Release gates
Status date: 2026-08-25.
This file covers the sitepilot-mcp repository only. Cloud control-plane deployment and acceptance are owned by the private sitepilot-cloud repository.
Blocking automated checks
Section titled “Blocking automated checks”@instantbuild-sitepilot/contracts: typecheck, Vitest, PHP↔TypeScript risk parity, build, and npm pack dry run.sitepilot-mcp: typecheck, Vitest, live WordPress 6.9/7.0 proxy matrix for Application Password, bearer, and OAuth, build, npm pack dry run, and isolated tarball install.- PHP: PHPUnit, PHPCS, PHPStan, and repository-wide syntax parsing on PHP 8.2–8.5.
- WordPress integration: 6.9, 7.0, and nightly activation plus OAuth, claimed Application Password scope, approval-channel, privacy, builder, changeset, rollback, and compatibility scenarios.
- Distribution: translation build, direct-distribution ZIP packaging, and archive SHA-256 verification.
- Licensing: the PHP runtime-dependency check rejects missing licence metadata and GPLv2-only dependencies.
- Security: dependency audit and history secret scan.
CI evidence counts only when the successful run’s head SHA is the exact release candidate.
Security release blockers
Section titled “Security release blockers”- O1 is closed in source: Application Password authority comes from an immutable credential grant rather than from
sitepilot_connectalone. - O2 is closed in source: approval requires
sitepilot_approveand the approval-channel guard;/ops/{ability}does not expose approval. - The private cloud source removes OAuth approval and requires a nonce/capability-protected WordPress approval followed by read-only status verification. Exact-SHA repair
e226372was deployed and passed the negative refusal plus live approval, execution, rollback, and restored-state inspection. Cloud merge865f13bis tree-identical to that deployed source and passed exact-head CI. - The former
<=0.4.4console compatibility hold is lifted for plugin0.4.7plus the migrated console. Older installations still retain their corresponding defects: 0.4.4 retains O2, and 0.4.3 retains O1 and O2. Fleet rollout remains a separate Owner action. - Live acceptance uses only Owner-designated disposable sites. Historical or third-party installations are not rollout targets.
Release authorization
Section titled “Release authorization”Release approval and operational publication procedures are maintained privately.
External acceptance
Section titled “External acceptance”- Reconnect a standards-compatible MCP client after each plugin upgrade and verify discovery, token rotation, revocation, inspect, plan, approval pause, execution, and rollback.
- Run representative Elementor, Enfold, Gutenberg, and WooCommerce acceptance on the exact packaged SHA. Mixed Elementor 4 inspection and known typed-setting updates are covered; atomic construction/global-style writes and Enfold nested global options remain explicit unsupported boundaries.
- Verify the installed ZIP hash matches the accepted artifact; a later code commit invalidates the acceptance run.
Public normalization derived from product commit 00c30de825b68dc14535f6455e82c927ad256b47, file docs/release-gates.md. See source-manifest.json for the source digest and declared normalization classes.