v1.9.5 — expose suite/get-status via show_in_rest

abilities-for-ai v1.9.5. Fix: suite/get-status now carries show_in_rest in its meta block so the MCP server can reach it — previously returned -32008 not-exposed despite mcp.public=true (#169). Library-wide audit confirmed it was the only ability with the defect. readme.txt Stable tag aligned to 1.9.5. One-line meta fix; no logic/schema/permission change. See CHANGELOG.md [1.9.5].

Abilities for AI v1.9.4 — README rewrite + constant alignment

Documentation update — README rewrite for four-layer permissions framing + v1.9.3 save-isolation surface + Wordpressnaut welcome. Code unchanged from v1.9.3 except for a single corrective constant alignment (see Corrections below).

Closes #163 via #164.

What's in this release

• README rewritten end-to-end:
  • PHP version requirement corrected from 8.0+ to 8.1+ (matches composer.json require.php and plugin header Requires PHP set in v1.9.1)
  • Four-layer permissions model section added — names the four layers (Abilities for AI module · WordPress capability · OAuth scope · unclear); points operators at the runtime [ability_disabled] error as the layer indicator; names this plugin as the layer that runs the module-permission check
  • Permissions UI save isolation documented (the #153 fix shipped in v1.9.3) — operators benefit from knowing that toggling a single module no longer wipes other modules' state, and per-blog isolation continues to apply on multisite
  • Paired ability classes architecture pattern documented — compact-vs-full pairs across list (content-list-structure ↔ content-list) and get (content-get-text ↔ content-get)
  • Bridge install commands updated — recommended paths are .mcpb for Claude Desktop and npm install -g @wickedevolutions/abilities-mcp for terminal MCP clients (replaces the prior npx pointer)
  • Welcome block at top with Wordpressnaut spaceship paragraph + 3 URL pointers
  • Disclaimer from J at the very top
  • Pointer to PRINCIPLES.md as the Official WordPress Compatibility Contract binding all four suite repos
• Security Model section reframed to lean into the four-layer model and explicitly mention v1.9.3's per-module save isolation

Corrections

ABILITIES_FOR_AI_VERSION constant in abilities-for-ai.php was set to '1.9.2' while the plugin header had been bumped to 1.9.3 in the v1.9.3 release — drift between the header and the runtime constant. The constant is the value reported through suite/get-status and to AI clients querying runtime version. v1.9.4 corrects this drift by setting the constant to '1.9.4' to align with the plugin header (skipping '1.9.3' since that intermediate value would just be re-corrected immediately).

Release-checklist item to add: bump both plugin header Version: and ABILITIES_FOR_AI_VERSION constant in the same change going forward.

Install

Download abilities-for-ai-1.9.4.zip below and upload via WP Admin → Plugins → Add New → Upload Plugin. Or, from the community store.

Verification

• sha256: 24c3feeaf85df98f618ada9930e64aa5fcdc9103bfbe7eb8cdd3f8325d7506e0
• 182 files, 807 KB packed (same file count as v1.9.3 — README + CHANGELOG + version constants differ; admin/kl/ built assets unchanged)

Companion releases

• abilities-mcp v1.6.1 (bridge — README rewrite + npm publish)
• abilities-mcp-adapter v1.4.7 (adapter — README rewrite)
• abilities-for-fluent-plugins v1.1.1 (next: v1.1.2 README rewrite incoming)

Abilities for AI v1.9.3 — Permissions UI save isolation + per-blog gate

Welcome, Wordpressnaut

Here is the spaceship, now you'll have to learn how to fly and please do remember, humans make mistakes, humans created AI so AI makes mistakes. Learning to fly is your job and to do that you'll need structure, systems, checklists, principles and understanding you stand before a magical leap of a steep and wonderful learning curve. Be patient and do backup things.

→ Knowledge layer (deeper traversal): https://knowledge.wickedevolutions.com
→ https://wickedevolutions.com
→ https://abilitiesforai.io

---

What changed

Fixed

• #153 — Permissions UI save now isolates to submitted modules. The explorer form posted to options.php, and abilities_for_ai_sanitize_permissions() rebuilt the entire option from form input — so any module not visible in the current filter was treated as unchecked and silently disabled. On wickedevolutions a save intended to enable cron.delete disabled settings.read, filesystem.read, plugins.read, users.read, diagnostic.read, and content.read. The same save surface also rendered every ability's full input_schema / output_schema inline, triggering a 512 MB allocation OOM mid-save. Replaced with a plugin-owned admin-post handler (admin_post_abilities_for_ai_save_permissions + network_admin_post_* mirror) that loads the existing option and patches only the modules submitted in this save — untouched modules remain byte-identical. Per-ability overrides are scoped the same way. Heavyweight schema bodies are no longer pre-rendered as part of the permissions surface; schemas remain available via mcp-adapter-get-ability-info and GET /wp-json/wp-abilities/v1/abilities/{name}. Capability + nonce checks preserve prior authorization semantics (manage_options site admin / manage_network_options network admin). 11 regression tests in tests/Unit/PermissionsPatchTest.php.

Notes

• Four-layer permissions model. Abilities for AI module permissions are an independent per-blog gate alongside OAuth scope, WordPress capability, and the unclear case. A granted OAuth scope is necessary but not sufficient to execute an ability — Abilities for AI's module permission settings (configured at Abilities for AI → Permissions in wp-admin, stored per-blog on multisite in wp_abilities_suite_permissions) gate execution independently. If a module's read/write/delete tier is disabled there, an OAuth-scope-bearing token receives [ability_disabled] 403 errors with explicit operator remediation guidance. The two gates apply together by design (Principle 5 — Permissions Stay Layered). The admin-post handler shipped in this release preserves the same two-gate model — saving permissions on a single module no longer wipes other modules' state, and per-blog isolation continues to apply on multisite.

Verification

• sha256: 98060262a3f5e66a2702a0b981be7ea341ffe085baba538b0c0d3ae51d05b40f
• Install: WP Admin → Plugins → Add New → Upload Plugin → abilities-for-ai-1.9.3.zip

Companion releases

• abilities-mcp v1.6.0
• abilities-mcp-adapter v1.4.6
• abilities-for-fluent-plugins v1.1.1

v1.9.1 — Stretch to Stable

Stretch-to-Stable post-alpha stabilization release. Two schema-correctness fixes that close a class of Anthropic API tool-registration rejection, plus a cross-cutting CI validator that protects every future ability from the same class of bug. Companion releases: abilities-mcp-adapter v1.4.4, abilities-mcp v1.5.1.

Bug — High

• #134: presto-player/update-setting value property used array-form type. The input_schema for the SureCart-adjacent update-setting ability declared 'type' => array( 'string', 'integer', 'boolean' ) on the value property — accepted by raw JSON Schema draft 2020-12 but rejected by the Anthropic API's stricter tool-catalog profile. Submitting a tool catalog containing this schema returned a 400 invalid_request_error from tools/list, and the entire catalog was dropped — every WordPress ability went dark for any client backed by the Anthropic API. Fixed by switching the value property to oneOf with single-typed branches per the issue body's preferred shape; the union semantics are preserved without violating Anthropic-strict. (#134, PR #137)
• #135: Registrar::register() default input_schema fallback emitted empty PHP array. When an ability was registered without an explicit input_schema (every no-arg read ability uses the default), the fallback $config['input_schema'] ?? array() produced {}, which the MCP adapter wrapped into { "type": "object", "properties": {} } downstream — the empty-properties shape Anthropic-strict rejects. Fixed structurally at src/Core/Registrar.php line 168: the fallback now emits array( 'type' => 'object' ), matching the canonical CLAUDE.md PHP rule about omitting properties for no-arg abilities. Single-line production change retroactively unblocks every no-arg ability across every suite without per-ability overrides; future no-arg abilities inherit the safe default by construction. New RegistrarTest::test_no_arg_ability_default_schema_omits_properties asserts the registered shape. (#135, PR #139)

Test infra

• Anthropic-strict draft 2020-12 validator shipped (cross-cutting deliverable from #134). New tests/Unit/InputSchemaDraft202012Test.php walks every registered ability's input_schema, parses it with opis/json-schema against the draft 2020-12 meta-schema, then layers an explicit Anthropic-strict lint on top — the lint catches the two rules the meta-schema permits but the Anthropic API rejects: array-form type (#134) and empty properties: {} on type: object (#135). Discovery is via PHP source-text extraction so the gate runs in the existing Unit suite without WP_TESTS_DIR. The validator is permanent CI infrastructure: every future ability gets the same gate without per-ability work. Class-level docstring documents the profile by name and the raw-2020-12-vs-Anthropic distinction so a future contributor reading the test understands why the lint goes beyond the meta-schema. New composer.json require-dev: opis/json-schema:^2.3. (PR #137)

CI

• PHP 8.0 dropped from CI matrix; PHP 8.5 added. PHPUnit 10's transitive dev-dependencies pinned in composer.lock require PHP >=8.1, so the 8.0 matrix entry had been failing on main since PHPUnit was bumped. Matrix is now ['8.1', '8.2', '8.3', '8.5']. Plugin header Requires PHP and composer.json require.php aligned to 8.1. Pre-C.1 housekeeping that unblocked Phase C's CI. (PR #138)

Notes

• Discovered during this sprint and filed for v1.9.2: #136 — cache/flush-page-cache output_schema declares array-form type (same bug class as #134, but in output_schema rather than input_schema; the validator currently walks input_schema only). #140 — strict validator's source-walk discovery skips abilities whose registration omits input_schema entirely, so the Registrar runtime default (now array( 'type' => 'object' )) is structurally invisible to the validator; the unit test on the Registrar carries the load-bearing proof for that path. Both are out of scope for v1.9.1 per the sprint plan's scope-boundary rule.

v1.9.0 — Public Alpha: Boundary Activity Logging

Public alpha hardening sprint — DB-1 component.

What's new

Boundary activity logging. A new sister table kl_boundary and writer BoundaryEventLogger capture protocol-level events (session init/terminate, auth denied, transport errors, rate-limit hits, settings audit changes) that were previously invisible to operators.

Activity admin tab. WP Admin → Tools → Activity now has a tab toggle for "Ability executions / Boundary events / Both" with UNION-paginated timeline view.

Settings audit events recorded. Master toggle changes, redaction keyword adjustments, per-ability exemption changes, and confirmation-flow failures all land in kl_boundary as info or warn severity.

HelpersTest aligned with Answer A posture. Test assertions updated to match the actual code defaults: filesystem-write and cron-write stay ON for the public alpha. The alpha trusts early users to know what they're doing; visibility is the safety surface.

Companion releases (this is one of three)

• abilities-mcp-adapter v1.4.0 — redaction filter, settings UI, rate limiter, Origin/CORS, minimal SSE stub
• abilities-mcp v1.4.0 — .mcpb distribution bundle + env-var config fallback

Verified

• 14/14 BoundaryEventLogger unit tests passing
• Live deployment validated on wickedevolutions.com multisite (4 subsites)
• 19 critical-path acceptance tests passing on the integrated build
• GPT 5.5 reviewed and authorised for code-side launch

Closes

• #131 (boundary log research)
• #132 (kl_boundary writer dev brief)

v1.7.1

Fixed

• Multisite permissions self-heal: Sites where the abilities_for_ai_permissions option was never seeded (missed activation hook, file-copy deploy, or subsites created during edge conditions) now auto-seed defaults on first ability call. Prevents silent delete: false on subsites that appear fully enabled in the UI on other sites.

Upgrade notes

Drop-in replacement for v1.7.0. No breaking changes. Multisite subsites with missing permissions will self-heal transparently on first use.

Abilities for AI v1.7.0

v1.7.0 Bug Fix Sprint

6 fixes across core, Astra suite, and Presto Player suite. All verified on production.

Fixed

• #46 Implemented astra_abilities_map_input_to_meta() — Astra Custom Layout create/update now maps meta correctly
• #53 theme/update-asset auto-detects file type from extension (asset_type now optional)
• #52 presto-player/create-video works with Presto Player's model API
• #50 Permission error messages now include module name and settings path for easy resolution
• #49 cron/list-events handles large payloads with pagination and type guards
• #70 Knowledge Layer seed_tags() runs on existing sites that missed the migration

Closed (not a bug)

• #47 astra/update-cpt-layout-defaults is fully implemented — was a false positive from testing without Astra active

Install

Download the zip below and upload via Plugins > Add New > Upload Plugin.

Or install from the Wicked Evolutions store.

Abilities for AI v1.6.1

What's New in v1.6.1

• GitHub Releases auto-update — users who install from GitHub now get update notifications in wp-admin without needing a FluentCart license
• Updated product page URLs and install documentation

See v1.6.0 release for the full feature list (Knowledge Layer Admin UI, filesystem abilities, Block API v2).

Install

Download the zip below and upload via Plugins > Add New > Upload Plugin in WordPress admin.

Or install from the Wicked Evolutions store for automatic updates.

Abilities for AI v1.6.0

What's New

• Knowledge Layer Admin UI — Vue SPA with documents, sessions, observations, tags, and dashboard views
• Knowledge Layer infrastructure — Tag models, FULLTEXT search, REST controllers, publish flow pipeline
• Filesystem abilities — filesystem/create-directory and filesystem/write-binary
• Block API v2 — 6 nested block abilities for advanced Gutenberg manipulation
• content/duplicate — duplicate any post, page, or CPT
• theme/enqueue-asset — load CSS/JS without PHP file writes
• content/append — simplified string-only API

Install

Download the zip below and upload via Plugins > Add New > Upload Plugin in WordPress admin.

Or install from the Wicked Evolutions store for automatic updates.

Requirements

• WordPress 6.9+
• PHP 8.0+
• Abilities MCP Adapter plugin
• Abilities MCP bridge