Integration/release refresh - #9
Conversation
Verified against the WordPress/ai v1.2.0 tag, not just the changelog. wp-ai-plugin (SKILL.md + all four references): - Re-anchor to v1.2.0 (frontmatter + reference version markers) - Add Suggest_Reply (ai/suggest-reply) to the built-in experiment list - Document the new core/read-content and core/read-users read Abilities - Document the show_in_abilities exposure flag for the read Abilities - Correct the new timeout filter to wpai_default_request_timeout; the changelog/readme mislabel it wp_ai_client_default_request_timeout, a name that appears in no plugin PHP - Note the Settings -> AI "Advanced settings" collapse (hidden by default) - Add a forward caveat: Guidelines is still the wp_guideline CPT at 1.2.0; the "Knowledge" rename is Gutenberg trunk (23.6.0-rc.1) / WP 7.1 wp-abilities-api: - Add a version-gated "format: uri" schema gotcha (Gutenberg #79555, WP 7.1+) - Point to core/read-content|users|settings as read-only ability examples wp-ai-connectors: - Note the Connectors application-password settings UI (Gutenberg #79403) shared/references: - Refresh upstream indices via update-upstream-indices.mjs (Gutenberg latest v23.5.3; WP core 7.0.1) Eval harness (node eval/harness/run.mjs) passes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012tU8bXRdMMSNkYkWVD2Wjs
…ith facts
Sparse-cloned WordPress/gutenberg at v23.6.0-rc.1 and read the code the
first commit could only cite from release notes.
wp-abilities-api (input-schema-gotchas.md):
- Rewrite the format gotcha: server and client validate with different
engines and mismatched format lists. The client (@wordpress/abilities)
uses AJV draft-04 + ajv-formats with exactly date-time, email, hostname,
ipv4, ipv6, uri, uuid; an unregistered format fails schema compilation
("Invalid schema provided for validation."), which is why uri support
(gutenberg#79555) shipped as a bug fix in 23.6.
wp-ai-connectors (SKILL.md):
- Application-password connectors, verified: authentication.method enum is
'api_key'|'application_password'|'none'; env/constant hold
"username:app-password" strings; DB setting stores {username,password}
(masked), auto-named connectors_{type}_{id}_application_password;
credentials UI is gutenberg#79403; e2e fixture cited as the example.
wp-ai-plugin (SKILL.md + guidelines-integration.md):
- Sharpen the Knowledge caveat with verified names: wp_knowledge CPT,
wp_knowledge_type taxonomy, types guideline/memory/note, per-scope rows
(guideline-{scope}, guideline-block-*), wp_guideline_scopes() registry
(site/copy/images/blocks/additional), REST /wp/v2/knowledge and
/wp/v2/knowledge/guideline-scopes, wp_guideline_max_length().
- Correct the framing: Knowledge ships in Gutenberg lib/experimental/,
not lib/compat/wordpress-7.1/ - core-merge timing is not settled.
Eval harness passes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012tU8bXRdMMSNkYkWVD2Wjs
…ke test Drift detection (docs/upstream-sync.md "automate first" plan): - update-upstream-indices.mjs also fetches WordPress/ai releases into shared/references/ai-plugin-releases.json (same GitHub Releases shape as the Gutenberg index) - New shared/scripts/check-upstream-drift.mjs: offline comparison of the committed index against the "current canonical release: vX.Y.Z" marker in skills/wp-ai-plugin/SKILL.md; wired into eval/harness/run.mjs so CI turns red when a skill lags a landed index refresh - upstream-sync.yml PR body documents the new index and the red-CI flow - Note: initial ai-plugin-releases.json bootstrapped from git tags (the GitHub API was rate-limited in the authoring environment; the file carries a provenance note). The weekly Upstream Sync run regenerates it from the Releases API. Eval scenario: - ai-plugin-expose-read-abilities.json exercises the 1.2.0 surface: show_in_abilities on register_post_type for core/read-content, reusing ai/suggest-reply instead of rebuilding it, and the real wpai_default_request_timeout filter (not the changelog's mislabel) Playground smoke test (eval/playground/ai-plugin-smoke/): - Blueprint + mu-plugin registering a downstream Experiment + Ability exactly as skills/wp-ai-plugin instructs, run against live WP + the wordpress.org ai plugin via @wp-playground/cli; run.sh asserts the full chain (filter -> Loader -> enabled toggles -> register() -> wp_abilities_api_init -> execute round-trip) plus presence of core/read-content, core/read-users, core/read-settings, and ai/suggest-reply. Verified green against AI plugin 1.2.0. Harness passes; smoke test passes from its committed location. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012tU8bXRdMMSNkYkWVD2Wjs
Conflict resolutions: took the PR #8 side for the four wp-ai-plugin files (1.2.0 refresh supersedes trunk's 1.1.0-era text), blueprint, and wpds; re-grafted trunk features the refresh dropped: the harness's validatePortableTriageCommand guard and the wpds Verification section. License frontmatter restoration handled in a follow-up integration commit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012tU8bXRdMMSNkYkWVD2Wjs
…ration Weaves both efforts: keeps PR #8's structure and its Settings->AI feature-group filters (verified in 1.2.0 source), plus the sync branch's verified additions - the wpai_default_request_timeout changelog-mislabel warning, the v1.1.0 threshold/capability filter rows, interface method version history, drift check alongside runSkillQuality in the harness, and the newer wordpress-core-versions index (7.0.2, PR #8 side). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012tU8bXRdMMSNkYkWVD2Wjs
PR #8's rewrite removed 'license: GPL-2.0-or-later' from all 20 skills (added repo-wide in the PR #7 audit). Restored; skills are copied standalone by skillpack-install, so per-skill license travels with them. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012tU8bXRdMMSNkYkWVD2Wjs
…napshot) Merge 2 accidentally kept the sync branch's older fetch (7.0.1); the release-conformance check caught it. PR #8's July 17 snapshot (7.0.2, including maintained 6.9.5) is authoritative. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012tU8bXRdMMSNkYkWVD2Wjs
![sourcery-ai[bot]](https://cdn.statically.io/img/avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Sorry @henryperkins, your pull request is larger than the review limit of 150000 diff characters
📝 WalkthroughSummary by CodeRabbit
WalkthroughThis release refresh adds upstream index synchronization, drift detection, deterministic release and skill-quality harnesses, scaffold CLI validation, evaluation fixtures, and updated guidance for Blueprint, Playground, Abilities API, AI integrations, WordPress 7.0 behavior, licensing, and WPDS fallback handling. ChangesRelease refresh and validation
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 2 | ❌ 3❌ Failed checks (1 warning, 2 inconclusive)
✅ Passed checks (2 passed)
✨ Finishing Touches📝 Generate docstrings
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![amazon-q-developer[bot]](https://cdn.statically.io/img/avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
This is a comprehensive release refresh PR that updates WordPress skills documentation, evaluation infrastructure, and upstream synchronization tooling. The changes include 77 files with 4,165 additions across evaluation harnesses, skill documentation, and automation scripts.
Key Changes Reviewed
Evaluation Infrastructure: New conformance testing harness (eval/harness/release-conformance.mjs), skill quality validation (eval/harness/skill-quality.mjs), and test runner (eval/harness/run.mjs) provide robust validation of skill documentation and scenarios.
Upstream Sync Automation: Automated workflow (.github/workflows/upstream-sync.yml) with drift detection (shared/scripts/check-upstream-drift.mjs) ensures skills stay synchronized with WordPress/Gutenberg releases.
Smoke Testing: WordPress Playground-based integration test (eval/playground/ai-plugin-smoke/) validates AI plugin integration in real WordPress environment.
The code demonstrates solid engineering practices with comprehensive error handling, proper validation, and thorough testing. No blocking defects were identified that would prevent merge.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
![coderabbitai[bot]](https://cdn.statically.io/img/avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
skills/wp-ai-client/SKILL.md (1)
16-16: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winClarify the 7.0 bundling claim in
skills/wp-ai-client/SKILL.md:16
WordPress 7.0 bundleswordpress/php-ai-client, not the fullwordpress/wp-ai-clientpackage. Keep the standalone package for the REST endpoints and JavaScript API, or this guidance implies it can be dropped and breaks those consumers.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/wp-ai-client/SKILL.md` at line 16, Clarify the migration guidance in SKILL.md by stating that WordPress 7.0 bundles only the standalone wordpress/php-ai-client package. Instruct users to retain wordpress/wp-ai-client when they need its REST endpoints or JavaScript API, rather than implying that both Composer packages can be removed.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@eval/playground/ai-plugin-smoke/run.sh`:
- Around line 9-11: Update the npx invocation in the run-blueprint command to
use the documented pinned `@wp-playground/cli` version 3.1.45 instead of `@latest`,
leaving the remaining command arguments unchanged.
In `@skills/wp-ai-client/references/error-handling.md`:
- Around line 14-23: Sanitize provider-controlled error details before logging:
in skills/wp-ai-client/references/error-handling.md:14-23, remove raw
get_error_message() and get_error_data() logging and retain only allowlisted
diagnostics such as error code, status, or request ID; at
skills/wp-ai-client/references/error-handling.md:41, replace guidance to log
code, message, and data with redacted/allowlisted diagnostics and require
sanitization of messages/data; align the example at
skills/wp-ai-client/SKILL.md:97-106 with the same rule.
In `@skills/wp-ai-plugin/references/experiments-framework.md`:
- Around line 77-83: Specify the text language on the fenced inventory block
containing the ability names by changing its opening fence to a text fence,
while leaving the list contents unchanged.
In `@skills/wp-plugin-directory-guidelines/references/gpl-compliance.md`:
- Around line 60-70: Add the text language identifier to both fenced code blocks
in gpl-compliance.md, changing each opening fence to ```text while preserving
their contents and surrounding documentation.
In `@skills/wpds/SKILL.md`:
- Around line 34-36: Update the markdown sublist indentation in the referenced
documentation list so each unordered item is indented at least three spaces
beneath its ordered-list parent. Preserve the existing item text and ordering.
---
Outside diff comments:
In `@skills/wp-ai-client/SKILL.md`:
- Line 16: Clarify the migration guidance in SKILL.md by stating that WordPress
7.0 bundles only the standalone wordpress/php-ai-client package. Instruct users
to retain wordpress/wp-ai-client when they need its REST endpoints or JavaScript
API, rather than implying that both Composer packages can be removed.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 87145b1b-4296-43cb-94d6-b0569835e9b7
📒 Files selected for processing (77)
.github/workflows/upstream-sync.yml.gitignoredocs/authoring-guide.mddocs/superpowers/plans/2026-07-17-wordpress-skills-release-refresh.mddocs/superpowers/specs/2026-07-17-wordpress-skills-release-refresh-design.mddocs/upstream-sync.mdeval/descriptions/README.mdeval/descriptions/wp-abilities-audit/holdout_queries.jsoneval/descriptions/wp-abilities-audit/train_queries.jsoneval/descriptions/wp-abilities-audit/validation_queries.jsoneval/descriptions/wp-abilities-verify/holdout_queries.jsoneval/descriptions/wp-abilities-verify/train_queries.jsoneval/descriptions/wp-abilities-verify/validation_queries.jsoneval/descriptions/wp-playground/holdout_queries.jsoneval/descriptions/wp-playground/train_queries.jsoneval/descriptions/wp-playground/validation_queries.jsoneval/harness/release-conformance.mjseval/harness/run.mjseval/harness/skill-quality.mjseval/playground/ai-plugin-smoke/.gitignoreeval/playground/ai-plugin-smoke/README.mdeval/playground/ai-plugin-smoke/blueprint.jsoneval/playground/ai-plugin-smoke/mu-plugins/wpai-skill-smoke.phpeval/playground/ai-plugin-smoke/run.sheval/results/2026-07-17-release-refresh-behavioral.jsoneval/scenarios/README.mdeval/scenarios/abilities-mcp-expose.jsoneval/scenarios/ai-client-add-feature-endpoint.jsoneval/scenarios/ai-plugin-expose-read-abilities.jsoneval/scenarios/ai-plugin-register-experiment.jsoneval/scenarios/blueprint-v2-environment.jsoneval/scenarios/interactivity-watch-router-state.jsoneval/scenarios/playground-cli-3-1-local-debug.jsoneval/scenarios/plugin-directory-license-review.jsoneval/scenarios/skillpack-build-and-install.jsoneval/scenarios/theme-json-7-dimensions.jsoneval/scenarios/upstream-sync-indices.jsoneval/scenarios/wpds-without-mcp.jsonshared/references/ai-plugin-releases.jsonshared/references/gutenberg-releases.jsonshared/references/wordpress-core-versions.jsonshared/references/wp-gutenberg-version-map.jsonshared/scripts/check-upstream-drift.mjsshared/scripts/scaffold-skill.mjsshared/scripts/update-upstream-indices.mjsshared/scripts/upstream-index-lib.mjsskills/blueprint/SKILL.mdskills/blueprint/references/v1-compatibility.mdskills/wp-abilities-api/SKILL.mdskills/wp-abilities-api/references/client-side.mdskills/wp-abilities-api/references/input-schema-gotchas.mdskills/wp-abilities-api/references/mcp-exposure.mdskills/wp-abilities-audit/SKILL.mdskills/wp-abilities-verify/SKILL.mdskills/wp-ai-client/SKILL.mdskills/wp-ai-client/references/error-handling.mdskills/wp-ai-client/references/prompt-builder.mdskills/wp-ai-connectors/SKILL.mdskills/wp-ai-plugin/SKILL.mdskills/wp-ai-plugin/references/dashboard-widgets.mdskills/wp-ai-plugin/references/experiments-framework.mdskills/wp-ai-plugin/references/guidelines-integration.mdskills/wp-ai-plugin/references/hooks-and-filters.mdskills/wp-block-development/SKILL.mdskills/wp-block-development/references/block-json.mdskills/wp-block-development/references/debugging.mdskills/wp-block-themes/references/theme-json.mdskills/wp-interactivity-api/SKILL.mdskills/wp-interactivity-api/references/debugging.mdskills/wp-playground/SKILL.mdskills/wp-playground/references/blueprints.mdskills/wp-playground/references/cli-commands.mdskills/wp-playground/references/debugging.mdskills/wp-plugin-directory-guidelines/SKILL.mdskills/wp-plugin-directory-guidelines/references/gpl-compliance.mdskills/wp-plugin-directory-guidelines/references/guideline-review-checklist.mdskills/wpds/SKILL.md
📜 Review details
🧰 Additional context used
🪛 LanguageTool
eval/playground/ai-plugin-smoke/README.md
[uncategorized] ~4-~4: The official name of this content management system is spelled with a capital “P”.
Context: ...th the canonical AI plugin (latest from wordpress.org), using WordPress Playground — no s...
(WORDPRESS)
skills/blueprint/references/v1-compatibility.md
[uncategorized] ~168-~168: The official name of this content management system is spelled with a capital “P”.
Context: ...option('key', 'value');" } ``` Require /wordpress/wp-load.php before calling WordPress f...
(WORDPRESS)
docs/upstream-sync.md
[style] ~49-~49: ‘with respect to’ might be wordy. Consider a shorter alternative.
Context: ...ll-name>` The updater is transactional with respect to parsing: it fetches and normalizes all ...
(EN_WORDINESS_PREMIUM_WITH_RESPECT_TO)
docs/superpowers/specs/2026-07-17-wordpress-skills-release-refresh-design.md
[style] ~5-~5: Consider using a different verb for a more formal wording.
Context: ...em releases available on July 17, 2026, correct every issue identified in the release a...
(FIX_RESOLVE)
skills/wp-abilities-api/SKILL.md
[uncategorized] ~87-~87: The official name of this content management system is spelled with a capital “P”.
Context: ...ion, bootstrap, or server code. Install wordpress/mcp-adapter; for multi-plugin dependen...
(WORDPRESS)
skills/wp-plugin-directory-guidelines/references/gpl-compliance.md
[style] ~72-~72: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...icenses/gpl-2.0.html ``` License URI is optional, recommended for clarity. ## ...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
skills/wp-plugin-directory-guidelines/SKILL.md
[style] ~113-~113: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...icenses/gpl-2.0.html ``` License URI is optional, recommended for clarity. ###...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
🪛 markdownlint-cli2 (0.23.0)
skills/wpds/SKILL.md
[warning] 37-37: Ordered list item prefix
Expected: 1; Actual: 3; Style: 1/2/3
(MD029, ol-prefix)
[warning] 42-42: Ordered list item prefix
Expected: 2; Actual: 4; Style: 1/2/3
(MD029, ol-prefix)
skills/wp-plugin-directory-guidelines/references/gpl-compliance.md
[warning] 60-60: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
[warning] 67-67: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
skills/wp-ai-plugin/references/experiments-framework.md
[warning] 77-77: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🪛 PHPMD (2.15.0)
eval/playground/ai-plugin-smoke/mu-plugins/wpai-skill-smoke.php
[error] 13-49: The class Smoke_Experiment is not named in CamelCase. (undefined)
(CamelCaseClassName)
[error] 14-16: The method get_id is not named in camelCase. (undefined)
(CamelCaseMethodName)
[error] 18-24: The method load_metadata is not named in camelCase. (undefined)
(CamelCaseMethodName)
🪛 Shellcheck (0.11.0)
eval/playground/ai-plugin-smoke/run.sh
[info] 13-28: Expressions don't expand in single quotes, use double quotes for that.
(SC2016)
🪛 SkillSpector (2.3.11)
skills/wp-abilities-verify/SKILL.md
[warning] 56: [RP1] null: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Remediation: Pin the version: npx @scope/server@1.2.3
(MCP Rug Pull (RP1))
🔇 Additional comments (83)
skills/wp-block-development/SKILL.md (1)
58-58: LGTM!skills/wp-block-development/references/block-json.md (1)
15-17: LGTM!skills/wp-block-development/references/debugging.md (1)
27-27: LGTM!skills/wp-block-themes/references/theme-json.md (1)
52-79: LGTM!skills/wp-interactivity-api/SKILL.md (1)
138-169: LGTM!skills/wp-interactivity-api/references/debugging.md (1)
30-36: LGTM!eval/scenarios/plugin-directory-license-review.json (1)
10-21: LGTM!skills/wp-plugin-directory-guidelines/SKILL.md (1)
59-60: LGTM!Also applies to: 85-85, 99-114
skills/wp-plugin-directory-guidelines/references/gpl-compliance.md (1)
20-21: LGTM!Also applies to: 44-44
skills/wp-plugin-directory-guidelines/references/guideline-review-checklist.md (1)
36-47: LGTM!skills/wpds/SKILL.md (1)
3-4: LGTM!eval/scenarios/wpds-without-mcp.json (1)
1-19: LGTM!eval/scenarios/theme-json-7-dimensions.json (1)
1-18: LGTM!eval/scenarios/skillpack-build-and-install.json (1)
3-3: LGTM!eval/scenarios/upstream-sync-indices.json (2)
3-3: LGTM!
13-24: LGTM!skills/wp-abilities-api/SKILL.md (1)
72-73: LGTM!Also applies to: 82-87
skills/wp-abilities-api/references/client-side.md (1)
15-34: LGTM!Also applies to: 141-165
skills/wp-abilities-api/references/input-schema-gotchas.md (1)
226-249: LGTM!skills/wp-abilities-api/references/mcp-exposure.md (1)
5-19: LGTM!Also applies to: 28-47, 59-67, 94-95
skills/wp-ai-plugin/references/guidelines-integration.md (1)
5-13: LGTM!skills/wp-ai-plugin/references/hooks-and-filters.md (1)
3-11: LGTM!Also applies to: 20-21, 48-49, 70-80, 96-96
eval/scenarios/abilities-mcp-expose.json (1)
9-17: LGTM!Also applies to: 19-27
eval/scenarios/ai-client-add-feature-endpoint.json (1)
15-16: LGTM!Also applies to: 26-27
eval/scenarios/ai-plugin-expose-read-abilities.json (1)
1-26: LGTM!eval/scenarios/ai-plugin-register-experiment.json (1)
4-4: LGTM!Also applies to: 18-19, 32-35
skills/wp-abilities-audit/SKILL.md (1)
3-3: LGTM!skills/wp-abilities-verify/SKILL.md (1)
3-3: LGTM!skills/wp-ai-client/references/prompt-builder.md (1)
167-175: LGTM!skills/wp-ai-connectors/SKILL.md (1)
118-125: LGTM!skills/wp-ai-plugin/SKILL.md (1)
4-4: LGTM!Also applies to: 27-39, 151-154, 172-176, 203-213, 240-243
skills/wp-ai-plugin/references/dashboard-widgets.md (1)
3-3: LGTM!Also applies to: 86-90
skills/wp-ai-plugin/references/experiments-framework.md (1)
3-3: LGTM!Also applies to: 30-30, 75-76, 85-101
docs/authoring-guide.md (1)
7-9: LGTM!Also applies to: 29-35, 36-48, 49-53, 69-76
docs/superpowers/plans/2026-07-17-wordpress-skills-release-refresh.md (1)
1-1548: LGTM!docs/superpowers/specs/2026-07-17-wordpress-skills-release-refresh-design.md (1)
1-173: LGTM!eval/descriptions/README.md (1)
1-13: LGTM!eval/descriptions/wp-abilities-audit/holdout_queries.json (1)
1-9: LGTM!eval/scenarios/README.md (1)
4-6: LGTM!Also applies to: 7-8, 9-9
shared/references/wp-gutenberg-version-map.json (1)
3-97: LGTM!.github/workflows/upstream-sync.yml (1)
31-33: LGTM!Also applies to: 34-36
eval/harness/release-conformance.mjs (1)
1-259: LGTM!eval/harness/skill-quality.mjs (1)
1-284: LGTM!eval/descriptions/wp-abilities-audit/train_queries.json (1)
1-14: LGTM!eval/descriptions/wp-abilities-audit/validation_queries.json (1)
1-10: LGTM!eval/descriptions/wp-abilities-verify/holdout_queries.json (1)
1-8: LGTM!eval/descriptions/wp-abilities-verify/train_queries.json (1)
1-14: LGTM!eval/descriptions/wp-abilities-verify/validation_queries.json (1)
1-10: LGTM!eval/descriptions/wp-playground/holdout_queries.json (1)
1-8: LGTM!eval/descriptions/wp-playground/train_queries.json (1)
1-14: LGTM!eval/harness/run.mjs (2)
4-5: LGTM!Also applies to: 96-106, 128-133
160-174: 🩺 Stability & AvailabilityNo action needed:
spawnSyncis already imported.> Likely an incorrect or invalid review comment.shared/scripts/scaffold-skill.mjs (1)
4-5: LGTM!Also applies to: 14-16, 18-37, 39-87
eval/descriptions/wp-playground/validation_queries.json (1)
1-10: LGTM!eval/results/2026-07-17-release-refresh-behavioral.json (1)
1-229: LGTM!docs/upstream-sync.md (2)
29-32: LGTM!
49-50: LGTM!shared/scripts/update-upstream-indices.mjs (5)
3-8: LGTM!
21-22: LGTM!
41-42: LGTM!
95-104: LGTM!
117-121: LGTM!shared/scripts/upstream-index-lib.mjs (1)
1-58: LGTM!shared/references/ai-plugin-releases.json (1)
1-120: LGTM!shared/references/gutenberg-releases.json (2)
4-39: LGTM!
189-191: LGTM!shared/references/wordpress-core-versions.json (2)
3-7: LGTM!
28-48: LGTM!shared/scripts/check-upstream-drift.mjs (1)
1-104: LGTM!skills/blueprint/SKILL.md (1)
3-66: LGTM!skills/blueprint/references/v1-compatibility.md (1)
1-252: LGTM!skills/wp-playground/SKILL.md (1)
3-51: LGTM!skills/wp-playground/references/blueprints.md (1)
1-21: LGTM!eval/playground/ai-plugin-smoke/README.md (1)
1-34: LGTM!eval/playground/ai-plugin-smoke/mu-plugins/wpai-skill-smoke.php (1)
1-57: LGTM!eval/playground/ai-plugin-smoke/blueprint.json (1)
1-28: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winRefactor this new Blueprint to use V2.
The updated skills guidance strictly advises using Blueprint V2 for all new Blueprints (
"version": 2, declarativeplugins,siteOptions, etc.). Since this is a new file introduced in this PR, it should follow the V2 schema rather than the legacy V1 format to lead by example and remain consistent with the new documentation.♻️ Proposed refactor to V2
{ "$schema": "https://playground.wordpress.net/blueprint-schema.json", - "preferredVersions": { - "php": "8.2", - "wp": "latest" - }, - "steps": [ - { - "step": "installPlugin", - "pluginData": { - "resource": "wordpress.org/plugins", - "slug": "ai" - } - }, - { - "step": "setSiteOptions", - "options": { - "wpai_features_enabled": "1", - "wpai_feature_smoke-experiment_enabled": "1", - "wpai_feature_suggest-reply_enabled": "1" - } - }, + "version": 2, + "wordpressVersion": "latest", + "phpVersion": "8.2", + "plugins": [ + "ai" + ], + "siteOptions": { + "wpai_features_enabled": "1", + "wpai_feature_smoke-experiment_enabled": "1", + "wpai_feature_suggest-reply_enabled": "1" + }, + "additionalStepsAfterExecution": [ { "step": "runPHP", "code": "<?php\nrequire '/wordpress/wp-load.php';\nwp_set_current_user( 1 );\n$get = function ( $id ) { return function_exists( 'wp_get_ability' ) ? wp_get_ability( $id ) : null; };\n$smoke = $get( 'smoke/echo' );\n$exec = null;\nif ( $smoke ) { $exec = $smoke->execute( array( 'msg' => 'hi' ) ); if ( is_wp_error( $exec ) ) { $exec = 'WP_Error: ' . $exec->get_error_code(); } }\n$result = array(\n 'wpai_version' => defined( 'WPAI_VERSION' ) ? WPAI_VERSION : null,\n 'abstract_feature' => class_exists( 'WordPress\\AI\\Abstracts\\Abstract_Feature' ),\n 'smoke_ability' => (bool) $smoke,\n 'smoke_exec' => $exec,\n 'read_content' => (bool) $get( 'core/read-content' ),\n 'read_users' => (bool) $get( 'core/read-users' ),\n 'read_settings' => (bool) $get( 'core/read-settings' ),\n 'suggest_reply' => (bool) $get( 'ai/suggest-reply' ),\n);\nfile_put_contents( '/wordpress/wp-content/mu-plugins/result.json', json_encode( $result, JSON_PRETTY_PRINT ) );\necho json_encode( $result );" } ] }> Likely an incorrect or invalid review comment.skills/wp-playground/references/cli-commands.md (1)
1-33: LGTM!skills/wp-playground/references/debugging.md (1)
1-18: LGTM!eval/scenarios/blueprint-v2-environment.json (1)
1-20: LGTM!eval/scenarios/interactivity-watch-router-state.json (1)
1-18: LGTM!eval/scenarios/playground-cli-3-1-local-debug.json (1)
1-19: LGTM!.gitignore (1)
10-11: LGTM!eval/playground/ai-plugin-smoke/.gitignore (1)
1-2: LGTM!
| npx -y @wp-playground/cli@latest run-blueprint \ | ||
| --blueprint=./blueprint.json \ | ||
| --mount="$PWD/mu-plugins:/wordpress/wp-content/mu-plugins" |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Pin the Playground CLI version for determinism.
The documentation specifically pins the CLI version to 3.1.45 (@wp-playground/cli@3.1.45) to ensure a deterministic environment. Using @latest here risks breaking the smoke test if an incompatible CLI version is released in the future.
🔧 Proposed fix to pin the CLI version
-npx -y `@wp-playground/cli`@latest run-blueprint \
+npx -y `@wp-playground/cli`@3.1.45 run-blueprint \
--blueprint=./blueprint.json \
--mount="$PWD/mu-plugins:/wordpress/wp-content/mu-plugins"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| npx -y @wp-playground/cli@latest run-blueprint \ | |
| --blueprint=./blueprint.json \ | |
| --mount="$PWD/mu-plugins:/wordpress/wp-content/mu-plugins" | |
| npx -y `@wp-playground/cli`@3.1.45 run-blueprint \ | |
| --blueprint=./blueprint.json \ | |
| --mount="$PWD/mu-plugins:/wordpress/wp-content/mu-plugins" |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@eval/playground/ai-plugin-smoke/run.sh` around lines 9 - 11, Update the npx
invocation in the run-blueprint command to use the documented pinned
`@wp-playground/cli` version 3.1.45 instead of `@latest`, leaving the remaining
command arguments unchanged.
| if ( is_wp_error( $result ) ) { | ||
| // Inspect ->get_error_code(), ->get_error_message(), ->get_error_data() | ||
| error_log( | ||
| sprintf( | ||
| 'AI request failed [%s]: %s', | ||
| $result->get_error_code(), | ||
| $result->get_error_message() | ||
| ) | ||
| ); | ||
| $upstream_data = $result->get_error_data(); | ||
| return $result; |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Redact provider-controlled error content before logging.
get_error_message() and especially get_error_data() are not constrained to safe diagnostics. Logging them verbatim can expose echoed prompt content, response bodies, PII, or provider metadata. Restrict the examples to an allowlisted error code/status/request ID, and explicitly state that messages/data require sanitization before logging.
skills/wp-ai-client/references/error-handling.md#L14-L23: remove the raw message/data logging pattern from the example.skills/wp-ai-client/references/error-handling.md#L41-L41: replace “log the code, message, and data” with redacted/allowlisted diagnostics.skills/wp-ai-client/SKILL.md#L97-L106: align the main skill example with the sanitized logging rule.
📍 Affects 2 files
skills/wp-ai-client/references/error-handling.md#L14-L23(this comment)skills/wp-ai-client/references/error-handling.md#L41-L41skills/wp-ai-client/SKILL.md#L97-L106
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/wp-ai-client/references/error-handling.md` around lines 14 - 23,
Sanitize provider-controlled error details before logging: in
skills/wp-ai-client/references/error-handling.md:14-23, remove raw
get_error_message() and get_error_data() logging and retain only allowlisted
diagnostics such as error code, status, or request ID; at
skills/wp-ai-client/references/error-handling.md:41, replace guidance to log
code, message, and data with redacted/allowlisted diagnostics and require
sanitization of messages/data; align the example at
skills/wp-ai-client/SKILL.md:97-106 with the same rule.
| ``` | ||
| Abilities_Explorer, Connector_Approval, AI_Request_Logging, | ||
| Content_Classification, Content_Resizing, Excerpt_Generation, | ||
| Alt_Text_Generation, Meta_Description, Editorial_Notes, Editorial_Updates, | ||
| Summarization, Title_Generation, Type_Ahead, Comment_Moderation, | ||
| Key_Encryption | ||
| Key_Encryption, Suggest_Reply | ||
| ``` |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Specify a language for the fenced inventory block.
This triggers markdownlint MD040. Use a text fence for this non-executable list.
Proposed fix
-```
+```text
Abilities_Explorer, Connector_Approval, AI_Request_Logging,
Content_Classification, Content_Resizing, Excerpt_Generation,
Alt_Text_Generation, Meta_Description, Editorial_Notes, Editorial_Updates,
Summarization, Title_Generation, Type_Ahead, Comment_Moderation,
Key_Encryption, Suggest_Reply📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ``` | |
| Abilities_Explorer, Connector_Approval, AI_Request_Logging, | |
| Content_Classification, Content_Resizing, Excerpt_Generation, | |
| Alt_Text_Generation, Meta_Description, Editorial_Notes, Editorial_Updates, | |
| Summarization, Title_Generation, Type_Ahead, Comment_Moderation, | |
| Key_Encryption | |
| Key_Encryption, Suggest_Reply | |
| ``` |
🧰 Tools
🪛 markdownlint-cli2 (0.23.0)
[warning] 77-77: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/wp-ai-plugin/references/experiments-framework.md` around lines 77 -
83, Specify the text language on the fenced inventory block containing the
ability names by changing its opening fence to a text fence, while leaving the
list contents unchanged.
Source: Linters/SAST tools
| ``` | ||
| License: GPL-3.0-or-later | ||
| License URI: https://www.gnu.org/licenses/gpl-3.0.html | ||
| ``` | ||
|
|
||
| `License URI` is optional, recommended for clarity. | ||
|
|
||
| ``` | ||
| License: GPLv2 or later | ||
| License URI: https://www.gnu.org/licenses/gpl-2.0.html | ||
| ``` |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value
Specify the language for fenced code blocks.
Adding a language identifier (such as text) to the fenced code blocks prevents markdown linter warnings and matches the formatting style used in SKILL.md.
♻️ Proposed fix
-```
+```text
License: GPL-3.0-or-later
License URI: https://www.gnu.org/licenses/gpl-3.0.htmlLicense URI is optional, recommended for clarity.
- +text
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ``` | |
| License: GPL-3.0-or-later | |
| License URI: https://www.gnu.org/licenses/gpl-3.0.html | |
| ``` | |
| `License URI` is optional, recommended for clarity. | |
| ``` | |
| License: GPLv2 or later | |
| License URI: https://www.gnu.org/licenses/gpl-2.0.html | |
| ``` |
🧰 Tools
🪛 markdownlint-cli2 (0.23.0)
[warning] 60-60: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
[warning] 67-67: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/wp-plugin-directory-guidelines/references/gpl-compliance.md` around
lines 60 - 70, Add the text language identifier to both fenced code blocks in
gpl-compliance.md, changing each opening fence to ```text while preserving their
contents and surrounding documentation.
Source: Linters/SAST tools
| - reference site (`wpds://pages`) | ||
| - list of available components (`wpds://components`) and specific component information (`wpds://components/:name`) | ||
| - list of available tokens (`wpds://design-tokens`) |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value
Fix markdown list indentation.
The sublist items are currently indented with 2 spaces. Markdown parsers typically require at least 3 spaces of indentation to nest an unordered list under an ordered list item (such as 2. ). Fixing the indentation prevents the markdown linter from misinterpreting the structure and reporting sequence errors for the subsequent list items.
♻️ Proposed fix
- - reference site (`wpds://pages`)
- - list of available components (`wpds://components`) and specific component information (`wpds://components/:name`)
- - list of available tokens (`wpds://design-tokens`)
+ - reference site (`wpds://pages`)
+ - list of available components (`wpds://components`) and specific component information (`wpds://components/:name`)
+ - list of available tokens (`wpds://design-tokens`)📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - reference site (`wpds://pages`) | |
| - list of available components (`wpds://components`) and specific component information (`wpds://components/:name`) | |
| - list of available tokens (`wpds://design-tokens`) | |
| - reference site (`wpds://pages`) | |
| - list of available components (`wpds://components`) and specific component information (`wpds://components/:name`) | |
| - list of available tokens (`wpds://design-tokens`) |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/wpds/SKILL.md` around lines 34 - 36, Update the markdown sublist
indentation in the referenced documentation list so each unordered item is
indented at least three spaces beneath its ordered-list parent. Preserve the
existing item text and ordering.
Source: Linters/SAST tools
![chatgpt-codex-connector[bot]](https://cdn.statically.io/img/avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d7c9aadefc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ### 0) Triage and confirm AI plugin context | ||
|
|
||
| 1. Run project triage if available: `node ../wp-project-triage/scripts/detect_wp_project.mjs` when the `wp-project-triage` skill is installed alongside; otherwise classify the project manually. | ||
| 1. Run triage: `node skills/wp-project-triage/scripts/detect_wp_project.mjs` |
There was a problem hiding this comment.
When this skill is installed from a skillpack and run against a user's WordPress repo, the repo will not contain skills/wp-project-triage/scripts/detect_wp_project.mjs (the packaged skills live under the client skill directory, e.g. .codex/skills/.github/skills). This makes the first procedure step fail with a missing module outside this source repository; keep the adjacent-skill path/fallback wording so the agent resolves the bundled triage script rather than a repo-local skills/ tree.
Useful? React with 👍 / 👎.
| const core = readJson(repoRoot, "shared/references/wordpress-core-versions.json"); | ||
| const gutenberg = readJson(repoRoot, "shared/references/gutenberg-releases.json"); | ||
| const map = readJson(repoRoot, "shared/references/wp-gutenberg-version-map.json"); | ||
| assert(core.latest === "7.0.2", "WordPress latest must be 7.0.2"); |
There was a problem hiding this comment.
This exact assertion makes every future upstream-index refresh fail CI as soon as WordPress publishes a newer core version (and the same block pins Gutenberg to v23.5.3). I checked the workflow ordering: .github/workflows/upstream-sync.yml updates the JSON indices before opening the PR, and .github/workflows/ci.yml runs this harness, so a normal refresh to 7.0.3/later would be blocked by the conformance test instead of validating the refreshed index shape or skill drift.
Useful? React with 👍 / 👎.
| - **Disable Guidelines integration**: `wpai_use_guidelines` (default `true`). | ||
| - **Adjust the minimum content threshold** (v1.1.0+): `wpai_min_content_length` (default 250 characters, per feature). Content-dependent Experiments (Summarization, Content Resizing, Content Classification, etc.) are disabled in the editor until the post reaches this character count. The legacy `wpai_summarization_min_content_length` filter was deprecated in 1.1.0 in favor of this one. | ||
| - **Claim Image Generation support** (v1.1.0+): `wpai_has_image_generation_support` — lets a third party declare image-generation support when it can't be auto-detected (e.g., a connector authenticating without an API key, such as OAuth). | ||
| - **Tune the default request timeout** (v1.2.0+): `wpai_default_request_timeout` — filters the per-request timeout as `( int $default_timeout, string $feature_id )`; the plugin uses it for the image-generation request (`includes/helpers.php`). ⚠️ The 1.2.0 changelog and `readme.txt` call this `wp_ai_client_default_request_timeout`, but that name appears in *no* PHP in the plugin — the applied filter is `wpai_default_request_timeout`. (`wp_ai_client_default_request_timeout` is most likely the core AI Client's own timeout filter; verify against the installed core version before using it.) |
There was a problem hiding this comment.
When someone follows this 1.2.0 guidance to extend image-generation request timeouts, their callback will never run: the AI plugin release notes and the official hook reference document wp_ai_client_default_request_timeout, not wpai_default_request_timeout. This also gives the wrong signature, so downstream code copied from the skill would silently leave the default timeout unchanged.
Useful? React with 👍 / 👎.
| "step": "installPlugin", | ||
| "pluginData": { | ||
| "resource": "wordpress.org/plugins", | ||
| "slug": "ai" | ||
| } |
There was a problem hiding this comment.
In this Blueprint, the installPlugin step only installs the WordPress.org plugin unless options.activate is set, but the following runPHP step expects WPAI_VERSION, the AI plugin classes, and its abilities to be loaded. As written, the smoke test will report the AI plugin surface as missing even when the installed plugin is valid; add "options": { "activate": true } or use the activating shorthand before setting the feature options.
Useful? React with 👍 / 👎.
|
|
||
| ```php | ||
| require_once plugin_dir_path( __FILE__ ) . 'vendor/autoloader.php'; // Jetpack Autoloader | ||
| require_once plugin_dir_path( __FILE__ ) . 'vendor/autoload_packages.php'; |
There was a problem hiding this comment.
When the adapter is consumed as a Composer dependency, requiring Jetpack Autoloader only makes classes available; it does not create the default server or fire the adapter hooks. A plugin following this bootstrap snippet will never register the MCP REST server until it also imports WP\MCP\Core\McpAdapter and calls McpAdapter::instance(), so the documented MCP exposure path remains non-functional.
Useful? React with 👍 / 👎.
2 participants
No description provided.