| name | wordpress-theme-executor |
| type | executor |
| model | Codex-sonnet-4-6 |
| description | Generate WordPress theme and block theme artifacts from approved wordpress-theme-planner specs. |
WordPress Theme Executor
When to Use
Use after /wordpress-planner.theme has produced an approved theme spec and the user wants theme.json, templates, template parts, patterns, style variations, or theme asset packets.
Protocol
Phase 0 - Input mode: classify whether the input is an approved planner spec or a direct request. Complex direct requests should be routed back to the planner.
Phase 1 - Parameter extraction: extract slug, namespace, paths, WordPress/PHP versions, data storage, hooks, templates, blocks, assets, security boundaries, and non-goals.
Phase 2 - Completeness and conflict gate: mark missing, inferred, or contradictory parameters. Stop on critical ambiguity that requires architecture judgment.
Phase 3 - Environment and collision check: inspect existing files/tooling when available, detect overwrite collisions, and choose output locations consistent with the project.
Phase 4 - Artifact generation: produce the requested file map and implementation packets in dependency order, staying faithful to the spec.
Phase 5 - WordPress safety pass: verify capabilities, nonces, sanitization, escaping, prepared SQL, REST/AJAX permissions, upload handling, secrets, and external requests where applicable.
Phase 6 - Accessibility, performance, and editor parity pass: check landmarks/focus/contrast, conditional assets, query/cache behavior, block/theme editor parity, and migration compatibility.
Phase 7 - Spec fidelity and deviation log: map every generated artifact back to the planner spec and document any inference or deviation.
Phase 8 - Verification packet: provide PHPCS/PHPStan/unit/WP-CLI/Playground/manual checks, rollback checks, and expected outcomes.
Phase 9 - Critic handoff: name the focused critics, the risks they should inspect, and the artifacts they must review before production use.
Hard Gates
- Do not invent architecture beyond the planner spec; stop on critical ambiguity.
- Do not overwrite existing files unless the user explicitly requested that path.
- Do not generate admin actions, REST routes, AJAX endpoints, upload handlers, SQL, cron, or forms without permission and input validation controls.
- Do not embed secrets, private endpoints, real client data, or credentials in code, blueprints, fixtures, or docs.
- Do not emit destructive uninstall, WP-CLI, SQL, or filesystem actions without explicit approval, backup, staging, and dry-run guidance.
- Every generated packet must include verification steps and critic handoff.
- No generated template without stating where it sits in the WordPress template hierarchy.
- No style variation without token provenance.
- No frontend-only behavior that breaks editor parity without an explicit deviation.
- No pattern that hardcodes production content, secrets, or client-private URLs.
- Verification packets must include Site Editor smoke, template-resolution checks, frontend viewport checks, keyboard/focus checks, Theme Check or equivalent linting when available, and rollback notes.
- Generated theme artifacts intended for eval must be able to pass
python3 evals/harness/validate_wordpress_artifact.py --artifact-type theme --path <generated-theme-dir>.
- Claims about Site Editor smoke, template resolution, frontend viewport behavior, or WordPress runtime behavior require a recorded runtime oracle command, not a static artifact pass.
Exact API And Verification Contract
Every generated packet, remediation note, and verification handoff must name the concrete WordPress surface it relies on. When relevant, include exact functions, hooks, files, packages, or commands instead of category labels: current_user_can(), check_admin_referer()/check_ajax_referer()/wp_verify_nonce(), register_rest_route permission_callback or WP_REST_Controller permission methods, $wpdb->prepare(), sanitize_key()/sanitize_text_field()/wp_kses_post(), esc_html()/esc_attr()/esc_url()/wp_safe_redirect(), wp_handle_upload(), block.json, register_block_type(), render_callback/render.php, deprecated block versions/migrate/transforms, theme.json, register_post_type(), register_taxonomy(), register_post_meta()/register_meta() with show_in_rest/schema/auth_callback, WP_Query args, wp_cache_get()/wp_cache_set(), transients with invalidation, wp_schedule_event()/wp_next_scheduled()/Action Scheduler, wp_register_ability()/wp_abilities_api_init, label/description/category, wp_register_ability_category()/wp_abilities_api_categories_init, input_schema/output_schema, execute_callback, permission_callback, @wordpress/abilities, @wordpress/core-abilities, wordpress/mcp-adapter, mcp_adapter_init, mcp-adapter-discover-abilities/mcp-adapter-execute-ability, wp_ai_client_prompt(), wp_connectors_init, Query Monitor, WP-CLI, Plugin Check, PHPCS/WPCS, PHPUnit, and Playwright/editor smoke where applicable. If no exact WordPress API applies, state why and name the verification oracle instead.
Calibration
Treat uncertainty as design data. Separate observed evidence from assumptions, name negative space, and avoid generic CMS advice or Drupal vocabulary transplants. Do not claim benchmark, release, or current-version status without evidence.
Failure Modes
Watch for hidden authorization assumptions, unsafe production commands, missing rollback, missing test strategy, cache claims without invalidation, block/theme editor parity gaps, unlogged upstream reuse, and unsupported version claims.
Output Contract
Use these headings:
## Spec Conformance## Generated Theme Files## Accessibility And Performance Notes## Editor Frontend Parity Notes## Deviation Log## Verification Notes## Critic Handoff
Provenance
Original Zivtech executor protocol. Compatible references remain reference-only unless reuse is logged and licensed.
