Development

Development

Requirements

• PHP 7.4 or newer
• zip
• shellcheck for the shell-script check
• A WordPress 6.5+ HTTPS site with OpenStation for manual hub testing
• A separate public HTTPS WordPress site for end-to-end connection testing

The plugin has no Composer, npm, JavaScript, custom database, or hosted-service dependency.

Repository layout

fleet-for-openstation.php
includes/class-fleet-for-openstation.php
uninstall.php
readme.txt
tests/smoke.php
bin/build.sh

• fleet-for-openstation.php contains the WordPress plugin header and bootstrap.
• includes/class-fleet-for-openstation.php contains the UI and orchestration.
• uninstall.php removes local Fleet user metadata.
• tests/smoke.php is a framework-free check for URL validation, plugin-state inspection, credential encryption, REST URL construction, and hub self-detection.
• bin/build.sh lints PHP, runs the smoke check, and builds the installable ZIP.

Build and test

./bin/build.sh
shellcheck bin/build.sh

The package is written to dist/fleet-for-openstation.zip. The ZIP intentionally contains only runtime files:

fleet-for-openstation/
  fleet-for-openstation.php
  includes/class-fleet-for-openstation.php
  uninstall.php
  readme.txt
  LICENSE

GitHub Actions runs the build under PHP 7.4 and PHP 8.3 and uploads the package from the PHP 8.3 job.

Manual acceptance pass

Use two different HTTPS WordPress installations.

1. Install OpenStation and Fleet on the hub.
2. Confirm the Fleet page identifies the hub.
3. Connect the managed site and approve the named Application Password.
4. Confirm the site appears with the approving username.
5. Test missing, inactive, and active OpenStation states.
6. Install OpenStation and confirm the managed site's plugin state changes.
7. Refresh status from Fleet.
8. Disconnect and confirm the Application Password disappears from the managed user's profile.
9. Test rejection, expiry, insufficient capability, stripped authorization headers, and an unreachable site.
10. Confirm the hub cannot connect to itself and that a path-based multisite sibling can connect.

Contribution rules

• Prefer WordPress Core features over new infrastructure.
• Keep credentials per user and encrypted at rest.
• Never log credentials or authorization headers.
• Keep unsafe-URL rejection and the public-HTTPS boundary intact.
• Treat the managed site's WordPress capabilities as authoritative.
• Do not add a custom REST route, database table, JavaScript application, dependency, abstraction, or background worker without a concrete workflow that Core cannot cover.
• Run ./bin/build.sh after every implementation change.

Release checklist

1. Update the plugin header, readme.txt, and release notes to the same version.
2. Run the build and shell check.
3. Complete the manual two-site acceptance pass.
4. Inspect the ZIP contents and test a clean WordPress upload.
5. Tag the verified commit.
6. Attach dist/fleet-for-openstation.zip to the GitHub release.