Zorderz 1.8.1 — mailbox admin-input hardening (security gate green)

What's in 1.8.1

A small hardening release over 1.8.0. It adds explicit input sanitizers to five administrator-only mailbox settings fields and brings the PHP_CodeSniffer security gate back to green. No user-facing changes, no database, schema, or REST changes, and no behavior change. A straight upgrade over 1.8.0.

Hardened

Five admin form inputs in the new mail apps now pass their value through an explicit WordPress sanitizer at the point of read, matching the project's coding standard:

• Inbox settings (ZIB_Admin::save): internal_domains, client_secret
• Exchange identity (ZMI_Admin): zmi_upn, zmi_aliases, zmi_services

Every one of these handlers was already capability-gated (manage_options / edit_users) and nonce-verified, and every value was already unslashed and parsed downstream, so this is defense in depth rather than a fix for an exploitable issue. Nothing in 1.8.0 was exploitable: the release ships no SQL injection (all queries are parameterized through $wpdb->prepare()) and no unauthenticated data path.

Why a point release

The 1.8.0 security gate (PHP_CodeSniffer, security ruleset, scoped to the lines a change touches) flagged these five reads because the new mail code did not sanitize at the boundary. Its other findings were false positives on safe code: parameterized SQL with interpolated table names, a nonce verified inside a shared helper, integer casts, and pre-escaped output. The changed-lines gate does not re-scan those once a change is not touching them, so hardening the five real reads restores a green gate without churning safe code.

Install / upgrade

Zorderz ships as two artifacts that upgrade together. Install or upgrade the theme first, then the apps. The order matters and is not enforced by WordPress.

• zorderz-theme-1.8.1.zip — the platform kernel and Core services
• zorderz-apps-1.8.1.zip — the app bundle

Fresh install: upload just the theme, and it installs and activates the apps itself. Theme and apps bundle move to 1.8.1 in lockstep.

Artifacts

• zorderz-theme-1.8.1.zip
• zorderz-apps-1.8.1.zip
• zorderz-1.8.1-checksums.txt (SHA-256)

Verified clean by the private tenant-data gate: zero customer, employee, pricing, or cost data in the release.

Open Source ERP: Zorderz 1.8 Adds an Email Assistant

What's new in 1.8

Email assistant (new app). Zorderz can now connect to a mailbox (Microsoft 365, delegated sign-in) and read it to surface and tag work-related mail and draft replies for your review. It is read-only, it never sends, it is connect-your-own, and it ships off until you connect an account.

One-click demo company. Tools → Zorderz Data now has "Load TestCo sample data": it populates a fresh install with a complete fictional business, its product catalog, price list, estimates and invoices, a team roster, chat history, and knowledge documents, so you can try every app with realistic data before entering your own. It keeps you as the owner and does not change your WordPress settings.

The assistant now works for any business. The chat assistant builds its knowledge from your own business profile, catalog, and team at run time, so on a fresh install it is neutral and honest instead of carrying one company's data.

Under the hood. Repaired the estimate to job handoff, fixed two dead cross-app lookups, extended the private tenant-data scan to cover the bundled demo data, and finished clearing legacy naming out of the platform.

Install

Fresh install: upload just the theme, and it installs and activates the apps itself. Existing install: update the theme first, then the apps (they move in lockstep, same version).

See https://github.com/CarletonTorpin/Zorderz/releases/latest and the repo README.

Artifacts

• zorderz-theme-1.8.0.zip
• zorderz-apps-1.8.0.zip
• zorderz-1.8.0-checksums.txt (SHA-256)

Verified clean by the private tenant-data gate: zero customer, employee, pricing, or cost data in the release.

Zorderz 1.7.2 — upgrade-path fix and version/config congruence

Zorderz v1.7.2 — upgrade-path fix and version/config congruence

A point release over v1.7.1. It repairs the in-place upgrade path for the apps bundle and closes three version and configuration congruence gaps found in review. No database, schema, or REST changes — a straight upgrade over 1.7.1.

Install / upgrade

Zorderz ships as two artifacts that upgrade together. Install or upgrade the theme first, then the apps — the ordering matters and is not enforced by WordPress.

1. zorderz-theme-1.7.2.zip — the platform kernel and Core services
2. zorderz-apps-1.7.2.zip — the 19-app bundle

Fixed

• In-place apps upgrade skipped its re-activation step. The apps bundle re-runs every app's activation on plugins_loaded when its version changes, because uploading a new apps zip over an existing install does not fire WordPress activation. The version marker ZDZ_APPS_VERSION had been left at 1.6.1 since that release, so on a 1.6.1 → 1.7.x in-place upgrade the marker still matched the stored value and the re-activation was silently skipped. ZDZ_APPS_VERSION now derives from the plugin's own Version: header, so it tracks every release and cannot drift again. Fresh installs were never affected (they run activation directly), and per-app database migrations were never affected (each guards itself on its own DB version).

Changed

• Declared PHP floor aligned to 8.0 everywhere (composer.json and both phpcs rulesets), to match the theme and apps Requires PHP: 8.0 headers.
• SECURITY.md supported-versions note corrected (Zorderz is past 1.0, not "pre-1.x").
• Apps bundle and theme move to 1.7.2 in lockstep.

Notes

• Full CI is required green on this release before merge (the standing bar).
• For everything the 1.7 line adds — Flow, Projects, Dot Plot, the update-estimate path, schedule inference, and the 502 fix — see the v1.7.0 release notes.

Zorderz v1.7.1 — display fix on the 1.7 workflow release

Zorderz v1.7.1 — display fix on the 1.7 workflow release

A point release over v1.7.0 — the workflow release (the Zdz_Flow spine and Projects, the Dot Plot app, the update-an-estimate path, schedule inference, and the reliability substrate that ends the worker-exhaustion 502s). 1.7.1 fixes a display bug found during live verification and brings the two artifacts back into version lockstep. No database, schema, or REST changes — a straight upgrade over 1.7.0.

Install / upgrade

Zorderz ships as two artifacts that upgrade together. Install or upgrade the theme first, then the apps — the ordering matters and is not enforced by WordPress.

1. zorderz-theme-1.7.1.zip — the platform kernel and Core services
2. zorderz-apps-1.7.1.zip — the 19-app bundle

Fixed

• Estimates widget rendered dark-on-dark. The Estimates widget styled its text with a --zdz-* CSS-variable namespace the theme never defines, so on the dark dashboard it fell back to hardcoded light-mode colors — the customer name, every line item and price, the typed textarea text, and the open/history cards were all near-invisible. Repointed to the theme's real --sys-* design tokens, so the widget is theme-aware across light, dark, sunlight, and system. Isolated to this one widget; every other app already used the correct tokens.

Changed

• Apps-bundle plugin header corrected to 19 apps (adds Dot Plot to the list) and moved to 1.7.1, in lockstep with the theme.

Notes

• Full CI is green on this release, and the published zips are the exact artifacts verified clean by the private tenant-data scan.
• For everything the 1.7 line adds — Flow, Projects, Dot Plot, the update-estimate path, schedule inference, and the 502 fix — see the v1.7.0 release notes.
• Verified live end to end on a fresh WordPress install before release.

Zorderz v1.7.0 — Flow, Projects, Dot Plot & the update-estimate path

Zorderz v1.7.0 — the workflow release

Ported the delta between the source app's V9.15 and V9.25.14 as four build waves, generalizing every tenant-specific value along the way so Core still names no business. Adds a workflow spine and the apps that ride on it, an update path for estimates, a schedule-inference service, and a visualization app — plus the reliability fix that ends the worker-exhaustion 502s.

Install / upgrade

Zorderz ships as two artifacts that upgrade together. Install or upgrade the theme first, then the apps — the ordering matters and is not enforced by WordPress.

1. zorderz-theme-1.7.0.zip — the platform kernel and Core services
2. zorderz-apps-1.7.0.zip — the 19-app bundle

Added

• Flow substrate + Projects. A workflow spine (Zdz_Flow) with a single state-writer, keyed references, logged dispositions and an event outbox. Every estimate becomes a trackable Project with a Record panel; a fresh install ships with no Projects data.
• Dot Plot (19th app) — plots work-item history from the Flow outbox, behind a report-spec validator and an Answer-Authority entitlement gate. Renders whatever sources a business registers; ships with none.
• Update an existing estimate — a two-phase preview→commit path with document-preservation, zero-regression and conflict guards, plus vision-on-update. With no billing provider connected, estimates still convert to trackable invoices.
• Schedule inference + handoff — an install-date resolver, a Schedule-Job intake, real participants from the Party roster and a CRON inference service that reads without writing.
• Geo/media location — a forward geocoder and a media-location classifier that expose only a categorical status to the client; coordinates never leave the server, and media serves through a token proxy.
• Reliability substrate — a request guard, service breaker and budgeted sweep that end the worker-exhaustion 502s; alias-tolerant passwordless login; one-click recovery of a lead that failed to reach the CRM; and a Vimeo chapter embed in messaging with the player origin hard-fixed.

Changed

• The Ai client is repaired and routed through the Model Registry (no vendor name in Core); every app now calls the one shared gateway instead of its own model client.
• Map links, address linkifying and the commission-coverage view are unified behind shared, generalized helpers.

Fixed

• Leads privacy gate. A generalization rename left a permission check pointing at a class that no longer exists, so it defaulted open — any viewer could see others' lead data and revenue in the dashboard. Corrected to the real permissions class.
• Activity telemetry (/track) returned 401. The front-end used navigator.sendBeacon, which cannot carry the REST nonce, so events were rejected. It now uses fetch({keepalive:true}) with the nonce and records correctly.

Notes

• Every value the waves touched is generalized: Core ships each one empty, and a business supplies its own through the Business Profile or an Identity Pack. Most new surfaces stay inert until configured.
• Theme and apps bundle move to 1.7.0 in lockstep.
• Full CI is green on this release — hypocrite-commit sentinel, unit tests (security invariants), PHP lint, PHP_CodeSniffer (security ruleset), WordPress-harness integration tests, and the build/packaging gate. The published zips are the exact artifacts verified clean by the private tenant-data scan.

Service Business Management Software: Zorderz 1.6.1 Hardens Security and Guards Contributions

A security release.

Zorderz 1.6.1 closes five hardening gaps found in a full security review and, because Zorderz is open source and takes outside contributions, adds an automated guardrail suite whose job is to stop a future "bug fix that is really an exploit" (the hypocrite commit pattern that hit xz utils in 2024) from ever landing. There are no behavior changes for legitimate users. Everything here either removes a way to leak or abuse data, or makes a security regression fail the build.

What got hardened: the Company Data export now excludes secrets three ways, by name, by suffix, and by redacting secret values wherever they are nested, so a credential can never travel in an export. Magic link OTP login takes the user id only from the server side and adds rate limiting keyed on the real client address. Non privileged KPI views strip revenue and fail closed. The knowledge app serves files with a nosniff header and a safe disposition. The kiosk PIN locks out after repeated wrong tries.

What guards the future: a hypocrite commit sentinel scans every pull request diff for the dangerous edits and fails the build, a security unit suite pins the invariants that must never regress (19 tests, 77 assertions), and branch protection on main now requires those checks and a code owner review before anything merges.

Lockstep release: Zorderz Core theme 1.6.1 and Zorderz Apps 1.6.1.

Full changelog: https://github.com/CarletonTorpin/Zorderz/blob/main/CHANGELOG.md

Service Business Management Software: Zorderz 1.6 Installs in One Upload

One upload to get started.

A first install used to take two files, the theme and then the apps. In 1.6 the theme carries the apps and installs and activates them for you, so a fresh install is a single upload. If a host will not let it write to the plugins folder, it falls back to a clear notice and the manual two artifact step, so nothing breaks.

Paired with the 1.5 Company Data export, setup is two moves: upload the theme, then import your one data file, and your whole business is back, the catalog, the roster, estimates and invoices, chats, the knowledge base, media, and your WordPress settings.

The agent install guide (docs/INSTALL-FOR-AI.md) and the README were rewritten around the one upload flow and the import fast path.

Lockstep release: Zorderz Core theme 1.6.0 and Zorderz Apps 1.6.0.

Full changelog: https://github.com/CarletonTorpin/Zorderz/blob/main/CHANGELOG.md

Zorderz 1.5.0

Zorderz 1.5.0

Comprehensive, frictionless data portability. A Company Data export now carries the two things it used to leave behind, so restoring onto a fresh install lands ready to use instead of needing a manual cleanup pass.

Media travels with the bundle. The export now includes the actual upload files, the originals and every generated thumbnail size, not just their database references. When media is present the download is a single .zip (the JSON bundle plus an uploads/ tree); with no media, or without ZipArchive on the server, it falls back to the plain .json. The import accepts either, extracts the files into wp-content/uploads, and the references resolve with no separate copy step. This closes the gap that left logos broken after a migration.

Portable WordPress settings travel too. A safe allowlist (site title, tagline, timezone, date and time formats, week start, and the permalink structure) is exported and applied on import, and permalinks take effect at once. Install-specific options (siteurl, home, upload paths) are deliberately excluded, and the import applies only allowlisted names, so a bundle can never repoint the new site at the old one. This removes the manual set-the-title, set-the-timezone, and set-the-permalinks steps.

The import keeps you logged in. Restoring the owner account used to invalidate the acting admin's session and bounce you to a login screen mid-import; the import now re-issues the auth cookie so the session simply continues.

The Ai client reports the real reason a call fails. A missing or invalid Poe key, or an unavailable model, previously surfaced as a blank "No response content." The client now names the actual reason (unset key, rejected key on HTTP 401 or 403, another HTTP error, or an empty model response) so a bad key is self-diagnosable.

All of this was verified end to end on a live install: an export carrying an image round-trips through an import that extracts the media (originals and thumbnails resolve), applies the settings, and keeps you logged in. Theme and apps move together to 1.5.0. Estimates ZEST 1.25.5 unchanged.

Install and upgrade order

Upload the theme zip first, then the apps zip. The order matters and is not enforced by WordPress.

Assets

zorderz-theme-1.5.0.zip is the theme (platform kernel plus Core services). zorderz-apps-1.5.0.zip is the apps bundle (18 apps).

Zorderz 1.4.3

Zorderz 1.4.3

Company Data Export and Import, plus a security and housekeeping pass. Rolls up 1.4.0 through 1.4.3.

The headline is a new capability: Company Data Export and Import (Tools -> Zorderz Data). A business can take all of its Zorderz data off one install as a single portable JSON file and restore it on another (a fresh WordPress plus Zorderz). The bundle carries settings and business profile, the Item Engine catalog, the user roster with roles and password hashes, every app custom table (estimates, invoices, knowledge, and the rest), media references, and Zorderz custom post types and taxonomies (Installation Receipts, Bug Reports, and the item subtypes with their term meta). Everything is discovered by name prefix, so new apps are covered automatically, and rows keep their primary keys so internal references stay valid on the fresh target. A dry run previews the restore counts before anything is written.

Connection credentials (Poe, FreshBooks, Nutshell, calendar OAuth) are never exported: they are removed by an option denylist, by scrubbing secret-named columns, and by skipping credential tables. Because password hashes travel so logins carry over to the new install, treat the downloaded bundle as sensitive.

This release also closes three issues an independent review of the staging install surfaced. Core Settings no longer renders credentials in the clear: the Poe key and the FreshBooks, Nutshell, and Review Bridge secrets were printed into the settings form as plain-text values, so they sat in the page HTML; those fields are now masked, and a normal Save keeps the stored value unless you type a new one. The Stock admin Dashboard, which denied access because its submenu registered before its parent menu existed, now loads. And the scheduler connections endpoint, which returned a bare 403 to an administrator while Connected Calendars is off, now returns 404, matching the intent that those routes behave as if they do not exist while the feature is off.

Theme and apps move together to 1.4.3 (Estimates ZEST 1.25.5, unchanged).

Install and upgrade order

Upload the theme zip first, then the apps zip. The order matters and is not enforced by WordPress.

Assets

zorderz-theme-1.4.3.zip is the theme (platform kernel plus Core services). zorderz-apps-1.4.3.zip is the apps bundle (18 apps).

Zorderz 1.3.6

Zorderz 1.3.6

Estimates reliability release, rolling up 1.3.4 through 1.3.6.

The Ai-assisted estimate text parse now runs synchronously and prices every line correctly. 1.3.4 briefly routed the text parse through a background job to dodge a managed-host gateway timeout, but on WP Engine that job returned an empty Ai response, so typing or dictating an estimate errored instead of showing a priced preview. A text parse finishes in a few seconds, well under the gateway timeout, so it never needed the background job. 1.3.5 restored the synchronous path (verified live), and 1.3.6 clears a leftover "Reading" status label that lingered above the finished preview.

The genuinely slow paths, photo parse and PDF import, stay asynchronous and are confirmed working. Front-end and docs only, no schema change. Theme and apps move together to 1.3.6 (Estimates ZEST 1.25.5).

Install and upgrade order

Upload the theme zip first, then the apps zip. The order matters and is not enforced by WordPress.

Assets

zorderz-theme-1.3.6.zip is the theme (platform kernel plus Core services). zorderz-apps-1.3.6.zip is the apps bundle (18 apps).