import StreamingResponse
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.db import get_db, set_tenant_context
-from app.core.visibility import apply_visibility_filter
+from app.core.db import get_db
 from app.core.event_bus import get_event_bus
 from app.deps import get_current_user, require_permission
 from app.plugins.builtins.ai_proactive.models import (
@@ -30,9 +29,9 @@ from app.plugins.builtins.ai_proactive.schemas import (
     ContextReport,
     SettingsResponse,
     SettingsUpdate,
+    StatsResponse,
     SuggestionListResponse,
     SuggestionResponse,
-    StatsResponse,
 )
 from app.plugins.builtins.ai_proactive.services import (
     execute_suggested_action,
@@ -184,7 +183,7 @@ async def dismiss_suggestion(
     try:
         sid = uuid.UUID(suggestion_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid suggestion ID")
+        raise HTTPException(status_code=400, detail="Invalid suggestion ID") from None
 
     success = await mark_dismissed(db, sid, user_id, tenant_id)
     if not success:
@@ -210,7 +209,7 @@ async def act_on_suggestion(
     try:
         sid = uuid.UUID(suggestion_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid suggestion ID")
+        raise HTTPException(status_code=400, detail="Invalid suggestion ID") from None
 
     result = await execute_suggested_action(
         db, sid, action.action_index, user_id, tenant_id, current_user
@@ -245,7 +244,7 @@ async def stream_suggestions(
             try:
                 suggestion = await asyncio.wait_for(queue.get(), timeout=30)
                 yield f"data: {json.dumps(suggestion, default=str)}\n\n"
-            except asyncio.TimeoutError:
+            except TimeoutError:
                 yield ": keepalive\n\n"
 
     return StreamingResponse(

app/plugins/builtins/ai_proactive/services.py

@@ -6,30 +6,28 @@ suggestions, pushes via SSE, and manages suggestion lifecycle.
 
 from __future__ import annotations
 
-import os
 import asyncio
 import json
 import logging
+import os
 import uuid
-from datetime import UTC, datetime, timedelta
+from datetime import UTC, datetime
 from typing import Any
 
 import litellm
-from app.ai.llm_client import llm_complete
 from sqlalchemy import func, select, text
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.cache import get_cache
-from app.core.db import create_db_session, get_session_factory
+from app.ai.llm_client import llm_complete
+from app.core.db import create_db_session
 from app.core.notifications import create_notification
 from app.models.audit import AuditLog
 from app.models.contact import Contact, ContactPerson
-from app.models.contact import Contact, ContactPerson
 from app.plugins.builtins.ai_proactive.models import (
-    ContextLog,
     ProactiveSettings,
     ProactiveSuggestion,
 )
+
 logger = logging.getLogger(__name__)
 
 litellm.suppress_debug_info = True
@@ -81,9 +79,10 @@ async def is_rate_limited(
     and ``window_seconds=rate_limit_seconds``.
     Returns ``True`` if rate-limited, ``False`` if allowed.
     """
-    from app.core.rate_limit import check_rate_limit
     from fastapi import HTTPException
 
+    from app.core.rate_limit import check_rate_limit
+
     redis_key = f"rate:ai_proactive:{tenant_id}:{user_id}"
     try:
         await check_rate_limit(redis_key, max_attempts=1, window_seconds=rate_limit_seconds)
@@ -208,18 +207,18 @@ async def gather_context(
         # Upcoming calendar events
         from app.plugins.builtins.calendar.contracts import get_contract as get_calendar_contract
         _cal = get_calendar_contract()
-        CalendarEntry = _cal.CalendarEntry
-        CalendarEntryLink = _cal.CalendarEntryLink
+        calendar_entry = _cal.calendar_entry
+        calendar_entry_link = _cal.calendar_entry_link
 
         now = datetime.now(UTC)
         event_result = await db.execute(
-            select(CalendarEntry)
-            .join(CalendarEntryLink, CalendarEntryLink.entry_id == CalendarEntry.id)
-            .where(CalendarEntryLink.entity_type == "contact")
-            .where(CalendarEntryLink.entity_id == entity_id)
-            .where(CalendarEntry.tenant_id == tenant_id)
-            .where(CalendarEntry.start_at > now)
-            .order_by(CalendarEntry.start_at.asc())
+            select(calendar_entry)
+            .join(calendar_entry_link, calendar_entry_link.entry_id == calendar_entry.id)
+            .where(calendar_entry_link.entity_type == "contact")
+            .where(calendar_entry_link.entity_id == entity_id)
+            .where(calendar_entry.tenant_id == tenant_id)
+            .where(calendar_entry.start_at > now)
+            .order_by(calendar_entry.start_at.asc())
             .limit(5)
         )
         context["events"] = [_serialize_row(e) for e in event_result.scalars().all()]
@@ -323,18 +322,18 @@ async def gather_context(
         # Upcoming events
         from app.plugins.builtins.calendar.contracts import get_contract as get_calendar_contract
         _cal = get_calendar_contract()
-        CalendarEntry = _cal.CalendarEntry
-        CalendarEntryLink = _cal.CalendarEntryLink
+        calendar_entry = _cal.calendar_entry
+        calendar_entry_link = _cal.calendar_entry_link
 
         now = datetime.now(UTC)
         event_result = await db.execute(
-            select(CalendarEntry)
-            .join(CalendarEntryLink, CalendarEntryLink.entry_id == CalendarEntry.id)
-            .where(CalendarEntryLink.entity_type == "contact")
-            .where(CalendarEntryLink.entity_id == entity_id)
-            .where(CalendarEntry.tenant_id == tenant_id)
-            .where(CalendarEntry.start_at > now)
-            .order_by(CalendarEntry.start_at.asc())
+            select(calendar_entry)
+            .join(calendar_entry_link, calendar_entry_link.entry_id == calendar_entry.id)
+            .where(calendar_entry_link.entity_type == "contact")
+            .where(calendar_entry_link.entity_id == entity_id)
+            .where(calendar_entry.tenant_id == tenant_id)
+            .where(calendar_entry.start_at > now)
+            .order_by(calendar_entry.start_at.asc())
             .limit(5)
         )
         context["events"] = [_serialize_row(e) for e in event_result.scalars().all()]
@@ -365,7 +364,9 @@ async def gather_context(
 
     # Semantically similar entities via unified_search
     try:
-        from app.plugins.builtins.unified_search.contracts import get_contract as get_search_contract
+        from app.plugins.builtins.unified_search.contracts import (
+            get_contract as get_search_contract,
+        )
         _search = get_search_contract()
         find_similar_all_types = _search.hybrid_search
 

app/plugins/builtins/ai_ui_control/contracts.py

@@ -5,8 +5,6 @@ Exposes the WebSocket manager and UI command schemas for other plugins.
 
 from __future__ import annotations
 
-from app.plugins.builtins.contracts import get_contract_registry
-from app.plugins.builtins.ai_ui_control.websocket_manager import AIUIControlWSManager
 from app.plugins.builtins.ai_ui_control.schemas import (
     UICommand,
     UICommandCreate,
@@ -16,6 +14,8 @@ from app.plugins.builtins.ai_ui_control.schemas import (
     UICommandStatusResponse,
     UICommandType,
 )
+from app.plugins.builtins.ai_ui_control.websocket_manager import AIUIControlWSManager
+from app.plugins.builtins.contracts import get_contract_registry
 
 
 class AiUiControlContract:

app/plugins/builtins/ai_ui_control/routes.py

@@ -11,12 +11,10 @@ import json
 import logging
 import uuid
 
-from fastapi import APIRouter, WebSocket, WebSocketDisconnect, Depends, HTTPException, Request
-from fastapi.responses import JSONResponse
+from fastapi import APIRouter, Depends, HTTPException, Request, WebSocket, WebSocketDisconnect
 
 from app.deps import require_permission
 from app.plugins.builtins.ai_ui_control.schemas import (
-    UICommand,
     UICommandCreate,
     UICommandFeedback,
     UICommandResponse,
@@ -45,7 +43,7 @@ async def send_ui_command(
     Authentication: requires valid session (same-user commands only).
     """
     from app.config import get_settings
-    from app.core.auth import get_session_data, get_redis
+    from app.core.auth import get_redis, get_session_data
     from app.core.service_container import get_container
 
     settings = get_settings()
@@ -117,7 +115,7 @@ async def get_command_status(
     AI agents call this to check if the frontend has executed the command.
     """
     from app.config import get_settings
-    from app.core.auth import get_session_data, get_redis
+    from app.core.auth import get_redis, get_session_data
     from app.core.service_container import get_container
 
     settings = get_settings()
@@ -173,7 +171,7 @@ async def get_command_status(
 async def get_online_users(request: Request):
     """Check which users are currently online (have active frontend WS connections)."""
     from app.config import get_settings
-    from app.core.auth import get_session_data, get_redis
+    from app.core.auth import get_redis, get_session_data
     from app.core.service_container import get_container
 
     settings = get_settings()
@@ -225,9 +223,11 @@ async def ai_ui_control_ws(websocket: WebSocket):
     tenant_id = auth["tenant_id"]
 
     # Plugin-Gate: check if ai_ui_control plugin is active (global + tenant)
-    from app.core.permission_registry import get_permission_registry
-    from sqlalchemy import text as sa_text
     import uuid as _uuid
+
+    from sqlalchemy import text as sa_text
+
+    from app.core.permission_registry import get_permission_registry
     try:
         registry = get_permission_registry()
         if not registry.is_plugin_active("ai_ui_control"):

app/plugins/builtins/ai_ui_control/schemas.py

@@ -2,13 +2,13 @@
 
 from __future__ import annotations
 
-from enum import Enum
+from enum import StrEnum
 from typing import Any
 
 from pydantic import BaseModel, Field
 
 
-class UICommandType(str, Enum):
+class UICommandType(StrEnum):
     """Supported UI command types."""
     navigate = "navigate"
     filter = "filter"
@@ -18,7 +18,7 @@ class UICommandType(str, Enum):
     settings = "settings"
 
 
-class UICommandStatus(str, Enum):
+class UICommandStatus(StrEnum):
     """Status of a UI command execution."""
     pending = "pending"
     delivered = "delivered"

app/plugins/builtins/ai_ui_control/websocket_manager.py

@@ -15,6 +15,7 @@ import uuid
 from typing import Any
 
 from fastapi import WebSocket
+from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.ws_helpers import (
     authenticate_ws,
@@ -28,7 +29,6 @@ from app.core.ws_pubsub import (
     get_tenant_channel,
     subscribe_to_channel,
 )
-from sqlalchemy.ext.asyncio import AsyncSession
 
 logger = logging.getLogger(__name__)
 
@@ -176,9 +176,9 @@ class AIUIControlWSManager:
         if command_id:
             self._feedback[command_id] = feedback
             # Enforce max feedback entries (FIFO eviction)
-            MAX_FEEDBACK_ENTRIES = 100
-            if len(self._feedback) > MAX_FEEDBACK_ENTRIES:
-                keys_to_remove = list(self._feedback.keys())[:-MAX_FEEDBACK_ENTRIES]
+            max_feedback_entries = 100
+            if len(self._feedback) > max_feedback_entries:
+                keys_to_remove = list(self._feedback.keys())[:-max_feedback_entries]
                 for key in keys_to_remove:
                     del self._feedback[key]
             logger.debug(f"AI UI Control: feedback stored for command {command_id}: {feedback.get('status')}")

app/plugins/builtins/automation/agent_comm.py

@@ -27,8 +27,8 @@ async def send_agent_message(
     3. Enqueue run_agent for the target agent with the message as trigger_data
     4. Return delivery status
     """
-    from app.plugins.builtins.automation.models import AgentDefinition
     from app.plugins.builtins.automation.agent_runner import run_agent
+    from app.plugins.builtins.automation.models import AgentDefinition
 
     # 1. Find target agent by name
     result = await db.execute(
@@ -56,7 +56,6 @@ async def send_agent_message(
     # 2. Create a kommunikation message in a dedicated agent room
     try:
         from app.plugins.builtins.kommunikation.contracts import Message, Room
-        from app.plugins.builtins.kommunikation.contracts import RoomService
 
         # Find or create the agent-to-agent room
         room_name = f"agent:{from_agent_id}:{target_agent.id}"

app/plugins/builtins/automation/agent_coordinator.py

@@ -12,7 +12,8 @@ import uuid
 from datetime import UTC, datetime
 from typing import Any
 
-from sqlalchemy import select, update as sa_update
+from sqlalchemy import select
+from sqlalchemy import update as sa_update
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.plugins.builtins.automation.models import AgentSubtask
@@ -60,12 +61,12 @@ class AgentCoordinator:
         return subtask
 
     @staticmethod
-    async def wait_for_subtask(
+    async def wait_for_subtask(  # noqa: ASYNC109
         db: AsyncSession,
         tenant_id: uuid.UUID,
         subtask_id: uuid.UUID,
         poll_interval: float = 0.5,
-        timeout: float = 300.0,
+        timeout: float = 300.0,  # noqa: ASYNC109
     ) -> dict[str, Any]:
         """Wait for a subtask to complete, fail, or be cancelled.
 

app/plugins/builtins/automation/agent_routes.py

@@ -7,13 +7,13 @@ from __future__ import annotations
 
 import logging
 import uuid
+from datetime import UTC
 from typing import Any
 
 from fastapi import APIRouter, Depends, HTTPException, Query
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.db import get_db, set_tenant_context
-from app.core.visibility import apply_visibility_filter
+from app.core.db import get_db
 from app.deps import get_current_user, require_permission
 from app.plugins.builtins.automation.models import (
     AgentDefinition,
@@ -216,7 +216,7 @@ async def get_agent(
     try:
         aid = uuid.UUID(agent_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid agent ID")
+        raise HTTPException(status_code=400, detail="Invalid agent ID") from None
 
     agent = await AgentService.get_by_id(db, tenant_id, aid)
     if agent is None:
@@ -241,7 +241,7 @@ async def update_agent(
     try:
         aid = uuid.UUID(agent_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid agent ID")
+        raise HTTPException(status_code=400, detail="Invalid agent ID") from None
 
     agent = await AgentService.update(
         db, tenant_id, aid, data.model_dump(exclude_none=True), user_id=user_id
@@ -265,7 +265,7 @@ async def delete_agent(
     try:
         aid = uuid.UUID(agent_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid agent ID")
+        raise HTTPException(status_code=400, detail="Invalid agent ID") from None
 
     success = await AgentService.delete(db, tenant_id, aid)
     if not success:
@@ -290,7 +290,7 @@ async def execute_agent(
     try:
         aid = uuid.UUID(agent_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid agent ID")
+        raise HTTPException(status_code=400, detail="Invalid agent ID") from None
 
     agent = await AgentService.get_by_id(db, tenant_id, aid)
     if agent is None:
@@ -325,9 +325,10 @@ async def execute_agent(
     )
 
     # Update run with results
+    from datetime import datetime
+
     from sqlalchemy import update as sa_update
-    from datetime import datetime, timezone
-    now = datetime.now(timezone.utc)
+    now = datetime.now(UTC)
     async with db.begin():
         await db.execute(
             sa_update(AgentRun)
@@ -358,7 +359,7 @@ async def test_run_agent(
     try:
         aid = uuid.UUID(agent_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid agent ID")
+        raise HTTPException(status_code=400, detail="Invalid agent ID") from None
 
     agent = await AgentService.get_by_id(db, tenant_id, aid)
     if agent is None:
@@ -397,7 +398,7 @@ async def list_agent_runs(
     try:
         aid = uuid.UUID(agent_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid agent ID")
+        raise HTTPException(status_code=400, detail="Invalid agent ID") from None
 
     items, total = await RunLogService.list_agent_runs(
         db, tenant_id, agent_id=aid, status=status, limit=limit, offset=offset
@@ -428,7 +429,7 @@ async def list_agent_versions(
     try:
         aid = uuid.UUID(agent_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid agent ID")
+        raise HTTPException(status_code=400, detail="Invalid agent ID") from None
 
     items, total = await AgentService.get_versions(
         db, tenant_id, aid, limit=limit, offset=offset
@@ -457,7 +458,7 @@ async def restore_agent_version(
         aid = uuid.UUID(agent_id)
         vid = uuid.UUID(version_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid ID")
+        raise HTTPException(status_code=400, detail="Invalid ID") from None
 
     agent = await AgentService.restore_version(
         db, tenant_id, aid, vid, user_id=user_id
@@ -485,7 +486,7 @@ async def send_agent_message_endpoint(
     try:
         aid = uuid.UUID(id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid agent ID")
+        raise HTTPException(status_code=400, detail="Invalid agent ID") from None
 
     # Verify the source agent exists
     agent = await AgentService.get_by_id(db, tenant_id, aid)

app/plugins/builtins/automation/agent_runner.py

@@ -16,8 +16,8 @@ from typing import Any
 
 from sqlalchemy import func, select
 
-from app.core.db import get_session_factory
 from app.ai.llm_client import llm_complete
+from app.core.db import get_session_factory
 
 logger = logging.getLogger(__name__)
 
@@ -161,15 +161,6 @@ async def run_agent(
     try:
         async def _run_llm() -> None:
             """Inner coroutine for LLM call with tool execution."""
-            from app.ai.llm_client import LLMClient
-
-            llm = LLMClient(
-                model=agent.model or None,
-                api_key=agent.api_key or None,
-                api_base=agent.api_base or None,
-                provider=agent.provider or None,
-            )
-
             # Build system prompt from agent configuration
             system_prompt = agent.system_prompt or "You are a helpful AI assistant."
             user_prompt = f"Context: {context_data}"
@@ -241,7 +232,7 @@ async def run_agent(
         # Run with timeout
         try:
             await asyncio.wait_for(_run_llm(), timeout=max_duration)
-        except asyncio.TimeoutError:
+        except TimeoutError:
             logger.warning(
                 "Agent %s execution timed out after %d seconds",
                 agent.id, max_duration,
@@ -295,6 +286,6 @@ async def run_agent(
 
 
 # Register all job functions with the job registry
-from app.core.job_registry import register_job
+from app.core.job_registry import register_job  # noqa: E402
 
-register_job("run_agent", run_agent)
+register_job("run_agent", run_agent)

app/plugins/builtins/automation/contracts.py

@@ -5,7 +5,9 @@ Exposes models, services, scheduler, and agent communication for other plugins.
 
 from __future__ import annotations
 
-from app.plugins.builtins.contracts import get_contract_registry
+from app.plugins.builtins.automation.agent_comm import send_agent_message
+from app.plugins.builtins.automation.agent_runner import run_agent
+from app.plugins.builtins.automation.execution_engine import run_automation
 from app.plugins.builtins.automation.models import (
     AgentDefinition,
     AgentRun,
@@ -15,19 +17,17 @@ from app.plugins.builtins.automation.models import (
     AutomationRun,
     AutomationVersion,
 )
+from app.plugins.builtins.automation.scheduler import (
+    calculate_next_run,
+    scheduler_tick,
+)
 from app.plugins.builtins.automation.services import (
     AgentService,
     AutomationService,
     CronJobService,
     RunLogService,
 )
-from app.plugins.builtins.automation.agent_runner import run_agent
-from app.plugins.builtins.automation.execution_engine import run_automation
-from app.plugins.builtins.automation.scheduler import (
-    calculate_next_run,
-    scheduler_tick,
-)
-from app.plugins.builtins.automation.agent_comm import send_agent_message
+from app.plugins.builtins.contracts import get_contract_registry
 
 
 class AutomationContract:
@@ -73,8 +73,6 @@ get_contract_registry().register("automation", _contract)
 __all__ = [
     "AutomationContract",
     "AgentDefinition",
-    "Automation",
-    "CronJob",
     "AgentService",
     "AutomationService",
     "CronJobService",

app/plugins/builtins/automation/execution_engine.py

@@ -2,9 +2,7 @@
 
 from __future__ import annotations
 
-import json
 import logging
-from datetime import UTC, datetime
 from typing import Any
 
 import httpx
@@ -166,9 +164,10 @@ async def _execute_action(
             return result
 
         try:
-            from app.services.workflow_service import create_instance
             from uuid import UUID
 
+            from app.services.workflow_service import create_instance
+
             factory = get_session_factory()
             async with factory() as db:
                 instance = await create_instance(
@@ -280,6 +279,6 @@ async def run_automation(
 
 
 # Register all job functions with the job registry
-from app.core.job_registry import register_job
+from app.core.job_registry import register_job  # noqa: E402
 
 register_job("run_automation", run_automation)

app/plugins/builtins/automation/jobs.py

@@ -16,9 +16,10 @@ async def backup_check(ctx: dict[str, Any]) -> None:
     Runs daily at 2:00. Checks the last backup timestamp from system settings
     and publishes backup.completed or backup.failed events accordingly.
     """
-    from app.core.event_bus import get_event_bus
     from sqlalchemy import text
 
+    from app.core.event_bus import get_event_bus
+
     event_bus = get_event_bus()
     factory = get_session_factory()
 

app/plugins/builtins/automation/models.py

@@ -17,7 +17,8 @@ from sqlalchemy import (
     Text,
     UniqueConstraint,
 )
-from sqlalchemy.dialects.postgresql import JSONB, UUID as PGUUID
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column
 
 from app.core.db import Base, TenantMixin

app/plugins/builtins/automation/plugin.py

@@ -176,6 +176,18 @@ class AutomationPlugin(BasePlugin):
         self._contributed_cron_jobs: dict[str, list[str]] = {}  # plugin_name -> [cron_job_name, ...]
         self._contributed_heartbeats: dict[str, list[str]] = {}  # plugin_name -> [agent_name, ...]
 
+    def get_entity_models(self) -> dict[str, type]:
+        from app.plugins.builtins.automation.models import AgentDefinition, AutomationDefinition
+        return {"agent_definition": AgentDefinition, "automation_definition": AutomationDefinition}
+
+    def get_job_modules(self) -> list[str]:
+        return [
+            "app.plugins.builtins.automation.scheduler",
+            "app.plugins.builtins.automation.workflow_timeout",
+            "app.plugins.builtins.automation.agent_runner",
+            "app.plugins.builtins.automation.execution_engine",
+        ]
+
     async def on_activate(self, db, service_container, event_bus) -> None:
         """Register event listeners on activation."""
         await super().on_activate(db, service_container, event_bus)
@@ -187,7 +199,9 @@ class AutomationPlugin(BasePlugin):
             logger.exception("Failed to register agent communication tool")
         # Register agent coordinator tools
         try:
-            from app.plugins.builtins.automation.agent_coordinator import register_agent_coordinator_tools
+            from app.plugins.builtins.automation.agent_coordinator import (
+                register_agent_coordinator_tools,
+            )
             register_agent_coordinator_tools()
         except Exception:
             logger.exception("Failed to register agent coordinator tools")
@@ -230,7 +244,9 @@ class AutomationPlugin(BasePlugin):
             logger.exception("Failed to unregister agent communication tool")
         # Unregister agent coordinator tools
         try:
-            from app.plugins.builtins.automation.agent_coordinator import unregister_agent_coordinator_tools
+            from app.plugins.builtins.automation.agent_coordinator import (
+                unregister_agent_coordinator_tools,
+            )
             unregister_agent_coordinator_tools()
         except Exception:
             logger.exception("Failed to unregister agent coordinator tools")
@@ -249,12 +265,16 @@ class AutomationPlugin(BasePlugin):
     async def register_plugin_contributions(self, db, plugin_name: str, manifest) -> None:
         """Register agent definitions, automation templates, cron jobs, and heartbeat configs
         from another plugin's manifest. Uses plugin name prefixing for conflict resolution."""
-        from app.plugins.builtins.automation.services import AgentService, AutomationService, CronJobService
-        from app.plugins.builtins.automation.models import AutomationCronJob
         from sqlalchemy import select
 
         # Get default tenant_id from the first tenant in the DB
         from app.models.tenant import Tenant
+        from app.plugins.builtins.automation.models import AutomationCronJob
+        from app.plugins.builtins.automation.services import (
+            AgentService,
+            AutomationService,
+            CronJobService,
+        )
         tenant_result = await db.execute(select(Tenant).limit(1))
         tenant = tenant_result.scalar_one_or_none()
         default_tenant_id = tenant.id if tenant else None
@@ -356,7 +376,11 @@ class AutomationPlugin(BasePlugin):
 
     async def unregister_plugin_contributions(self, db, plugin_name: str) -> None:
         """Remove all contributed definitions from a plugin that is being deactivated."""
-        from app.plugins.builtins.automation.services import AgentService, AutomationService, CronJobService
+        from app.plugins.builtins.automation.services import (
+            AgentService,
+            AutomationService,
+            CronJobService,
+        )
 
         # Remove contributed agents
         agent_names = self._contributed_agents.pop(plugin_name, [])
@@ -384,8 +408,9 @@ class AutomationPlugin(BasePlugin):
         cron_job_names = self._contributed_cron_jobs.pop(plugin_name, [])
         for cron_name in cron_job_names:
             try:
-                from app.plugins.builtins.automation.models import AutomationCronJob
                 from sqlalchemy import select
+
+                from app.plugins.builtins.automation.models import AutomationCronJob
                 result = await db.execute(
                     select(AutomationCronJob).where(AutomationCronJob.name == cron_name).limit(1)
                 )
@@ -411,9 +436,10 @@ class AutomationPlugin(BasePlugin):
 
     async def ensure_ai_proactive_heartbeat(self, db) -> None:
         """Migrate the hardcoded ai_proactive heartbeat to a configurable cron job."""
+        from sqlalchemy import select
+
         from app.plugins.builtins.automation.models import AutomationCronJob
         from app.plugins.builtins.automation.services import CronJobService
-        from sqlalchemy import select
 
         # Check if ai_proactive heartbeat cron job already exists
         result = await db.execute(
@@ -456,4 +482,4 @@ class AutomationPlugin(BasePlugin):
 
     async def on_workflow_timeout(self, payload: dict[str, Any]) -> None:
         """Handle workflow.timeout event — trigger matching automations."""
-        logger.debug("workflow.timeout event received: %s", payload)
+        logger.debug("workflow.timeout event received: %s", payload)

app/plugins/builtins/automation/routes.py

@@ -7,13 +7,13 @@ from __future__ import annotations
 
 import logging
 import uuid
+from datetime import UTC
 from typing import Any
 
 from fastapi import APIRouter, Depends, HTTPException, Query
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.db import get_db, set_tenant_context
-from app.core.visibility import apply_visibility_filter
+from app.core.db import get_db
 from app.deps import get_current_user, require_permission
 from app.plugins.builtins.automation.models import (
     AutomationDefinition,
@@ -253,9 +253,10 @@ async def get_automation_settings(
 ):
     """Get automation settings (persisted in system_settings metadata)."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
-    from app.models.system_settings import SystemSettings
     from sqlalchemy import select
 
+    from app.models.system_settings import SystemSettings
+
     result = await db.execute(
         select(SystemSettings).where(SystemSettings.tenant_id == tenant_id)
     )
@@ -285,9 +286,9 @@ async def update_automation_settings(
 ):
     """Update automation settings (persisted in system_settings metadata)."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
-    from app.models.system_settings import SystemSettings
     from sqlalchemy import select
-    from sqlalchemy.dialects.postgresql import JSONB
+
+    from app.models.system_settings import SystemSettings
 
     result = await db.execute(
         select(SystemSettings).where(SystemSettings.tenant_id == tenant_id)
@@ -345,7 +346,7 @@ async def get_automation(
     try:
         aid = uuid.UUID(automation_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid automation ID")
+        raise HTTPException(status_code=400, detail="Invalid automation ID") from None
 
     automation = await AutomationService.get_by_id(db, tenant_id, aid)
     if automation is None:
@@ -370,7 +371,7 @@ async def update_automation(
     try:
         aid = uuid.UUID(automation_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid automation ID")
+        raise HTTPException(status_code=400, detail="Invalid automation ID") from None
 
     automation = await AutomationService.update(
         db, tenant_id, aid, data.model_dump(exclude_none=True), user_id=user_id
@@ -394,7 +395,7 @@ async def delete_automation(
     try:
         aid = uuid.UUID(automation_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid automation ID")
+        raise HTTPException(status_code=400, detail="Invalid automation ID") from None
 
     success = await AutomationService.delete(db, tenant_id, aid)
     if not success:
@@ -419,7 +420,7 @@ async def execute_automation(
     try:
         aid = uuid.UUID(automation_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid automation ID")
+        raise HTTPException(status_code=400, detail="Invalid automation ID") from None
 
     automation = await AutomationService.get_by_id(db, tenant_id, aid)
     if automation is None:
@@ -441,7 +442,6 @@ async def execute_automation(
     await db.flush()
 
     # Execute automation via execution engine
-    import asyncio
     from app.plugins.builtins.automation.execution_engine import run_automation
 
     run_id = str(run.id)
@@ -456,9 +456,10 @@ async def execute_automation(
     )
 
     # Update run with results
+    from datetime import datetime
+
     from sqlalchemy import update as sa_update
-    from datetime import datetime, timezone
-    now = datetime.now(timezone.utc)
+    now = datetime.now(UTC)
     async with db.begin():
         await db.execute(
             sa_update(AutomationRun)
@@ -489,14 +490,16 @@ async def dry_run_automation(
     try:
         aid = uuid.UUID(automation_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid automation ID")
+        raise HTTPException(status_code=400, detail="Invalid automation ID") from None
 
     automation = await AutomationService.get_by_id(db, tenant_id, aid)
     if automation is None:
         raise HTTPException(status_code=404, detail="Automation not found")
 
     # Execute dry-run via execution engine
-    from app.plugins.builtins.automation.execution_engine import run_automation as execute_automation_engine
+    from app.plugins.builtins.automation.execution_engine import (
+        run_automation as execute_automation_engine,
+    )
 
     result = await execute_automation_engine(
         ctx={},
@@ -558,7 +561,7 @@ async def list_automation_runs(
     try:
         aid = uuid.UUID(automation_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid automation ID")
+        raise HTTPException(status_code=400, detail="Invalid automation ID") from None
 
     items, total = await RunLogService.list_automation_runs(
         db, tenant_id, automation_id=aid, status=status, limit=limit, offset=offset
@@ -589,7 +592,7 @@ async def list_automation_versions(
     try:
         aid = uuid.UUID(automation_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid automation ID")
+        raise HTTPException(status_code=400, detail="Invalid automation ID") from None
 
     items, total = await AutomationService.get_versions(
         db, tenant_id, aid, limit=limit, offset=offset
@@ -618,7 +621,7 @@ async def restore_automation_version(
         aid = uuid.UUID(automation_id)
         vid = uuid.UUID(version_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid ID")
+        raise HTTPException(status_code=400, detail="Invalid ID") from None
 
     automation = await AutomationService.restore_version(
         db, tenant_id, aid, vid, user_id=user_id
@@ -653,7 +656,7 @@ async def list_subtasks(
         parent_id = uuid.UUID(parent_agent_id) if parent_agent_id else None
         child_id = uuid.UUID(child_agent_id) if child_agent_id else None
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid agent ID")
+        raise HTTPException(status_code=400, detail="Invalid agent ID") from None
 
     from app.plugins.builtins.automation.agent_coordinator import AgentCoordinator
 
@@ -688,7 +691,7 @@ async def create_subtask(
         parent_id = uuid.UUID(data.parent_agent_id)
         child_id = uuid.UUID(data.child_agent_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid agent ID")
+        raise HTTPException(status_code=400, detail="Invalid agent ID") from None
 
     from app.plugins.builtins.automation.agent_coordinator import AgentCoordinator
 
@@ -718,10 +721,11 @@ async def get_subtask(
     try:
         sid = uuid.UUID(subtask_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid subtask ID")
+        raise HTTPException(status_code=400, detail="Invalid subtask ID") from None
+
+    from sqlalchemy import select
 
     from app.plugins.builtins.automation.models import AgentSubtask
-    from sqlalchemy import select
 
     result = await db.execute(
         select(AgentSubtask)
@@ -751,10 +755,11 @@ async def update_subtask(
     try:
         sid = uuid.UUID(subtask_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid subtask ID")
+        raise HTTPException(status_code=400, detail="Invalid subtask ID") from None
+
+    from sqlalchemy import select
 
     from app.plugins.builtins.automation.models import AgentSubtask
-    from sqlalchemy import select
 
     result = await db.execute(
         select(AgentSubtask)
@@ -795,7 +800,7 @@ async def cancel_subtask(
     try:
         sid = uuid.UUID(subtask_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid subtask ID")
+        raise HTTPException(status_code=400, detail="Invalid subtask ID") from None
 
     from app.plugins.builtins.automation.agent_coordinator import AgentCoordinator
 
@@ -823,7 +828,7 @@ async def wait_for_subtask(
     try:
         sid = uuid.UUID(subtask_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid subtask ID")
+        raise HTTPException(status_code=400, detail="Invalid subtask ID") from None
 
     from app.plugins.builtins.automation.agent_coordinator import AgentCoordinator
 
@@ -845,7 +850,7 @@ async def aggregate_subtasks(
     try:
         ids = [uuid.UUID(sid) for sid in subtask_ids]
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid subtask ID in list")
+        raise HTTPException(status_code=400, detail="Invalid subtask ID in list") from None
 
     from app.plugins.builtins.automation.agent_coordinator import AgentCoordinator
 

app/plugins/builtins/automation/scheduler.py

@@ -74,6 +74,6 @@ async def scheduler_tick(ctx: dict[str, Any]) -> None:
 
 
 # Register all job functions with the job registry
-from app.core.job_registry import register_job
+from app.core.job_registry import register_job  # noqa: E402
 
 register_job("scheduler_tick", scheduler_tick)

app/plugins/builtins/automation/schemas.py

@@ -2,12 +2,10 @@
 
 from __future__ import annotations
 
-from datetime import datetime
 from typing import Any
 
 from pydantic import BaseModel, Field
 
-
 # ─── Agent Definition Schemas ───
 
 

app/plugins/builtins/automation/services.py

@@ -10,10 +10,10 @@ import uuid
 from datetime import UTC, datetime
 from typing import Any
 
-from sqlalchemy import func, select, text, update
-from app.core.visibility import apply_visibility_filter
+from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.core.visibility import apply_visibility_filter
 from app.plugins.builtins.automation.models import (
     AgentDefinition,
     AgentRun,
@@ -668,7 +668,7 @@ class CronJobService:
         now = datetime.now(UTC)
         result = await db.execute(
             select(AutomationCronJob)
-            .where(AutomationCronJob.is_active == True)
+            .where(AutomationCronJob.is_active.is_(True))
             .where(AutomationCronJob.next_run_at <= now)
             .limit(limit)
         )

app/plugins/builtins/automation/tests/test_automation.py

@@ -7,33 +7,24 @@ since PostgreSQL may not be available in the dev container.
 from __future__ import annotations
 
 import uuid
+from collections.abc import AsyncGenerator
 from datetime import UTC, datetime, timedelta
-from typing import Any, AsyncGenerator
 
 import pytest
 import pytest_asyncio
-from sqlalchemy import create_engine, event
 from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
-from sqlalchemy.orm import sessionmaker
 
 from app.core.db import Base
 from app.plugins.builtins.automation.models import (
-    AgentDefinition,
     AgentRun,
-    AgentVersion,
-    AutomationCronJob,
-    AutomationDefinition,
     AutomationRun,
-    AutomationVersion,
 )
 from app.plugins.builtins.automation.services import (
     AgentService,
     AutomationService,
     CronJobService,
-    RunLogService,
 )
 
-
 # ─── Fixtures ───
 
 
@@ -536,12 +527,12 @@ class TestInfiniteLoopDetection:
         tool_call_count: dict[str, int] = {}
         tool_name = "send_email"
 
-        for i in range(5):
+        for _i in range(5):
             tool_call_count[tool_name] = tool_call_count.get(tool_name, 0) + 1
             if tool_call_count[tool_name] >= 5:
                 assert True
                 return
-        assert False, "Loop detection should have triggered"
+        raise AssertionError("Loop detection should have triggered")
 
     def test_different_tools_not_detected(self):
         """Test that different tool calls don't trigger loop detection."""
@@ -549,5 +540,5 @@ class TestInfiniteLoopDetection:
         for i in range(5):
             tool_call_count[f"tool_{i}"] = tool_call_count.get(f"tool_{i}", 0) + 1
             if tool_call_count[f"tool_{i}"] >= 5:
-                assert False, "Different tools should not trigger loop detection"
+                raise AssertionError("Different tools should not trigger loop detection")
         assert True

app/plugins/builtins/automation/workflow_timeout.py

@@ -67,7 +67,7 @@ async def check_workflow_timeouts(ctx: dict[str, Any]) -> None:
                         user_id=instance.initiated_by,
                         type="workflow_timeout",
                         title=f"Workflow '{workflow_name}' cancelled due to timeout",
-                        body=f"The workflow instance timed out and was automatically cancelled.",
+                        body="The workflow instance timed out and was automatically cancelled.",
                     )
                     db.add(notification)
 
@@ -83,6 +83,6 @@ async def check_workflow_timeouts(ctx: dict[str, Any]) -> None:
 
 
 # Register all job functions with the job registry
-from app.core.job_registry import register_job
+from app.core.job_registry import register_job  # noqa: E402
 
 register_job("check_workflow_timeouts", check_workflow_timeouts)

app/plugins/builtins/calendar/commands.py

@@ -0,0 +1,181 @@
+"""Calendar commands — create, update, delete entries via Command pattern."""
+
+from __future__ import annotations
+
+import logging
+import uuid
+from datetime import datetime
+from typing import Any
+
+import redis.asyncio as aioredis
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.commands.base import BaseCommand, CommandResult
+from app.core.outbox import enqueue_outbox_event
+
+logger = logging.getLogger(__name__)
+
+
+class CreateCalendarEntryCommand(BaseCommand):
+    """Create a new calendar entry (appointment, task, reminder)."""
+
+    permission = "calendar:write"
+
+    def __init__(self, calendar_id: str, title: str, start_at: str, end_at: str | None = None,
+                 description: str | None = None, location: str | None = None,
+                 entry_type: str = "appointment", status: str = "open"):
+        self.calendar_id = calendar_id
+        self.title = title
+        self.start_at = start_at
+        self.end_at = end_at
+        self.description = description
+        self.location = location
+        self.entry_type = entry_type
+        self.status = status
+
+    async def run(self, db: AsyncSession, redis: aioredis.Redis, current_user: dict[str, Any]) -> CommandResult:
+        from app.plugins.builtins.calendar.models import Calendar, CalendarEntry
+
+        tenant_id = self._tenant_id(current_user)
+        user_id = self._user_id(current_user)
+
+        try:
+            cal_id = uuid.UUID(self.calendar_id)
+        except ValueError:
+            return CommandResult.fail("Invalid calendar_id")
+
+        # Verify calendar belongs to tenant
+        cal_result = await db.execute(
+            select(Calendar).where(Calendar.id == cal_id, Calendar.tenant_id == tenant_id)
+        )
+        if cal_result.scalar_one_or_none() is None:
+            return CommandResult.fail("Calendar not found")
+
+        entry_id = uuid.uuid4()
+        entry = CalendarEntry(
+            id=entry_id,
+            tenant_id=tenant_id,
+            calendar_id=cal_id,
+            title=self.title,
+            description=self.description,
+            location=self.location,
+            start_at=datetime.fromisoformat(self.start_at),
+            end_at=datetime.fromisoformat(self.end_at) if self.end_at else None,
+            entry_type=self.entry_type,
+            status=self.status,
+            created_by=user_id,
+        )
+        db.add(entry)
+        await db.flush()
+
+        await enqueue_outbox_event(db, tenant_id, "calendar.entry.created", {
+            "entry_id": str(entry_id),
+            "title": self.title,
+            "start_at": self.start_at,
+        })
+
+        return CommandResult.ok({
+            "id": str(entry_id),
+            "title": self.title,
+            "start_at": self.start_at,
+            "status": self.status,
+        })
+
+    async def audit(self, db: AsyncSession, current_user: dict[str, Any]) -> None:
+        from app.core.audit import log_audit
+        await log_audit(
+            db, self._tenant_id(current_user), self._user_id(current_user),
+            action="calendar.entry.create", entity_type="calendar_entry",
+            changes={"title": self.title, "start_at": self.start_at},
+        )
+
+
+class UpdateCalendarEntryCommand(BaseCommand):
+    """Update an existing calendar entry."""
+
+    permission = "calendar:write"
+
+    def __init__(self, entry_id: str, data: dict[str, Any]):
+        self.entry_id = entry_id
+        self.data = data
+
+    async def run(self, db: AsyncSession, redis: aioredis.Redis, current_user: dict[str, Any]) -> CommandResult:
+        from app.plugins.builtins.calendar.models import CalendarEntry
+
+        tenant_id = self._tenant_id(current_user)
+        try:
+            eid = uuid.UUID(self.entry_id)
+        except ValueError:
+            return CommandResult.fail("Invalid entry_id")
+
+        result = await db.execute(
+            select(CalendarEntry).where(CalendarEntry.id == eid, CalendarEntry.tenant_id == tenant_id)
+        )
+        entry = result.scalar_one_or_none()
+        if entry is None:
+            return CommandResult.fail("Calendar entry not found")
+
+        # Apply updates
+        for key, value in self.data.items():
+            if hasattr(entry, key) and key not in ("id", "tenant_id", "created_at"):
+                if key in ("start_at", "end_at") and isinstance(value, str):
+                    value = datetime.fromisoformat(value)
+                setattr(entry, key, value)
+
+        await db.flush()
+
+        await enqueue_outbox_event(db, tenant_id, "calendar.entry.updated", {
+            "entry_id": self.entry_id,
+            "changes": self.data,
+        })
+
+        return CommandResult.ok({"id": self.entry_id, "updated": True})
+
+    async def audit(self, db: AsyncSession, current_user: dict[str, Any]) -> None:
+        from app.core.audit import log_audit
+        await log_audit(
+            db, self._tenant_id(current_user), self._user_id(current_user),
+            action="calendar.entry.update", entity_type="calendar_entry",
+            changes={"entry_id": self.entry_id, "fields": list(self.data.keys())},
+        )
+
+
+class DeleteCalendarEntryCommand(BaseCommand):
+    """Delete a calendar entry."""
+
+    permission = "calendar:delete"
+
+    def __init__(self, entry_id: str):
+        self.entry_id = entry_id
+
+    async def run(self, db: AsyncSession, redis: aioredis.Redis, current_user: dict[str, Any]) -> CommandResult:
+        from app.plugins.builtins.calendar.models import CalendarEntry
+
+        tenant_id = self._tenant_id(current_user)
+        try:
+            eid = uuid.UUID(self.entry_id)
+        except ValueError:
+            return CommandResult.fail("Invalid entry_id")
+
+        result = await db.execute(
+            select(CalendarEntry).where(CalendarEntry.id == eid, CalendarEntry.tenant_id == tenant_id)
+        )
+        entry = result.scalar_one_or_none()
+        if entry is None:
+            return CommandResult.fail("Calendar entry not found")
+
+        await db.delete(entry)
+        await db.flush()
+
+        await enqueue_outbox_event(db, tenant_id, "calendar.entry.deleted", {"entry_id": self.entry_id})
+
+        return CommandResult.ok({"id": self.entry_id, "deleted": True})
+
+    async def audit(self, db: AsyncSession, current_user: dict[str, Any]) -> None:
+        from app.core.audit import log_audit
+        await log_audit(
+            db, self._tenant_id(current_user), self._user_id(current_user),
+            action="calendar.entry.delete", entity_type="calendar_entry",
+            changes={"entry_id": self.entry_id},
+        )

app/plugins/builtins/calendar/contracts.py

@@ -2,8 +2,8 @@
 
 from __future__ import annotations
 
-from app.plugins.builtins.contracts import get_contract_registry
 from app.plugins.builtins.calendar.models import Calendar, CalendarEntry, CalendarEntryLink
+from app.plugins.builtins.contracts import get_contract_registry
 
 
 class CalendarContract:

app/plugins/builtins/calendar/plugin.py

@@ -3,7 +3,13 @@
 from __future__ import annotations
 
 from app.plugins.base import BasePlugin
-from app.plugins.manifest import PluginManifest, PluginRouteDef, FrontendMenuItem, FrontendPageRoute, FrontendDetailTab
+from app.plugins.manifest import (
+    FrontendDetailTab,
+    FrontendMenuItem,
+    FrontendPageRoute,
+    PluginManifest,
+    PluginRouteDef,
+)
 
 
 class CalendarPlugin(BasePlugin):
@@ -56,11 +62,45 @@ class CalendarPlugin(BasePlugin):
         contract_version="1.0.0",
     )
 
+    async def on_activate(self, db, service_container, event_bus) -> None:
+        """Activate plugin: register restore config + history hooks."""
+        await super().on_activate(db, service_container, event_bus)
+
+        # Register restore config for CalendarEntry entities (P0-7 fix)
+        from app.core.restore_registry import RestoreConfig, get_restore_registry
+        from app.plugins.builtins.calendar.models import CalendarEntry
+        get_restore_registry().register(RestoreConfig(
+            entity_type="calendar_entry",
+            model_class=CalendarEntry,
+            restore_permission="calendar:write",
+            excluded_fields=frozenset({"calendar_id", "created_by", "assigned_to", "source_mail_id"}),
+        ))
+
+        # Register history hooks for CalendarEntry entities (P0-8 fix)
+        from app.core.history_hooks import register_history_hooks
+        from app.core.hooks import get_hook_registry
+        register_history_hooks(
+            get_hook_registry(), "calendar_entry",
+            "calendar_entry.after_create", "calendar_entry.after_update", "calendar_entry.after_delete",
+            owner_tag="calendar",
+        )
+
     async def on_deactivate(
         self, db, service_container, event_bus
     ) -> None:
-        """Deactivate plugin: unregister contract and event listeners."""
+        """Deactivate plugin: unregister contract, restore, history, events."""
         # Contract abmelden
         from app.plugins.builtins.contracts import get_contract_registry
         get_contract_registry().unregister(self.manifest.name)
+
+        # Unregister restore config (P0-7 fix)
+        from app.core.restore_registry import get_restore_registry
+        get_restore_registry().unregister("calendar_entry")
+
+        # Unregister history hooks (free functions, not bound methods)
+        from app.core.hooks import get_hook_registry
+        get_hook_registry().unregister_actions_by_owner("calendar_entry.after_create", "calendar")
+        get_hook_registry().unregister_actions_by_owner("calendar_entry.after_update", "calendar")
+        get_hook_registry().unregister_actions_by_owner("calendar_entry.after_delete", "calendar")
+
         await super().on_deactivate(db, service_container, event_bus)

app/plugins/builtins/calendar/routes.py

@@ -22,7 +22,6 @@ from sqlalchemy import select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import get_db
-from app.core.visibility import apply_visibility_filter, check_single_entity_access
 from app.deps import get_current_user, require_admin, require_permission
 from app.plugins.builtins.calendar.ics_utils import (
     export_entries_to_ics,
@@ -292,8 +291,8 @@ async def share_calendar(
 
     # Grant calendar:read (or calendar:write) permission to the shared user's role
     if body.user_id:
-        from app.models.user import UserTenant
         from app.models.role import Role
+        from app.models.user import UserTenant
         shared_user_id = _parse_uuid(body.user_id, "user_id")
         ut_q = await db.execute(
             select(UserTenant).where(

app/plugins/builtins/contacts/__init__.py

@@ -0,0 +1,3 @@
+from app.plugins.builtins.contacts.plugin import ContactsPlugin
+
+__all__ = ["ContactsPlugin"]

app/plugins/builtins/contacts/plugin.py

@@ -0,0 +1,95 @@
+"""Contacts plugin — Core CRM entity lifecycle management.
+
+Registers Contact entity models, permissions, restore config, and history hooks
+via the same plugin lifecycle as all other business plugins. No Core special case.
+"""
+
+from __future__ import annotations
+
+import logging
+
+from app.plugins.base import BasePlugin
+from app.plugins.manifest import PluginManifest
+
+logger = logging.getLogger(__name__)
+
+
+class ContactsPlugin(BasePlugin):
+    """Contacts plugin — manages Contact entity lifecycle (models, permissions, restore, history).
+
+    Routes remain in app/routes/contacts.py as core routes, but entity lifecycle
+    (permissions, entity models, restore, history) is managed through on_activate/on_deactivate.
+    """
+
+    manifest = PluginManifest(
+        name="contacts",
+        version="1.0.0",
+        display_name="Contacts",
+        description="Core CRM contacts — persons and companies.",
+        dependencies=[],
+        routes=[],  # Routes are registered as core routes in main.py
+        events=[],
+        migrations=[],
+        permissions=[
+            "contacts:read",
+            "contacts:write",
+            "contacts:delete",
+        ],
+        is_core=True,
+        author="LeoCRM Team",
+        min_app_version="1.0.0",
+        contract_version="1.0.0",
+    )
+
+    def get_entity_models(self) -> dict[str, type]:
+        from app.models.contact import Contact
+        return {
+            "contact": Contact,
+            "contacts": Contact,
+            "company": Contact,
+        }
+
+    async def on_activate(self, db, service_container, event_bus) -> None:
+        """Activate: register restore config + history hooks for Contact."""
+        await super().on_activate(db, service_container, event_bus)
+
+        # Register restore config for Contact entities
+        from app.core.restore_registry import RestoreConfig, get_restore_registry
+        from app.models.contact import Contact
+        get_restore_registry().register(RestoreConfig(
+            entity_type="contact",
+            model_class=Contact,
+            restore_permission="contacts:write",
+            excluded_fields=frozenset({
+                "search_tsv", "embedding", "default_person_id", "admin_contactperson_id",
+            }),
+        ))
+
+        # Register history hooks for Contact entities
+        from app.core.history_hooks import register_history_hooks
+        from app.core.hooks import get_hook_registry
+        register_history_hooks(
+            get_hook_registry(), "contact",
+            "contact.after_create", "contact.after_update", "contact.after_delete",
+            owner_tag="contacts",
+        )
+
+        logger.info("Contacts plugin activated: restore + history registered")
+
+    async def on_deactivate(self, db, service_container, event_bus) -> None:
+        """Deactivate: unregister restore config + history hooks for Contact."""
+        from app.core.restore_registry import get_restore_registry
+        get_restore_registry().unregister("contact")
+
+        # Unregister history hooks — use owner_tag to remove only this plugin's hooks
+        from app.core.hooks import get_hook_registry
+        hook_reg = get_hook_registry()
+        hook_reg.unregister_actions_by_owner("contact.after_create", "contacts")
+        hook_reg.unregister_actions_by_owner("contact.after_update", "contacts")
+        hook_reg.unregister_actions_by_owner("contact.after_delete", "contacts")
+
+        from app.plugins.builtins.contracts import get_contract_registry
+        get_contract_registry().unregister(self.manifest.name)
+
+        await super().on_deactivate(db, service_container, event_bus)
+        logger.info("Contacts plugin deactivated: restore + history unregistered")

app/plugins/builtins/dms/commands.py

@@ -0,0 +1,161 @@
+"""DMS commands — file upload, delete, restore via Command pattern."""
+
+from __future__ import annotations
+
+import hashlib
+import logging
+import os
+import uuid
+from typing import Any
+
+import redis.asyncio as aioredis
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.commands.base import BaseCommand, CommandResult
+from app.core.outbox import enqueue_outbox_event
+from app.core.storage import get_storage_backend
+
+logger = logging.getLogger(__name__)
+
+CHUNK_SIZE = 1024 * 1024  # 1MB
+
+
+def _sanitize_filename(filename: str) -> str:
+    """Sanitize a filename for safe use in Content-Disposition headers."""
+    import re
+    safe = os.path.basename(filename.replace("\\", "/"))
+    safe = re.sub(r"[^a-zA-Z0-9.\-_\u00c0-\u017f\u4e00-\u9fff ]", "_", safe)
+    safe = re.sub(r"\.{2,}", "_", safe)
+    safe = re.sub(r" {2,}", " ", safe)
+    safe = safe.lstrip(".").strip()
+    if len(safe) > 200:
+        name, ext = safe.rsplit(".", 1) if "." in safe[:200] else (safe[:200], "")
+        safe = name[:200] + ("." + ext if ext else "")
+    return safe or "file"
+
+
+class UploadFileCommand(BaseCommand):
+    """Upload a file to DMS with chunked streaming and SHA-256 hashing."""
+
+    permission = "dms:write"
+
+    def __init__(self, file_content: bytes, filename: str, mime_type: str, folder_id: str | None = None):
+        self.file_content = file_content
+        self.filename = _sanitize_filename(filename)
+        self.mime_type = mime_type
+        self.folder_id = folder_id
+
+    async def run(self, db: AsyncSession, redis: aioredis.Redis, current_user: dict[str, Any]) -> CommandResult:
+        from app.plugins.builtins.dms.models import File as DmsFile
+        from app.plugins.builtins.dms.models import Folder
+
+        tenant_id = self._tenant_id(current_user)
+        user_id = self._user_id(current_user)
+
+        # Validate folder if specified
+        fid = None
+        if self.folder_id:
+            try:
+                fid = uuid.UUID(self.folder_id)
+            except ValueError:
+                return CommandResult.fail("Invalid folder_id")
+            folder_result = await db.execute(
+                select(Folder).where(Folder.id == fid, Folder.tenant_id == tenant_id, Folder.deleted_at.is_(None))
+            )
+            if folder_result.scalar_one_or_none() is None:
+                return CommandResult.fail("Folder not found")
+
+        # Calculate SHA-256
+        sha256 = hashlib.sha256()
+        sha256.update(self.file_content)
+        content_hash = sha256.hexdigest()
+        file_size = len(self.file_content)
+
+        # Create file record
+        file_id = uuid.uuid4()
+        storage_path = f"{tenant_id}/{file_id}"
+
+        # Save file
+        storage = get_storage_backend()
+        await storage.save(storage_path, self.file_content)
+
+        dms_file = DmsFile(
+            id=file_id,
+            tenant_id=tenant_id,
+            name=self.filename,
+            folder_id=fid,
+            uploaded_by=user_id,
+            mime_type=self.mime_type,
+            size_bytes=file_size,
+            storage_path=storage_path,
+            content_hash=content_hash,
+        )
+        db.add(dms_file)
+        await db.flush()
+
+        # Enqueue outbox event
+        await enqueue_outbox_event(db, tenant_id, "dms.file.uploaded", {
+            "file_id": str(file_id),
+            "name": self.filename,
+            "size_bytes": file_size,
+            "content_hash": content_hash,
+        })
+
+        return CommandResult.ok({
+            "id": str(file_id),
+            "name": self.filename,
+            "size_bytes": file_size,
+            "content_hash": content_hash,
+            "mime_type": self.mime_type,
+        })
+
+    async def audit(self, db: AsyncSession, current_user: dict[str, Any]) -> None:
+        from app.core.audit import log_audit
+        await log_audit(
+            db, self._tenant_id(current_user), self._user_id(current_user),
+            action="dms.file.upload", entity_type="dms_file",
+            changes={"name": self.filename, "size": len(self.file_content)},
+        )
+
+
+class DeleteFileCommand(BaseCommand):
+    """Soft-delete a DMS file."""
+
+    permission = "dms:delete"
+
+    def __init__(self, file_id: str):
+        self.file_id = file_id
+
+    async def run(self, db: AsyncSession, redis: aioredis.Redis, current_user: dict[str, Any]) -> CommandResult:
+        from datetime import UTC, datetime
+
+        from app.plugins.builtins.dms.models import File as DmsFile
+
+        tenant_id = self._tenant_id(current_user)
+        try:
+            fid = uuid.UUID(self.file_id)
+        except ValueError:
+            return CommandResult.fail("Invalid file_id")
+
+        result = await db.execute(
+            select(DmsFile).where(DmsFile.id == fid, DmsFile.tenant_id == tenant_id, DmsFile.deleted_at.is_(None))
+        )
+        dms_file = result.scalar_one_or_none()
+        if dms_file is None:
+            return CommandResult.fail("File not found")
+
+        dms_file.deleted_at = datetime.now(UTC)
+        await db.flush()
+
+        await enqueue_outbox_event(db, tenant_id, "dms.file.deleted", {"file_id": self.file_id})
+
+        return CommandResult.ok({"id": self.file_id, "deleted": True})
+
+    async def audit(self, db: AsyncSession, current_user: dict[str, Any]) -> None:
+        from app.core.audit import log_audit
+        await log_audit(
+            db, self._tenant_id(current_user), self._user_id(current_user),
+            action="dms.file.delete", entity_type="dms_file",
+            changes={"file_id": self.file_id},
+        )

app/plugins/builtins/dms/contracts.py

@@ -3,7 +3,8 @@
 from __future__ import annotations
 
 from app.plugins.builtins.contracts import get_contract_registry
-from app.plugins.builtins.dms.models import File as DmsFile, Folder
+from app.plugins.builtins.dms.models import File as DmsFile
+from app.plugins.builtins.dms.models import Folder
 
 
 class DmsContract:

app/plugins/builtins/dms/plugin.py

@@ -3,7 +3,13 @@
 from __future__ import annotations
 
 from app.plugins.base import BasePlugin
-from app.plugins.manifest import PluginManifest, PluginRouteDef, FrontendMenuItem, FrontendPageRoute, FrontendDetailTab
+from app.plugins.manifest import (
+    FrontendDetailTab,
+    FrontendMenuItem,
+    FrontendPageRoute,
+    PluginManifest,
+    PluginRouteDef,
+)
 
 
 class DmsPlugin(BasePlugin):
@@ -48,11 +54,45 @@ class DmsPlugin(BasePlugin):
         contract_version="1.0.0",
     )
 
+    async def on_activate(self, db, service_container, event_bus) -> None:
+        """Activate plugin: register restore config + history hooks."""
+        await super().on_activate(db, service_container, event_bus)
+
+        # Register restore config for DMS File entities (P0-7 fix)
+        from app.core.restore_registry import RestoreConfig, get_restore_registry
+        from app.plugins.builtins.dms.models import File as DmsFile
+        get_restore_registry().register(RestoreConfig(
+            entity_type="dms_file",
+            model_class=DmsFile,
+            restore_permission="dms:write",
+            excluded_fields=frozenset({"storage_path", "content_hash", "size_bytes", "uploaded_by", "folder_id"}),
+        ))
+
+        # Register history hooks for DMS File entities (P0-8 fix)
+        from app.core.history_hooks import register_history_hooks
+        from app.core.hooks import get_hook_registry
+        register_history_hooks(
+            get_hook_registry(), "dms_file",
+            "dms_file.after_create", "dms_file.after_update", "dms_file.after_delete",
+            owner_tag="dms",
+        )
+
     async def on_deactivate(
         self, db, service_container, event_bus
     ) -> None:
-        """Deactivate plugin: unregister contract and event listeners."""
+        """Deactivate plugin: unregister contract, restore, history, events."""
         # Contract abmelden
         from app.plugins.builtins.contracts import get_contract_registry
         get_contract_registry().unregister(self.manifest.name)
+
+        # Unregister restore config (P0-7 fix)
+        from app.core.restore_registry import get_restore_registry
+        get_restore_registry().unregister("dms_file")
+
+        # Unregister history hooks (free functions, not bound methods)
+        from app.core.hooks import get_hook_registry
+        get_hook_registry().unregister_actions_by_owner("dms_file.after_create", "dms")
+        get_hook_registry().unregister_actions_by_owner("dms_file.after_update", "dms")
+        get_hook_registry().unregister_actions_by_owner("dms_file.after_delete", "dms")
+
         await super().on_deactivate(db, service_container, event_bus)

app/plugins/builtins/dms/routes.py

@@ -21,7 +21,7 @@ from sqlalchemy import select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import get_db
-from app.core.storage import get_storage_backend, LocalStorage
+from app.core.storage import LocalStorage, get_storage_backend
 from app.core.visibility import apply_visibility_filter, check_single_entity_access
 from app.deps import get_current_user, require_permission
 from app.plugins.builtins.dms.models import File as DmsFile
@@ -140,7 +140,7 @@ def _is_blocked_filetype(filename: str) -> bool:
     return ext in BLOCKED_EXTENSIONS
 
 
-CHUNK_SIZE = 1024 * 1024  # 1MB chunks for streaming uploads
+chunk_size = 1024 * 1024  # 1MB chunks for streaming uploads
 
 # ─── Folders ───
 
@@ -546,14 +546,14 @@ async def upload_file(
 
     # Stream file to storage — avoid loading entire file into RAM
     import hashlib
-    CHUNK_SIZE = 1024 * 1024  # 1MB chunks
+    chunk_size = 1024 * 1024  # 1MB chunks
     sha256 = hashlib.sha256()
     file_size = 0
 
     async def chunk_stream():
         nonlocal file_size
         while True:
-            chunk = await file.read(CHUNK_SIZE)
+            chunk = await file.read(chunk_size)
             if not chunk:
                 break
             file_size += len(chunk)
@@ -1011,8 +1011,8 @@ async def preview_file(
         )
 
     # Stream file directly from storage without loading into RAM
+
     from fastapi.responses import FileResponse as FastApiFileResponse
-    import os as _os
 
     if isinstance(storage, LocalStorage):
         # LocalStorage: use FileResponse for automatic streaming

app/plugins/builtins/entity_links/plugin.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 from typing import Any
 
 from app.plugins.base import BasePlugin
-from app.plugins.manifest import PluginManifest, PluginRouteDef, FrontendDetailTab
+from app.plugins.manifest import FrontendDetailTab, PluginManifest, PluginRouteDef
 
 
 class EntityLinksPlugin(BasePlugin):
@@ -45,7 +45,7 @@ class EntityLinksPlugin(BasePlugin):
         detail_tabs=[
             FrontendDetailTab(entity_type='contact', label_key='tabs.links', label='Verknüpfungen', component='@/components/contact/ContactLinksTab', icon='Link', order=60, permission='entity_links:read'),
         ],
-    
+
         author="LeoCRM Team",
         min_app_version="1.0.0",
         contract_version="1.0.0")
@@ -75,6 +75,10 @@ class EntityLinksPlugin(BasePlugin):
             )
             await session.commit()
 
+    def get_entity_models(self) -> dict[str, type]:
+        from app.plugins.builtins.entity_links.models import EntityLink
+        return {"entity_link": EntityLink}
+
     async def on_deactivate(
         self, db, service_container, event_bus
     ) -> None:

app/plugins/builtins/entity_links/routes.py

@@ -9,17 +9,21 @@ from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import get_db
-from app.core.visibility import apply_visibility_filter
 from app.deps import get_current_user, require_permission
-from app.services.entity_permission_service import check_entity_access
 from app.plugins.builtins.entity_links.models import EntityLink
 from app.plugins.builtins.entity_links.schemas import EntityLinkRequest
+from app.services.entity_permission_service import check_entity_access
 
 router = APIRouter(prefix="/api/v1/entity-links", tags=["entity-links"])
 contact_router = APIRouter(prefix="/api/v1/contacts", tags=["entity-links"])
 company_router = APIRouter(prefix="/api/v1/companies", tags=["entity-links"])
 
-VALID_ENTITY_TYPES = {"contact", "company"}
+# Entity types validated dynamically against ENTITY_MODELS at runtime (P1-13 fix)
+
+def _is_valid_entity_type(entity_type: str) -> bool:
+    """Check if entity_type is registered in ENTITY_MODELS."""
+    from app.services.entity_permission_service import ENTITY_MODELS
+    return entity_type in ENTITY_MODELS
 
 
 def _parse_uuid(val: str, field: str) -> uuid.UUID:
@@ -44,7 +48,7 @@ async def link_file_to_entity(
     fid = _parse_uuid(file_id, "file_id")
     entity_id = _parse_uuid(body.entity_id, "entity_id")
 
-    if body.entity_type not in VALID_ENTITY_TYPES:
+    if not _is_valid_entity_type(body.entity_type):
         raise HTTPException(
             400, detail={"detail": "Invalid entity_type", "code": "invalid_entity_type"}
         )
@@ -103,7 +107,6 @@ async def unlink_file_from_entity(
 ):
     """Remove a link between a file and an entity."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
-    user_id = uuid.UUID(current_user["user_id"])
     fid = _parse_uuid(file_id, "file_id")
     entity_id = _parse_uuid(body.entity_id, "entity_id")
 
@@ -131,7 +134,6 @@ async def list_file_links(
 ):
     """List all entities linked to a file."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
-    user_id = uuid.UUID(current_user["user_id"])
     fid = _parse_uuid(file_id, "file_id")
 
     result = await db.execute(

app/plugins/builtins/entity_links/schemas.py

@@ -6,7 +6,7 @@ from pydantic import BaseModel, Field
 
 
 class EntityLinkRequest(BaseModel):
-    entity_type: str = Field(..., pattern="^(contact|company)$")
+    entity_type: str = Field(...)
     entity_id: str
 
 

app/plugins/builtins/forgejo_error_reporter/models.py

@@ -5,12 +5,9 @@ Tracks which errors have been reported to Forgejo for audit purposes.
 
 from __future__ import annotations
 
-from datetime import datetime
-
 from sqlalchemy import Column, DateTime, Integer, String, Text, func
-from sqlalchemy.orm import declarative_base
 
-Base = declarative_base()
+from app.core.db import Base
 
 
 class ReportedError(Base):

app/plugins/builtins/forgejo_error_reporter/plugin.py

@@ -35,7 +35,7 @@ class ForgejoErrorReporterPlugin(BasePlugin):
                 router_attr="router",
             ),
         ],
-    
+
         author="LeoCRM Team",
         min_app_version="1.0.0",
         contract_version="1.0.0")

app/plugins/builtins/forgejo_error_reporter/service.py

@@ -154,9 +154,10 @@ async def report_error_to_forgejo(entry: dict[str, Any]) -> bool:
         return False
 
     # Rate limit check — uses central check_rate_limit() with Redis + in-memory fallback
-    from app.core.rate_limit import check_rate_limit
     from fastapi import HTTPException
 
+    from app.core.rate_limit import check_rate_limit
+
     try:
         await check_rate_limit(
             "rate:forgejo_report:global",

app/plugins/builtins/graph_rag/plugin.py

@@ -34,6 +34,10 @@ class GraphRAGPlugin(BasePlugin):
         contract_version="1.0.0",
     )
 
+    def get_entity_models(self) -> dict[str, type]:
+        from app.plugins.builtins.graph_rag.models import EntityRelationship
+        return {"entity_relationship": EntityRelationship}
+
     async def on_activate(self, db, service_container, event_bus) -> None:
         """Activate plugin: register GraphRAG search provider."""
         from app.plugins.builtins.graph_rag.provider import GraphRAGSearchProvider

app/plugins/builtins/graph_rag/services.py

@@ -6,7 +6,7 @@ import uuid
 from collections import deque
 from typing import Any
 
-from sqlalchemy import select, text as sql_text
+from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.plugins.builtins.graph_rag.models import EntityRelationship

app/plugins/builtins/kommunikation/content_types.py

@@ -4,7 +4,6 @@ from __future__ import annotations
 
 from typing import Any
 
-
 # Known block types and their expected schema
 BLOCK_TYPES: dict[str, dict[str, Any]] = {
     "text": {

app/plugins/builtins/kommunikation/contracts.py

@@ -36,6 +36,7 @@ from app.plugins.builtins.kommunikation.services import (
     parse_mentions,
     send_message,
 )
+from app.plugins.builtins.kommunikation.services import post_system_message as _post_system_message
 
 
 class KommunikationContract:
@@ -64,6 +65,7 @@ class KommunikationContract:
     MiniAppDef = MiniAppDef
     get_miniapp_registry = staticmethod(get_miniapp_registry)
     reset_miniapp_registry = staticmethod(reset_miniapp_registry)
+    post_system_message = staticmethod(_post_system_message)
 
     # ─── models (read-only for queries) ───
     CommConversation = CommConversation

app/plugins/builtins/kommunikation/dms_bridge.py

@@ -8,12 +8,12 @@ import uuid
 from typing import Any
 
 import aiofiles
-
 from fastapi import UploadFile
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.plugins.builtins.dms.contracts import get_contract as get_dms_contract
+
 _dms = get_dms_contract()
 DmsFile = _dms.DmsFile
 Folder = _dms.Folder

app/plugins/builtins/kommunikation/miniapp_registry.py

@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 import logging
-from typing import Any, Callable, Awaitable
+from typing import Any
 
 from pydantic import BaseModel, Field
 

app/plugins/builtins/kommunikation/models.py

@@ -17,7 +17,8 @@ from sqlalchemy import (
     UniqueConstraint,
     func,
 )
-from sqlalchemy.dialects.postgresql import JSONB, UUID as PGUUID
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column
 
 from app.core.db import Base, TenantMixin

app/plugins/builtins/kommunikation/plugin.py

@@ -6,7 +6,7 @@ import logging
 from typing import Any
 
 from app.plugins.base import BasePlugin
-from app.plugins.manifest import PluginManifest, PluginRouteDef, FrontendMenuItem, FrontendPageRoute
+from app.plugins.manifest import FrontendMenuItem, FrontendPageRoute, PluginManifest, PluginRouteDef
 
 logger = logging.getLogger(__name__)
 
@@ -60,6 +60,10 @@ class KommunikationPlugin(BasePlugin):
         contract_version="1.0.0",
     )
 
+    def get_entity_models(self) -> dict[str, type]:
+        from app.plugins.builtins.kommunikation.models import CommConversation
+        return {"comm_conversation": CommConversation}
+
     async def on_activate(self, db, service_container, event_bus) -> None:
         """Register participant registry and WebSocket manager."""
         await super().on_activate(db, service_container, event_bus)

app/plugins/builtins/kommunikation/routes.py

@@ -5,25 +5,34 @@ from __future__ import annotations
 import json
 import logging
 import uuid
-from typing import Any
 
-from fastapi import APIRouter, Depends, HTTPException, Query, UploadFile, File, WebSocket, WebSocketDisconnect, status
+from fastapi import (
+    APIRouter,
+    Depends,
+    File,
+    HTTPException,
+    Query,
+    UploadFile,
+    WebSocket,
+    WebSocketDisconnect,
+)
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import get_db
-from app.core.visibility import apply_visibility_filter
 from app.deps import get_current_user, require_permission
+from app.plugins.builtins.kommunikation.content_types import list_block_types
+from app.plugins.builtins.kommunikation.dms_bridge import DmsBridge
 from app.plugins.builtins.kommunikation.rbac import CommRBAC
 from app.plugins.builtins.kommunikation.schemas import (
     ConversationCreate,
     ConversationUpdate,
     MessageCreate,
     MessageUpdate,
+    MiniAppStartRequest,
     ParticipantAdd,
     ParticipantRoleUpdate,
     ReactionCreate,
     ReadStateUpdate,
-    MiniAppStartRequest,
 )
 from app.plugins.builtins.kommunikation.services import (
     add_participant,
@@ -45,8 +54,6 @@ from app.plugins.builtins.kommunikation.services import (
     unpin_conversation,
     update_conversation,
 )
-from app.plugins.builtins.kommunikation.content_types import list_block_types
-from app.plugins.builtins.kommunikation.dms_bridge import DmsBridge
 
 logger = logging.getLogger(__name__)
 
@@ -57,7 +64,7 @@ def _parse_uuid(val: str, field: str = "id") -> uuid.UUID:
     try:
         return uuid.UUID(val)
     except (ValueError, TypeError):
-        raise HTTPException(400, detail={"detail": f"Invalid {field}", "code": "invalid_id"})
+        raise HTTPException(400, detail={"detail": f"Invalid {field}", "code": "invalid_id"}) from None
 
 
 # ─── Conversations ───
@@ -102,8 +109,8 @@ async def get_single_conversation(
     db: AsyncSession = Depends(get_db),
 ):
     """Get a single conversation with participants."""
-    tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    tenant_id = uuid.UUID(current_user["tenant_id"])
     conv_id = _parse_uuid(conversation_id, "conversation_id")
     conv = await get_conversation(db, tenant_id, conv_id, user_id)
     if conv is None:
@@ -119,8 +126,8 @@ async def update_single_conversation(
     db: AsyncSession = Depends(get_db),
 ):
     """Update a conversation (title, archive)."""
-    tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    tenant_id = uuid.UUID(current_user["tenant_id"])
     conv_id = _parse_uuid(conversation_id, "conversation_id")
     conv = await update_conversation(db, tenant_id, conv_id, user_id, title=body.title, is_archived=body.is_archived)
     if conv is None:
@@ -135,7 +142,6 @@ async def leave_or_delete_conversation(
     db: AsyncSession = Depends(get_db),
 ):
     """Leave (member) or delete (admin) a conversation."""
-    tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
     conv_id = _parse_uuid(conversation_id, "conversation_id")
     # For now: just leave (set left_at)
@@ -152,8 +158,8 @@ async def pin_conv(
     db: AsyncSession = Depends(get_db),
 ):
     """Pin a conversation for the current user."""
-    tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    tenant_id = uuid.UUID(current_user["tenant_id"])
     conv_id = _parse_uuid(conversation_id, "conversation_id")
     await pin_conversation(db, tenant_id, conv_id, user_id)
     return {"success": True}
@@ -179,8 +185,8 @@ async def mute_conv(
     db: AsyncSession = Depends(get_db),
 ):
     """Mute a conversation."""
-    tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    tenant_id = uuid.UUID(current_user["tenant_id"])
     conv_id = _parse_uuid(conversation_id, "conversation_id")
     await mute_conversation(db, tenant_id, conv_id, user_id)
     return {"success": True}
@@ -270,8 +276,8 @@ async def get_conv_messages(
     db: AsyncSession = Depends(get_db),
 ):
     """Get paginated messages for a conversation."""
-    tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    tenant_id = uuid.UUID(current_user["tenant_id"])
     conv_id = _parse_uuid(conversation_id, "conversation_id")
     if not await CommRBAC.is_participant(db, conv_id, user_id):
         raise HTTPException(403, detail={"detail": "Not a participant", "code": "forbidden"})
@@ -287,8 +293,8 @@ async def send_conv_message(
     db: AsyncSession = Depends(get_db),
 ):
     """Send a message to a conversation."""
-    tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    tenant_id = uuid.UUID(current_user["tenant_id"])
     conv_id = _parse_uuid(conversation_id, "conversation_id")
     if not await CommRBAC.can_user_write(db, conv_id, current_user):
         raise HTTPException(403, detail={"detail": "Cannot write to this conversation", "code": "forbidden"})
@@ -359,6 +365,7 @@ async def upload_attachment(
     )
     # Get conversation_id from message
     from sqlalchemy import select
+
     from app.plugins.builtins.kommunikation.models import CommMessage
     result = await db.execute(select(CommMessage).where(CommMessage.id == msg_id))
     msg = result.scalar_one_or_none()
@@ -367,7 +374,7 @@ async def upload_attachment(
     try:
         return await DmsBridge.store_attachment(db, tenant_id, msg.conversation_id, user_id, file)
     except ValueError as e:
-        raise HTTPException(413, detail={"detail": str(e), "code": "file_too_large"})
+        raise HTTPException(413, detail={"detail": str(e), "code": "file_too_large"}) from e
 
 
 # ─── Reactions ───
@@ -415,8 +422,8 @@ async def mark_conv_read(
     db: AsyncSession = Depends(get_db),
 ):
     """Mark a conversation as read."""
-    tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    tenant_id = uuid.UUID(current_user["tenant_id"])
     conv_id = _parse_uuid(conversation_id, "conversation_id")
     await mark_read(db, tenant_id, conv_id, user_id, body.last_read_msg_id)
     return {"success": True}
@@ -445,8 +452,8 @@ async def start_miniapp(
     db: AsyncSession = Depends(get_db),
 ):
     """Start a mini-app in a conversation."""
-    tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    tenant_id = uuid.UUID(current_user["tenant_id"])
     conv_id = _parse_uuid(conversation_id, "conversation_id")
     if not await CommRBAC.can_user_write(db, conv_id, current_user):
         raise HTTPException(403, detail={"detail": "Cannot write", "code": "forbidden"})
@@ -500,9 +507,11 @@ async def websocket_endpoint(
     tenant_id = auth["tenant_id"]
 
     # Plugin-Gate: check if kommunikation plugin is active (global + tenant)
-    from app.core.permission_registry import get_permission_registry
-    from sqlalchemy import text as sa_text
     import uuid as _uuid
+
+    from sqlalchemy import text as sa_text
+
+    from app.core.permission_registry import get_permission_registry
     try:
         registry = get_permission_registry()
         if not registry.is_plugin_active("kommunikation"):
@@ -533,8 +542,9 @@ async def websocket_endpoint(
                 conv_id = msg.get("conversation_id")
                 if conv_id:
                     # P1.9 fix: Check if user is a participant of this conversation
-                    from app.core.db import async_session_maker
                     from sqlalchemy import text as sql_text
+
+                    from app.core.db import async_session_maker
                     try:
                         async with async_session_maker() as db:
                             await db.execute(sql_text("SELECT set_config('app.current_tenant_id', :tid, true)"), {"tid": tenant_id})

app/plugins/builtins/kommunikation/schemas.py

@@ -2,13 +2,10 @@
 
 from __future__ import annotations
 
-import uuid
-from datetime import datetime
 from typing import Any
 
 from pydantic import BaseModel, Field
 
-
 # ─── Conversation Schemas ───
 
 class ParticipantResponse(BaseModel):

app/plugins/builtins/kommunikation/search_provider.py

@@ -6,7 +6,8 @@ import logging
 import uuid
 from typing import Any
 
-from sqlalchemy import select, func, or_, text as sql_text
+from sqlalchemy import select
+from sqlalchemy import text as sql_text
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.plugins.builtins.kommunikation.models import (
@@ -15,6 +16,7 @@ from app.plugins.builtins.kommunikation.models import (
     CommParticipant,
 )
 from app.plugins.builtins.unified_search.contracts import get_contract as get_search_contract
+
 _search = get_search_contract()
 generate_embedding = _search.generate_embedding
 

app/plugins/builtins/kommunikation/services.py

@@ -5,10 +5,10 @@ from __future__ import annotations
 import logging
 import re
 import uuid
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 from typing import Any
 
-from sqlalchemy import select, update, func, and_, or_
+from sqlalchemy import and_, func, select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.event_bus import get_event_bus
@@ -20,8 +20,8 @@ from app.plugins.builtins.kommunikation.models import (
     CommMessageAttachment,
     CommMessageBlock,
     CommMessageEdit,
-    CommMessageRead,
     CommMessageReaction,
+    CommMessageRead,
     CommParticipant,
 )
 from app.plugins.builtins.kommunikation.participant_registry import get_participant_registry
@@ -518,7 +518,7 @@ async def remove_participant(
     p = result.scalar_one_or_none()
     if p is None:
         return False
-    p.left_at = datetime.now(timezone.utc)
+    p.left_at = datetime.now(UTC)
     await db.flush()
 
     event_bus = get_event_bus()
@@ -711,7 +711,7 @@ async def send_message(
         update(CommConversation)
         .where(CommConversation.id == conversation_id)
         .values(
-            last_msg_at=datetime.now(timezone.utc),
+            last_msg_at=datetime.now(UTC),
             last_msg_preview=content[:200] if content else "",
             last_msg_sender_type=sender_type,
         )
@@ -883,7 +883,7 @@ async def edit_message(
 
     # Update message
     msg.content = new_content
-    msg.edited_at = datetime.now(timezone.utc)
+    msg.edited_at = datetime.now(UTC)
     await db.flush()
     await do_action("comm.after_edit", message_id=message_id, tenant_id=tenant_id, user_id=user_id)
 
@@ -903,7 +903,7 @@ async def delete_message(
         return False
     from app.core.hooks import do_action
     await do_action("comm.before_delete", message_id=message_id)
-    msg.deleted_at = datetime.now(timezone.utc)
+    msg.deleted_at = datetime.now(UTC)
     await db.flush()
     await do_action("comm.after_delete", message_id=message_id)
     return True
@@ -1007,7 +1007,7 @@ async def mark_read(
         db.add(read)
     else:
         read.last_read_msg_id = msg_id
-        read.last_read_at = datetime.now(timezone.utc)
+        read.last_read_at = datetime.now(UTC)
 
     await db.flush()
     return True
@@ -1064,7 +1064,7 @@ async def create_plugin_room(
         select(CommConversation).where(
             CommConversation.tenant_id == tenant_id,
             CommConversation.title == title,
-            CommConversation.is_locked == True,
+            CommConversation.is_locked.is_(True),
             CommConversation.locked_by == plugin_name,
             CommConversation.deleted_at.is_(None),
         ).join(CommParticipant, CommParticipant.conversation_id == CommConversation.id).where(
@@ -1313,13 +1313,13 @@ async def post_system_message(
     await db.flush()
 
     # Update conversation last_msg
-    from datetime import datetime, timezone as dt_timezone
+    from datetime import datetime
 
     await db.execute(
         update(CommConversation)
         .where(CommConversation.id == conv.id)
         .values(
-            last_msg_at=datetime.now(dt_timezone.utc),
+            last_msg_at=datetime.now(UTC),
             last_msg_preview=content[:200],
             last_msg_sender_type="system",
         )

app/plugins/builtins/kommunikation/websocket_manager.py

@@ -8,6 +8,7 @@ import uuid
 from typing import Any
 
 from fastapi import WebSocket
+from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.ws_helpers import (
     authenticate_ws,
@@ -21,7 +22,6 @@ from app.core.ws_pubsub import (
     get_tenant_channel,
     subscribe_to_channel,
 )
-from sqlalchemy.ext.asyncio import AsyncSession
 
 logger = logging.getLogger(__name__)
 
@@ -106,7 +106,7 @@ class WebSocketManager:
 
         # Remove from subscriptions if no more connections
         if user_id not in self._connections:
-            for conv_id, users in self._subscriptions.items():
+            for _conv_id, users in self._subscriptions.items():
                 users.discard(user_id)
 
         logger.debug(f"WebSocket disconnected: user={user_id}")

app/plugins/builtins/mail/commands.py

@@ -0,0 +1,174 @@
+"""Mail commands — send, mark read/unread, delete via Command pattern."""
+
+from __future__ import annotations
+
+import logging
+import uuid
+from datetime import UTC, datetime
+from typing import Any
+
+import redis.asyncio as aioredis
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.commands.base import BaseCommand, CommandResult
+from app.core.outbox import enqueue_outbox_event
+from app.plugins.builtins.mail.services import sanitize_html
+
+logger = logging.getLogger(__name__)
+
+
+class SendMailCommand(BaseCommand):
+    """Send an email via a configured IMAP/SMTP account."""
+
+    permission = "mail:send"
+
+    def __init__(self, account_id: str, to: list[str], subject: str, body_text: str, body_html: str | None = None, cc: list[str] | None = None, in_reply_to: str | None = None):
+        self.account_id = account_id
+        self.to = to
+        self.subject = subject
+        self.body_text = body_text
+        self.body_html = body_html
+        self.cc = cc or []
+        self.in_reply_to = in_reply_to
+
+    async def run(self, db: AsyncSession, redis: aioredis.Redis, current_user: dict[str, Any]) -> CommandResult:
+        from app.plugins.builtins.mail.models import Mail, MailAccount
+
+        tenant_id = self._tenant_id(current_user)
+
+        try:
+            account_uuid = uuid.UUID(self.account_id)
+        except ValueError:
+            return CommandResult.fail("Invalid account_id")
+
+        # Verify account belongs to tenant
+        acct_result = await db.execute(
+            select(MailAccount).where(MailAccount.id == account_uuid, MailAccount.tenant_id == tenant_id)
+        )
+        account = acct_result.scalar_one_or_none()
+        if account is None:
+            return CommandResult.fail("Mail account not found")
+
+        # Create mail record
+        mail_id = uuid.uuid4()
+        mail = Mail(
+            id=mail_id,
+            tenant_id=tenant_id,
+            account_id=account_uuid,
+            message_id=f"<leocrm-{mail_id}@{account.email_address}>",
+            from_addr=account.email_address,
+            to_addr=",".join(self.to),
+            cc_addr=",".join(self.cc) if self.cc else None,
+            subject=self.subject,
+            body_text=self.body_text,
+            body_html_sanitized=sanitize_html(self.body_html) if self.body_html else None,
+            direction="outgoing",
+            received_at=datetime.now(UTC),
+            is_read=True,
+            folder="Sent",
+        )
+        db.add(mail)
+        await db.flush()
+
+        # Enqueue outbox event for async SMTP send
+        await enqueue_outbox_event(db, tenant_id, "mail.send", {
+            "mail_id": str(mail_id),
+            "account_id": self.account_id,
+            "to": self.to,
+            "subject": self.subject,
+        })
+
+        return CommandResult.ok({
+            "id": str(mail_id),
+            "status": "queued",
+            "to": self.to,
+            "subject": self.subject,
+        })
+
+    async def audit(self, db: AsyncSession, current_user: dict[str, Any]) -> None:
+        from app.core.audit import log_audit
+        await log_audit(
+            db, self._tenant_id(current_user), self._user_id(current_user),
+            action="mail.send", entity_type="mail",
+            changes={"to": self.to, "subject": self.subject},
+        )
+
+
+class MarkMailReadCommand(BaseCommand):
+    """Mark a mail as read or unread."""
+
+    permission = "mail:write"
+
+    def __init__(self, mail_id: str, is_read: bool = True):
+        self.mail_id = mail_id
+        self.is_read = is_read
+
+    async def run(self, db: AsyncSession, redis: aioredis.Redis, current_user: dict[str, Any]) -> CommandResult:
+        from app.plugins.builtins.mail.models import Mail
+
+        tenant_id = self._tenant_id(current_user)
+        try:
+            mid = uuid.UUID(self.mail_id)
+        except ValueError:
+            return CommandResult.fail("Invalid mail_id")
+
+        result = await db.execute(
+            select(Mail).where(Mail.id == mid, Mail.tenant_id == tenant_id)
+        )
+        mail = result.scalar_one_or_none()
+        if mail is None:
+            return CommandResult.fail("Mail not found")
+
+        mail.is_read = self.is_read
+        await db.flush()
+
+        return CommandResult.ok({"id": self.mail_id, "is_read": self.is_read})
+
+    async def audit(self, db: AsyncSession, current_user: dict[str, Any]) -> None:
+        from app.core.audit import log_audit
+        await log_audit(
+            db, self._tenant_id(current_user), self._user_id(current_user),
+            action="mail.mark_read", entity_type="mail",
+            changes={"mail_id": self.mail_id, "is_read": self.is_read},
+        )
+
+
+class DeleteMailCommand(BaseCommand):
+    """Soft-delete a mail."""
+
+    permission = "mail:delete"
+
+    def __init__(self, mail_id: str):
+        self.mail_id = mail_id
+
+    async def run(self, db: AsyncSession, redis: aioredis.Redis, current_user: dict[str, Any]) -> CommandResult:
+        from app.plugins.builtins.mail.models import Mail
+
+        tenant_id = self._tenant_id(current_user)
+        try:
+            mid = uuid.UUID(self.mail_id)
+        except ValueError:
+            return CommandResult.fail("Invalid mail_id")
+
+        result = await db.execute(
+            select(Mail).where(Mail.id == mid, Mail.tenant_id == tenant_id, Mail.deleted_at.is_(None))
+        )
+        mail = result.scalar_one_or_none()
+        if mail is None:
+            return CommandResult.fail("Mail not found")
+
+        mail.deleted_at = datetime.now(UTC)
+        await db.flush()
+
+        await enqueue_outbox_event(db, tenant_id, "mail.deleted", {"mail_id": self.mail_id})
+
+        return CommandResult.ok({"id": self.mail_id, "deleted": True})
+
+    async def audit(self, db: AsyncSession, current_user: dict[str, Any]) -> None:
+        from app.core.audit import log_audit
+        await log_audit(
+            db, self._tenant_id(current_user), self._user_id(current_user),
+            action="mail.delete", entity_type="mail",
+            changes={"mail_id": self.mail_id},
+        )

app/plugins/builtins/mail/models.py

@@ -6,12 +6,12 @@ import uuid
 from datetime import UTC, datetime
 
 from sqlalchemy import (
+    JSON,
     Boolean,
     DateTime,
     ForeignKey,
     Index,
     Integer,
-    JSON,
     String,
     Text,
     UniqueConstraint,

app/plugins/builtins/mail/plugin.py

@@ -4,18 +4,98 @@ from __future__ import annotations
 
 import asyncio
 import logging
+from datetime import UTC
 from typing import Any
 
 from app.plugins.base import BasePlugin
-from app.plugins.manifest import PluginManifest, PluginRouteDef, FrontendMenuItem, FrontendPageRoute, FrontendDetailTab, FrontendSettingsPage
+from app.plugins.manifest import (
+    FrontendDetailTab,
+    FrontendMenuItem,
+    FrontendPageRoute,
+    FrontendSettingsPage,
+    PluginManifest,
+    PluginRouteDef,
+)
 
 logger = logging.getLogger(__name__)
 
 
+async def _mail_restore_handler(
+    db, entity, action: str, snapshot: dict, context: dict,
+) -> dict:
+    """Special restore handler for Mail entities (moved from core, P0-7 fix).
+
+    Mail restore has IMAP semantics:
+    - delete: move back from trash to original folder (if folder still exists)
+    - update: revert metadata fields
+    - create: soft-delete (undo send only works for drafts)
+    """
+    import uuid
+    from datetime import datetime
+
+    from sqlalchemy import select
+
+    user_id = context.get("user_id")
+    tenant_id = context.get("tenant_id")
+
+    if action == "delete":
+        if entity is None:
+            raise ValueError("Mail entity not found for restore")
+        entity.deleted_at = None
+        if user_id:
+            entity.updated_by = user_id if hasattr(entity, "updated_by") else None
+        original_folder_id = snapshot.get("folder_id")
+        if original_folder_id and hasattr(entity, "folder_id"):
+            try:
+                folder_uuid = uuid.UUID(str(original_folder_id))
+                from app.plugins.builtins.mail.models import MailFolder
+                folder_q = select(MailFolder).where(
+                    MailFolder.id == folder_uuid,
+                    MailFolder.tenant_id == tenant_id,
+                    MailFolder.deleted_at.is_(None),
+                )
+                folder_result = await db.execute(folder_q)
+                folder = folder_result.scalar_one_or_none()
+                if folder:
+                    entity.folder_id = folder_uuid
+                else:
+                    logger.warning(
+                        "Original mail folder %s no longer exists, "
+                        "restoring mail without folder assignment",
+                        original_folder_id,
+                    )
+            except (ValueError, Exception) as e:
+                logger.warning("Failed to restore mail folder: %s", e)
+        await db.flush()
+        return {"id": str(entity.id), "restored": True, "entity_type": "mail"}
+
+    elif action == "update":
+        if entity is None:
+            raise ValueError("Mail entity not found for restore")
+        from app.core.restore_registry import _DEFAULT_EXCLUDED
+        excluded = _DEFAULT_EXCLUDED | {
+            "message_id", "rfc822_size", "raw_path", "account_id", "folder_id",
+        }
+        for key, value in snapshot.items():
+            if hasattr(entity, key) and key not in excluded:
+                setattr(entity, key, value)
+        await db.flush()
+        return {"id": str(entity.id), "restored": True, "entity_type": "mail"}
+
+    elif action == "create":
+        if entity is None:
+            raise ValueError("Mail entity not found for restore")
+        entity.deleted_at = datetime.now(UTC)
+        await db.flush()
+        return {"id": str(entity.id), "restored": True, "entity_type": "mail", "note": "soft-deleted (undo create)"}
+
+    raise ValueError(f"Unsupported action for mail restore: {action}")
+
+
 async def _auto_sync_loop() -> None:
     """Background loop: process pending sync queue, then sync all active mail accounts every 5 minutes."""
-    from app.plugins.builtins.mail.services import auto_sync_all_accounts, process_sync_queue
     from app.core.db import get_session_factory
+    from app.plugins.builtins.mail.services import auto_sync_all_accounts, process_sync_queue
 
     while True:
         try:
@@ -78,9 +158,29 @@ class MailPlugin(BasePlugin):
     async def on_activate(
         self, db, service_container, event_bus
     ) -> None:
-        """Activate plugin: register events + start auto-sync background task."""
+        """Activate plugin: register events, restore, history + start auto-sync."""
         await super().on_activate(db, service_container, event_bus)
 
+        # Register restore config for Mail entities (P0-7 fix)
+        from app.core.restore_registry import RestoreConfig, get_restore_registry
+        from app.plugins.builtins.mail.models import Mail
+        get_restore_registry().register(RestoreConfig(
+            entity_type="mail",
+            model_class=Mail,
+            restore_permission="mail:write",
+            excluded_fields=frozenset({"message_id", "rfc822_size", "raw_path", "account_id", "folder_id"}),
+            special_handler=_mail_restore_handler,
+        ))
+
+        # Register history hooks for Mail entities (P0-8 fix)
+        from app.core.history_hooks import register_history_hooks
+        from app.core.hooks import get_hook_registry
+        register_history_hooks(
+            get_hook_registry(), "mail",
+            "mail.after_create", "mail.after_update", "mail.after_delete",
+            owner_tag="mail",
+        )
+
         if self._auto_sync_task is None or self._auto_sync_task.done():
             self._auto_sync_task = asyncio.create_task(_auto_sync_loop())
             logger.info("Mail plugin: auto-sync background task started")
@@ -117,4 +217,14 @@ class MailPlugin(BasePlugin):
             self._auto_sync_task = None
             logger.info("Mail plugin: auto-sync background task stopped")
 
+        # Unregister history hooks (free functions, not bound methods)
+        from app.core.hooks import get_hook_registry
+        get_hook_registry().unregister_actions_by_owner("mail.after_create", "mail")
+        get_hook_registry().unregister_actions_by_owner("mail.after_update", "mail")
+        get_hook_registry().unregister_actions_by_owner("mail.after_delete", "mail")
+
+        # Unregister restore config for Mail entities
+        from app.core.restore_registry import get_restore_registry
+        get_restore_registry().unregister("mail")
+
         await super().on_deactivate(db, service_container, event_bus)

app/plugins/builtins/mail/routes.py

@@ -17,6 +17,7 @@ from fastapi.responses import StreamingResponse
 from sqlalchemy import and_, asc, desc, func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+import app.plugins.builtins.mail.services as mail_services
 from app.core.db import get_db
 from app.core.storage import get_storage_backend
 from app.core.visibility import apply_visibility_filter, check_single_entity_access
@@ -62,15 +63,11 @@ from app.plugins.builtins.mail.schemas import (
     TemplateSubstituteRequest,
     VacationConfig,
 )
-import app.plugins.builtins.mail.services as mail_services
 from app.plugins.builtins.mail.services import (
     MAX_ATTACHMENT_SIZE,
-    _attachment_storage_path,
     _sanitize_filename,
-    _save_attachment_to_storage,
     account_to_response,
     apply_rules_to_mail,
-    attachment_to_response,
     create_mail_account,
     encrypt_password,
     folder_to_response,
@@ -78,8 +75,6 @@ from app.plugins.builtins.mail.services import (
     get_account_password,
     imap_create_folder,
     imap_delete_folder,
-    imap_delete_mail,
-    imap_move_mail,
     imap_sync_account,
     import_pgp_private_key,
     import_pgp_public_key,
@@ -239,7 +234,6 @@ async def create_account(
 ):
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-    is_system_admin = current_user.get("is_system_admin", False)
     account = await create_mail_account(
         db, tenant_id=tenant_id, user_id=user_id, data=data.model_dump()
     )
@@ -291,12 +285,12 @@ async def delete_account(
     user_id = uuid.UUID(current_user["user_id"])
     is_system_admin = current_user.get("is_system_admin", False)
     acc_id = _parse_uuid(account_id, "account_id")
-    account = await _get_account(db, acc_id, tenant_id, user_id, is_system_admin=is_system_admin)
     has_admin = await check_single_entity_access(
         db, "mail_account", acc_id, user_id, tenant_id, "admin", is_system_admin
     )
     if not has_admin:
         raise HTTPException(403, detail={"detail": "Only owner can delete", "code": "forbidden"})
+    account = await _get_account(db, acc_id, tenant_id, user_id, is_system_admin=is_system_admin)
     await db.delete(account)
 
 
@@ -311,7 +305,6 @@ async def assign_shared_users(
     user_id = uuid.UUID(current_user["user_id"])
     is_system_admin = current_user.get("is_system_admin", False)
     acc_id = _parse_uuid(account_id, "account_id")
-    account = await _get_account(db, acc_id, tenant_id, user_id, is_system_admin=is_system_admin)
     has_admin = await check_single_entity_access(
         db, "mail_account", acc_id, user_id, tenant_id, "admin", is_system_admin
     )
@@ -357,7 +350,6 @@ async def create_delegate(
     user_id = uuid.UUID(current_user["user_id"])
     is_system_admin = current_user.get("is_system_admin", False)
     acc_id = _parse_uuid(account_id, "account_id")
-    account = await _get_account(db, acc_id, tenant_id, user_id, is_system_admin=is_system_admin)
     has_admin = await check_single_entity_access(
         db, "mail_account", acc_id, user_id, tenant_id, "admin", is_system_admin
     )
@@ -402,7 +394,6 @@ async def create_send_permission(
     user_id = uuid.UUID(current_user["user_id"])
     is_system_admin = current_user.get("is_system_admin", False)
     acc_id = _parse_uuid(account_id, "account_id")
-    account = await _get_account(db, acc_id, tenant_id, user_id, is_system_admin=is_system_admin)
     has_admin = await check_single_entity_access(
         db, "mail_account", acc_id, user_id, tenant_id, "admin", is_system_admin
     )
@@ -714,8 +705,6 @@ async def sync_folder(
 ):
     """Sync a single folder from IMAP server immediately."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
-    user_id = uuid.UUID(current_user["user_id"])
-    is_system_admin = current_user.get("is_system_admin", False)
     f_id = _parse_uuid(folder_id, "folder_id")
     folder = (
         await db.execute(
@@ -724,7 +713,6 @@ async def sync_folder(
     ).scalar_one_or_none()
     if not folder:
         raise HTTPException(404, detail={"detail": "Folder not found", "code": "not_found"})
-    account = await _get_account(db, folder.account_id, tenant_id, user_id, is_system_admin=is_system_admin)
     result = await mail_services.imap_sync_folder(db, f_id, tenant_id)
     await db.flush()
     return result
@@ -746,7 +734,6 @@ async def upload_attachment(
     """
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-    is_system_admin = current_user.get("is_system_admin", False)
 
     # Rate limit — UPLOAD policy
     from app.core.rate_limit import RateLimitPolicy, check_rate_limit_policy
@@ -919,7 +906,6 @@ async def create_template(
 ):
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-    is_system_admin = current_user.get("is_system_admin", False)
     template = MailTemplate(
         tenant_id=tenant_id,
         user_id=user_id,
@@ -979,7 +965,6 @@ async def create_signature(
 ):
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-    is_system_admin = current_user.get("is_system_admin", False)
     acc_id = _parse_uuid(data.account_id, "account_id") if data.account_id else None
     sig = MailSignature(
         tenant_id=tenant_id,
@@ -1131,7 +1116,6 @@ async def import_pgp_key(
 ):
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-    is_system_admin = current_user.get("is_system_admin", False)
     key_id, public_key_armored = import_pgp_private_key(data.private_key_armored, data.passphrase)
     encrypted_private = encrypt_password(data.private_key_armored)
     pgp_key = PgpKey(
@@ -1152,7 +1136,6 @@ async def list_pgp_keys(
 ):
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-    is_system_admin = current_user.get("is_system_admin", False)
     keys = (
         (
             await db.execute(
@@ -1204,7 +1187,6 @@ async def create_label(
 ):
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-    is_system_admin = current_user.get("is_system_admin", False)
     label = MailLabel(tenant_id=tenant_id, name=data.name, color=data.color, user_id=user_id)
     db.add(label)
     await db.flush()
@@ -1512,21 +1494,21 @@ async def create_event_from_mail(
     try:
         from app.plugins.builtins.calendar.contracts import get_contract as get_calendar_contract
         _cal = get_calendar_contract()
-        Calendar = _cal.Calendar
-        CalendarEntry = _cal.CalendarEntry
+        calendar = _cal.calendar
+        calendar_entry = _cal.calendar_entry
     except ImportError:
-        return {"created": False, "error": "Calendar plugin not available"}
+        return {"created": False, "error": "calendar plugin not available"}
     cal_id = _parse_uuid(data.calendar_id, "calendar_id")
     calendar = (
         await db.execute(
-            select(Calendar).where(and_(Calendar.id == cal_id, Calendar.tenant_id == tenant_id))
+            select(calendar).where(and_(calendar.id == cal_id, calendar.tenant_id == tenant_id))
         )
     ).scalar_one_or_none()
     if not calendar:
-        raise HTTPException(404, detail={"detail": "Calendar not found", "code": "not_found"})
+        raise HTTPException(404, detail={"detail": "calendar not found", "code": "not_found"})
     title = data.title or mail.subject
     description = data.description or (mail.body_text[:500] if mail.body_text else "")
-    entry = CalendarEntry(
+    entry = calendar_entry(
         tenant_id=tenant_id,
         calendar_id=cal_id,
         title=title,

app/plugins/builtins/mail/services.py

@@ -5,7 +5,6 @@ from __future__ import annotations
 import base64
 import json
 import logging
-import mimetypes
 import os
 import re
 import uuid
@@ -22,7 +21,7 @@ import pgpy
 from cryptography.fernet import Fernet
 from cryptography.hazmat.primitives import hashes
 from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
-from sqlalchemy import and_, func, or_, select, text
+from sqlalchemy import and_, func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.config import settings
@@ -519,7 +518,7 @@ def _build_folder_hierarchy(
                 mapping_by_imap[imap_name_val] = std_type
 
     # First pass: create or update folder records
-    for flags, imap_name in imap_folders:
+    for _flags, imap_name in imap_folders:
         if not imap_name:
             continue
 
@@ -1539,7 +1538,7 @@ async def send_mail_via_smtp(
         file_path = att_info.get("path", "")
         filename = att_info.get("filename", os.path.basename(file_path))
         mime_type = att_info.get("mime_type", "application/octet-stream")
-        if not file_path or not os.path.exists(file_path):
+        if not file_path or not os.path.exists(file_path):  # noqa: ASYNC240
             continue
         async with aiofiles.open(file_path, "rb") as f:
             content = await f.read()
@@ -1619,7 +1618,7 @@ async def send_mail_via_smtp(
                         select(MailFolder).where(
                             and_(
                                 MailFolder.account_id == account.id,
-                                MailFolder.is_standard == True,
+                                MailFolder.is_standard.is_(True),
                                 MailFolder.imap_name.ilike("%sent%"),
                             )
                         )

app/plugins/builtins/marketplace/config.py

@@ -4,7 +4,6 @@ from __future__ import annotations
 
 from app.config import settings
 
-
 # Marketplace server URL — must be configured via env var MARKETPLACE_SERVER_URL
 # Default: empty string means marketplace is not configured
 MARKETPLACE_SERVER_URL: str = getattr(settings, "marketplace_server_url", "")

app/plugins/builtins/marketplace/models.py

@@ -6,7 +6,8 @@ import uuid
 from datetime import UTC, datetime
 
 from sqlalchemy import DateTime, Float, Index, Integer, String, Text
-from sqlalchemy.dialects.postgresql import JSONB, UUID as PGUUID
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column
 
 from app.core.db import Base, TimestampMixin

app/plugins/builtins/marketplace/plugin.py

@@ -3,7 +3,6 @@
 from __future__ import annotations
 
 import logging
-from typing import Any
 
 from app.plugins.base import BasePlugin
 from app.plugins.manifest import PluginManifest, PluginRouteDef

app/plugins/builtins/marketplace/routes.py

@@ -3,23 +3,21 @@
 from __future__ import annotations
 
 import logging
-import uuid
-from pathlib import Path
 
 from fastapi import APIRouter, Depends, HTTPException, Query
 from sqlalchemy.ext.asyncio import AsyncSession
 
+import app.plugins.builtins.marketplace.services as marketplace_services
 from app.core.db import get_db
 from app.deps import require_admin, require_permission
 from app.plugins.builtins.marketplace.schemas import (
     MarketplaceCategoriesResponse,
     MarketplaceInstallRequest,
     MarketplaceInstallResponse,
-    MarketplaceListResponse,
     MarketplaceListingRead,
+    MarketplaceListResponse,
     MarketplaceVerifyResponse,
 )
-import app.plugins.builtins.marketplace.services as marketplace_services
 
 logger = logging.getLogger(__name__)
 
@@ -51,7 +49,7 @@ async def list_marketplace_listings(
     )
 
     return MarketplaceListResponse(
-        listings=[MarketplaceListingRead(**l) for l in result["listings"]],
+        listings=[MarketplaceListingRead(**listing) for listing in result["listings"]],
         total=result["total"],
         page=result["page"],
         page_size=result["page_size"],

app/plugins/builtins/marketplace/services.py

@@ -3,7 +3,6 @@
 from __future__ import annotations
 
 import logging
-import os
 import shutil
 import tempfile
 import zipfile
@@ -11,13 +10,12 @@ from pathlib import Path
 from typing import Any
 
 import httpx
-from sqlalchemy import and_, func, select
+from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.plugins.builtins.marketplace.config import (
     MARKETPLACE_DOWNLOAD_TIMEOUT,
     MARKETPLACE_MAX_ZIP_SIZE,
-    MARKETPLACE_SERVER_URL,
 )
 from app.plugins.builtins.marketplace.models import MarketplaceListing
 from app.plugins.signature import PluginSignature
@@ -70,7 +68,7 @@ async def fetch_listings(
     listings = (await db.execute(query)).scalars().all()
 
     return {
-        "listings": [_listing_to_response(l) for l in listings],
+        "listings": [_listing_to_response(listing) for listing in listings],
         "total": total,
         "page": page,
         "page_size": page_size,
@@ -121,7 +119,7 @@ async def download_plugin(
         # Validate it's a valid ZIP
         if not zipfile.is_zipfile(zip_path):
             shutil.rmtree(temp_dir, ignore_errors=True)
-            raise ValueError(f"Downloaded file is not a valid ZIP archive")
+            raise ValueError("Downloaded file is not a valid ZIP archive")
 
         return zip_path
 
@@ -189,7 +187,6 @@ async def install_plugin(
     try:
         # 3. Verify signature if public key is available
         if listing.signature_public_key:
-            public_key_bytes = listing.signature_public_key.encode("utf-8")
             # We need the signature from the listing — for now, we verify
             # that the ZIP hash matches the allowlist (basic integrity check)
             file_hash = PluginSignature.compute_hash(zip_path)
@@ -204,7 +201,7 @@ async def install_plugin(
 
         # Copy the ZIP to a temp location for the plugin service
         # The plugin service expects a ZIP file to extract
-        install_result = await service.install_plugin_from_zip(
+        await service.install_plugin_from_zip(
             db,
             zip_path=str(zip_path),
             tenant_id=tenant_id,

app/plugins/builtins/mcp_client/contracts.py

@@ -6,8 +6,8 @@ Exposes the MCP client and server config model for other plugins.
 from __future__ import annotations
 
 from app.plugins.builtins.contracts import get_contract_registry
-from app.plugins.builtins.mcp_client.models import McpServerConfig
 from app.plugins.builtins.mcp_client.client import McpClient
+from app.plugins.builtins.mcp_client.models import McpServerConfig
 from app.plugins.builtins.mcp_client.schemas import (
     McpServerExecuteRequest,
     McpServerExecuteResponse,

app/plugins/builtins/mcp_client/models.py

@@ -3,9 +3,9 @@
 from __future__ import annotations
 
 import uuid
-from datetime import datetime
+from datetime import UTC, datetime
 
-from sqlalchemy import Boolean, DateTime, ForeignKey, Index, String, Text
+from sqlalchemy import Boolean, DateTime, Index, String, Text
 from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column
 
@@ -32,5 +32,5 @@ class McpServerConfig(Base, TenantMixin, OwnedMixin):
     description: Mapped[str | None] = mapped_column(Text, nullable=True)
     last_connected_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
     created_by: Mapped[uuid.UUID | None] = mapped_column(PGUUID(as_uuid=True), nullable=True)
-    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=datetime.utcnow, nullable=False)
-    updated_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=datetime.utcnow, onupdate=datetime.utcnow, nullable=False)
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=datetime.now(UTC), nullable=False)
+    updated_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=datetime.now(UTC), onupdate=datetime.now(UTC), nullable=False)

app/plugins/builtins/mcp_client/plugin.py

@@ -29,11 +29,15 @@ class McpClientPlugin(BasePlugin):
             "mcp-client:write",
             "mcp-client:admin",
         ],
-    
+
         author="LeoCRM Team",
         min_app_version="1.0.0",
         contract_version="1.0.0")
 
+    def get_entity_models(self) -> dict[str, type]:
+        from app.plugins.builtins.mcp_client.models import McpServerConfig
+        return {"mcp_server_config": McpServerConfig}
+
     async def on_deactivate(
         self, db, service_container, event_bus
     ) -> None:

app/plugins/builtins/mcp_client/routes.py

@@ -7,13 +7,13 @@ import uuid
 from datetime import datetime
 from typing import Any
 
-from fastapi import APIRouter, Depends, HTTPException, status
+from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy import select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import get_db
 from app.core.visibility import apply_visibility_filter
-from app.deps import get_current_user, require_permission
+from app.deps import require_permission
 from app.plugins.builtins.mcp_client.client import McpClient
 from app.plugins.builtins.mcp_client.models import McpServerConfig as McpServerConfigModel
 from app.plugins.builtins.mcp_client.schemas import (
@@ -97,7 +97,7 @@ async def update_mcp_server(
     try:
         sid = uuid.UUID(server_id)
     except (ValueError, TypeError):
-        raise HTTPException(400, detail={"detail": "Invalid server_id", "code": "invalid_id"})
+        raise HTTPException(400, detail={"detail": "Invalid server_id", "code": "invalid_id"}) from None
 
     stmt = select(McpServerConfigModel).where(
         McpServerConfigModel.id == sid,
@@ -127,7 +127,7 @@ async def delete_mcp_server(
     try:
         sid = uuid.UUID(server_id)
     except (ValueError, TypeError):
-        raise HTTPException(400, detail={"detail": "Invalid server_id", "code": "invalid_id"})
+        raise HTTPException(400, detail={"detail": "Invalid server_id", "code": "invalid_id"}) from None
 
     stmt = select(McpServerConfigModel).where(
         McpServerConfigModel.id == sid,
@@ -152,7 +152,7 @@ async def list_server_tools(
     try:
         sid = uuid.UUID(server_id)
     except (ValueError, TypeError):
-        raise HTTPException(400, detail={"detail": "Invalid server_id", "code": "invalid_id"})
+        raise HTTPException(400, detail={"detail": "Invalid server_id", "code": "invalid_id"}) from None
 
     stmt = select(McpServerConfigModel).where(
         McpServerConfigModel.id == sid,
@@ -176,7 +176,7 @@ async def list_server_tools(
         return tools_resp
     except Exception as exc:
         logger.exception("Failed to list tools from MCP server %s", cfg.name)
-        raise HTTPException(502, detail={"detail": f"Failed to connect: {exc}", "code": "connection_failed"})
+        raise HTTPException(502, detail={"detail": f"Failed to connect: {exc}", "code": "connection_failed"}) from exc
 
 
 @router.post("/servers/{server_id}/execute", response_model=McpServerExecuteResponse)
@@ -190,7 +190,7 @@ async def execute_server_tool(
     try:
         sid = uuid.UUID(server_id)
     except (ValueError, TypeError):
-        raise HTTPException(400, detail={"detail": "Invalid server_id", "code": "invalid_id"})
+        raise HTTPException(400, detail={"detail": "Invalid server_id", "code": "invalid_id"}) from None
 
     stmt = select(McpServerConfigModel).where(
         McpServerConfigModel.id == sid,

app/plugins/builtins/mcp_server/contracts.py

@@ -6,19 +6,19 @@ Exposes tool definitions and schemas for other plugins.
 from __future__ import annotations
 
 from app.plugins.builtins.contracts import get_contract_registry
-from app.plugins.builtins.mcp_server.tool_definitions import (
-    TOOL_DEFINITIONS,
-    TOOL_HANDLERS,
-    get_all_tool_names,
-    get_tool_definition,
-)
 from app.plugins.builtins.mcp_server.schemas import (
+    McpServerConfig,
     McpToolDefinition,
     McpToolExecuteRequest,
     McpToolExecuteResponse,
     McpToolListResponse,
     McpToolParameter,
-    McpServerConfig,
+)
+from app.plugins.builtins.mcp_server.tool_definitions import (
+    TOOL_DEFINITIONS,
+    TOOL_HANDLERS,
+    get_all_tool_names,
+    get_tool_definition,
 )
 
 
@@ -50,7 +50,6 @@ get_contract_registry().register("mcp_server", _contract)
 
 __all__ = [
     "McpServerContract",
-    "ToolDefinitions",
     "McpToolDefinition",
     "McpToolParameter",
     "McpServerConfig",

app/plugins/builtins/mcp_server/plugin.py

@@ -28,7 +28,7 @@ class McpServerPlugin(BasePlugin):
             "mcp:read",
             "mcp:write",
         ],
-    
+
         author="LeoCRM Team",
         min_app_version="1.0.0",
         contract_version="1.0.0")

app/plugins/builtins/mcp_server/routes.py

@@ -6,14 +6,13 @@ import logging
 import uuid
 from typing import Any
 
-from fastapi import APIRouter, Depends, Header, HTTPException, status
+from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import get_db
-from app.deps import get_current_user, get_current_user_or_bearer, require_permission
+from app.deps import get_current_user, get_current_user_or_bearer
 from app.plugins.builtins.mcp_server.schemas import (
     McpServerConfig,
-    McpToolDefinition,
     McpToolExecuteRequest,
     McpToolExecuteResponse,
     McpToolListResponse,
@@ -101,8 +100,9 @@ async def execute_mcp_tool(
     }
 
     # Audit log
-    from app.core.audit import log_audit
     import uuid as uuid_mod
+
+    from app.core.audit import log_audit
     correlation_id = str(uuid_mod.uuid4())
     await log_audit(
         db,

app/plugins/builtins/mcp_server/tool_definitions.py

@@ -168,19 +168,21 @@ async def _handler_search(db: AsyncSession, arguments: dict[str, Any], context:
         return {"error": "invalid tenant/user context"}
 
     try:
-        from app.plugins.builtins.unified_search.query_understanding import llm_analyze_query
-        from app.plugins.builtins.unified_search.search_engine import hybrid_search
-
-        query_analysis = await llm_analyze_query(query, db=db, tenant_id=tenant_uuid)
-        results = await hybrid_search(
-            db=db,
-            query_analysis=query_analysis,
-            tenant_id=tenant_uuid,
-            entity_types=entity_types,
-            limit=limit,
-            user_id=user_uuid,
-            is_system_admin=is_system_admin,
-        )
+        from app.plugins.builtins.contracts import get_contract
+        search_contract = get_contract("unified_search")
+        if search_contract is not None:
+            query_analysis = await search_contract.llm_analyze_query(query, db=db, tenant_id=tenant_uuid)
+            results = await search_contract.hybrid_search(
+                db=db,
+                query_analysis=query_analysis,
+                tenant_id=tenant_uuid,
+                entity_types=entity_types,
+                limit=limit,
+                user_id=user_uuid,
+                is_system_admin=is_system_admin,
+            )
+        else:
+            return {"error": "search plugin not available"}
     except Exception as e:
         logger.exception("MCP search failed")
         return {"error": str(e)}

app/plugins/builtins/permissions/plugin.py

@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 from app.plugins.base import BasePlugin
-from app.plugins.manifest import PluginManifest, PluginRouteDef, FrontendSettingsPage
+from app.plugins.manifest import FrontendSettingsPage, PluginManifest, PluginRouteDef
 
 
 class PermissionsPlugin(BasePlugin):
@@ -42,6 +42,10 @@ class PermissionsPlugin(BasePlugin):
         contract_version="1.0.0",
     )
 
+    def get_entity_models(self) -> dict[str, type]:
+        from app.plugins.builtins.permissions.models import ShareLink
+        return {"share_link": ShareLink}
+
     async def on_deactivate(
         self, db, service_container, event_bus
     ) -> None:

app/plugins/builtins/permissions/public_routes.py

@@ -12,8 +12,9 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import get_db
 from app.core.storage import get_storage_backend
-from app.plugins.builtins.permissions.models import ShareLink
 from app.plugins.builtins.dms.contracts import DmsContract
+from app.plugins.builtins.permissions.models import ShareLink
+
 DmsFile = DmsContract.DmsFile
 
 router = APIRouter(prefix="/api/v1/public/share", tags=["public-share"])

app/plugins/builtins/permissions/routes.py

@@ -12,7 +12,6 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.auth import hash_password, verify_password
 from app.core.db import get_db
-from app.core.visibility import apply_visibility_filter
 from app.deps import get_current_user, require_permission
 from app.plugins.builtins.permissions.models import Permission, ShareLink
 from app.plugins.builtins.permissions.schemas import (
@@ -49,7 +48,6 @@ async def list_permissions(
 ):
     """List all permissions for a file."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
-    user_id = uuid.UUID(current_user["user_id"])
     fid = _parse_uuid(file_id, "file_id")
 
     result = await db.execute(
@@ -80,7 +78,6 @@ async def grant_permission(
 ):
     """Grant a permission on a file to a user."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
-    user_id = uuid.UUID(current_user["user_id"])
     fid = _parse_uuid(file_id, "file_id")
     user_id = _parse_uuid(body.user_id, "user_id")
     group_id = _parse_uuid(body.group_id, "group_id") if body.group_id else None

app/plugins/builtins/report_generator/jobs.py

@@ -25,7 +25,6 @@ import uuid
 from typing import Any
 
 from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import create_db_session
 from app.core.job_registry import register_job
@@ -76,9 +75,10 @@ async def generate_report_job(
         {"dms_file_id": ..., "filename": ..., "format": ..., "size": ...}
     """
     import hashlib
+
     from app.plugins.builtins.contracts import get_contract_registry
     _dms_contract = get_contract_registry().get("dms")
-    DmsFile = _dms_contract.DmsFile
+    dms_file = _dms_contract.dms_file
 
     async with create_db_session() as db:
         # 1. Fetch template
@@ -124,7 +124,7 @@ async def generate_report_job(
         storage = get_storage_backend()
         await storage.save(storage_path, raw_bytes)
 
-        dms_file = DmsFile(
+        dms_file = dms_file(
             tenant_id=uuid.UUID(tenant_id),
             name=f"{template.name}.{ext}",
             folder_id=None,

app/plugins/builtins/report_generator/pdf_generator.py

@@ -3,12 +3,11 @@
 from __future__ import annotations
 
 import io
-import os
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 from pathlib import Path
 from typing import Any
 
-from jinja2 import Environment, FileSystemLoader, select_autoescape, StrictUndefined
+from jinja2 import FileSystemLoader, StrictUndefined, select_autoescape
 from jinja2.sandbox import SandboxedEnvironment
 
 # ─── Constants ──────────────────────────────────────────────────────────────
@@ -99,7 +98,7 @@ def render_template_file(template_name: str, data: dict[str, Any]) -> str:
     template = env.get_template(template_name)
     # Inject generated_at if not provided
     if "generated_at" not in data:
-        data["generated_at"] = datetime.now(timezone.utc).strftime(
+        data["generated_at"] = datetime.now(UTC).strftime(
             "%Y-%m-%d %H:%M UTC"
         )
     return template.render(**data)
@@ -124,7 +123,7 @@ def render_template_string(template_content: str, data: dict[str, Any]) -> str:
     env.globals.clear()
     template = env.from_string(template_content)
     if "generated_at" not in data:
-        data["generated_at"] = datetime.now(timezone.utc).strftime(
+        data["generated_at"] = datetime.now(UTC).strftime(
             "%Y-%m-%d %H:%M UTC"
         )
     return template.render(**data)

app/plugins/builtins/report_generator/plugin.py

@@ -3,10 +3,7 @@
 from __future__ import annotations
 
 from app.plugins.base import BasePlugin
-from app.plugins.manifest import PluginManifest, PluginRouteDef, FrontendMenuItem, FrontendPageRoute
-
-# Register background jobs (isolated report generation in worker)
-from app.plugins.builtins.report_generator import jobs  # noqa: F401
+from app.plugins.manifest import FrontendMenuItem, FrontendPageRoute, PluginManifest, PluginRouteDef
 
 
 class ReportGeneratorPlugin(BasePlugin):
@@ -35,11 +32,23 @@ class ReportGeneratorPlugin(BasePlugin):
         page_routes=[
             FrontendPageRoute(path='/reports', component='@/pages/Reports', protected=True),
         ],
-    
+
         author="LeoCRM Team",
         min_app_version="1.0.0",
         contract_version="1.0.0")
 
+    def get_entity_models(self) -> dict[str, type]:
+        from app.plugins.builtins.report_generator.models import ReportInstance, ReportTemplate
+        return {"report_template": ReportTemplate, "report_instance": ReportInstance}
+
+    async def on_activate(
+        self, db, service_container, event_bus
+    ) -> None:
+        """Activate plugin: register background jobs and event listeners."""
+        # Register background jobs (isolated report generation in worker)
+        from app.plugins.builtins.report_generator import jobs  # noqa: F401
+        await super().on_activate(db, service_container, event_bus)
+
     async def on_deactivate(
         self, db, service_container, event_bus
     ) -> None:

app/plugins/builtins/report_generator/routes.py

@@ -7,20 +7,19 @@ import io
 import json
 import os
 import uuid
+from datetime import UTC
 
 import aiofiles
-
 from fastapi import APIRouter, Depends, HTTPException, status
 from fastapi.responses import StreamingResponse
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.models.contact import Contact
-from app.core.visibility import apply_visibility_filter
-from app.models.audit import AuditLog
-
 from app.core.db import get_db, set_tenant_context
-from app.deps import get_current_user, require_permission
+from app.core.visibility import apply_visibility_filter
+from app.deps import require_permission
+from app.models.audit import AuditLog
+from app.models.contact import Contact
 from app.plugins.builtins.report_generator.models import (
     ReportInstance,
     ReportTemplate,
@@ -95,7 +94,6 @@ def _generate_csv(rendered: str) -> io.BytesIO:
     """Parse rendered Jinja2 output as CSV and return BytesIO."""
     output = io.BytesIO()
     reader = csv.reader(io.StringIO(rendered))
-    writer = csv.writer(io.BytesIO())  # temporary, will write directly
     # Write to BytesIO with UTF-8 BOM for Excel compatibility
     output.write(b"")
     for row in reader:
@@ -166,7 +164,6 @@ async def generate_preset(
     merges with user-provided parameters, and generates the report.
     """
     tenant_id = uuid.UUID(current_user["tenant_id"])
-    user_id = uuid.UUID(current_user["user_id"])
 
     # Set tenant context for RLS
     await set_tenant_context(db, tenant_id)
@@ -391,7 +388,7 @@ async def delete_template(
     current_user: dict = Depends(require_permission("reports:manage_templates")),
 ):
     """Soft-delete a report template."""
-    from datetime import datetime, timezone
+    from datetime import datetime
 
     tenant_id = uuid.UUID(current_user["tenant_id"])
     tid = _parse_uuid(template_id, "template_id")
@@ -407,7 +404,7 @@ async def delete_template(
         raise HTTPException(
             404, detail={"detail": "Template not found", "code": "not_found"}
         )
-    template.deleted_at = datetime.now(timezone.utc)
+    template.deleted_at = datetime.now(UTC)
     await db.flush()
     return None
 
@@ -423,7 +420,6 @@ async def generate_report(
 ):
     """Generate a report from a template and data (synchronous)."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
-    user_id = uuid.UUID(current_user["user_id"])
     tid = _parse_uuid(body.template_id, "template_id")
 
     # Fetch template
@@ -516,6 +512,7 @@ async def generate_report_async(
     """
     from arq import create_pool
     from arq.connections import RedisSettings
+
     from app.config import get_settings
 
     settings = get_settings()
@@ -596,7 +593,7 @@ async def download_report(
             400,
             detail={"detail": "Report not ready for download", "code": "not_ready"},
         )
-    if not os.path.exists(report.output_path):
+    if not os.path.exists(report.output_path):  # noqa: ASYNC240
         raise HTTPException(
             404, detail={"detail": "Report file missing on disk", "code": "file_missing"}
         )

app/plugins/builtins/system_notif/plugin.py

@@ -6,7 +6,7 @@ import logging
 from typing import Any
 
 from app.plugins.base import BasePlugin
-from app.plugins.manifest import PluginManifest, FrontendSettingsPage
+from app.plugins.manifest import FrontendSettingsPage, PluginManifest
 
 logger = logging.getLogger(__name__)
 
@@ -47,7 +47,7 @@ class SystemNotifPlugin(BasePlugin):
         settings_pages=[
             FrontendSettingsPage(path='notifications', label_key='settings.notifications', label='Notifications', component='@/pages/SettingsNotifications', icon='Bell', order=40),
         ],
-    
+
         author="LeoCRM Team",
         min_app_version="1.0.0",
         contract_version="1.0.0")
@@ -60,8 +60,8 @@ class SystemNotifPlugin(BasePlugin):
         """Register as system participant and subscribe to events."""
         await super().on_activate(db, service_container, event_bus)
 
-        from app.plugins.builtins.system_notif.participant_handler import SystemParticipantHandler
         from app.plugins.builtins.kommunikation.contracts import get_participant_registry
+        from app.plugins.builtins.system_notif.participant_handler import SystemParticipantHandler
 
         self._system_handler = SystemParticipantHandler(service_container)
         registry = get_participant_registry()
@@ -231,13 +231,17 @@ class SystemNotifPlugin(BasePlugin):
 
             # Find the System room conversation
             from sqlalchemy import select
-            from app.plugins.builtins.kommunikation.contracts import CommConversation, CommParticipant
+
+            from app.plugins.builtins.kommunikation.contracts import (
+                CommConversation,
+                CommParticipant,
+            )
 
             result = await db.execute(
                 select(CommConversation).where(
                     CommConversation.tenant_id == tenant_id,
                     CommConversation.title == "System",
-                    CommConversation.is_locked == True,
+                    CommConversation.is_locked.is_(True),
                     CommConversation.locked_by == "system_notif",
                     CommConversation.deleted_at.is_(None),
                 ).join(CommParticipant, CommParticipant.conversation_id == CommConversation.id).where(

app/plugins/builtins/tags/plugin.py

@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 from app.plugins.base import BasePlugin
-from app.plugins.manifest import PluginManifest, PluginRouteDef, FrontendDetailTab
+from app.plugins.manifest import FrontendDetailTab, PluginManifest, PluginRouteDef
 
 
 class TagsPlugin(BasePlugin):
@@ -34,11 +34,15 @@ class TagsPlugin(BasePlugin):
         detail_tabs=[
             FrontendDetailTab(entity_type='contact', label_key='tabs.tags', label='Tags', component='@/components/contact/ContactTagsTab', icon='Tag', order=50, permission='tags:read'),
         ],
-    
+
         author="LeoCRM Team",
         min_app_version="1.0.0",
         contract_version="1.0.0")
 
+    def get_entity_models(self) -> dict[str, type]:
+        from app.plugins.builtins.tags.models import Tag
+        return {"tag": Tag}
+
     async def on_deactivate(
         self, db, service_container, event_bus
     ) -> None:

app/plugins/builtins/tags/routes.py

@@ -22,7 +22,12 @@ from app.plugins.builtins.tags.schemas import (
 
 router = APIRouter(prefix="/api/v1/tags", tags=["tags"])
 
-VALID_ENTITY_TYPES = {"contact", "file", "folder"}
+# Entity types validated dynamically against ENTITY_MODELS at runtime (P1-13 fix)
+
+def _is_valid_entity_type(entity_type: str) -> bool:
+    """Check if entity_type is registered in ENTITY_MODELS."""
+    from app.services.entity_permission_service import ENTITY_MODELS
+    return entity_type in ENTITY_MODELS
 
 
 def _parse_uuid(val: str, field: str) -> uuid.UUID:
@@ -158,10 +163,11 @@ async def assign_tag(
 ):
     """Assign a tag to an entity."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["id"])
     tag_id = _parse_uuid(body.tag_id, "tag_id")
     entity_id = _parse_uuid(body.entity_id, "entity_id")
 
-    if body.entity_type not in VALID_ENTITY_TYPES:
+    if not _is_valid_entity_type(body.entity_type):
         raise HTTPException(
             400, detail={"detail": "Invalid entity_type", "code": "invalid_entity_type"}
         )
@@ -218,6 +224,7 @@ async def unassign_tag(
 ):
     """Remove a tag assignment from an entity."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["id"])
     tag_id = _parse_uuid(body.tag_id, "tag_id")
     entity_id = _parse_uuid(body.entity_id, "entity_id")
 
@@ -249,6 +256,7 @@ async def delete_tag(
 ):
     """Delete a tag and cascade-delete all its assignments."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["id"])
     tid = _parse_uuid(tag_id, "tag_id")
 
     result = await db.execute(select(Tag).where(Tag.id == tid, Tag.tenant_id == tenant_id))
@@ -280,7 +288,7 @@ async def bulk_assign_tags(
     tenant_id = uuid.UUID(current_user["tenant_id"])
     entity_id = _parse_uuid(body.entity_id, "entity_id")
 
-    if body.entity_type not in VALID_ENTITY_TYPES:
+    if not _is_valid_entity_type(body.entity_type):
         raise HTTPException(
             400, detail={"detail": "Invalid entity_type", "code": "invalid_entity_type"}
         )

app/plugins/builtins/tags/schemas.py

@@ -24,19 +24,19 @@ class TagResponse(BaseModel):
 
 class TagAssignRequest(BaseModel):
     tag_id: str
-    entity_type: str = Field(..., pattern="^(contact|file|folder)$")
+    entity_type: str = Field(...)
     entity_id: str
 
 
 class TagUnassignRequest(BaseModel):
     tag_id: str
-    entity_type: str = Field(..., pattern="^(contact|file|folder)$")
+    entity_type: str = Field(...)
     entity_id: str
 
 
 class TagBulkAssignRequest(BaseModel):
     tag_ids: list[str] = Field(..., min_length=1)
-    entity_type: str = Field(..., pattern="^(contact|file|folder)$")
+    entity_type: str = Field(...)
     entity_id: str
 
 

app/plugins/builtins/tasks/jobs.py

@@ -3,7 +3,6 @@
 from __future__ import annotations
 
 import logging
-from datetime import datetime, timezone
 
 from app.core.db import get_session_factory
 
@@ -16,11 +15,12 @@ async def tasks_due_reminder(ctx: dict) -> None:
     Runs daily at 8:00 via cron. Finds all non-done tasks with due_date <= now
     and creates a notification for the assigned user.
     """
-    from app.plugins.builtins.tasks.services import get_due_tasks
-    from app.models.tenant import Tenant
-    from app.core.notifications import create_notification
     from sqlalchemy import select
 
+    from app.core.notifications import create_notification
+    from app.models.tenant import Tenant
+    from app.plugins.builtins.tasks.services import get_due_tasks
+
     factory = get_session_factory()
     async with factory() as db:
         result = await db.execute(select(Tenant))
@@ -62,6 +62,6 @@ async def tasks_due_reminder(ctx: dict) -> None:
 
 
 # Register all job functions with the job registry
-from app.core.job_registry import register_job
+from app.core.job_registry import register_job  # noqa: E402
 
 register_job("tasks_due_reminder", tasks_due_reminder)

app/plugins/builtins/tasks/plugin.py

@@ -4,11 +4,11 @@ from __future__ import annotations
 
 from app.plugins.base import BasePlugin
 from app.plugins.manifest import (
-    PluginManifest,
-    PluginRouteDef,
+    CronJobContribution,
     FrontendMenuItem,
     FrontendPageRoute,
-    CronJobContribution,
+    PluginManifest,
+    PluginRouteDef,
 )
 
 
@@ -62,17 +62,58 @@ class TasksPlugin(BasePlugin):
                 plugin_name="tasks",
             ),
         ],
-    
+
         author="LeoCRM Team",
         min_app_version="1.0.0",
         hooks=["contact.after_create"],
         contract_version="1.0.0")
 
+    def get_job_modules(self) -> list[str]:
+        return ["app.plugins.builtins.tasks.jobs"]
+
+    def get_entity_models(self) -> dict[str, type]:
+        from app.plugins.builtins.tasks.models import Task
+        return {"task": Task}
+
+    async def on_activate(self, db, service_container, event_bus) -> None:
+        """Activate plugin: register restore config + history hooks."""
+        await super().on_activate(db, service_container, event_bus)
+
+        # Register restore config for Task entities (P0-7 fix)
+        from app.core.restore_registry import RestoreConfig, get_restore_registry
+        from app.plugins.builtins.tasks.models import Task
+        get_restore_registry().register(RestoreConfig(
+            entity_type="task",
+            model_class=Task,
+            restore_permission="tasks:write",
+            excluded_fields=frozenset({"created_by", "assigned_to", "contact_id"}),
+        ))
+
+        # Register history hooks for Task entities (P0-8 fix)
+        from app.core.history_hooks import register_history_hooks
+        from app.core.hooks import get_hook_registry
+        register_history_hooks(
+            get_hook_registry(), "task",
+            "task.after_create", "task.after_update", "task.after_delete",
+            owner_tag="tasks",
+        )
+
     async def on_deactivate(
         self, db, service_container, event_bus
     ) -> None:
-        """Deactivate plugin: unregister contract and event listeners."""
+        """Deactivate plugin: unregister contract, restore, history, events."""
         # Contract abmelden
         from app.plugins.builtins.contracts import get_contract_registry
         get_contract_registry().unregister(self.manifest.name)
+
+        # Unregister restore config (P0-7 fix)
+        from app.core.restore_registry import get_restore_registry
+        get_restore_registry().unregister("task")
+
+        # Unregister history hooks (free functions, not bound methods)
+        from app.core.hooks import get_hook_registry
+        get_hook_registry().unregister_actions_by_owner("task.after_create", "tasks")
+        get_hook_registry().unregister_actions_by_owner("task.after_update", "tasks")
+        get_hook_registry().unregister_actions_by_owner("task.after_delete", "tasks")
+
         await super().on_deactivate(db, service_container, event_bus)

app/plugins/builtins/tasks/routes.py

@@ -8,7 +8,6 @@ from fastapi import APIRouter, Depends, HTTPException, Query, Response, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import get_db
-from app.core.visibility import apply_visibility_filter
 from app.deps import get_current_user, require_permission
 from app.plugins.builtins.tasks import services
 from app.plugins.builtins.tasks.schemas import (