ConfigOps – Configuration Management

The undo button WordPress forgot WordPress shows you the settings form. ConfigOps shows you what the save actually changed. Agent-ready. Human by default. WordPress Abilities and machine-readable JSON WP-CLI commands let an authorized tool list recorded changes, inspect redacted diffs, control named Change Sessions, and run the restore checks without writing. Compatible MCP adapters can expose the same abilities as agent tools. Humans retain write authority by default. A service user with the separate configops_apply capability can replace human confirmation for one mutation only by sending dangerouslyRunUndo: true or --dangerously-run-undo. That acknowledgement does not bypass scope, conflict, reference, lock, audit, verification, or compensation checks. ConfigOps exposes no generic option writer, raw SQL tool, or plugin installer. Visit the ConfigOps website or read the documentation. Change a supported WordPress or plugin setting as usual. ConfigOps automatically opens an isolated observation for that save, groups the resulting writes, and reduces repeated writes to the same option into the original-to-final change. A compact evidence card states how many values WordPress wrote, separates likely decisions from housekeeping, and links to the stored diff. Whole-save Undo appears only when every recorded value is restorable and still passes the conflict check. Version 0.7 adds private Configuration Packs. Save a completed Change Session as a declarative .configops.json desired state, remove individual settings, import it on another website, inspect the complete Apply Preview, and apply it as an ordinary undoable History session. Packs are not database snapshots. They contain no old values, autoload flags, table names, SQL, or executable code. Complete options containing protected data are excluded before export. Import rechecks the destination's WordPress and plugin versions, adapter ownership, local references, protected values, current baselines, and site scope before writing. URLs, absolute paths, email addresses, and environment-specific values are warned instead of silently rewritten. Private Packs remain deliberately local files. Version 0.7 includes no cloud, marketplace, account, synchronization, variable substitution, or drift engine. One action. The hidden writes behind it. A clear diff. A conflict-checked undo. What a settings save actually wrote ConfigOps is not a generic activity log. It does more than report that somebody clicked Save: it records the supported Options API writes caused by the request, separates likely decisions from plugin housekeeping, and attributes the responsible component and code path where possible. ConfigOps is not a backup. It restores only supported setting values that still match the recorded state, so a later legitimate change is not silently overwritten. ConfigOps is not plugin-version rollback. It works with configuration values, not plugin or theme code. What ConfigOps records and checks

• Agent-ready discovery through the native WordPress Abilities API.
• Machine-readable JSON wp configops commands designed for scripts and language-model tool use.
• Read-only restore planning that checks scope, conflicts, references, autoload state, filtered option reads, adapters, and verified generic-array paths without writing.
• Explicit agent undo for one mutation when configops_apply and the dangerously-run-undo acknowledgement are both present; all ordinary restore checks remain active.
• Automatic local evidence for authorized settings changes made through WordPress admin, REST, and WP-CLI requests.
• Plain-language nested diffs that turn option arrays into recognizable settings.
• An immediate link to the recorded diff and whole-save Undo only when every value passes the restore policy.
• Named Change Sessions for planned maintenance, support cases, and investigations that span several requests.
• Private declarative Configuration Packs exported from completed Change Sessions.
• Complete Apply Preview with requirements, matching state, changes, skips, conflicts, and portability warnings.
• One-use, expiring Apply plans with destination drift checks before the first write.
• Pack application recorded in History with Pack ID/version provenance and ordinary whole-session Undo.
• Provenance for the user, request, component, code path, capture-time plugin version, and direct-versus-registered source basis where ConfigOps can determine it.
• Secret redaction before mutation history is stored.
• Conflict checks before every restore.
• Isolated site evidence across network-active WordPress Multisite installations.
• Multi-Network boundaries tied to each site's real network ownership, including fail-closed foreign-network writes and lifecycle switches.
• A separate Network Admin ledger for Network Options changes.
• Named Network Change Sessions for planned work that spans several Network Admin requests.
• Mutation-level undo for complete Network Options additions and updates.
• Optional experimental undo for verified keys in ordinary, unclaimed associative wp_options arrays.

Safety before convenience Probable credentials are removed before mutation history is stored. Undo first checks that the current value still matches the observed value. An interrupted or incomplete observation loses whole-save undo instead of pretending its evidence is safe. Direct writes to custom plugin tables are recorded as value-free warnings. ConfigOps does not store raw SQL and does not claim it can reverse data it does not understand. Site icons, site logos, and supported Yoast logo and social-image settings show the referenced attachment name, file type, dimensions, thumbnail, and missing state. Yoast publisher-policy, content-ignore, and LLMs.txt page IDs show bounded page identity instead of a bare database ID. ConfigOps never copies or deletes referenced media or content. All evidence remains in the website database. ConfigOps does not send observation data to pyrra or another external service. Suggested disclosure text is added to WordPress's privacy-policy guide. Tested component contracts The current release includes pinned adapters for:

• WordPress Core 7.0–7.1
• WP Mail SMTP Free 4.7–4.9
• Yoast SEO Free 28.1–28.3
• WooCommerce 10.3, 10.7, 10.9, and 11.0 core settings, feature flags, performance controls, and Point of Sale receipt details

These plugin ranges cover every version line that the official WordPress.org usage API exposed separately on 2026-08-24. CI rechecks that list and fails when a newly visible line has no real-plugin contract. Every contract also audits the release’s published option map, registered defaults, or Settings API and fails on settings ConfigOps still treats as unknown. WordPress.org combines the remaining installations under "other" without disclosing their versions, so that bucket is not advertised as verified support. The Support contracts screen lists each tested plugin version, mapped settings family, refused operation, and undo level. The WooCommerce contract covers core Options API settings, feature flags, REST and catalog performance controls, and Point of Sale receipt details. HPOS datastore switches and Cost of Goods are explained but not undone; orders, products, tax-rate tables, shipping zones, webhooks, extension gateways, and scheduled jobs are not rolled back. An untested component version keeps its observed evidence but disables automatic undo. Plugins without a dedicated adapter still retain their source slug and, when WordPress can resolve the owning plugin file, the version observed when the setting was saved. When WordPress Core performs the final write for an option that a plugin registered through the Settings API, the review says Setting registered by instead of pretending that the plugin directly called the Options API. Their nested leaf keys receive readable labels, but ConfigOps explicitly marks the plugin meaning as unmapped instead of inventing semantics. Multisite in version 0.7 On a network-active installation, each site keeps its own isolated evidence lifecycle. On Multi-Network installations, ConfigOps derives the network from the actual site record after every internal context switch, refuses lifecycle work that crosses networks, and excludes foreign Network Options writes from the current network ledger. An affected open capture is marked incomplete instead of silently appearing trustworthy. Network Admin receives a separate network-wide ledger for supported Network Options API changes, with guarded mutation-level undo for complete additions and updates. Network option deletes remain review-only because WordPress reports them after the previous value is gone. Named Network Change Sessions can group network-owned evidence, but whole-network-change undo, cross-site aggregation, and bulk operations are not available. Version 0.7 is a local single-site and Multisite evidence layer plus private, site-scoped Configuration Packs for supported WordPress settings. Packs are not available for the Network Options ledger. ConfigOps is not a staging service, backup, content migration, database synchronization, fleet manager, or generic activity log.

1. Upload the ConfigOps ZIP through Plugins > Add Plugin > Upload Plugin.
2. Activate ConfigOps.
3. Change one WordPress or plugin setting as usual.
4. Use the ConfigOps evidence card to review the hidden writes or undo a save whose recorded values all pass the restore policy.
5. For a multi-request task, open ConfigOps and start a named Change Session.

For Multisite, network-activate ConfigOps to initialize and maintain isolated site ledgers. Super administrators can review supported Network Options changes from Network Admin → ConfigOps.

0.7.0

• Saves safe, complete, adapter-backed settings from a completed Change Session as a private .configops.json desired state.
• Excludes complete options containing protected data and warns about source URLs, absolute paths, email addresses, environment values, and local references.
• Previews WordPress/plugin requirements and every destination diff before writing; one-use plans are invalidated by destination drift.
• Applies under the ordinary site safety boundary with per-write verification and compensation, then records Pack identity/version in History.
• Makes Pack applications undoable through the existing whole-session conflict checks.
• Reserves variables and extensions for a future schema while keeping both non-executable and empty in version 1; no cloud, marketplace, accounts, or sync are included.

0.6.0

• Adds a WooCommerce core adapter for the WordPress.org-visible 10.3, 10.7, 10.9, and 11.0 lines, including core settings, feature flags, performance controls, and Point of Sale receipt details.
• Audits every supported plugin release’s published settings surface in CI and rejects fields or newly visible version lines without a tested contract.
• Records adapterless plugin identity, capture-time version when resolvable, direct-versus-Settings-API ownership basis, and readable nested leaf labels without claiming plugin semantics.
• Adds a ninth site-scoped WordPress Ability and matching JSON WP-CLI command for explicitly authorized single-mutation undo.
• Keeps restore apply human-authorized by default while allowing a configops_apply service user to acknowledge dangerously-run-undo; the flag does not bypass restore checks, locking, audit, verification, or compensation.

0.5.1

• Adds eight site-scoped WordPress Abilities for state, evidence discovery, named Change Sessions, and read-only restore planning.
• Adds machine-readable JSON wp configops commands with the same capability checks and bounded response contracts.
• Keeps restore apply human-authorized: automation can inspect evidence and validate a plan but cannot write settings.
• Records WP-CLI observations without --user as shell-authorized actor ID 0 instead of silently dropping them.
• Refuses site and network undo before writing when a pre_* filter or path-relevant missing-row default virtualizes the target, without falsely blocking normal post-read transforms such as Yoast's option_wpseo.
• Avoids synchronous all-site traversal on large-network activation and provisions existing sites lazily.

0.5.0

• Adds opt-in verified key undo for ordinary plugin settings arrays without requiring a dedicated ConfigOps adapter.
• Preserves unrelated later keys, rechecks current structure and adapter ownership, and refuses the complete patch when snapshots, target paths, secrets, autoload state, or ownership fail the restore policy.
• Adds named Network Change Sessions for planned Network Admin work without enabling unsafe whole-network-change undo.
• Makes named-session pointer release owner-conditional across site and network scopes and prevents activation races from resurrecting or orphaning sessions.
• Serializes site and network retention with restore so cleanup cannot remove evidence from an in-flight undo.

0.4.3

• Adds a tested WordPress 7.1 Core compatibility contract for single-site and Multisite settings evidence, review, and guarded undo.
• Extends the Core adapter through WordPress 7.1 while continuing to fail closed for untested WordPress 7.2 releases.
• Adds permanent WordPress 7.1 release-candidate lanes across PHP, exact adapters, browser flows, MySQL, and MariaDB.

0.4.2

• Adds a guided WordPress Playground preview that opens WP Mail SMTP with ConfigOps active and ready to observe one sender-email change.
• Adds an end-to-end release gate for the public demo's direct landing, focused Evidence Card, Review, and conflict-checked Undo flow.
• Keeps runtime behavior and the version 0.4 Multisite support contract unchanged.

0.4.1

• Adds visible links to the ConfigOps website and documentation on the WordPress.org plugin page.
• Keeps the runtime behavior and Multisite support contract unchanged from 0.4.0.

0.4.0

• Adds network activation with isolated evidence, capabilities, retention, migration, site deletion, deactivation, and uninstall lifecycle across WordPress Multisite.
• Adds automatic Network Options evidence in a dedicated Network Admin ledger.
• Adds conflict-checked, mutation-level undo for complete Network Options additions and updates, with locking, audit records, verification, and compensation.
• Keeps network deletes, lifecycle and authority state, named network sessions, whole-change undo, cross-site aggregation, and bulk operations explicitly unavailable.
• Includes the navigation-safe evidence delivery and maintainability hardening developed after 0.3.0.

0.3.1

• Prevents automatic evidence cards from being lost when a settings save navigates between admin requests.
• Consolidates shared command, adapter, request-evidence, pagination, browser-test, and CI workflows.
• Moves the public plugin website to configops.pyrra.net and documentation to configops.pyrra.net/docs/.

0.3.0

• Records authorized settings saves automatically in isolated request-local observations.
• Shows immediate evidence with write, decision, technical, and protected-secret counts plus direct review and conflict-checked undo actions.
• Keeps named Change Sessions as the focused mode for planned multi-request work.
• Preserves automatic observations and named Change Sessions as distinct modes through the schema, review, retention, and uninstall lifecycle.
• Repositions ConfigOps as the undo and evidence layer for WordPress settings with a new directory title, description, and artwork.

0.2.0

• Supports PHP 8.2 through 8.5 with full minimum-runtime and endpoint browser contracts.
• Enforces 70% production and 75% trust-boundary PHP line coverage in CI.
• Adds hostile-input, warning/deprecation, dependency-advisory, and runtime-lifecycle gates.
• Builds a byte-reproducible release archive before WordPress Plugin Check.
• Publishes a complete operator, safety, support, and development documentation site through GitHub Pages.

0.1.0

• First technical preview by pyrra.
• Explicit local captures with request grouping and source attribution.
• Local intent correlation matches touched admin-field names and labels to saved option paths without reading field values or expanding undo permissions.
• Same-request option-write chains collapse to their original and final state; complete same-owner reverts disappear from review.
• Typed nested diffs, conservative noise classification, and secret redaction before persistence.
• A WordPress Core 7.0 settings contract for General, Writing, Reading, Discussion, Media, and Permalink settings.
• Conflict-checked field and session undo with value-free audit records and compensating recovery.
• Exact deep-field contracts for every bundled WP Mail SMTP Free 4.9.0 mailer and the Yoast SEO Free 28.2 feature, crawl, schema, search, social, and LLMs.txt families.
• Media and content identity review for WordPress site icons/logos and supported Yoast image/page fields, including missing-target undo protection.
• Fail-closed capture finalization, schema recovery, bounded 30-day retention, and integrity warnings.
• Performance-budgeted React review interface with responsive and keyboard-tested states.