fix: prepare WordPress.org release package

[chubes4]

Preparatory Status

This PR prepares Data Machine for a future WordPress.org 1.0 candidate. It does not release, tag, deploy, submit, or complete #2424. Homeboy remains responsible for future 1.0 version and changelog mutation.

Refs #2424.
Refs #3357.
Fixes #3376.
Fixes #3377.

Summary

• Prune tests, fixtures, development configuration, unused stubs, and unused dependency trees from the supported Homeboy release package.
• Preserve integrated origin/main behavior while fixing the missing processed-items ability path without triggering WordPress incorrect-usage notices.
• Exclude retained runtime evidence from production ZIPs through .buildignore.
• Inventory bundled licenses and remove unused @tanstack/react-query-devtools.
• Add a WordPress.org SVN checklist, exact ZIP assertions, and package-hash-bound Plugin Check warning evidence.

Exact Candidate

• Head commit: 6c9378e3726734a2a5a51f12ce898fab380ce52e
• Current preparatory version: 0.175.20
• Build path: build/data-machine.zip
• SHA256: fb0f4164717d6f8519b4aadc57cf3e8111f4f97144e7788c188a47fd22941558
• Exact size: 4,470,929 bytes
• Exact inventory: 2,123 entries under one data-machine/ root
• Runtime requirement: managed WP Codebox >=0.23.4

Package Verification

DATAMACHINE_PACKAGE_ZIP=build/data-machine.zip php tests/plugin-check-error-cleanup-smoke.php passed all 20 assertions. The exact package contains no:

• test, fixture, __tests__, or bundled Agents API stub trees
• PHPUnit, PHPStan, PHPCS, or Psalm development configuration
• nested ZIP, PHAR, TAR, or GZ archives
• .git, .github, .datamachine, artifacts, node_modules, or docs trees
• host-private operator paths or credential signatures

The retained runtime evidence that exposed #3377 remains outside the package. Public project provenance and functional WordPress/Playground loopback behavior are not classified as private operator data.

Plugin Check

Managed WP Codebox 0.23.4 installed the exact extracted ZIP on WordPress 7.1 and ran wordpress.plugin-check read-only:

• Exit code: 0
• Errors: 0
• Warnings: 222
• Notices/info/unknown: 0

Warning classes:

• PluginCheck.Security.DirectDB.UnescapedDBParameter: 83
• WordPress.DB.DirectDatabaseQuery.NoCaching: 60
• WordPress.DB.DirectDatabaseQuery.DirectQuery: 40
• WordPress.DB.DirectDatabaseQuery.SchemaChange: 39

docs/plugin-check-wordpress-org-candidate.json is bound to SHA256 fb0f4164…41558 and matches all 83 unescaped-parameter locations exactly. No warning is hidden, suppressed package-wide, or autoformatted away.

Runtime Evidence

• WordPress 7.1 clean single-site activation: passed; Data Machine 0.175.20 moved inactive to active with no diagnostics or errors.
• WordPress 6.9 requirement guard: passed; plugin remained inactive with plugin_wp_incompatible and no fatal error.
• Runtime-backed multisite gate: passed with managed WP Codebox 0.23.4.
• Network activation: passed; data-machine/data-machine.php became network-active.
• Two-site bootstrap: passed; sites 1 and 2 each reported version 0.175.20, network_active=true, and bootstrapped=true.
• Browser probe: passed no-page-errors; console and error logs were empty.
• Browser screenshot SHA256: d413bea6092dbf4b588b0dc6fa9db4634cc97c1235ade39eb3aad083085a6320.
• Multisite artifact bundle: valid with zero integrity violations; digest 4be19f384018eaa51af18d0d1d8278050a35ea0c73764b76a7370b413dbd7629.

Quality Evidence

• Focused missing-ability endpoint suite: 5/5 passed.
• Complete managed SQLite suite: 1,507 total, 1,478 passed, 29 skipped, 0 failed.
• Homeboy build: passed frontend compilation, production Composer install, PHP syntax, structure validation, and exact ZIP creation.
• Exact Plugin Check: passed with 0 errors.
• Full local lint normalized 0 findings but Homeboy 0.355.1 incorrectly converted unreadable unrelated /proc entries into an infrastructure failure; tracked upstream as fix: prevent unreadable proc entries from failing clean lint runs homeboy#13318.
• A nominally read-only refactor probe attempted source formatting without --write; its accidental edits were fully restored and the Homeboy bug is tracked as fix: keep read-only refactor runs from mutating source files homeboy#13317. No autofix output is included in this PR.
• Authoritative GitHub candidate audit, lint, refactor, and all four MySQL test shards are green on this pushed head.

Remaining #2424 Gates

• Exact 1.0 release bytes do not exist; this 0.175.20 package is preparatory evidence only.
• Maintainer-approved WordPress.org directory artwork is still required in SVN top-level assets/.
• Release automation must rebuild the exact 1.0 package and rerun all hash-bound gates before Prepare Data Machine for WordPress.org plugin directory submission after 1.0 #2424 can close.

No tag, release, deployment, merge, production modification, WordPress.org submission, SVN commit, version bump, or changelog edit occurred.

AI Assistance

• Model: GPT-5.6 Sol
• Tool: OpenCode
• Used for: package audit, narrow fixes, exact runtime certification, and evidence capture. Chris Huber remains responsible for every line.

[chubes4]

Blocking corrections before merge:

• Restore suppress_filters => false in BlocksCommand::bulkQueryArgs(). Removing it changes destructive bulk-repair inventory semantics on filtered installs. Retain it with a narrow Plugin Check/PHPCS justification rather than changing behavior.
• Correct THIRD-PARTY-NOTICES.txt: browser dependencies are not all permissive. Explicitly account for GPL @extrachill/chat and WordPress packages plus permissive components and source/license locations.
• Extend package pruning to remove shipped vendor development configs (phpstan.neon.dist, psalm.xml, phpcs.xml.dist) and unused vendor/wordpress/agents-api/stubs/, then assert the resulting ZIP inventory rather than only ignore literals.
• Narrow the claim that no Extra Chill names remain: package names/provenance are acceptable; the gate is no private domains, identities, endpoints, or runtime assumptions.
• Preserve the exact Plugin Check report for all 84 unescaped-parameter warnings as evidence.

Do not manually mutate 1.0 versions. This PR is preparatory; #2424 remains open until release automation builds the exact 1.0.0 bytes and reruns hash, Plugin Check, network activation, full lint, and artwork gates.

[chubes4]

Blocking review corrections are addressed in new commit 15cb8bcb2:

• restored suppress_filters => false with a narrow justified sniff suppression and behavior coverage
• corrected GPL/permissive browser dependency notices, including @extrachill/chat and externalized WordPress packages
• pruned and ZIP-asserted vendor analysis configs and unused Agents API stubs
• preserved a package-hash-bound map of all 84 unescaped-parameter warnings
• narrowed private-runtime scan claims and made the checklist/PR explicitly preparatory

Corrected candidate: SHA256 99bb77b18bd06e3e80befee215973ba922d199d86027b8e53b8e2792d86d9049, 2,123 entries, 4,470,596 bytes. Plugin Check passes with 0 errors / 223 documented warnings; activation, requirement guard, build, tests, and changed-file lint pass. #2424 remains open on exact 1.0.0 bytes, network activation, 168-finding full lint, and approved artwork.

[chubes4]

One remaining semantic correction: WordPress applies query filters when suppress_filters is false. origin/main used true; restore suppress_filters => true in the destructive bulk-repair query and correct the smoke/comment accordingly. Also @tanstack/react-query-devtools appears declared but unused and is not compiled into assets; remove the production dependency/lock entry if confirmed by source/build search, otherwise describe it accurately as declared but not bundled.

[chubes4]

Final review correction is in new commit 7268d1c4a.

• restored the exact origin/main value suppress_filters => true
• retained the narrow justified Plugin Check/PHPCS suppression
• corrected source and reflection assertions to require true
• confirmed React Query Devtools had no source import or generated bundle output
• removed @tanstack/react-query-devtools and its transitive Devtools package from package.json / package-lock.json
• removed the unused dependency from THIRD-PARTY-NOTICES.txt

Rebuilt exact ZIP: SHA256 e65dac886a6ee35db0003bb923b9a5779003e1e3b3bfb57b8cfecfee7c544073, 2,123 entries, 4,470,570 bytes. Plugin Check passes with 0 errors / 223 documented warnings; exact activation and requirement guard pass; full tests pass 1,472 / 28 skipped / 0 failed; build and changed-file lint pass. PR body and the hash-bound 84-warning map were updated.

[chubes4]

Runtime-backed multisite gate remains blocked upstream

Retested PR #3361 head 7268d1c4a and exact package SHA256 e65dac886a6ee35db0003bb923b9a5779003e1e3b3bfb57b8cfecfee7c544073 through the supported current boundary:

wp-codebox run-fuzz-suite \
  --input-file .multisite-2424-workload.json \
  --format=json \
  --runner-mode=runtime-backed \
  --artifacts .multisite-2424-evidence

The dry run passes and resolves Blueprint enableMultisite, the readonly exact-package mount, network activation, two WP-CLI site bootstraps, and browser screenshot capture. The real runtime still fails before its first workload command with:

Error when executing the blueprint step #2: The current host is 127.0.0.1:56491, but WordPress multisites do not support custom ports.

Retained evidence:

• run run_5ab46731e85549e0976c34715c7481b1
• runtime runtime-mt6oqx3t-u38ffj
• .multisite-2424-evidence/manifest.json
• .multisite-2424-evidence/recipe-run-effective-recipe.json
• .multisite-2424-evidence/recipe-run-failure-diagnostics.json
• WP Codebox binary SHA256 fc817440b6efe83f8358a223dbdf46def4bf23d5c5db4e71fa1e7f1762ad76c0

Tracked upstream as Automattic/wp-codebox#2342: Automattic/wp-codebox#2342

No Data Machine package command ran, so this is not a package failure and no source change was made. Network activation/two-site bootstrap/screenshot evidence remain blocked until the upstream runtime-backed path actually applies #2316's portless URL normalization.

[chubes4]

Runtime-backed multisite package gate: passed

Retested PR #3361 head 7268d1c4a and exact package SHA256 e65dac886a6ee35db0003bb923b9a5779003e1e3b3bfb57b8cfecfee7c544073 with managed WP Codebox 0.23.4 at c3385816 through run-fuzz-suite --runner-mode=runtime-backed and Blueprint enableMultisite.

Green evidence:

• run run_3d30cd7dbbdc4739945b706538438a49
• runtime runtime-mt6pijnw-dlerex
• artifact bundle digest 4be19f384018eaa51af18d0d1d8278050a35ea0c73764b76a7370b413dbd7629
• retained bundle .multisite-2424-evidence-managed-0234-green2/runtime-mt6pijnw-dlerex/
• artifact verification: valid, zero violations
• wordpress.plugin-state: multisite true, requested network true, network activation supported, data-machine/data-machine.php network-active
• site 2 created at http://127.0.0.1/second/
• site 1: Data Machine 0.175.18, network_active=true, bootstrapped=true
• site 2: Data Machine 0.175.18, network_active=true, bootstrapped=true
• browser probe: exit 0, no-page-errors passed, console/errors empty
• screenshot files/browser/screenshot.png, SHA256 d413bea6092dbf4b588b0dc6fa9db4634cc97c1235ade39eb3aad083085a6320

Automattic/wp-codebox#2342 was closed as stale installed-runtime distribution skew: the installed public binary is 0.21.0, while current managed 0.23.4 contains #2316 and passes. The release runner must use WP Codebox >=0.23.4. The multisite package blocker is removed; exact 1.0.0 release bytes, full lint, and approved artwork remain open gates.

[chubes4]

Final exact-candidate recertification for head 6c9378e37:

• ZIP: fb0f4164717d6f8519b4aadc57cf3e8111f4f97144e7788c188a47fd22941558, 4,470,929 bytes, 2,123 entries
• Exact inventory: all 20 assertions passed; no retained runtime artifacts, forbidden development paths, nested archives, host-private operator paths, or credential signatures
• Plugin Check on WordPress 7.1 / WP Codebox 0.23.4: 0 errors, 222 documented warnings; all 83 unescaped-parameter locations match the hash-bound JSON
• Single-site activation: passed; WordPress 6.9 requirement guard returned plugin_wp_incompatible without a fatal
• Multisite: network activation passed; sites 1 and 2 both reported 0.175.20, network-active and bootstrapped; browser no-page-errors passed
• SQLite: 1,507 total, 1,478 passed, 29 skipped, 0 failed
• Multisite artifact bundle integrity: valid, zero violations, digest 4be19f384018eaa51af18d0d1d8278050a35ea0c73764b76a7370b413dbd7629

Evidence is retained. No release, deploy, merge, tag, version bump, changelog edit, or WordPress.org submission occurred.

[chubes4]

Current-main integration review

Do not merge this head as-is despite GitHub reporting it mechanically mergeable.

Current main is release commit 0440a8b / v0.175.25, while this branch still carries preparatory metadata and evidence from older bytes:

• package-lock.json would restore root versions 0.175.18;
• readme.txt would restore Stable tag: 0.175.20;
• docs/plugin-check-wordpress-org-candidate.json is bound to obsolete SHA256 fb0f4164…41558 and old warning locations;
• the PR body describes head/package state before the final simplification and conversation-result convergence wave;
• composer.lock, dependency inventory, package entry count, and Plugin Check evidence need regeneration from current main.

The substantive package exclusions, third-party notices, generic example cleanup, #3376 guard, and #3377 artifact exclusion remain useful. Refresh this branch only after current product regressions #3254/#3255 are resolved or disproved, preserve Homeboy-owned current version metadata, then rebuild and replace every hash-bound claim with exact new candidate evidence.

No release, deployment, version edit, or branch mutation was performed in this review.