Check visibility of methods in `Plan`

[qinsoon]

Currently Plan is a public trait, and all the methods in Plan are public. However, many methods in Plan should not be public. We can either split Plan into two traits, one with public visibility and one with private visibility, or we can introduce a public type that wraps Plan (like SpaceStats for Space in #1083).