Fix LLM validation and dashboard health hot paths

backend/src/services/rbac_permission_catalog.py

@@ -10,6 +10,7 @@
 
 # [SECTION: IMPORTS]
 import re
+from functools import lru_cache
 from pathlib import Path
 from typing import Iterable, Set, Tuple
 
@@ -80,6 +81,17 @@ def _discover_route_permissions() -> Set[Tuple[str, str]]:
 # [/DEF:_discover_route_permissions:Function]
 
 
+# [DEF:_discover_route_permissions_cached:Function]
+# @PURPOSE: Cache route permission discovery because route source files are static during normal runtime.
+# @PRE: None.
+# @POST: Returns stable discovered route permission pairs without repeated filesystem scans.
+@lru_cache(maxsize=1)
+def _discover_route_permissions_cached() -> Tuple[Tuple[str, str], ...]:
+    with belief_scope("rbac_permission_catalog._discover_route_permissions_cached"):
+        return tuple(sorted(_discover_route_permissions()))
+# [/DEF:_discover_route_permissions_cached:Function]
+
+
 # [DEF:_discover_plugin_execute_permissions:Function]
 # @PURPOSE: Derives dynamic task permissions of form plugin:{plugin_id}:EXECUTE from plugin registry.
 # @PRE: plugin_loader is optional and may expose get_all_plugin_configs.
@@ -108,6 +120,19 @@ def _discover_plugin_execute_permissions(plugin_loader=None) -> Set[Tuple[str, s
 # [/DEF:_discover_plugin_execute_permissions:Function]
 
 
+# [DEF:_discover_plugin_execute_permissions_cached:Function]
+# @PURPOSE: Cache dynamic plugin EXECUTE permission pairs by normalized plugin id tuple.
+# @PRE: plugin_ids is a deterministic tuple of plugin ids.
+# @POST: Returns stable permission tuple without repeated plugin catalog expansion.
+@lru_cache(maxsize=8)
+def _discover_plugin_execute_permissions_cached(
+    plugin_ids: Tuple[str, ...],
+) -> Tuple[Tuple[str, str], ...]:
+    with belief_scope("rbac_permission_catalog._discover_plugin_execute_permissions_cached"):
+        return tuple((f"plugin:{plugin_id}", "EXECUTE") for plugin_id in plugin_ids)
+# [/DEF:_discover_plugin_execute_permissions_cached:Function]
+
+
 # [DEF:discover_declared_permissions:Function]
 # @PURPOSE: Builds canonical RBAC permission catalog from routes and plugin registry.
 # @PRE: plugin_loader may be provided for dynamic task plugin permission discovery.
@@ -115,8 +140,17 @@ def _discover_plugin_execute_permissions(plugin_loader=None) -> Set[Tuple[str, s
 # @RETURN: Set[Tuple[str, str]] - Complete discovered permission set.
 def discover_declared_permissions(plugin_loader=None) -> Set[Tuple[str, str]]:
     with belief_scope("rbac_permission_catalog.discover_declared_permissions"):
-        permissions = _discover_route_permissions()
-        permissions.update(_discover_plugin_execute_permissions(plugin_loader))
+        permissions = set(_discover_route_permissions_cached())
+        plugin_ids = tuple(
+            sorted(
+                {
+                    str(getattr(plugin_config, "id", "") or "").strip()
+                    for plugin_config in (plugin_loader.get_all_plugin_configs() if plugin_loader else [])
+                    if str(getattr(plugin_config, "id", "") or "").strip()
+                }
+            )
+        )
+        permissions.update(_discover_plugin_execute_permissions_cached(plugin_ids))
         return permissions
 # [/DEF:discover_declared_permissions:Function]
 
@@ -153,4 +187,4 @@ def sync_permission_catalog(
         return len(missing_pairs)
 # [/DEF:sync_permission_catalog:Function]
 
-# [/DEF:backend.src.services.rbac_permission_catalog:Module]
+# [/DEF:backend.src.services.rbac_permission_catalog:Module]