Add CLAUDE.md with codebase orientation for AI assistants

[Shubochandrosarker]

Summary

Adds a CLAUDE.md at the repository root: a single orientation document for AI assistants (and new contributors) covering the plugin's structure, its development workflows, and the conventions that aren't discoverable from any one file.

There was no existing CLAUDE.md, so this is a new file. Nothing else in the repository changes.

What it documents

Commands and CI. composer install + vendor/bin/phpunit -c phpunit.xml, plus the exact php -l and node --check invocations CI runs. Notes that composer test aborts under root (Composer refuses to load plugins as super-user) and that the phpcs job is advisory and always exits 0 — so a green phpcs proves nothing.

Layout. A directory map of includes/ (database, rest, admin, frontend, waivers, integrations, payments, corporate, cli, utilities), assets/, templates/, docs/, and tests/.

The parts that silently break work:

• No autoloader. Plugin::load_dependencies() is a hand-ordered require_once array of ~70 files; a new class is inert until it's added there.
• Schema changes need three coordinated edits — Schema::create_tables(), an idempotent migration returning true, and a MEMBERISTIC_DB_VERSION bump with registration in Migrations::migrations().
• Settings are one array option read through memberistic_get_setting(), with Stripe secrets lockable by wp-config.php constants and never returned in plain text over REST.
• REST: memberistic/v1, mandatory permission_callback, __return_true banned, and why pii_permissions_check() is deliberately narrower than the admin check. Webhooks authenticate by signature before parsing.
• Capabilities, not roles — and that a new capability must also be granted to administrator.
• Admin JS is vanilla wp.element with no JSX and no build output; conditional per-screen enqueueing and the window.memberistic*Settings handoff. Frontend assets load only on pages that need them, so a new shortcode needs adding to that list.
• Integrations default off, and the fresh-install-makes-no-outbound-request property to preserve.
• Template override resolution and its path validation, the Scheduler cron hooks, and the four WP-CLI commands.

Guard tests. FreshInstallDefaultsTest and PmproRemovalTest assert against the source files rather than behaviour, and will fail a change that reintroduces seeded plans, partner branding, or a PMPro dependency. Also explains that tests/bootstrap.php runs with no live WordPress and loads only two production files, so testing anything else means extending the stubs.

Code style. WordPress Coding Standards (tabs, Yoda, array()), the sanitize/escape/nonce helpers, i18n requirements, and the codebase's most distinctive habit — comments that explain the reasoning and the failure mode avoided, not the mechanics.

Release checklist. The version string lives in five places and CI checks none of them.

Doc sync table. Which of docs/HOOKS.md, docs/INTEGRATIONS.md, docs/entitlements.md, README.md, CHANGELOG.md, and readme.txt a given kind of change is expected to update.

Verification

• vendor/bin/phpunit -c phpunit.xml — OK (47 tests, 831 assertions)
• Every claim was checked against the source rather than inferred: the require list in class-plugin.php, Migrations/Schema, Capabilities, REST_Controller, Integrations_Registry, Scheduler, helpers.php, the CLI registrations, and both guard tests.
• Markdown only — no PHP or JS touched, so the lint jobs are unaffected.

---

Generated by Claude Code