docs: add intro and 2 step install process for PSP advanced docs

docs/advanced/psp/index.md

@@ -4,6 +4,26 @@ sidebar_label: Introduction
 sidebar_position: 0
 ---
 
-## Plugin Setup Processor
+## Introduction to Plugin Setup Processor (PSP)
 
-This section will contain docs.
+The Plugin Setup Processor (PSP) is the component of the Aragon OSx framework which connects plugins and DAOs. Created and maintained by Aragon, the PSP is a non upgradeable smart contract and has undergone rigorous audits to ensure transparency and safety. This contracts governs how plugins are integrated into your DAO, handling the necessary permissions to install/uninstall/upgrade plugins into/from your DAO.
+
+### Why is the PSP Important?
+
+The PSP ensures that any changes made to the DAO’s functionality via plugins are secure and transparent. It uses a prepared setup from the `PluginSetup.sol` contract to manage the installation process, granting or revoking permissions as needed to incorporate/drop the new functionality into/from the DAO. This method guarantees that DAO members are aware of the changes being made and can trust the process.
+
+## Interactions with the PSP
+
+### During DAO Deployment
+
+When you deploy your DAO using the `DAOFactory.sol` contract, the PSP is utilized to install the necessary plugins. A DAO requires at least one plugin to function, and the `DAOFactory` simplifies this process by handling the setup for you. You simply provide an array of settings, where each position corresponds to a different plugin, and the `DAOFactory` takes care of the rest.
+
+### After DAO Deployment
+
+Once your DAO is deployed, you might want to install additional plugins, or uninstall or upgrade existing ones. In these cases, the PSP comes into play again. Here, you need to have an approved proposal that includes actions for both the preparation and application phases of the installation process. Alternatively, you might need two separate proposals, one for each phase.
+
+### Summary
+
+The PSP is a foundational element of the Aragon DAO ecosystem, ensuring that plugins can be managed in a secure and transparent manner. By leveraging the PSP, you can confidently extend the functionality of your DAO, knowing that the process is robust and reliable.
+
+For a detailed walkthrough of the plugin management process, including installation, uninstallation, and upgrades, please refer to the [Managing Plugins](./managing-plugins.md) section.

docs/advanced/psp/managing-plugins.md

@@ -0,0 +1,79 @@
+---
+title: Managing Plugins
+sidebar_label: Managing Plugins
+sidebar_position: 1
+---
+
+### Two Steps Plugin Install/Uninstall/Upgrade
+
+**Safety is our top priority in the design of the whole protocol.** We want to make sure that the DAO members know exactly what permissions are granted/revoked to whom before any processing takes place.
+
+:::note
+The following explanation will take as example the installation process, however same principles apply for uninstallation and upgrading processes.
+:::
+
+This is why we see the installation process in two phases:
+
+1. **Preparation:** Defining the parameters to be set on the new plugin instance and helpers, as well as requesting the permissions needed for it to work properly. The `PluginSetup` contains the setup script where developers can perform any unprivileged operations. These will need a privileged confirmation in the next step.
+2. **Application:** The granting or revoking of the plugin's requested permissions (based on the preparation step above). This is a privileged action performed by Aragon's `PluginSetupProcessor` (you can understand it as the "installer"), so that the plugin becomes effectively installed or uninstalled. It gets executed whenever someone with `ROOT` privileges on the DAO applies it (most likely through a proposal).
+
+The `PluginSetupProcessor` is the Aragon contract in charge of invoking the `prepareInstallation()` function from your plugin's `PluginSetup` contract and use it to prepare the installation and (eventually) apply it once it has been approved by the DAO.
+
+#### What happens during the Plugin Preparation?
+
+The preparation of a `PluginSetup` contract proceeds as follows:
+
+1. A DAO builder selects a plugin to install, uninstall, or update.
+
+2. The DAO builder defines the parameters and settings that he/she wants for their DAO. Depending on the case, the `prepareInstallation`, `prepareUpdate`, or `prepareUninstallation` method in the `PluginSetup` contract is called through the `PluginSetupProcessor` (and creates a unique setup ID).
+
+3. The [`PluginSetup`](https://github.com/aragon/osx/blob/develop/packages/contracts/src/framework/plugin/setup/PluginSetupProcessor.sol) contract deploys all the contracts and gathers addresses and other input arguments required for the installation/uninstallation/upgrade instructions.
+
+   Because the addresses of all associated contracts are now known, a static permission list can be emitted, hashed, and stored on-chain.
+
+4. Once the Plugin installation has been prepared, we use it as the parameter of the `applyInstallation()` action. Once encoded, this action is what must be added to the `Action[]` array of the installation proposal. That way, when the proposal passes, the action becomes executable and the plugin can be installed in the DAO using the parameters defined in the prepare installation process. For a plugin to be installed, it needs to be approved by the governance mechanism (plugin) of the organization, passed as the encoded action of a proposal, and executed by a signer.
+
+:::info
+The governance plugin can be a simple majority vote, an optimistic process or an admin governance plugin that does not involve a waiting period. It can be any governance mechanism existing within the DAO which has access to the DAO's `execute` permission.
+:::
+
+This gives the DAO members the opportunity to check which permissions the `PluginSetup` contract request before granting/revoking them.
+
+Plugin setup proposals must be carefully examined as they can be a potential security risk if the `PluginSetup` contract comes from an untrusted source. To learn more visit the [Security](./01-security-risk-mitigation.md) section.
+
+<!-- TODO: add a costs sections
+
+Optionally, the proposer can also request refunds for the gas spent for the preparation of the plugin in the proposal.
+-->
+
+#### What happens during the Preparation Application?
+
+After this initial preparation transaction, the addresses and permissions related to the plugin become apparent. The members of a governance plugin with permissions can decide if the installation proposal should be accepted or denied.
+
+Once the proposal has passed, the actions specified in the `Action[]` array can get executed and the `applyInstallation()` action is used to complete the installation of the plugin into the DAO.
+
+This is processed as follows:
+
+1. The DAO temporarily grants the `ROOT_PERMISSION_ID` permission to the `PluginSetupProcessor`. This is needed so that the processor can modify the DAO's permissions settings to set up the plugin.
+2. This `Action` calls the `applyInstallation`, `applyUpdate`, or `applyUninstallation` method in the `PluginSetupProcessor`, containing the list of requested permissions as argument. The permissions hash is compared with the stored hash to make sure that no permission was changed.
+   In addition to the above, the update process also upgrades the logic contract to which the proxy points too.
+3. If the hash is valid, the list is processed and `PluginSetupProcessor` conducts the requested sequence of `grant`, `grantWithCondition` and `revoke` calls on the owning DAO.
+   Finally, the `PluginSetupProcessor` asks the DAO to revoke the `ROOT_PERMISSION_ID` permission from itself.
+
+:::info
+The two-step setup procedure in Aragon OSx is not limited to the setup of only one plugin — you can **setup multiple plugins at once** by first preparing them in a single proposal and then processing the entire setup sequence in one transaction. This is powerful and allows you to **transform your entire DAO in one proposal**, for example, to install a new governance plugin (e.g., a gasless ZK-vote) and finance plugin (e.g., to stream loans to your members), while uninstalling your old ERC20 token vote in one go.
+:::
+
+In the next sections, you will learn about how plugins are curated on Aragon's repository.
+
+<div class="center-column">
+
+**a.** ![Schematic depiction of the plugin installation process.](/optimized-svg/plugins/plugin-installation.drawio.svg)
+**b.** ![Schematic depiction of the plugin update process.](/optimized-svg/plugins/plugin-update.drawio.svg)
+**c.** ![Schematic depiction of the plugin uninstallation process.](/optimized-svg/plugins/plugin-uninstallation.drawio.svg)
+
+<p class="caption">
+   Simplified overview of the two-transaction plugin <b>a.</b> installation, <b>b.</b> update, and <b>c.</b> uninstallation process with the involved contracts as rounded rectangles, interactions between them as arrows, and relations as dashed lines. The first and second transaction are distinguished by numbering as well as solid and dotted lines, respectively.
+</p>
+
+</div>