fix: prepare WordPress.org release package

.buildignore

@@ -4,6 +4,7 @@
 .gitignore
 .github/
 .datamachine/
+artifacts/
 AGENTS.md
 .DS_Store
 **/.DS_Store
@@ -19,7 +20,10 @@ build.sh
 # Testing
 bin/install-wp-tests.sh
 tests/
+bench/
 phpunit.xml
+phpunit.xml.dist
+phpunit.sqlite.xml.dist
 coverage/
 
 # Development dependencies (handled by composer --no-dev)
@@ -36,6 +40,12 @@ vendor/php-stubs/
 # Composer development files
 composer.lock
 
+# Development configuration
+eslint.config.js
+jsconfig.json
+phpstan-baseline.neon
+webpack.config.js
+
 # Node.js (if any)
 node_modules/
 package-lock.json
@@ -51,6 +61,45 @@ README.md
 docs/
 extensions/
 
+# Bundled dependency development files
+vendor/wordpress/agents-api/.github/
+vendor/wordpress/agents-api/.gitignore
+vendor/wordpress/agents-api/CHANGELOG.md
+vendor/wordpress/agents-api/composer.json
+vendor/wordpress/agents-api/composer.lock
+vendor/wordpress/agents-api/docs/
+vendor/wordpress/agents-api/homeboy.json
+vendor/wordpress/agents-api/phpstan.neon.dist
+vendor/wordpress/agents-api/phpunit.xml.dist
+vendor/wordpress/agents-api/README.md
+vendor/wordpress/agents-api/stubs/
+vendor/wordpress/agents-api/tests/
+vendor/automattic/blocks-engine-php-transformer/.git/
+vendor/automattic/blocks-engine-php-transformer/.github/
+vendor/automattic/blocks-engine-php-transformer/.gitignore
+vendor/automattic/blocks-engine-php-transformer/CONTEXT.md
+vendor/automattic/blocks-engine-php-transformer/CONTRIBUTING.md
+vendor/automattic/blocks-engine-php-transformer/docs/
+vendor/automattic/blocks-engine-php-transformer/figma-transformer/
+vendor/automattic/blocks-engine-php-transformer/fixtures/
+vendor/automattic/blocks-engine-php-transformer/packages/
+vendor/automattic/blocks-engine-php-transformer/README.md
+vendor/automattic/blocks-engine-php-transformer/scripts/
+vendor/automattic/blocks-engine-php-transformer/tests/
+vendor/automattic/blocks-engine-php-transformer/php-transformer/.gitattributes
+vendor/automattic/blocks-engine-php-transformer/php-transformer/.gitignore
+vendor/automattic/blocks-engine-php-transformer/php-transformer/CHANGELOG.md
+vendor/automattic/blocks-engine-php-transformer/php-transformer/composer.json
+vendor/automattic/blocks-engine-php-transformer/php-transformer/composer.lock
+vendor/automattic/blocks-engine-php-transformer/php-transformer/docs/
+vendor/automattic/blocks-engine-php-transformer/php-transformer/homeboy.json
+vendor/automattic/blocks-engine-php-transformer/php-transformer/README.md
+vendor/automattic/blocks-engine-php-transformer/php-transformer/tests/
+vendor/automattic/blocks-engine-php-transformer/php-transformer/tools/
+vendor/**/phpstan.neon.dist
+vendor/**/psalm.xml
+vendor/**/phpcs.xml.dist
+
 # Temporary and cache files
 *.tmp
 *.cache

THIRD-PARTY-NOTICES.txt

@@ -0,0 +1,39 @@
+# Third-Party Notices
+
+Data Machine bundles production PHP dependencies and compiled browser assets so the WordPress plugin can run without Composer or npm on the destination site. Exact resolved versions, sources, integrity hashes, and transitive dependency metadata are recorded in `composer.lock` and `package-lock.json` in the source repository.
+
+## PHP Runtime Dependencies
+
+| Dependency | License | Source |
+| --- | --- | --- |
+| Automattic Blocks Engine PHP Transformer | GPL-3.0 | https://github.com/Automattic/blocks-engine |
+| WordPress Agents API | GPL-2.0-or-later | https://github.com/Automattic/agents-api |
+| WooCommerce Action Scheduler | GPL-3.0-or-later | https://actionscheduler.org/ |
+| league/commonmark | BSD-3-Clause | https://github.com/thephpleague/commonmark |
+| league/config | BSD-3-Clause | https://github.com/thephpleague/config |
+| league/html-to-markdown | MIT | https://github.com/thephpleague/html-to-markdown |
+| dflydev/dot-access-data | MIT | https://github.com/dflydev/dflydev-dot-access-data |
+| nette/schema | BSD-3-Clause, GPL-2.0-only, or GPL-3.0-only | https://github.com/nette/schema |
+| nette/utils | BSD-3-Clause, GPL-2.0-only, or GPL-3.0-only | https://github.com/nette/utils |
+| psr/event-dispatcher | MIT | https://github.com/php-fig/event-dispatcher |
+| symfony/deprecation-contracts | MIT | https://github.com/symfony/deprecation-contracts |
+| symfony/polyfill-php80 | MIT | https://github.com/symfony/polyfill |
+
+Applicable dependency license files are retained in the package. Blocks Engine is pinned to commit `d8842683cb7928a0ae1f56878de93cf0bc8b7343`; its GPL-3.0 license is retained at `vendor/automattic/blocks-engine-php-transformer/LICENSE`.
+
+## Browser Build Inputs
+
+The compiled JavaScript includes these direct production packages or consumes them from WordPress at runtime:
+
+| Dependency | License | Packaging |
+| --- | --- | --- |
+| `@extrachill/chat` | GPL-2.0-or-later | Compiled into Data Machine browser assets; source at https://github.com/Extra-Chill/chat |
+| `@tanstack/react-query` | MIT | Compiled into Data Machine browser assets; source at https://github.com/TanStack/query |
+| `react-markdown` and its unified/remark/unist dependencies | MIT | Compiled into Data Machine browser assets; source at https://github.com/remarkjs/react-markdown |
+| `zustand` | MIT | Compiled into Data Machine browser assets; source at https://github.com/pmndrs/zustand |
+| `@wordpress/api-fetch`, `components`, `data`, `dom-ready`, `element`, `hooks`, `i18n`, and `notices` | GPL-2.0-or-later | Build/runtime dependencies externalized to WordPress-provided script handles; source at https://github.com/WordPress/gutenberg |
+| React and React DOM peer dependencies | MIT | Externalized to the WordPress element runtime; source at https://github.com/facebook/react |
+
+Transitive permissive browser dependencies use MIT, ISC, BSD, Apache-2.0, or Unicode licenses as recorded per package in `package-lock.json`. GPL dependencies are listed explicitly above and are compatible with Data Machine's GPL-2.0-or-later license.
+
+Data Machine source: https://github.com/Extra-Chill/data-machine

composer.json

@@ -1,7 +1,6 @@
 {
 	"name": "chubes/datamachine",
 	"description": "WordPress plugin for automated data collection, AI processing, and multi-platform publishing",
-	"version": "0.10.2",
 	"license": "GPL-2.0-or-later",
 	"require": {
 		"php": ">=8.2",

docs/plugin-check-wordpress-org-candidate.json

@@ -0,0 +1,42 @@
+{
+  "schema": "data-machine/plugin-check-unescaped-parameter-map/v1",
+  "package_sha256": "fb0f4164717d6f8519b4aadc57cf3e8111f4f97144e7788c188a47fd22941558",
+  "command": "wordpress.plugin-check",
+  "wordpress_version": "7.1",
+  "plugin_check": {
+    "exit_code": 0,
+    "status": "passed",
+    "summary": {
+      "total": 222,
+      "errors": 0,
+      "warnings": 222,
+      "notices": 0,
+      "info": 0,
+      "unknown": 0
+    }
+  },
+  "rule": "PluginCheck.Security.DirectDB.UnescapedDBParameter",
+  "total": 83,
+  "files": [
+    { "file": "inc/Abilities/Job/RecoverStuckJobsAbility.php", "count": 9, "locations": ["341:25", "450:29", "953:23", "975:18", "1018:19", "1059:23", "1268:17", "1334:22", "1382:27"] },
+    { "file": "inc/Cli/Commands/ProcessedItemsCommand.php", "count": 8, "locations": ["101:21", "385:25", "429:21", "497:25", "520:21", "594:25", "621:18", "704:21"] },
+    { "file": "inc/Core/ActionScheduler/ClaimIndexMigration.php", "count": 1, "locations": ["221:32"] },
+    { "file": "inc/Core/ActionScheduler/PathlessBatchRecovery.php", "count": 1, "locations": ["118:21"] },
+    { "file": "inc/Core/ActionScheduler/ScopedDrainService.php", "count": 10, "locations": ["212:29", "224:29", "238:29", "456:20", "492:23", "939:23", "987:24", "1008:23", "1059:18", "1095:18"] },
+    { "file": "inc/Core/Admin/FlowFormatter.php", "count": 1, "locations": ["225:18"] },
+    { "file": "inc/Core/Database/BaseRepository.php", "count": 1, "locations": ["131:29"] },
+    { "file": "inc/Core/Database/BatchItems/BatchItems.php", "count": 1, "locations": ["156:23"] },
+    { "file": "inc/Core/Database/Chat/Chat.php", "count": 6, "locations": ["399:25", "1330:22", "1748:22", "1856:19", "1885:23", "1959:21"] },
+    { "file": "inc/Core/Database/Flows/Flows.php", "count": 4, "locations": ["427:25", "641:25", "684:25", "723:25"] },
+    { "file": "inc/Core/Database/Jobs/Jobs.php", "count": 12, "locations": ["772:23", "867:25", "921:25", "1068:37", "1092:24", "1116:24", "1155:24", "1186:25", "1400:27", "1791:30", "1832:30", "4369:20"] },
+    { "file": "inc/Core/Database/Logs/LogRepository.php", "count": 3, "locations": ["185:32", "193:32", "199:25"] },
+    { "file": "inc/Core/Database/Pipelines/Pipelines.php", "count": 12, "locations": ["272:27", "337:27", "368:27", "625:25", "659:20", "660:20", "662:20", "663:20", "665:20", "666:20", "668:20", "669:20"] },
+    { "file": "inc/Core/Database/PostIdentityIndex/PostIdentityIndex.php", "count": 1, "locations": ["127:26"] },
+    { "file": "inc/Core/Database/ProcessedItems/ProcessedItemDeferrals.php", "count": 2, "locations": ["198:11", "208:11"] },
+    { "file": "inc/Core/Database/ProcessedItems/ProcessedItems.php", "count": 1, "locations": ["892:32"] },
+    { "file": "inc/Core/Database/RunMetadata/RunMetadata.php", "count": 2, "locations": ["151:24", "195:25"] },
+    { "file": "inc/Core/Database/TrackedItems/TrackedItems.php", "count": 2, "locations": ["149:24", "166:24"] },
+    { "file": "inc/Core/Database/TransactionScope.php", "count": 4, "locations": ["41:26", "62:40", "82:32", "86:32"] },
+    { "file": "inc/Engine/AI/Actions/PendingActionStore.php", "count": 2, "locations": ["650:18", "730:18"] }
+  ]
+}

docs/wordpress-org-submission.md

@@ -0,0 +1,36 @@
+# WordPress.org Submission Checklist
+
+This document is a preparatory checklist. Issue #2424 remains open until release automation builds the exact 1.0.0 bytes and the package hash, Plugin Check, network activation, full lint, and approved artwork gates all pass. Do not manually bump 1.0 versions.
+
+The WordPress.org package must be the exact Data Machine release package produced by Homeboy. Do not rebuild or edit files in SVN after release packaging.
+
+## Candidate Gate
+
+1. Confirm the release commit is clean, pushed, and is the intended tag commit.
+2. Build through Homeboy's WordPress release package path. `.buildignore` is the authoritative package exclusion file; `.distignore` is not used by this repository-supported path.
+3. Record the ZIP path, SHA256, uncompressed inventory, entry count, and version from `data-machine.php` and `readme.txt`.
+4. Reject packages containing tests, fixtures, PHPUnit files, development configuration, nested archives, local paths, secrets, private domains, identities, endpoints, or runtime assumptions. Project names and public source provenance are allowed.
+5. Run Plugin Check against the installed ZIP on the `Tested up to` WordPress version. Resolve all errors and record every warning code, count, and disposition.
+   Preserve the exact report or a package-hash-bound machine-readable location map such as `plugin-check-wordpress-org-candidate.json`.
+6. Run clean single-site activation, deactivation, and reactivation. Confirm missing requirements fail with WordPress's normal plugin requirement message and no fatal error.
+7. Run network activation on multisite, verify Data Machine loads on at least two sites, then network-deactivate cleanly.
+8. Run the full Homeboy audit, lint, build, and test gates without skipped checks.
+9. Run `composer validate --strict`, `composer audit --no-dev`, and `npm audit --omit=dev`; review `THIRD-PARTY-NOTICES.txt` against the final lockfiles.
+10. Confirm plugin headers and `readme.txt` agree on Requires WordPress, Requires PHP, stable tag, and license. Verify description, installation, FAQ, external services, source, support, and changelog links.
+
+## Directory Assets
+
+WordPress.org directory banners, icons, and screenshots belong in the SVN repository's top-level `assets/` directory and must not be added to the plugin ZIP. This Git repository does not currently contain approved directory artwork. Obtain maintainer-approved assets before submission; do not invent or generate replacements during packaging.
+
+## SVN Staging
+
+1. Check out the assigned WordPress.org SVN repository into a clean temporary directory.
+2. Copy the exact contents of the verified ZIP's `data-machine/` directory into `trunk/`.
+3. Copy the same contents into `tags/<release-version>/`; do not run Composer, npm, formatters, or text replacement in SVN.
+4. Add maintainer-approved directory artwork to top-level `assets/` only.
+5. Review `svn status`, reject unexpected deletions or unversioned files, and compare a deterministic file-hash inventory of `trunk/` and `tags/<release-version>/` with the extracted ZIP.
+6. Re-run readme validation and inspect the local SVN diff.
+7. Obtain maintainer approval for the exact diff and package hash before `svn commit`.
+8. After commit, verify the public directory page, download ZIP hash/content, readme rendering, assets, and installation on a clean site.
+
+Tagging, releasing, WordPress.org submission, SVN commit, and deployment remain explicit maintainer actions.

inc/Abilities/AgentAbilities.php

@@ -854,7 +854,7 @@ public function registerAbilities(): void {
 							),
 							'principal_id'   => array(
 								'type'        => 'string',
-								'description' => 'Principal identifier, such as public or automattician.',
+								'description' => 'Principal identifier, such as public or organization-member.',
 							),
 							'role'           => array(
 								'type'        => 'string',

inc/Abilities/AgentRemoteCall/AgentRemoteCallAbility.php

@@ -40,7 +40,7 @@ private function registerAbility(): void {
 						'properties' => array(
 							'remote_site' => array(
 								'type'        => 'string',
-								'description' => __( 'Remote site domain (e.g., "chubes.net"). Scheme optional.', 'data-machine' ),
+								'description' => __( 'Remote site domain (e.g., "remote.example"). Scheme optional.', 'data-machine' ),
 							),
 							'agent_slug'  => array(
 								'type'        => 'string',

inc/Abilities/AgentTokenAbilities.php

@@ -56,7 +56,7 @@ private function registerCreateToken(): void {
 						),
 						'label'        => array(
 							'type'        => 'string',
-							'description' => __( 'Human-readable label (e.g., "kimaki-prod", "ci-pipeline")', 'data-machine' ),
+							'description' => __( 'Human-readable label (e.g., "desktop-client", "ci-pipeline")', 'data-machine' ),
 						),
 						'capabilities' => array(
 							'type'        => 'array',

inc/Api/Agents.php

@@ -285,7 +285,7 @@ public static function register_routes(): void {
 							'type'              => 'string',
 							'required'          => false,
 							'default'           => '',
-							'description'       => __( 'Human-readable label (e.g., "kimaki-prod").', 'data-machine' ),
+							'description'       => __( 'Human-readable label (e.g., "desktop-client").', 'data-machine' ),
 							'sanitize_callback' => 'sanitize_text_field',
 						),
 						'capabilities' => array(

inc/Api/ProcessedItems.php

@@ -84,6 +84,11 @@ public static function handle_clear( $request ) {
 		$clear_type = $request->get_param( 'clear_type' );
 		$target_id  = (int) $request->get_param( 'target_id' );
 
+		$registry = \WP_Abilities_Registry::get_instance();
+		if ( ! $registry->is_registered( 'datamachine/clear-processed-items' ) ) {
+			return new \WP_Error( 'ability_not_found', __( 'Ability not found', 'data-machine' ), array( 'status' => 500 ) );
+		}
+
 		$ability = wp_get_ability( 'datamachine/clear-processed-items' );
 		if ( ! $ability ) {
 			return new \WP_Error( 'ability_not_found', __( 'Ability not found', 'data-machine' ), array( 'status' => 500 ) );