Npcink Governance Core

FAQ

Who is this plugin for?

It is for site administrators, host plugins, adapters, and developers that need reviewable governance for AI-assisted WordPress operations. It is especially useful when AI tools can prepare changes but the site still needs approval, commit preflight, and audit evidence before those changes are applied.

Is this an AI content generator?

No. Core does not write articles, generate media, create SEO copy, reply to comments, choose AI models, or store provider credentials. It governs proposed operations created by separate tools, adapters, or WordPress Abilities API providers.

Does Core execute AI writes?

No. Core records governance proposals and returns commit-preflight context. Final writes belong to a trusted host, Adapter, or runtime outside Core.

What is a proposal?

A proposal is a stored request for an AI-assisted WordPress operation. It includes the target ability, input summary, preview or dry-run evidence, status, caller metadata, and audit trail needed for review.

What is commit preflight?

Commit preflight is the governance check that runs after approval and before a trusted external component performs the final write. It returns bounded context, correlation data, and input binding so the downstream component can verify that it is acting on the approved request.

Do I need another plugin for abilities?

For full ability intake, yes. Core governs abilities exposed by WordPress Abilities API providers. Npcink Abilities Toolkit is the reference provider, and third-party providers can also integrate by exposing stable ability ids, schemas, permissions, risk metadata, and dry-run previews.

Does this plugin send data to an external AI service?

No. Core does not call external AI services and does not send site data to third parties. It stores governance records locally in WordPress database tables.

What data does Core store?

Core stores proposal records, approval and rejection decisions, commit-preflight evidence, execution-result handoff records, audit events, app-key metadata, and rate-limit state. App-key secrets are stored as hashes, and one-time bearer tokens are only shown when created.

What are scoped app keys used for?

Scoped app keys allow trusted governance clients to call specific Core REST endpoints without giving them broad administrator access. They are intended for controlled hosts, adapters, and internal governance clients.

Should OpenClaw connect directly to Core?

Productized OpenClaw setup should connect through a trusted adapter. Direct Core app keys are only for internal governance clients and fallback testing.

Can third-party ability providers use Core?

Yes. The proposal lifecycle is provider-neutral at the base layer. Third-party providers can expose WordPress Abilities API definitions with schemas, permission callbacks, risk metadata, and dry-run previews, then submit write or destructive operations for Core review.

Why does Core require WordPress 7.0?

Core ability intake reads the WordPress Abilities API surface and Core governance contracts are built and tested against WordPress 7.0 and later. On older WordPress versions ability intake is not tested and Core fails closed instead of governing proposals it cannot validate against real ability ids.

Does Core work with multisite?

Yes. Network activation provisions the Core governance tables for every existing site, and newly created sites are provisioned during initialization. Governance records are stored per site.

What happens to governance records when the plugin is deactivated or deleted?

Deactivation keeps all governance records. Deleting the plugin also keeps records: proposals, audit events, app-key metadata, and read authorization records are retained because approval and audit history may be subject to site retention requirements. There is no automatic uninstall deletion in this release.