AICPub Publisher Connector

AICPub Publisher Connector connects one WordPress site to the AICPub publishing
service. A WordPress administrator chooses the publishing user, allowed authors
and categories, and whether the connection may publish publicly.

An authorized AICPub user can prepare a draft or request a publication using
the permissions granted to that site. Every content change requires its own
approval. The connector reports the result back to AICPub so the user can
verify what WordPress saved or published.

An AICPub account with access to the service is required. See External service
for the data exchanged during setup and publishing.

Administrator-managed connection

Open Settings > AICPub Publisher Connector. Paste the one-use code and the exact local
policy JSON. The policy lists revision,execution_user_id,allowed_author_ids,
allowed_category_ids,capabilities and html_profile=publisher-post-html-v1. Choose
existing users/categories; arrays must be sorted and unique. site.read and
operation.read are mandatory; draft.create,draft.update,media.upload,
published.update,publication.publish are
separate opt-in grants. The administrator then confirms the returned tenant,
exact site and grants. Pending consent does not enable content operations.
Every content effect additionally needs its own current signed approval attestation.

External service

This connector integrates with AICPub (https://aicpub.com/). An admitted AICPub
account is required for its account-first setup. The default setup service is
https://app.aicpub.com/; an operator may configure a separate test deployment.
Activation alone does not connect an account or start a content transfer.

When a WordPress administrator starts setup, the connector sends the site’s name,
HTTPS REST address, installation/setup identifiers and a temporary setup proof to
the configured service. After account approval, the selected WordPress execution
user ID, allowed author/category IDs or category scope, and granted capabilities
are sent for consent. Setup status and pairing requests use those same service
endpoints. The administrator must approve the account/site and permissions before
the binding becomes active.

For an active binding, authenticated service requests read the permitted site
profile and operation status and deliver only the content/media and actions
covered by the granted policy and current signed approval. Responses can include
permitted author/category information, post/media identifiers, URLs and operation
verification results. Disconnect sends a revocation notice to the configured
service. Unknown write outcomes are inspected; they are not automatically retried.

AICPub privacy information: https://aicpub.com/privacy/
AICPub service terms: https://aicpub.com/terms/
Support: https://aicpub.com/support/

Updating an existing installation

The directory installs under aicpub-publisher-connector. Some earlier private
installations use publisher-connector. If your site uses that older folder,
ask your site administrator to verify the migration and rollback path before
installing the directory version. Changing the folder can stop WordPress from
loading the active connector. Activating it again revokes the existing pairing.

Keep the complete WordPress content-directory and database backup, including
all connector options and any existing legacy key file.
Update an active installation without deactivating, deleting or reactivating the plugin: those
lifecycle actions revoke the connection and require pairing again. Pause and
drain service dispatch before a file-consistent replacement; retain the key and
operation journal. A local upgrade from an observed 0.1.6 source snapshot passed;
an actual connected production-account upgrade remains unverified. Once database-
backed ciphertext is stored, older releases cannot decrypt it. Use a release that
supports the current key format for rollback; never restore stale connection or
operation records to make an older release appear usable.

Operations and lifecycle

POST outcomes are never automatically retried. Executing/unknown operation rows
remain nonexecutable; authenticated GET readback does not repair/delete content.
Disconnect revokes locally first; its service notice is attempted once. Reactivation
requires pairing. Deactivation/uninstall preserve posts,media,installation identity
and operation tombstones while removing active secret material. There is no automatic
content cleanup or tombstone purge. Controlled restore/clone requires revoking the
service epoch before copying/restoring; undetected same-origin database rollback
cannot be detected reliably by this plugin.

Durable fixed-window quotas: authenticated tenant/site requests 120/minute; code
exchange attempts 10/10minutes per installation+admin and 30/10minutes per direct IP.
Quota and nonce state does not rely on WordPress transients/object cache. A 429 is
not permission to retry a business POST; reconcile with authenticated reads.

Native Sodium clears temporary secret buffers. On WordPress sodium_compat,
references are released without calling its unsupported memory-wipe function;
secure physical memory erasure is not claimed for the PHP polyfill.

Explicit result control after connection renewal

The authenticated operation control route accepts the exact original expired
request and original key ID through a current same-tenant/site/installation
binding. The old key ID is audit metadata; old secret material is not used.
Existing executing/completed/cancelled rows must match the full original request
audit fingerprint. Control holds the original execution lock and never writes,
deletes or republishes content. A missing correlated receipt can be repaired
transactionally, or an absent request can receive a nonexecutable tombstone.
Changed content, missing correlation or another installation remain unresolved.
A normal operation request cannot use this route as an execution fallback.

License

The distributed Publisher Connector package is licensed under GPL-2.0-or-later.
See LICENSE for the complete GNU General Public License version 2. This license
applies to the distributed connector files, including its schema copy; it does
not relicense the separate publisher engine, operator workspaces or AICPub service.