0.4.0

Breaking: every core ability name is now prefixed with og- (e.g. plugins/list-plugins → og-plugins/list-plugins), and the Core categories are namespaced og-core-*. This frees the unprefixed names for official WordPress and third-party abilities. Pre-1.0, so there is no alias shim — consumers that stored ability names, including the MCP exposure allow-list, must re-select abilities under their new names.

New: multisite support. A policy decorator injects an optional blog_id into site-scoped abilities on multisite so a network admin can target a specific site, a new og-users/list-my-sites ability discovers the sites a user can act on, and non-site abilities declare their scope so the decorator leaves them alone. The catalog is now 231 abilities.

Changed:

• The MCP knowledge tool now reads file-based OKF bundles (markdown with YAML frontmatter) under includes/knowledge/ instead of bundled PHP recipe classes. The add-on filter is now abilities_catalog_mcp_knowledge, carrying scanned KnowledgeBundle objects.
• Better blind search in the MCP search server — tokens are stemmed and weighted by IDF, content abilities carry search keywords, and search is oriented with category examples plus a no-match map. Unknown-ability errors name the domain's owned prefixes to steer recovery.
• The Settings → MCP Server exposure page groups abilities by category with an improved UX, and the observability handler is now filterable.

Fixes: og-content/get-post exposes featured_media; search-server list results are wrapped consistently.

Shipped knowledge concepts are English-only (the files are not translated).