v0.0.18 — Feature 060 (ACF integration framework) + wp.org guideline #8 compliance fixes

Highlights

Feature 060 — Third-party integration framework with Advanced Custom Fields (ACF) as the first concrete integration. Flip one toggle on a new "Acf" tab in the Ability Library page to enable ACF's AI abilities (FieldGroup / PostType / Taxonomy) without editing code. The base class is reusable — future integrations (WooCommerce, WPForms, …) subclass it and declare their own slug / label / enable_filter / abilities.

Extensibility surface — any WordPress plugin can now register its own regular ability cards on an integration's tab (alongside the integration's own toggle card) via a documented 3-step contract using wp_register_ability_category(), extending Ability_Definition, and setting meta.acrossai.tab_group to the integration's published TAB_GROUP constant.

Two WordPress.org plugin directory guideline #8 compliance fixes rolled into the acrossai-co/main-menu 0.0.23 → 0.0.27 composer bump:

• 0.0.26 — Consultations submenu no longer embeds a Calendly iframe. Renders a self-contained call-to-action page that opens calendly.com in a new browser tab only when the admin clicks the button. Fixes the "using iframes for admin pages" prohibition.
• 0.0.27 — Add-ons page install action is now WordPress.org-only. Cards whose source is wordpress.org continue to install in-page (plugins_api() + Plugin_Upgrader); cards with any other source (github, freemius, or any consumer-defined value) render as external "Get add-on ↗" links that open the vendor's site in a new browser tab. Fixes the "installing plugins/themes/add-ons from non-WordPress.org servers" prohibition. Same pattern used by WooCommerce and GiveWP for their extension marketplaces.

New

• REST filter — acrossai_integration_toggle_capability lets sites raise (never lower) the WordPress capability required to flip an integration toggle. Enforced server-side on the same write path that persists the toggle. Companion audit action acrossai_integration_toggle_denied fires immediately before the 403.
• 20 new PHPUnit tests + 12 new Jest tests cover the base-class contract, the extension pattern end-to-end, resilience under target-plugin deactivation, the default-OFF safety property, and the sparse-storage bugfix regression. Full suite: 191 tests passing.
• 6 new durable memory entries in docs/memory/:
  • DEC-ABILITY-DEFINITION-CTOR-HOOKS
  • PATTERN-LIBRARY-INTEGRATION-BASE
  • PATTERN-LIBRARY-INTEGRATION-TAB-EXTENSION
  • PATTERN-FILTERABLE-CAPABILITY-RAISE-ONLY
  • BUG-WP-CORE-ABILITY-CATEGORY-PRE-REGISTRATION (WP core silently rejects abilities whose category isn't pre-registered via wp_register_ability_category)
  • BUG-SPARSE-STORAGE-UNIFORM-DEFAULT-ASSUMPTION (asymmetric-default keys break naive sparse-storage optimisations)

Fixed

• Sparse-storage in acrossai_library_config was silently stripping integration ON entries. The pre-Feature-060 sparse-storage rule assumed every category defaults to enabled=true, so a { enabled: true, mode: 'all', sub_keys: {} } payload was stripped as "default state". Integration categories invert that default (missing = OFF per FR-008), so the ON state was being silently dropped and the toggle appeared to turn itself off on reload. Fixed by teaching sparse-storage which slugs are integrations (via new public helper AcrossAI_Ability_Library_Registry::get_integration_slugs()) and computing the correct default per-category before deciding whether to strip.

Compatibility

No breaking changes. No ability slug rename. No REST endpoint change. No option-shape change. No new required capability. Existing 218 abilities behave identically. Safe upgrade from 0.0.17.

Consumers that only ship wp.org-sourced add-ons via the acrossai_addons filter see no visible change. Consumers pushing GitHub/Freemius entries will see those cards flip from Install button to "Get add-on ↗" link — no code change required on their side.

Full changelog

See README.txt — the = 0.0.18 = block has the full entry list.

Merge commit: 6f12789
Pull request: #96