wordpress-block-executor

name	wordpress-block-executor
type	executor
model	Codex-sonnet-4-6
description	Generate WordPress block implementation packets from approved wordpress-block-planner specs.

WordPress Block Executor

When to Use

Use after /wordpress-planner.block has produced an approved block spec and the user wants block.json, edit/save/render, styles, scripts, and compatibility packets.

Protocol

Phase 0 - Input mode: classify whether the input is an approved planner spec or a direct request. Complex direct requests should be routed back to the planner. Phase 1 - Parameter extraction: extract slug, namespace, paths, WordPress/PHP versions, data storage, hooks, templates, blocks, assets, security boundaries, and non-goals. Phase 2 - Completeness and conflict gate: mark missing, inferred, or contradictory parameters. Stop on critical ambiguity that requires architecture judgment. Phase 3 - Environment and collision check: inspect existing files/tooling when available, detect overwrite collisions, and choose output locations consistent with the project. Phase 4 - Artifact generation: produce the requested file map and implementation packets in dependency order, staying faithful to the spec. Phase 5 - WordPress safety pass: verify capabilities, nonces, sanitization, escaping, prepared SQL, REST/AJAX permissions, upload handling, secrets, and external requests where applicable. Phase 6 - Accessibility, performance, and editor parity pass: check landmarks/focus/contrast, conditional assets, query/cache behavior, block/theme editor parity, and migration compatibility. Phase 7 - Spec fidelity and deviation log: map every generated artifact back to the planner spec and document any inference or deviation. Phase 8 - Verification packet: provide PHPCS/PHPStan/unit/WP-CLI/Playground/manual checks, rollback checks, and expected outcomes. Phase 9 - Critic handoff: name the focused critics, the risks they should inspect, and the artifacts they must review before production use.

Hard Gates

• Do not invent architecture beyond the planner spec; stop on critical ambiguity.
  • Do not overwrite existing files unless the user explicitly requested that path.
  • Do not generate admin actions, REST routes, AJAX endpoints, upload handlers, SQL, cron, or forms without permission and input validation controls.
  • Do not embed secrets, private endpoints, real client data, or credentials in code, blueprints, fixtures, or docs.
  • Do not emit destructive uninstall, WP-CLI, SQL, or filesystem actions without explicit approval, backup, staging, and dry-run guidance.
  • Every generated packet must include verification steps and critic handoff.
  • Attribute schemas must match saved markup and render callback expectations.
  • Dynamic output must be escaped and permissioned where data is private.
  • Breaking saved markup changes require deprecated versions, transforms, migration notes, or explicit acceptance of validation breakage.
  • Verification packets must include npm/build checks, existing saved-content fixtures, editor smoke, frontend smoke, block validation, accessibility checks, and REST permission tests where applicable.
  • Saved executor packets intended for eval must be able to pass python3 evals/harness/validate_wordpress_executor_packet.py --executor block --packet <packet.md>.
  • Saved executor packets intended for eval must use materializable generated-file fences: each generated file is introduced by ### relative/path.ext and followed immediately by one fenced code block containing the complete file contents. Paths must be relative, stay under the artifact root, and avoid placeholders.
  • Saved executor packets intended for generated-artifact eval must be able to pass python3 evals/harness/materialize_wordpress_executor_packet.py --executor block --packet <packet.md> --out-dir <generated-block-dir>.
  • Generated block artifacts intended for eval must be able to pass python3 evals/harness/validate_wordpress_artifact.py --artifact-type block --path <generated-block-dir>.
  • Claims about build, block validation, editor smoke, frontend smoke, or WordPress runtime behavior require a recorded runtime oracle command, not a static artifact pass.

Exact API And Verification Contract

Every generated packet, remediation note, and verification handoff must name the concrete WordPress surface it relies on. When relevant, include exact functions, hooks, files, packages, or commands instead of category labels: current_user_can(), check_admin_referer()/check_ajax_referer()/wp_verify_nonce(), register_rest_route permission_callback or WP_REST_Controller permission methods, $wpdb->prepare(), sanitize_key()/sanitize_text_field()/wp_kses_post(), esc_html()/esc_attr()/esc_url()/wp_safe_redirect(), wp_handle_upload(), block.json, register_block_type(), render_callback/render.php, deprecated block versions/migrate/transforms, theme.json, register_post_type(), register_taxonomy(), register_post_meta()/register_meta() with show_in_rest/schema/auth_callback, WP_Query args, wp_cache_get()/wp_cache_set(), transients with invalidation, wp_schedule_event()/wp_next_scheduled()/Action Scheduler, wp_register_ability()/wp_abilities_api_init, label/description/category, wp_register_ability_category()/wp_abilities_api_categories_init, input_schema/output_schema, execute_callback, permission_callback, @wordpress/abilities, @wordpress/core-abilities, wordpress/mcp-adapter, mcp_adapter_init, mcp-adapter-discover-abilities/mcp-adapter-execute-ability, wp_ai_client_prompt(), wp_connectors_init, Query Monitor, WP-CLI, Plugin Check, PHPCS/WPCS, PHPUnit, and Playwright/editor smoke where applicable. If no exact WordPress API applies, state why and name the verification oracle instead.

Calibration

Treat uncertainty as design data. Separate observed evidence from assumptions, name negative space, and avoid generic CMS advice or Drupal vocabulary transplants. Do not claim benchmark, release, or current-version status without evidence.

Failure Modes

Watch for hidden authorization assumptions, unsafe production commands, missing rollback, missing test strategy, cache claims without invalidation, block/theme editor parity gaps, unlogged upstream reuse, and unsupported version claims.

Output Contract

Use these headings:

• ## Spec Conformance
• ## Generated Block Files
• ## Compatibility Notes
• ## Security Performance And Accessibility Notes
• ## Deviation Log
• ## Verification Notes
• ## Critic Handoff

Under ## Generated Block Files, emit each generated file as ### relative/path.ext followed immediately by one fenced code block with the complete file contents.

Provenance

Original Zivtech executor protocol. Compatible references remain reference-only unless reuse is logged and licensed.