# Source audit: dynamic-loader

Decision: OMP-port-backlog, read-only locally. Real plugin install, enable, disable, uninstall, marketplace, and runtime loading behavior belongs to OMP plugin manager. Local `apply` and `rollback` are fail-closed until that behavior is ported.

Current local state:

- `extensions/dynamic-loader/index.ts` registers `/extensions` and `dynamicLoader`.
- `list` and `preview` read local `catalog/<kind>/<id>/manifest.json`.
- `apply` and `rollback` return `isError=true` with `owner: "omp-plugin-manager"` and `ported: false`.
- The extension no longer writes dev events for fake apply/rollback and no longer claims `.pi` write permission.
- The extension is disabled by default through `package.json#pi.extensions`.

OMP source evidence:

- `/tmp/oh-my-pi-review/packages/coding-agent/src/extensibility/plugins/manager.ts` owns plugin install, uninstall, enable/disable state, feature selection, settings, lockfile writes, package validation, dry-run install, and project overrides.
- `/tmp/oh-my-pi-review/packages/coding-agent/src/extensibility/plugins/loader.ts` owns enabled plugin discovery from installed packages, runtime lockfile, project overrides, manifest entry resolution, feature-specific tools/hooks/commands/extensions, and legacy compatibility.
- `/tmp/oh-my-pi-review/packages/coding-agent/src/extensibility/plugins/types.ts` owns plugin manifest, feature, installed plugin, runtime config, project override, and install option contracts.
- `/tmp/oh-my-pi-review/packages/coding-agent/src/extensibility/plugins/installer.ts` owns legacy install/link/uninstall/list helpers and package validation.
- `/tmp/oh-my-pi-review/packages/coding-agent/src/extensibility/plugins/marketplace/manager.ts` owns marketplace add/remove/update/list, plugin discovery, install/uninstall scope, registry writes, cache promotion, and plugin roots cache invalidation.
- `/tmp/oh-my-pi-review/packages/coding-agent/src/extensibility/plugins/marketplace/registry.ts`, `fetcher.ts`, `source-resolver.ts`, `cache.ts`, and `types.ts` own marketplace persistence, source normalization, fetching, caching, and installed plugin registries.
- `/tmp/oh-my-pi-review/packages/coding-agent/src/extensibility/extensions/loader.ts` owns loading extension entrypoints from enabled plugins into the runtime.

Implementation boundary:

- Do not return success for local `apply` or `rollback` until durable OMP plugin state changes are ported.
- Do not write `.pi` settings as a parallel fake plugin registry.
- Do not implement remote install without OMP package validation, cache, registry, and project/user scope behavior.

License note: OMP files are source evidence for the future port. No OMP implementation code was copied in the read-only slice.