Npcink AI Client Adapter

Npcink AI Client Adapter connects local AI clients, such as OpenClaw-compatible tools, to a WordPress site through a focused REST adapter. It is designed for sites that use Npcink Governance Core for reviewable AI operations and WordPress Abilities API providers, such as Npcink Abilities Toolkit, for concrete WordPress capabilities. The Adapter gives clients one stable WordPress REST surface for checking readiness, reading governance guidance, running approved read abilities, creating governed proposals, and executing supported writes only after Core approval and commit-preflight. The default connection path uses signed key-pair pairing so the AI client does not need to receive a WordPress Application Password. A WordPress Application Password fallback is available for clients that already have a dedicated secret field or credential vault. Adapter is intentionally thin. It does not define abilities, store approval truth, run workflow queues, act as an MCP server, manage model providers, store prompts, or execute arbitrary final write mutations. Governance remains in Npcink Governance Core. Ability definitions and callbacks remain in Npcink Abilities Toolkit or another WordPress Abilities API provider. Adapter exposes a machine-readable client_policy on health, help, and the connection manifest so compatible clients can consume explicit route, output, sensitive-read, and write-flow boundaries. The local CLI also redacts profile paths, key ids, signing headers, tokens, passwords, and secrets from output. Current governed execution support covers explicit Adapter profiles after Core approval, including npcink-abilities-toolkit/trash-post, npcink-abilities-toolkit/create-draft, npcink-abilities-toolkit/update-post, npcink-abilities-toolkit/update-post-blocks, npcink-abilities-toolkit/set-post-terms, npcink-abilities-toolkit/reply-comment, and npcink-abilities-toolkit/approve-comment. Key features:

• Connect OpenClaw-compatible and similar local AI clients to WordPress through one Adapter REST namespace.
• Check Adapter readiness and dependency status before a client starts work.
• Expose a machine-readable client_policy so clients can understand route, read, write, and sensitive-data boundaries.
• Route approved direct-read requests through the WordPress Abilities API.
• Forward governed write requests to Npcink Governance Core proposal and commit-preflight endpoints.
• Support a user-triggered approve-and-execute path for explicit, allowlisted execution profiles after Core approval.
• Prefer signed key-pair pairing for local clients, with an Application Password fallback when appropriate.
• Keep channel, governance, ability, cloud, and model-provider responsibilities separate.

0.3.2

• Close the release-candidate boundary by keeping media derivative transport outside Adapter and retaining only reviewed adoption handoff.
• Require explicit signed-client execute scope for final Adapter write routes.
• Restore Core capability forwarding and default execution response compatibility for consumer smoke coverage.

0.3.1

• Bind Adapter final execution to Core approval and commit-preflight execution handoffs.
• Forward signed local client fingerprints to trusted Core app-token requests and fail closed on mismatched Core contexts.
• Validate Core dependency contract semantics for site and signed-client bindings before reporting dependency readiness.

0.3.0

• Add Adapter-declared Core and Abilities Toolkit compatibility floors to the machine-readable contract metadata.
• Record a signed local AI client create-draft proposal, approve-and-execute, readback, and cleanup acceptance pass.

0.2.1

• Add contract snapshot smoke coverage across health, help, and connection manifest responses.
• Reject batch write actions that request core_proxy_execute=true before Adapter execution.
• Expand negative smoke coverage for core_proxy_execute and commit_execution batch fail-closed behavior.

0.2.0

• Add machine-readable Adapter contract metadata and stable contract hashes on health, help, and manifest responses.
• Add the local AI client acceptance command for non-destructive Adapter/Core boundary checks.
• Align block theme visual acceptance, batch review feedback, and release package smoke documentation with the governed execution profile boundary.

0.1.1

• Add local AI client CLI helper commands, output redaction, and machine-readable client policy.

0.1.0

• Initial thin AI client adapter for Npcink Governance Core and WordPress Abilities API routing.