SaltusDev · LC43 · Jun 19, 2026 · Jun 19, 2026 · Jun 19, 2026 · Jun 19, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -1,162 +1,50 @@
 name: CI
 
 on:
-  workflow_dispatch:
   push:
-    branches:
-      - main
-    tags:
-      - "v*"
+    branches: [main, feature/**]
   pull_request:
-    branches:
-      - main
-  schedule:
-    - cron: "23 4 * * 1"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+    branches: [main]
 
 jobs:
-  composer:
-    name: Composer validation
+  test:
+    name: PHP ${{ matrix.php }} — tests
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ['7.4', '8.0', '8.1', '8.2', '8.3']
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@v7
+      - uses: actions/checkout@v4
 
-      - name: Setup PHP
+      - name: Set up PHP ${{ matrix.php }}
         uses: shivammathur/setup-php@v2
         with:
-          php-version: "8.3"
-          coverage: none
+          php-version: ${{ matrix.php }}
           tools: composer:v2
+          coverage: none
 
-      - name: Validate Composer package
+      - name: Validate composer.json
         run: composer validate --strict
 
-  composer-audit:
-    name: Composer audit
-    runs-on: ubuntu-latest
-    needs: composer
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-
-      - name: Setup PHP with Composer cache
-        uses: ./.github/actions/php-setup
+      - name: Cache Composer dependencies
+        uses: actions/cache@v4
         with:
-          cache-key: ${{ runner.os }}-audit-php8.3-composer-${{ hashFiles('composer.lock') }}
-          cache-restore-keys: ${{ runner.os }}-audit-php8.3-composer-
+          path: vendor
+          key: composer-${{ runner.os }}-${{ matrix.php }}-${{ hashFiles('composer.json') }}
+          restore-keys: |
+            composer-${{ runner.os }}-${{ matrix.php }}-
+            composer-${{ runner.os }}-
 
       - name: Install dependencies
-        run: composer install --no-ansi --no-interaction --no-progress --prefer-dist
+        run: composer install --prefer-dist --no-progress
 
-      - name: Run Composer audit
-        run: composer audit
-
-  coding-standards:
-    name: Coding standards and PHP compatibility
-    runs-on: ubuntu-latest
-    needs: composer
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-
-      - name: Setup PHP with Composer cache
-        uses: ./.github/actions/php-setup
-        with:
-          cache-key: ${{ runner.os }}-phpcs-php8.3-composer-${{ hashFiles('composer.lock') }}
-          cache-restore-keys: ${{ runner.os }}-phpcs-php8.3-composer-
-
-      - name: Install dependencies
-        run: composer install --no-ansi --no-interaction --no-progress --prefer-dist
-
-      - name: Run PHPCS
-        run: composer phpcs
-
-  static-analysis:
-    name: Static analysis
-    runs-on: ubuntu-latest
-    needs: composer
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-
-      - name: Setup PHP with Composer cache
-        uses: ./.github/actions/php-setup
-        with:
-          cache-key: ${{ runner.os }}-phpstan-php8.3-composer-${{ hashFiles('composer.lock') }}
-          cache-restore-keys: ${{ runner.os }}-phpstan-php8.3-composer-
-
-      - name: Install dependencies
-        run: composer install --no-ansi --no-interaction --no-progress --prefer-dist
+      - name: Run PHPUnit
+        run: ./vendor/bin/phpunit -c phpunit.xml
 
       - name: Run PHPStan
-        run: composer phpstan -- --no-progress
-
-  dependency-compatibility:
-    name: PHP ${{ matrix.php }} / ${{ matrix.dependencies }} runtime dependencies
-    runs-on: ubuntu-latest
-    needs: composer
-
-    strategy:
-      fail-fast: false
-      matrix:
-        php:
-          - "7.4"
-          - "8.0"
-          - "8.1"
-          - "8.2"
-          - "8.3"
-          - "8.4"
-        dependencies:
-          - highest
-        include:
-          - php: "7.4"
-            dependencies: lowest
-          - php: "8.3"
-            dependencies: locked
-          - php: "8.4"
-            dependencies: locked
+        run: ./vendor/bin/phpstan analyse --memory-limit=2G --no-progress
 
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-
-      - name: Setup PHP with Composer cache
-        uses: ./.github/actions/php-setup
-        with:
-          php-version: ${{ matrix.php }}
-          cache-key: ${{ runner.os }}-dependencies-php${{ matrix.php }}-${{ matrix.dependencies }}-${{ hashFiles('composer.json', 'composer.lock') }}
-          cache-restore-keys: |
-            ${{ runner.os }}-dependencies-php${{ matrix.php }}-${{ matrix.dependencies }}-
-            ${{ runner.os }}-dependencies-php${{ matrix.php }}-
-
-      - name: Prepare runtime-only Composer manifest
-        run: jq 'del(."require-dev", ."autoload-dev", .scripts)' composer.json > composer.runtime.json
-
-      - name: Install locked dependencies
-        if: matrix.dependencies == 'locked'
-        run: composer install --no-dev --no-ansi --no-interaction --no-progress --prefer-dist
-
-      - name: Install highest dependencies
-        if: matrix.dependencies == 'highest'
-        run: COMPOSER=composer.runtime.json composer update --no-dev --no-ansi --no-interaction --no-progress --prefer-dist
-
-      - name: Install lowest dependencies
-        if: matrix.dependencies == 'lowest'
-        run: COMPOSER=composer.runtime.json composer update --no-dev --prefer-lowest --prefer-stable --no-ansi --no-interaction --no-progress --prefer-dist
-
-      - name: Validate Composer platform compatibility
-        run: composer check-platform-reqs --no-dev
-
-      - name: Lint PHP source
-        run: find src -name '*.php' -print0 | xargs -0 -n 1 -P 4 php -l
+      - name: Run PHPCS
+        run: ./vendor/bin/phpcs --standard=phpcs.xml
diff --git a/.gitignore b/.gitignore
@@ -6,4 +6,5 @@ vendor/
 **/.DS_Store
 .vscode
 *~
-saltus-framework.code-workspace
+saltus-framework.code-workspace
+tests/tester.php
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,9 +2,59 @@
 
 
 ## [Unreleased]
-	- Fix: Bring the source tree back to a clean PHPStan level 7 run.
-	- Improvement: Tighten service, model, asset, admin column, admin filter, and meta feature typing.
-	- Docs: Document local static-analysis and coding-standard checks.
+
+### Fixed
+	- Fixed single-post REST export so `/saltus-framework/v1/export/{post_id}` returns WXR for only the requested post instead of the entire post type.
+	- Fixed framework lifecycle hook registration by allowing `Core` to receive the consuming plugin bootstrap file for activation/deactivation hooks.
+	- Tightened WordPress-native MCP/Abilities permission callbacks so mutating post and term tools fail closed when required target arguments are missing.
+	- Fixed structured settings updates so nested arrays, booleans, numbers, and null values are preserved while string values and keys are sanitized recursively.
+	- Fixed settings sanitization so non-stringable object payloads cannot fatal during REST/MCP settings updates.
+	- Fixed single-post REST export so WordPress core download headers from `export_wp()` do not leak into REST responses.
+	- Fixed health error-rate reporting so validation and rate-limit outcomes remain visible but do not mark framework health as degraded.
+	- Fixed the non-WordPress JSON encoding fallback in `AbilityRuntime`.
+	- Cleared the remaining PHPStan Level 7 issues in `Modeler`, REST route registration, and MCP taxonomy REST-base handling.
+	- Added an explicit model name accessor contract so `Modeler` no longer depends on concrete model properties.
+
+### Changed
+	- Added regression coverage for export isolation, plugin-file lifecycle hook registration, fail-closed MCP ability permissions, and structured settings payloads.
+	- Brought `AssetLoader` back under PHPStan analysis with a typed `AssetLoadingService` base class.
+	- Removed the standalone stdio MCP server path; WP7 MCP/Abilities is now the only supported MCP transport.
+	- Migrated MCP audit logging, rate limiting, and caching to WordPress-native storage around WP7 ability execution.
+	- Moved MCP audit retention cleanup from the audit write path to a daily WP-Cron event.
+
+## [2.0.0] - 2026-06-30
+
+### Added
+	- MCP/Abilities integration: WordPress 7.0 native ability definitions through AbilityRegistrar
+	- MCP protocol server with stdio transport: initialize, tools/list, tools/call, resources/list, resources/read, prompts/list, prompts/get
+	- REST API namespace `saltus-framework/v1/` with 9 routes: models, duplicate, export, settings (GET/PUT), meta (aggregate + per-CPT), reorder
+	- 16 MCP tools (9 Phase 1 CRUD + 7 Phase 2): models, posts, terms, duplicate, export, settings, reorder, meta fields
+	- 3 MCP prompt templates for post/content generation workflows
+	- Meta field normalization: nested Codestar fields flattened to explicit paths with JSON-schema-like types
+	- ToolFactory for shared tool definitions between MCP and WordPress-native abilities
+	- Caching layer (CacheInterface + InMemoryCache) for WordPressClient GET requests
+	- Sliding-window rate limiter (default 60 req/60s) for tool calls
+	- Audit trail logger with JSON records to STDERR and optional file
+	- Structured error codes (ErrorCode constants + McpError value object with resolution hints)
+	- Config::fromEnv for environment-variable-based configuration (15 env vars)
+	- 243 PHPUnit tests across MCP, REST, and framework core
+
+### Fixed
+	- Rate limiter race condition in concurrent test scenarios
+	- ModelFactory static make method call operator
+	- WalkerTaxonomyDropdown incompatible void return type
+	- WordPress key length validation in get_registration_name()
+	- Admin columns non-string return from get_edit_term_link
+	- Various type safety issues across services, models, assets, admin columns, meta, drag-drop, and container
+
+### Changed
+	- Version bumped to 2.0.0
+	- Type safety improvements across the entire codebase
+	- MCP Server uses ToolFactory for unified tool definitions
+	- Config constructor refactored to array bag pattern
+	- PHP 8.3+ required (str_starts_with in McpError)
+	- PHPStan Level 7 compliance for all src/MCP/ and src/Rest/ code
+	- PHPUnit configuration with strict flags, random execution order, and failOn* rules
 
 ## [1.3.5] - 2026-06-20
 	- Chore: Package it for packagist

diff --git a/README.md b/README.md
@@ -7,7 +7,7 @@ Visit saltus.dev for more information.
 
 ## Version
 
-### Current version [1.3.5] - 2026-06-20
+### Current version [2.0.0] - 2026-06-30
 
 See [change log file](CHANGELOG.md) for full details.
 
@@ -59,7 +59,7 @@ Once the framework is installed and Composer's autoloader is loaded by your plug
       * The path to the plugin root directory is mandatory,
       * so it loads the models from a subdirectory.
       */
-      $framework = new \Saltus\WP\Framework\Core( dirname( __FILE__ ) );
+      $framework = new \Saltus\WP\Framework\Core( dirname( __FILE__ ), __FILE__ );
       $framework->register();
 
       /**
@@ -183,6 +183,86 @@ Includes support for [github-updater](https://github.com/afragen/github-updater)
 * Clone [github-updater](https://github.com/afragen/github-updater) to your sites plugins/ folder
 * Activate via WordPress
 
+## WordPress-Native MCP/Abilities
+
+Saltus Framework exposes its AI-facing tool surface through the WordPress-native MCP/Abilities API. Native WordPress MCP clients can discover and call the `saltus/*` abilities directly from the active plugin.
+
+For full documentation, see [docs/MCP.md](docs/MCP.md). For client integration guidance, see [docs/MCP-CLIENTS.md](docs/MCP-CLIENTS.md). These pages are source material for the future Saltus MCP documentation site.
+
+### Quick Start
+
+Install and activate the plugin that uses Saltus Framework on a WordPress version with the Abilities API. Saltus registers its abilities during `wp_abilities_api_init`; clients that understand WordPress-native MCP/Abilities can discover the `saltus/*` tools from WordPress.
+
+The standalone local stdio MCP server has been removed. Saltus MCP development targets WordPress-native abilities instead.
+
+### Capability Dispatch
+
+Abilities dispatch through WordPress REST requests, so existing REST permission callbacks and `current_user_can()` checks remain authoritative. WordPress versions without the Abilities API simply skip Saltus ability registration.
+
+### Service Gating and `is_needed()`
+
+To keep the application performant and clean, the framework separates REST/MCP route registration from the execution of admin and frontend hooks using a two-pass registration model:
+- **First Pass (Unconditional):** Services implementing `RestRouteProvider` or `ToolContributor` are instantiated unconditionally during plugin boot to register endpoints and tools. No scripts, styles, or hooks are wired up.
+- **Second Pass (Gated):** Services are registered in the main service container, which strictly enforces the `is_needed()` gate (defined by the `Conditional` interface). If `is_needed()` returns `false` (e.g. an admin-only feature on a frontend page, or a disabled feature), the service is skipped, avoiding loading unneeded scripts, styles, or hooks.
+
+Saltus wraps ability execution with WordPress-native audit logging, rate limiting, and transient caching. Read-only abilities can be cached in transients, mutating abilities clear the MCP cache, rate limits are keyed by the current user or request identifier, and audit records are written to the Saltus MCP audit table. Expired audit rows are removed by a daily WP-Cron retention job.
+
+### Available Tools
+
+| Tool | Description |
+|------|-------------|
+| `get_health` | Get Saltus Framework health, version, error rate, latency, cache, and rate-limit status |
+| `list_models` | List all registered CPTs and taxonomies |
+| `get_model` | Get details of a specific post type or taxonomy |
+| `list_posts` | Query posts with filters (status, search, pagination) |
+| `get_post` | Get a single post with all fields and meta |
+| `create_post` | Create a new post in any CPT |
+| `update_post` | Update an existing post's fields and meta |
+| `delete_post` | Trash or force delete a post |
+| `list_terms` | List terms from a taxonomy |
+| `create_term` | Create a new term in a taxonomy |
+| `duplicate_post` | Duplicate a WordPress post |
+| `export_post` | Export a post as WXR |
+| `get_settings` | Get Saltus settings for a post type |
+| `update_settings` | Update Saltus settings for a post type |
+| `reorder_posts` | Batch update post menu order |
+| `list_meta_fields` | Discover Saltus meta field definitions across all registered CPTs |
+| `get_meta_fields` | Get Saltus meta field definitions for a post type |
+
+Meta field discovery preserves the raw Saltus/Codestar configuration in `meta` and includes normalized MCP-friendly metadata in `normalized.fields` and `normalized.rest_meta_keys`. Nested fields are exposed as paths such as `points_info.coordinates.latitude`, with JSON-schema-like types and REST writability information.
+
+### Requirements
+
+- WordPress 7.0+ or a WordPress build that provides the Abilities API
+- A WordPress-native MCP/Abilities client
+- The plugin using Saltus Framework must be active
+
+### Configuration
+
+No local MCP server configuration is required for the WordPress-native path. Runtime behavior can be tuned with WordPress filters:
+
+| Filter | Purpose |
+|--------|---------|
+| `saltus/framework/mcp/audit/enabled` | Enable or disable audit writes |
+| `saltus/framework/mcp/audit/retention_days` | Set audit retention before daily WP-Cron cleanup |
+| `saltus/framework/mcp/rate_limit/enabled` | Enable or disable rate limiting |
+| `saltus/framework/mcp/rate_limit/max_requests` | Set max ability calls per window |
+| `saltus/framework/mcp/rate_limit/window_seconds` | Set the rate-limit window |
+| `saltus/framework/mcp/rate_limit/identifier` | Override the rate-limit identifier |
+| `saltus/framework/mcp/cache/enabled` | Enable or disable transient caching |
+| `saltus/framework/mcp/cache/ttl` | Set cache TTL per tool |
+| `saltus/framework/mcp/cache/cacheable` | Override whether a tool is cacheable |
+
+### Generated MCP documentation
+
+The detailed MCP ability reference is generated from the `src/MCP/Tools` source classes:
+
+```bash
+composer docs:mcp
+```
+
+This refreshes `docs/MCP-ABILITIES.md` and the generated ability table in `docs/MCP.md`.
+
 ## Building
 
 ### Quality checks