v0.0.11 — Feature 042: Core category (WP core update) + backup filename scheme

Highlights

Adds two abilities under a brand-new Core Category folder that finally let AI / MCP clients apply WordPress core updates through the Abilities API — a gap that existed since Feature 046's absorbed inventory shipped. Also rebalances backup filenames from opaque backup-{type}-{slug}-{random}.zip to human-readable, time-sortable {slug}-{unix-timestamp}-{ms}.zip.

New Core category

• acrossai-abilities-manager/wp-core-update-check — read-only. Wraps WP core's get_core_updates(); flattens the first offer into JSON-friendly fields (current_version, new_version, response, locale, download URL, PHP / MySQL requirements). Safe from any authenticated admin context.
• acrossai-abilities-manager/wp-core-update — wraps WP core Core_Upgrader::upgrade(). Optional version (+ optional locale) inputs; when omitted, upgrades to the first response=upgrade offer. Requires BOTH manage_options AND update_core (matches WP core's own admin gate). Honours DISALLOW_FILE_MODS via File_Mods_Guard. Multisite guard bails cleanly if the current user lacks network-level update_core. Idempotent — re-running on an already-latest site returns updated=false with a clean success envelope.

Both live under a new Core tab on the Ability Library page, sub-grouped as Lifecycle.

WP-core-only: No bundled updater code, no custom HTTP fetch, no custom integrity verification. All upgrade infrastructure is WP core's responsibility.

Backup filename scheme

Filenames produced by zip-create (and finalized zips from zip-upload) change from backup-{type}-{slug}-{random-12-chars}.zip to {slug}-{unix-timestamp}-{ms}.zip.

• Readable at a glance: hello-dolly-1721260800-517.zip vs backup-plugin-hello-dolly-abcXYZ12dEfG.zip.
• Lexicographic sort = chronological sort: ls -1 wp-content/uploads/acrossai-backups/ now lists in creation order.
• No same-second collisions: the 3-digit ms suffix from microtime(true) guarantees two back-to-back calls for the same target produce distinct filenames.
• Trade-off: dropping the 12-char random suffix removes the enumeration-by-guessing defense the old scheme provided. Mitigations still in force: .htaccess disables directory listing (Options -Indexes) and blocks execution of PHP-family extensions; zip-list / zip-download still require manage_options.
• Backwards-compatible: backups created on 0.0.9 / 0.0.10 with the old scheme continue to work. Only new backups get the new naming.

Spec-Kit backfill for Feature 041

specs/041-backup-restore-abilities-and-updates/ now exists with the full artifact set (spec / plan / tasks / checklists / security-constraints / memory-synthesis / architecture-review) documenting the 8 abilities that shipped in 0.0.9 and the 0.0.10 include_hidden fix. Same seven-file layout used by Feature 053's backfill.

No breaking changes

No changes to existing abilities, REST endpoints, capability requirements, or database schema. Safe upgrade.

Quality gates

• PHPStan L8 — zero errors
• PHPCS strict (WPCS) — zero errors
• PHPUnit — 153 tests / 504 assertions (up from 144 / 468 on 0.0.10; +9 tests / +36 assertions covering Feature 042)

Pull requests

• Feature: #75 — Feature 042 — Core category (WP core update) + backup filename scheme
• Release: #76 — Release 0.0.11 — bump version + changelog