=== MCP Project Milestones ===
Contributors: vibexvx
Tags: mcp, artificial intelligence, project management, automation, milestones
Requires at least: 6.9
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 2.2.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Give authenticated AI agents guarded CRUD access to private, structured project milestones through the WordPress Abilities API.

== Description ==

MCP Project Milestones registers a private Project Milestone post type, a namespaced Advanced Custom Fields field group, and five typed WordPress abilities:

* Create a milestone with duplicate protection.
* Query milestones using bounded filters and pagination.
* Read a canonical milestone record.
* Update a milestone with optimistic conflict detection.
* Move a milestone to Trash or permanently delete it with explicit confirmation.

The abilities are designed for authenticated AI clients connected through the official WordPress MCP Adapter. Every operation uses the current WordPress user's normal capabilities. The plugin does not create roles, grant capabilities, change themes or permalinks, expose milestone records through the public REST API, or add public-facing attribution.

= Required software =

* WordPress 6.9 or newer, where the Abilities API is included in WordPress core.
* Advanced Custom Fields Free or Pro from its official distribution source: https://wordpress.org/plugins/advanced-custom-fields/
* The official WordPress MCP Adapter from https://github.com/WordPress/mcp-adapter. Version 0.5.0 or newer is recommended.
* WP-CLI on the system providing the MCP STDIO transport, when using a local agent connection.

The plugin intentionally does not use the `Requires Plugins` header. WordPress can only resolve WordPress.org dependency slugs through that header, which would incorrectly reject an otherwise valid ACF Pro installation and cannot represent the MCP Adapter dependency. The scoped Setup & Status screen verifies both dependencies without changing other admin settings.

= Privacy and external services =

The plugin itself does not send data to Vibex VX, add telemetry, load remote assets, or call an external service. Milestones remain in the site's WordPress database.

When a site administrator separately configures the WordPress MCP Adapter and an AI client, the selected client may receive milestone fields, generated edit URLs, and ability results and may transmit them to the administrator's selected model provider. That transfer is initiated by the administrator and is governed by the MCP client, adapter, and model provider configuration and privacy terms.

For accountability, the plugin stores a bounded audit history with timestamps, WordPress user IDs, actions, and changed field names. A permanent deletion audit stores the post ID and one-way hashes of the project name and title. Per-record history and permanent-deletion history are each limited to the latest 100 entries.

= Data retention =

Deactivating or deleting the plugin does not delete Project Milestone posts, their metadata, or the permanent-deletion audit option. This protects operational records from accidental loss. Site administrators can delete milestones and remove the namespaced audit option before removing the plugin when their retention policy requires it.

== Installation ==

1. In WordPress, go to Plugins > Add New > Upload Plugin.
2. Upload `mcp-project-milestones.zip`, select Install Now, and activate the plugin.
3. Install and activate Advanced Custom Fields Free or Pro.
4. Install the official WordPress MCP Adapter using its supported Composer or plugin installation method.
5. Open Project Milestones > Setup & Status and confirm every dependency reports Ready.
6. Copy the generated WP-CLI MCP server configuration into your AI client and use a dedicated least-privilege WordPress account.

The default MCP Adapter server exposes three adapter tools. Agents use the adapter's discover, information, and execution tools to find and call this plugin's five public abilities.

== Frequently Asked Questions ==

= Does this plugin send milestone data to an AI provider? =

Not by itself. This plugin validates permissions and reads or writes WordPress data. An administrator-configured MCP client or adapter may send requested milestone data to the selected model provider as described in the Privacy and external services section.

= Are milestone records publicly accessible? =

No. The custom post type is not public, is not publicly queryable, and is not exposed through the standard WordPress REST API.

= Can an AI agent bypass WordPress permissions? =

No. Each ability checks the capabilities of the authenticated WordPress user. Use a dedicated account with only the permissions required for the intended workflow.

= How are duplicate records prevented? =

Create requests use optional idempotency keys, deterministic content fingerprints, and a short-lived atomic lock. An exact retry returns the existing canonical record.

= What happens when the plugin is removed? =

Milestone posts, metadata, and the permanent-deletion audit option are preserved. The plugin intentionally does not erase operational data automatically.

== Changelog ==

= 2.2.1 =

* Added a WordPress.org-compatible plugin package and readme.
* Added GPL, privacy, data-retention, and translation metadata for directory distribution.
* Removed the custom Update URI so WordPress.org can manage updates.
* Documented ACF and MCP Adapter installation and current adapter discovery behavior.

= 2.2.0 =

* Added complete create, query, get, update, and delete abilities.
* Added idempotency keys, deterministic duplicate detection, and atomic create locks.
* Added private records, strict schemas, record-level permissions, optimistic conflict detection, and bounded audit history.
* Added a scoped, read-only Setup & Status screen.

== Upgrade Notice ==

= 2.2.1 =

This release adds WordPress.org distribution metadata without changing stored milestone data.
