Corrected the minimum WordPress version to 6.9 and added a real minimum-version release smoke.
Made Toolkit the canonical owner of reusable static workflow definitions without adding workflow runtime state.
Replaced the raw ability-count gate with representative contract assertions and documented WordPress Core convergence rules.
Made write and destructive callbacks fail safe unless commit intent is explicit and host-governed.
Restricted post-meta reads to explicit non-sensitive keys and required host allowlists for setting patch targets.
Validated remote media before uploads, removed the obsolete in-memory fallback, and redacted reversible setting fragments.
Added internal autoloading, lazy package construction, and a cold-bootstrap performance budget.
Removed the incomplete bundled Traditional Chinese starter locale until it can be maintained as a complete pack.
0.5.2
Added read-only review artifacts for image candidates, internal link candidates, taxonomy suggestions, and comment reply suggestions.
Kept candidate review helpers suggestion-only and host-governed; they do not create proposals, approve work, execute writes, or contact external providers.
Expanded acceptance contracts and first-party pack documentation for the new handoff artifacts.
0.5.1
Added Composer dependency advisory audit to the default local and CI source gate.
Aligned CI and PHPStan with the package PHP 8.0 runtime floor.
Published the canonical public GitHub repository and documented the post-publication gate baseline.
Upgraded GitHub Actions checkout to the Node 24-compatible actions/checkout@v5.
0.5.0
Improved the admin page as a connection and discovery surface with clearer package status, catalog navigation, copyable REST endpoints, and two bounded read-only checks.
Added bundled translation templates and starter locale packs for the admin connection/discovery surface, API ability labels/descriptions, and common runtime error messages.
Removed development demo ability controls from the admin page and kept showcase, model-call, write, and workflow execution outside this package surface.
Renamed nonproduction cleanup abilities and media cleanup inputs to avoid public test terminology in released ability ids and schema fields.
Added taxonomy assignment proposal support and strengthened Core consumer handoff checks for harvested workflow surfaces.
Hardened media replacement and Cloud derivative adoption previews so approved replacements can repair exact post-content media URLs, including old intermediate-size URLs.
Documented the foundation-layer testing strategy and default local source gate.
0.4.0
Added read-only host composition recipe metadata discovery abilities and public PHP helpers.
Added Core governance handoff documentation, a catalog snapshot fixture, a permission matrix, and a schema boundary audit.
Hardened write-like contracts with requires_approval, explicit dry-run and commit defaults, and bounded idempotency keys.
Expanded REST verification coverage for governance metadata and schemas.
Added a consumer example for preparing Core proposal payloads from discovered ability contracts.
0.3.0
Added package and sub-pack filters so hosts can keep a full catalog by default or opt into a light core_wordpress_read profile.
Kept public third-party helpers read-only/write-proposal oriented and documented that final commit authorization belongs to the host runtime.
Made Npcink AI catalog projection thin by default and added a projection-row filter for host-owned policy expansion.
Established npcink-abilities-toolkit/* as the canonical id namespace for abilities owned by this plugin.
Added explicit read/comment sub-pack maps as the split point for future source-file extraction.
Verified Npcink AI catalog compatibility against a WordPress site.
0.2.0
Stabilized the public helper contract and ability metadata rules.
Documented host-governed write/destructive semantics and the Npcink AI integration boundary.
Added first-party ability pack grouping and 0.2 candidate verification evidence.
Strengthened lightweight tests for schema controls, Npcink catalog projection, provider defaults, and invalid ability ids.
Verified WordPress REST coverage and Npcink AI consumer split-boundary checks.
