feat: modular resource handlers and simulation-based safety layer

README.md

@@ -289,6 +289,24 @@ All operations can be run in "dry-run" mode first:
 - Maintains accurate infrastructure state
 - Detects drift from expected configuration
 
+### v2.0 Enhanced Safety Layer
+- **Simulation Modes**: Full simulation, validation-only, or disabled
+- **Validation Framework**: Parameter validation, dependency validation, quota checks
+- **Audit Logging**: Complete operation audit trail
+- **Dry-Run Decorator**: Transparent operation wrapping for safety
+
+### v2.0 Plugin Architecture
+- **Dynamic Registration**: Register and unregister resource handlers at runtime
+- **Middleware Chain**: Cross-cutting concerns (logging, recovery, metrics, timeouts)
+- **Hook System**: Before/after execution callbacks
+- **Lifecycle Management**: Dependency-aware initialization and health monitoring
+
+### v2.0 Enhanced Reasoning
+- **Multi-Step Verification**: Pre-flight, dependency, safety, and impact phases
+- **Risk Assessment**: Automatic risk level evaluation with mitigations
+- **Rollback Planning**: Each operation includes rollback strategies
+- **Cost Estimation**: Automatic cost calculation for planned resources
+
 ### Contributing
 
 1. Fork the repository
@@ -402,6 +420,14 @@ agent:
 - ✅ ReAct Agent
 - ✅ Better UX/UI
 
+### v2.0 Enhancements (Latest)
+- ✅ Plugin Architecture for resource handlers
+- ✅ Safety Layer with simulation mode and validation
+- ✅ Enhanced reasoning with multi-step verification
+- ✅ Dry-run decorator pattern
+- ✅ Audit logging framework
+- ✅ Cost estimation integration
+
 ### Upcoming Features (v0.1.*)
 - 🔄 Cost optimization recommendations
 - 🔄 Enhanced conflict resolution

docs/architecture/architecture-overview.md

@@ -345,6 +345,291 @@ The testing architecture includes a sophisticated mock system that provides real
 - Secure state file storage with restricted access
 - Comprehensive audit logging for compliance requirements
 
+## Plugin Architecture (v2.0)
+
+### Overview
+
+The Plugin Architecture provides a modular, extensible system for managing AWS resource handlers. It enables dynamic registration, lifecycle management, and middleware chaining for all resource operations.
+
+### Core Components
+
+#### Plugin Registry
+
+The central registry manages all resource handlers:
+
+```go
+type PluginRegistry struct {
+    handlers    map[string]ResourceHandler
+    metadata    map[string]PluginMetadata
+    hooks       map[string][]PluginHook
+    middlewares map[string][]Middleware
+}
+```
+
+**Key Features:**
+- Dynamic plugin registration and unregistration
+- Thread-safe operations with RWMutex
+- Hook system for before/after execution callbacks
+- Middleware chaining for cross-cutting concerns
+
+#### Resource Handler Interface
+
+All resource handlers implement a unified interface:
+
+```go
+type ResourceHandler interface {
+    Plugin
+    Create(ctx context.Context, params interface{}) (*types.AWSResource, error)
+    List(ctx context.Context) ([]*types.AWSResource, error)
+    Get(ctx context.Context, id string) (*types.AWSResource, error)
+    Update(ctx context.Context, id string, params interface{}) (*types.AWSResource, error)
+    Delete(ctx context.Context, id string) error
+    ExecuteSpecial(ctx context.Context, operation string, params interface{}) (*types.AWSResource, error)
+    ValidateParams(operation string, params interface{}) error
+}
+```
+
+#### Lifecycle Management
+
+The LifecycleManager handles plugin initialization order based on dependencies:
+
+```go
+type LifecycleManager struct {
+    registry   *PluginRegistry
+    statuses   map[string]*PluginStatus
+    healthTick time.Duration
+}
+```
+
+**Features:**
+- Topological sorting for dependency-aware initialization
+- Continuous health monitoring
+- Graceful shutdown with error handling
+- Hot reload support for development
+
+### Built-in Middleware
+
+| Middleware | Purpose |
+|------------|---------|
+| `LoggingMiddleware` | Operation logging with duration tracking |
+| `RecoveryMiddleware` | Panic recovery with stack traces |
+| `MetricsMiddleware` | Performance metrics collection |
+| `TimeoutMiddleware` | Configurable operation timeouts |
+
+### Usage Example
+
+```go
+registry := plugins.NewPluginRegistry(logger)
+lifecycle := plugins.NewLifecycleManager(registry, logger)
+
+// Register plugin with middleware
+registry.Register(ec2Handler, &PluginConfig{
+    AWSClient: awsClient,
+    Logger:    logger,
+})
+
+registry.AddMiddleware("ec2-instance", plugins.LoggingMiddleware(logger))
+registry.AddMiddleware("ec2-instance", plugins.TimeoutMiddleware(30*time.Second))
+
+// Execute with hooks and middleware
+result, err := registry.ExecuteWithHooks(ctx, "ec2-instance", "create", params)
+```
+
+## Safety Layer Architecture (v2.0)
+
+### Overview
+
+The Safety Layer provides comprehensive protection mechanisms including simulation mode, validation, and dry-run capabilities. It ensures safe infrastructure operations through multiple validation checkpoints.
+
+### Core Components
+
+#### Simulator
+
+The Simulator enables safe testing of infrastructure operations:
+
+```go
+type Simulator struct {
+    config     SimulationConfig
+    validators map[string]SafetyValidator
+    rules      map[string][]ValidationRule
+}
+```
+
+**Simulation Modes:**
+| Mode | Description |
+|------|-------------|
+| `SimulationDisabled` | Normal execution without simulation |
+| `SimulationDryRun` | Full simulation with no actual changes |
+| `SimulationValidate` | Validation only, no resource changes |
+
+**Simulation Results:**
+```go
+type SimulationResult struct {
+    Success          bool
+    WouldCreate      []*types.AWSResource
+    WouldModify      []*types.AWSResource
+    WouldDelete      []string
+    ValidationErrors []ValidationError
+    Warnings         []string
+    EstimatedCost    *CostEstimate
+}
+```
+
+#### Dry-Run Decorator
+
+The decorator pattern wraps operations for safety:
+
+```go
+type DryRunDecorator struct {
+    simulator  *Simulator
+    auditLog   *AuditLog
+    config     DryRunConfig
+}
+```
+
+**Features:**
+- Transparent dry-run mode activation
+- Pre-execution validation
+- Audit trail generation
+- Blocked operation enforcement
+
+#### Validation Layer
+
+Multi-level validation for infrastructure operations:
+
+```go
+type ValidationLayer struct {
+    validators map[string]ResourceValidator
+    rules      map[string][]ValidationRule
+}
+```
+
+**Validation Levels:**
+- **Error**: Blocks execution
+- **Warning**: Logs but allows execution
+- **Info**: Informational only
+
+**Built-in Validators:**
+| Validator | Scope |
+|-----------|-------|
+| `ValidatorRegistry` | Parameter validation with rules |
+| `DependencyValidator` | Dependency order verification |
+| `QuotaValidator` | Resource quota enforcement |
+
+### Validation Rules
+
+Pre-configured rules for common AWS resources:
+
+```yaml
+ec2-instance:
+  - imageId: required
+  - instanceType: required, pattern("^[a-z][0-9][a-z]?\\.[a-z0-9]+$")
+
+rds-instance:
+  - engine: required
+  - dbInstanceClass: required
+  - allocatedStorage: min(20)
+
+vpc:
+  - cidrBlock: required, cidr
+```
+
+### Usage Example
+
+```go
+simulator := safety.NewSimulator(logger, safety.SimulationConfig{
+    Mode:               safety.SimulationDryRun,
+    EnableCostEstimate: true,
+    EnableQuotaCheck:   true,
+})
+
+decorator := safety.NewDryRunDecorator(logger, simulator, safety.DryRunConfig{
+    EnabledByDefault:    true,
+    RequireConfirmation: true,
+    AuditEnabled:        true,
+})
+
+// Wrap operation with dry-run support
+safeOperation := decorator.Decorate(createInstance, &safety.ExecutionContext{
+    Operation:    "create",
+    ResourceType: "ec2-instance",
+    DryRun:       true,
+})
+
+result, err := safeOperation(ctx, params)
+```
+
+## Enhanced Reasoning System (v2.0)
+
+### Overview
+
+The reasoning system has been enhanced with multi-step verification protocols, providing structured safety checks at every stage of infrastructure planning.
+
+### Verification Phases
+
+#### Phase 1: Pre-Flight Validation
+1. Parse and validate user intent
+2. Identify all required AWS resources
+3. Check MANAGED RESOURCES section
+4. Verify tool availability
+5. Assess operation risk level
+
+#### Phase 2: Dependency Resolution
+1. Map resource dependencies
+2. Identify cross-service dependencies
+3. Verify prerequisite resources
+4. Detect circular dependencies
+5. Generate execution order
+
+#### Phase 3: Safety Validation
+1. Validate parameter completeness
+2. Check naming conflicts
+3. Verify CIDR availability
+4. Validate security group rules
+5. Check IAM requirements
+
+#### Phase 4: Impact Assessment
+1. Identify resources to be created
+2. Identify resources to be modified
+3. Identify affected resources
+4. Estimate cost implications
+5. Assess rollback complexity
+
+### Enhanced Output Format
+
+```json
+{
+  "action": "create_infrastructure",
+  "reasoning": "Explanation with verification approach",
+  "riskAssessment": {
+    "level": "medium",
+    "factors": ["New VPC creation", "Multiple subnets"],
+    "mitigations": ["Rollback plan included"]
+  },
+  "verificationSummary": {
+    "preFlightChecks": ["VPC exists", "Subnet available"],
+    "dependencyOrder": ["VPC", "Subnet", "SecurityGroup", "Instance"],
+    "postFlightChecks": ["Instance running", "Correct subnet"]
+  },
+  "executionPlan": [{
+    "id": "step-create-instance",
+    "verification": {
+      "preConditions": ["subnetId exists"],
+      "postConditions": ["instanceId returned", "state is running"],
+      "rollbackStrategy": "terminate-instance"
+    }
+  }]
+}
+```
+
+### Rollback Considerations
+
+Each operation includes rollback planning:
+- Can this operation be easily undone?
+- What resources depend on this resource?
+- Is there a rollback path if subsequent steps fail?
+- Should this be split into multiple plans?
+
 ## Conclusion
 
 The AI Infrastructure Agent represents a sophisticated approach to infrastructure automation, combining the power of Large Language Models with robust engineering practices. The system's layered architecture provides separation of concerns while maintaining flexibility and extensibility.
@@ -358,4 +643,10 @@ Key architectural strengths include:
 - **Performance**: Optimized for concurrent operations and resource efficiency
 - **Security**: Multiple security layers with defense-in-depth approach
 
+The v2.0 enhancements add:
+
+- **Plugin Architecture**: Dynamic, middleware-enabled resource handlers
+- **Safety Layer**: Comprehensive simulation and validation framework
+- **Enhanced Reasoning**: Multi-step verification with rollback planning
+
 The system is designed to scale from proof-of-concept deployments to production environments while maintaining the simplicity of natural language infrastructure management.