Npcink AI Client Adapter

Npcink AI Client Adapter 通过聚焦的 REST 适配器，将 OpenClaw 兼容工具等本地 AI 客户端连接到 WordPress 站点。 它适用于使用 Npcink Governance Core 管理可审查 AI 操作，并使用 Npcink Abilities Toolkit 等 WordPress Abilities API provider 提供具体 WordPress 能力的站点。Adapter 为客户端提供一个稳定的 WordPress REST 入口，用于检查就绪状态、读取治理指引、运行已批准的读取能力、创建受治理的提案，并且只在 Core 批准和提交预检之后执行受支持的写入。 默认连接路径使用签名密钥配对，因此 AI 客户端不需要接收 WordPress 应用密码。对于已经有专用 secret 字段或凭据库的客户端，仍可使用 WordPress 应用密码备用路径。 Adapter 有意保持很薄。它不定义能力、不保存批准真相、不运行工作流队列、不充当 MCP server、不管理模型 provider、不保存提示词，也不执行任意最终写入变更。治理仍属于 Npcink Governance Core。能力定义和回调仍属于 Npcink Abilities Toolkit 或其他 WordPress Abilities API provider。 Adapter exposes a machine-readable client_policy on health, help, and the connection manifest so compatible clients can consume explicit route, output, sensitive-read, and write-flow boundaries. The local CLI also redacts profile paths, key ids, signing headers, tokens, passwords, and secrets from output, and its mcp subcommand runs a client-side stdio MCP server over the same signed profile with governed read, propose, preflight, and execute-after-human-approval tools only. Current governed execution support covers explicit Adapter profiles after Core approval and commit-preflight: npcink-abilities-toolkit/trash-post, npcink-abilities-toolkit/create-draft, npcink-abilities-toolkit/update-post, npcink-abilities-toolkit/patch-post-content, npcink-abilities-toolkit/update-post-blocks, npcink-abilities-toolkit/update-template-blocks, npcink-abilities-toolkit/upsert-template-blocks, npcink-abilities-toolkit/update-template-part-blocks, npcink-abilities-toolkit/patch-setting-value, npcink-abilities-toolkit/set-post-seo-meta, npcink-abilities-toolkit/adopt-article-audio, npcink-abilities-toolkit/set-post-slug, npcink-abilities-toolkit/set-post-terms, npcink-abilities-toolkit/delete-term, npcink-abilities-toolkit/update-media-details, npcink-abilities-toolkit/upload-media-from-url, npcink-abilities-toolkit/set-post-featured-image, npcink-abilities-toolkit/optimize-media-asset, npcink-abilities-toolkit/replace-media-file, npcink-abilities-toolkit/restore-media-backup, npcink-abilities-toolkit/adopt-cloud-media-derivative, npcink-abilities-toolkit/rename-media-file, npcink-abilities-toolkit/delete-media-permanently, npcink-abilities-toolkit/delete-attachment, npcink-abilities-toolkit/reply-comment, npcink-abilities-toolkit/trash-comment, and npcink-abilities-toolkit/approve-comment. 核心功能：

• 通过一个 Adapter REST namespace，将 OpenClaw 兼容及类似本地 AI 客户端连接到 WordPress。
• 在客户端开始工作前检查 Adapter 就绪状态和依赖状态。
• Expose a machine-readable client_policy so clients can understand route, read, write, and sensitive-data boundaries.
• 通过 WordPress Abilities API 路由已批准的 direct-read 请求。
• 将受治理的写入请求转发到 Npcink Governance Core 提案和提交预检端点。
• Support human-approved final execution for explicit, supported execution profiles after Core approval, plus a unified approve-and-execute action reserved for WordPress administrator sessions.
• 优先为本地客户端使用签名密钥配对，并在合适场景下保留应用密码备用方式。
• 保持通道、治理、能力、云端和模型 provider 职责分离。

0.4.3

• Add an explicit post-Core execution profile for npcink-abilities-toolkit/delete-attachment on hosts providing that Toolkit ability; require deletion policy branch, operator reason, idempotency key, approval and commit preflight.
• Add a complete local development acceptance command covering deterministic gates, WordPress fixtures, fresh package installation and restoration, and signed client contract checks; reject incomplete or skipped smoke passes.
• Preserve the original plugin on package smoke prerequisite failures, restore network activation correctly, and accept the standard Local.app MySQL socket setting in Plugin Check.
• Keep the 0.4.2 non-numeric limit rejection on both list routes and test media-deletion proposals without current Core branch evidence as fail-closed.
• Accept Toolkit flagged-media removal plans through the existing proposal bridge and verify signed deletion, retained-backup restoration, and duplicate-execution refusal over HTTPS.
• Forward scoped proposal, correlation, and Adapter request identifiers during approved writes so real AI Request Logs can match the signed execution; restore prior log context on success, errors, and exceptions without forwarding private execution authority.

0.4.2

• Reject non-numeric limit query parameters on proposal and sensitive read-request list routes with the standard WordPress REST 400 error envelope instead of silently coercing them to 1.
• Unify consumer-facing REST error details and complete /help and connection-manifest discovery for the shipped route surface, including actionable administrator-session and malformed-id responses.
• Synchronize consumer documentation with the 26 explicit post-Core execution profiles and add a route-drift release gate.
• Surface missing dependencies, contract mismatches, and recent client errors in the Adapter admin page; clean up tracked fallback Application Password credentials on revocation and uninstall.
• Mark the 0.4.0 administrator-session restriction for unified approve-and-execute as a breaking change for signed clients.

0.4.1

• Verification integrity with Governance Core 0.3.0 (ADR-012/ADR-013): executions request execution-attached verification reads at commit preflight and present them on action results; after execution, block readbacks that could not be verified get a Core-recorded, result-bound second chance (provisional-record supplement), so objects created inside the same batch verify through Core-minted evidence instead of degrading. The recorded readback metadata always reflects the latest attempt, and the supplement re-runs log through the same request context as the first pass. Verification-read features require Governance Core 0.3.0 or newer.
• Adopt the Governance Core 0.2.x/0.3.0 REST contract changes: recoverable preflight handoffs (409 envelope with correlation id and expiry), app_auth_expired hints, the 429 retry relay honoring delay-seconds Retry-After, contract:read fallback, and audit offset passthrough.
• Administrator review hardening from the 2026-10 AI review backlog: server-side ability_id enforcement on governed routes, hardened governed-write locks and handoff consumption, structured CLI schema enforcement with redaction, and admin-surface fixes.
• Complete the zh_CN catalog (0 fuzzy, 0 untranslated) and gate translation coverage at release.
• Split the controller into behavior-preserving domain services (signing auth, execution records, upstream dispatch, dependency status, preflight handoffs, read governance, proposal review, contract metadata) and promote static analysis (PHPStan, PHPCS) plus the delivered-review triage gate to required CI.
• Return structured, actionable authentication errors for signed requests: credential completeness, clock skew, and body-hash mismatches now carry distinct stable codes with reason and next_step data instead of a generic rest_forbidden; key-record and signature failures share one pre-verification code so key liveness is never observable without the private key; scope and nonce-replay causes are reported only after the signature verifies. Requests without credentials receive npcink_openclaw_adapter_authentication_required pointing at the device-pairing entry, and logged-in non-administrator accounts receive npcink_openclaw_adapter_privilege_required.
• Pairing rate-limit responses now set the standard Retry-After response header alongside the existing error data.
• Remove stale GET /terms/GET /term purpose strings from /help route discovery.
• Companion CLI 0.6.0: failed Adapter responses now print the full error envelope including data.operator_feedback, next_step, and retry_after (redacted); the bounded AI image ratio crop recipe helper now mirrors the reviewed recipe contract locally because Adapter /help no longer carries recipe playbooks.

0.4.0

• Restrict the unified approve-and-execute action to WordPress administrator sessions. Signed AI clients now wait for human approval in the Npcink Governance Core admin and then call the execute route; signed attempts on the unified route fail closed with npcink_openclaw_adapter_approve_requires_admin_session.
• Add client_policy.boundary_enforcement (client policy version 2) so clients can distinguish enforced key-pair connections from conventional WordPress-native credentials.
• Add the connection readiness checklist and CLI boundary status reporting.
• Document the governed MCP tool surface of the companion CLI (@npcink/openclaw-adapter-cli 0.5.0): read, propose, preflight, and execute-after-human-approval tools only, with no self-approval tool.

0.3.3

• Harden release packaging, uninstall cleanup, and batch execution contract checks.
• Preserve actionable, redacted CLI output when the signed local acceptance fixture fails.

0.3.2

• 通过把媒体派生传输保持在 Adapter 之外，并只保留已审查的采纳交接，关闭 release-candidate 边界。
• 为最终 Adapter 写入路由要求明确的 signed-client execute scope。
• 恢复 Core capability 转发和默认执行响应兼容性，用于 consumer smoke 覆盖。

0.3.1

• 将 Adapter 最终执行绑定到 Core 批准和提交预检执行交接。
• 将签名本地客户端指纹转发到受信任的 Core app-token 请求，并在 Core 上下文不匹配时失败关闭。
• 在报告依赖就绪之前，验证站点和 signed-client 绑定的 Core 依赖合约语义。

0.3.0

• 在机器可读合约元数据中添加 Adapter 声明的 Core 和 Abilities Toolkit 兼容性下限。
• 记录签名本地 AI 客户端 create-draft 提案、approve-and-execute、读回和清理验收通过。

0.2.1

• 为 health、help 和 connection manifest 响应添加合约快照 smoke 覆盖。
• Reject batch write actions that request core_proxy_execute=true before Adapter execution.
• Expand negative smoke coverage for core_proxy_execute and commit_execution batch fail-closed behavior.

0.2.0

• 在 health、help 和 manifest 响应中添加机器可读 Adapter 合约元数据和稳定合约哈希。
• 添加本地 AI 客户端验收命令，用于非破坏性的 Adapter/Core 边界检查。
• 使区块主题视觉验收、批量审查反馈和 release package smoke 文档与受治理执行配置边界保持一致。

0.1.1

• 添加本地 AI 客户端 CLI 辅助命令、输出脱敏和机器可读 client policy。

0.1.0

• 初始薄 AI 客户端适配器，用于 Npcink Governance Core 和 WordPress Abilities API 路由。