v1.6.3

Upgrading

• Guest clients need the code step. The bundled widget (0.12.3) already has it, and the [escalated_guest_create] form gains it in this release. Custom widget or API clients must call /verification and send verification_id and verification_code with tickets, chats and lookups.
• Guest links sent before this release (permanent guest_token) keep working while Legacy guest links is on under Settings (the default). Turn it off once guests have moved to expiring links. Live chat sessions still use the chat ticket's token as their id and are not affected.
• New table escalated_guest_verifications and ticket columns guest_access_hash and guest_access_expires_at, added by the normal schema upgrade.
• The Settings page no longer has Webhook URL and Secret fields. On upgrade an existing URL becomes a webhook subscribed to every event with the same secret, so receivers keep getting events. A URL set in the webhook_url setting from code is moved the same way when the next event fires.
• Webhooks are now sent a moment after the change, from WP-Cron, instead of during the request. Sites with WP-Cron disabled need a real cron calling wp-cron.php.
• NotificationService::send_webhook() now queues the event for every subscribed webhook and returns whether any delivery was queued.
• escalated_webhook_sent and escalated_webhook_failed receive the webhook row as an extra last argument.
• Webhook receivers get more events than before, including note.created for internal notes (id and author only). Ignore the names you do not handle.
• reply.agent_reply (staff replies only) is kept as a WordPress extension trigger.

Security

• Verified guest access, like escalated-laravel. See docs/guest-access.md.
  • Guests prove their mailbox with an emailed 8-digit code before they open a ticket (widget or [escalated_guest_create] form), start a chat, or look a ticket up. A code lasts 10 minutes, allows 5 guesses, works once, and is bound to the email and purpose. Only keyed digests are stored. Codes are limited to 3 an hour per mailbox per client IP and 10 an hour per mailbox.
  • New routes POST /widget/verification, POST /widget/lookup, POST /guest/verification and POST /guest/lookup.
  • Tickets get expiring, encrypted access grants (24 hours by default; the Guest link lifetime setting allows 5 minutes to 7 days). A new grant rotates the old one, and changing the guest email voids them. The widget status route takes the grant as Authorization: Bearer.
  • /widget/config now sends guest_verification_required: true and status_lookup_enabled: true, so the bundled widget shows its code step and Status tab.

Added

• Ticket merge, like escalated-laravel. The ticket screen has a Merge box. POST /tickets/{ref}/merge with {target_reference} and GET /tickets/merge-search?q= do the same over the API. Replies move to the target, both tickets get a system note, and the source is closed with the new merged_into_id column, in one transaction. Needs the escalated_ticket_merge capability. See the README.
• Webhook subscriptions under Escalated > Webhooks, like escalated-laravel: any number of webhooks, each with its own URL, signing secret, events and active switch, and a delivery log with a Retry button. See docs/webhooks.md.
  • Events are queued and sent from WP-Cron (Action Scheduler when installed), so a slow receiver no longer holds up ticket requests.
  • Failed deliveries are retried after 120 s and 240 s, then marked failed.
  • The URL must resolve only to public addresses. This is checked when a webhook is saved and again before every attempt; redirects are not followed and the connection is pinned to the checked address.
  • New tables escalated_webhooks and escalated_webhook_deliveries, created by the normal schema upgrade.
• Workflow admin. Escalated > Workflows creates, edits, enables, orders and deletes workflows, so the existing engine can be configured without code. REST routes under /admin/workflows (index, new, edit, create, update, toggle, reorder, delete) take the shared workflow admin contract's body and return 422 with errors on bad input. Both need escalated_automation_manage and are audited. See docs/workflows.md.
• Workflow conditions can use tags, hours_since_created and hours_since_updated, and add_note fills in {{field}} templates, as the contract says.

Changed

• One event vocabulary (escalated-developer-context ADR 2026-10-21-event-vocabulary). Webhooks and workflow triggers use the canonical names, the same as escalated-laravel. The list is in Escalated\Services\EventVocabulary.
  • The workflow tag trigger is ticket.tag_added (was ticket.tagged).
  • Workflows can now also run on ticket.tag_removed, ticket.unassigned, ticket.escalated, ticket.resolved, ticket.closed, note.created and the live chat events chat.started, chat.assigned, chat.message and chat.ended.
  • The webhook now also receives ticket.resolved, ticket.closed, ticket.reopened, ticket.escalated, ticket.priority_changed, ticket.tag_added, ticket.tag_removed, sla.warning (once per warning, not on every SLA cron run) and note.created. note.created carries the note's id and author, never its body.
• Legacy names still work when read. A workflow stored as ticket.tagged, ticket.replied, internal_note.added, ticket.untagged or another legacy name from the ADR runs on the canonical event. Workflow log rows record the canonical name.

Fixed

• Customers and guests see the replies on their ticket pages again. The public reply query filtered on a column that does not exist, so it returned nothing.
• The [escalated_guest_create] form posts guest_name / guest_email, which the handler did not read, so it always failed with "All fields are required". Both spellings are read now.
• A workflow whose actions fire its own trigger (a ticket.updated workflow that changes the priority) no longer runs itself without end. It runs once per event; other events still chain.

What's Changed

• Emit the canonical event vocabulary to webhooks and workflows by @mpge in #100
• Webhook subscriptions with a delivery log, retries and background sending by @mpge in #101
• Workflow admin: wp-admin screen and contract REST routes by @mpge in #102
• Verified guest access: emailed codes, expiring grants, verification and lookup routes by @mpge in #103
• Ticket merge by @mpge in #104
• chore(release): v1.6.3 by @mpge in #105

Full Changelog: v1.6.2...v1.6.3