v1.32.0 — operator rules enforced on Elementor writes

1.32.0 — operator rules enforced on Elementor writes

• New (governance): operator rules are enforced on Elementor writes (Aura P4.1, plan 3 of 4). An operator's rule in Aura — block or warn on a page/post by id or a freeze of the whole site — is pushed to SiteAgent, and this plugin now asks SiteAgent's matcher before every governed write. Elementor saves through its own paths rather than /wp/v2/posts, which is why SiteAgent's own core-REST enforcement could not cover them and this plugin needs its own point.
  • Rules decide before anything is written or snapshotted. Inside a governed run the order is grant → rules → snapshot → write: a block returns aura_rule_blocked (403) naming the rule and its reason, with nothing executed and no snapshot taken. A create-style tool is refused before its callback runs, so it cannot insert a draft and then be told no.
  • What a write declares — declared per ability, default create. Each ability declares meta.governance.writes: 'edit' or 'create' (or omits the key, which is 'create', fail closed); an 'edit' ability declares the input post id as both post:<id> and page:<id> (an operator does not know which one "checkout" is); a 'create' ability declares the whole site (site:*) until the new id exists, PLUS the input post id's own touches when one is present — an ability like save-as-template reads a source post id and inserts a new template, and inferring "edit" from that source id's mere presence (fixed in a later patch of this release) let a site freeze catch the write only after the insert had already happened. Design-token and global-class writes declare the whole site the same way, via meta.governance.scope.
  • A rule outranks an approval. A valid grant does not bypass a block; the refusal says "approval does not override a rule; release the rule first".
  • warn proceeds and the outcome carries warnings: [{rule, reason}], once per rule — on an array result as a key, on an error (the write failed after the warn) in its data, on a scalar by wrapping it as { value, warnings }.
  • Previews are exempt — a dry run writes nothing; rules block execution, not sight.
  • Nothing is re-implemented here. Matching, the signed ruleset, expiry and the forensic hooks (aura_worker_rule_blocked / aura_worker_rule_warned) stay in SiteAgent; this plugin only declares and translates. Without SiteAgent there are no rules and no policy — and a SiteAgent that is installed but cannot evaluate rules refuses the write (aura_rules_unavailable, 503) rather than lifting a block it cannot see.
• New: server-info reports rules — rules: { enforced, source, state: absent|outdated|incomplete|ready, ruleset: { seq, rule_count, received_at } | null, points } — and says in plain words when a fork-only site enforces none, when an outdated SiteAgent (has the snapshot engine, predates 2.10.0's rules engine) needs updating rather than installing, or when an incomplete SiteAgent is refusing every write.

Pull requests: #63 (rules bridge), #62 (WP 7.1), #61 (plugin ZIP). Pairs with SiteAgent ≥ 2.10.2 and Aura P4.1.

Full Changelog: v1.31.0...v1.32.0