NV Digital Open Operator System (NV oOS)

NV Digital Open Operator System (NVoOS)

         

Version: 1.1.43 Release Date: 2026-08-01

See § Previous Releases for all version history.

MCP Specification: 2026-07-28 (Stateless Core, Full Compliance) Maintained by NV Digital License: GPLv3 or later Requires: WordPress 6.0+, PHP 7.4+ Patent Status: Patent Pending (Application #19/410,504) Documentation: Grade A (95/100) — 1,617 files across 12 directories, 108 admin screenshots, 100% feature coverage

🔍 For Reviewers & Auditors

New to this repo? Start here → docs/project/FOR_REVIEWERS.md That document answers every common question in one place: what the project is, current security posture, what's production vs experimental, PHP version requirements, AI development methodology, compliance status, and scoping advice for a limited-budget review. Quick links for reviewers: - Addon Inventory — what each of 26 addons does and its status - Security Posture — current state of all 50 audit findings - Compliance Traceability — every .org rejection reason → commit → verification command - AI-Assisted Development — methodology, transparency, and what to scrutinize - Architecture Overview — component diagram and data flow

📑 Table of Contents

Getting Started

• 🧩 Overview
• 🎯 Our Mission
• 🛡️ Active Security Monitoring
• ⚠️ Warranty & Safe Use
• 🏗 System Architecture
• 🚀 Features
• 📦 Installation
• 🌱 Beginner 3-Step Install (Try it on Your PC)
• 🔌 What You Lose Without Third-Party Plugins
• ⚙️ Configuration Checklist
• 📚 Documentation

Core Functionality

• 🧠 Memory & Tool Stack Overview
• 🛠 Built-in tools & automations
• 🗨️ Front-end chat surfaces
• 💬 Frontend Shortcode

Addons & Extensions

• 🏗 System Architecture (covers addon ecosystem)

Orchestration & AI Features

• 🏗 System Architecture (covers orchestration, harnessing, MCP servers, memory bridge)

AI Providers & Integration

• 🧠 Language Model Providers
• 🧱 ChatKit Integration
• 🌐 Crawl4AI Integration
• 📡 Job Notification System
• 🧊 Elementor Widgets

Performance & Optimization

• ⚡ Message Bundling
• 🎯 Agentic Loop Token Management
• 🔄 Chat Performance Optimizations
• 🌐 Mesh Compute Routing
• 🔗 Federation & Discovery System

Remote MCP Setup

• 🔒 MCP Server Authentication
• 🌐 Connecting Remote MCP Clients
• 🛰 REST API Endpoints
• 🌊 SSE Streaming Support
• 📝 MCP JSON-RPC 2.0 Endpoint
• 🔑 Assistant API Credentials
• 🎫 Token Management UI

Assistant Management

• 🛠 Assistant Editor Overview
• 📊 Assistant Storage: CPT vs CCT
• ⚡ Assistant Tool Shortcuts
• 🧠 Agent Skills
• 👔 Professional & Team Layers
• 🧵 REST Chat Payloads & Attachments

Development

• 🐳 Local Development with Docker
• 🧑‍💻 Development Tooling
• 📦 NPM Packages
• 🧪 Testing & QA
• 🧩 Hooks & Filters
• 🧰 WP-CLI Commands

Reference

• 🔐 JetEngine Capability Reference
• 🛰 JetEngine REST API Reference
• 🧮 Usage Tracking
• 🧷 Attachment MIME Controls
• 🧾 Logging
• 🧾 JetEngine REST Endpoint Report Helper
• 🔌 Optional Tools & Dependencies
• ✅ Manual QA Scenarios

---

🗺 Repository Map

| Directory | Purpose | |-----------|---------| | includes/ | Core plugin classes — admin, assistants, tools, services, REST, security (7 infrastructure classes), providers (~15 AI backends), harness, data, markup, measurement, skills, professions, teams, slash-commands, A2A/ACP protocols, federation, elementor, blocks, crawler, integrations | | lib/core/ | Framework-agnostic AI orchestration engine (nvoos/core): 32 domain contracts, 21 WordPress adapters, ChatOrchestrator, ProviderRouter, ToolRegistry, SkillRegistry — PHP 8.1+ | | addons/ | 27 installable addons (Pro, Chat SPA, Docs Hub, SaaS Controller, Cloud Worker, Cloudways Dashboard, Toolkit Shell, Canvas, Canvas Toolkit, Document Editor, Media Studio, Graphify, Comic Reader, Funiq Bridge, AI Platform, Algorave, Cornerstone3D, Embedded, Fantasy Football, LibreChat, Schedule Anything Platform, Schedule Anything SPA, Tenant Router, Page Agent, Crocoblock DS, LibreChat, Status Page) | | assets/ | Frontend JS/CSS, images, CSV templates, examples | | .agents/skills/ | 21 coding-time agent skills for Zed editor (WordPress plugin development patterns) | | .bmad/ | 6 BMAD workflow agent YAML definitions + team composition config | | .context/ | Subsystem context files (8 topics + 5 templates) for agent session loading | | plugins/ | Standalone plugins: NVOOS Graphify, NVOOS Graphify AI, NVOOS Graphify AI Platform | | packages/ | 23 NPM packages under @nvdigitalsolutions scope | | src/ | TMA (Telegram Mini App) builders + workflow builder source | | shared/ | Shared source code across builds | | core/ | Standalone "core" distribution (mcp-ai-wpoos-core.php) | | config/ | Site blueprints | | examples/ | Agent and workflow example code | | tests/ | PHPUnit test suite | | docs/ | Comprehensive documentation (~1,600 files across 12 directories) | | bin/ | Development and deployment scripts | | docker/ | Docker Compose configuration | | languages/ | Translation files (.pot/.po/.mo) | | patches/ | Dependency patches | | .github/ | CI/CD workflows (~30 pipelines), custom agents, Copilot instructions |

---

🧩 Overview

Real-time AI Orchestration Toolkit for Wordpress - NV oOS is a modular AI framework (Object-Oriented System) for WordPress that connects your site's data with 15 language-model providers: OpenAI, Gemini, Anthropic, DeepSeek, OpenRouter, Baseten, Kimi (Moonshot), Z.AI (GLM), DigitalOcean, NVIDIA NIM, Cloudflare Worker AI, Ollama, LM Studio, and Hugging Face. It allows you to create and manage AI Assistants that can interact with users, access WordPress data, and perform custom tool functions.

✨ What's New at a Glance (v1.1.43)

• 🔒 Security Hardening v1.1.43 (16 files). SSRF protection across 7 provider connection handlers + A2A agent URL. SQL table-name validation against injection. A2A per-assistant agent cards now auth-gated. Chat SPA /config and /manifest endpoints require authentication (no longer public). Missing args schemas on 7 REST endpoints. Guest rate-limiting now IP-based (DoS vector closed). 3 tool capability mismatches corrected. Centralized defense-in-depth capability gate in Tool Registry. PHP object injection prevention via safe_unserialize helper.
• 🆙 MCP Protocol Upgrade (2026-07-28). Stateless core — sessions retired, server/discover replaces initialize, _meta per-request capabilities, Mcp-Method/Mcp-Name headers on Streamable HTTP, TTL/cache-scope on tools/list. Legacy client shim for backward compatibility. 10 files changed.
• 📚 OKF v0.2 Trust-Signal Support. Indentation-aware recursive descent parser with inline YAML mappings, nested object lists, and flow sequences. New trust-tier derivation (unverified/machine-confirmed/human-reviewed), staleness checks, search() extension with trust filters. New okf_validate_attestation tool. All 6 existing OKF tools surface trust signals. 15 files, 27 standalone smoke tests.
• 🏗️ Pro Module Registry. wp_mcp_ai_pro_init() decomposed from ~625-line monolithic function into a PSR-4 module registry with per-module loading, dependency ordering, and graceful degradation. Fixes broken require paths in module loader.
• 🎯 Ideal Customer Profile (ICP) System (Pro CRM Phase G). 7-dimension scoring engine (0–100) with fit+intent separation, behavioral decay, and negative scoring. 2 new MCP tools: compute_icp_score, manage_icp_profile. Admin UI with profile list table and 7-tab editor.
• 🔧 Profession & Playbook Sync Fixes (7 PRs). Playbook bulk sync silent failures now report errors. Force-regenerated playbook files no longer deleted. Undefined array key in playbook stats fixed. Duplicate profession slugs removed from knowledge base (312→311 entries). Title fallback prevents duplicate posts on Update. Consumed-post collision fix ensures all unique KB entries create distinct posts. Test Model assistant dropdown restored.
• 🧹 Hexagonal Architecture Purity. PlatformFlushInterface contract extracts wp_ob_end_flush_all from framework-agnostic lib/core/ SSE handler into a WordPress adapter — zero WordPress references remain in nvoos/core.
• 🛡️ Phase 3 Operational Security. Audit logger REST route hook corrected (init → rest_api_init). Security posture signals hardened.
• 📦 Dependency Updates. WPCS bumped to 3.4.1 (CVE-2026-45293). Dev tooling: Phpactor LSP replaces Intelephense.

✨ What's New at a Glance (v1.1.42)

• 🛡️ Security Infrastructure Hardening. 7 new security infrastructure classes (Request Guard, Security Posture with 21 signals A-F grading, Destructive Ops Gate, URL Guard, Concurrency Guard, Cost Tracker, API Key Store). Site Health integration. Production hardening guide. CORS, rate limiting, error verbosity, and body size enforcement with admin dashboard posture signals.
• 🏗️ Framework-Agnostic Core (lib/core/). nvoos/core package — Hexagonal Architecture with 32 domain contracts + 21 WordPress adapters. ChatOrchestrator with RateLimiter + SemanticCompressor. 109 tools migrated to framework-agnostic format. ProviderRouter with 12-provider routing. 5 chat parity gaps closed.
• 📡 Status Page & Incident Communication (Pro). Maintenance window system with frontend banner, countdown timer, and multi-channel notifications. Incident workflow with phase state machine, phase-aware dispatcher, and lesson bridge. 4 new AI tools for service status and incident management.
• 🤖 Agent Skills & BMAD Agents. 21 coding-time agent skills for Zed editor covering WordPress plugin development patterns. 6 BMAD workflow agent YAML definitions with team composition config. Full .context/ subsystem context files with 8 topics + 5 templates.
• 🎵 Algorave Addon. New live coding and algorithmic music generation addon with 9 tools, pattern/session CPTs, and REST API.
• 🔒 Security Hardening (12 fixes). OAuth token lifetime controls, DICOM PHI auto-redaction, asset version stripping, exception guard, auth brute-force protection, SSE CORS filter, webhook secret indicator. 13 new security unit tests.

✨ What's New at a Glance (v1.1.41)

• 📚 OKF Integration (Open Knowledge Format v0.1). Google vendor-neutral knowledge format engine with 6 MCP tools for curated, deterministic knowledge management. All 41 bundled skills are now OKF v0.1-conformant.
• 🔒 Security Compliance Fixes (11 HIGH/P0). HMAC-signed policy tokens for professional selector, health endpoint auth-gating, ZIP path traversal prevention, CSRF nonces on sync endpoints, SRI integrity hashes for all 6 CDN libraries, Google Chat OIDC hardening.
• 🔧 Playbook Sync Fixes. Duplicate AJAX handler conflict resolved. Silent sync failures now report errors to admin UI. CPT class loading guards prevent fatal errors during bulk reseed.
• 🔑 Model Provider Credential Resolution. Model picker now resolves API keys from all 4 sources — settings, credentials option, environment variables, and PHP constants.
• 🛡️ Dependency Security. adm-zip, axios, and brace-expansion bumped to resolve 18 Dependabot alerts across 5 package.json files. npm audit: 0 vulnerabilities.

✨ What's New at a Glance (v1.1.40)

• 📝 Content Format Awareness. New WP_MCP_AI_Content_Format_Helper detects and preserves Markdown, HTML, and plain text formats across post-modifying and analysis tools — AI-generated content retains its intended structure through the full create/update pipeline.
• 🔗 Research → Paper Store → WordPress Draft Pipeline. All research tools now support save_to_paper_store for staging results in the flat-file Paper Store. New create_post_from_research Pro tool bridges staged research to WordPress drafts. Human-in-the-loop review before publishing.
• 🎬 Demo Video Pipeline Complete (Phases 0–5). Scripted scene recording with AI voiceover narration. GitHub Actions CI workflow automates video assembly. 14 narration scripts and video catalog.
• 🔐 Settings Credential Split. Sensitive API keys moved from wp_mcp_ai_settings (autoload) to separate non-autoload wp_mcp_ai_credentials option with transparent merge. One-time migration. wp_suspend_cache_addition and dual cache clearing for defense-in-depth.
• 🤖 Kimi & DeepSeek Client Parity. Both providers now match all first-class providers: streaming, tool use, token tracking, and error handling. Plus DeepSeek and 9 missing providers added to all research tools.
• 📊 Model Catalog Update (July 2026). 24 files updated across base + pro. Default bumps: Gemini gemini-2.5-flash → gemini-3.5-flash, NVIDIA meta/llama-3.1-8b → nvidia/nemotron-3-nano-30b-a3b, Gemini Live gemini-2.5-flash-live → gemini-3.1-flash-live-preview.
• 🏗️ OOS Engine: SchemaStoreInterface + Tests. New domain contract, PostTypeSchema/TaxonomySchema entities, GetPostTypeSchemaTool, WordPress adapter. 45 new tests.
• ⚡ SSE HTTP/2 Fixes. ob_clean() replaces ob_flush() to prevent protocol errors. 524 timeout resolved in Pro SPA v2.
• 🔍 Vector Store Sync — No Polling. Status now checked only on assistant change and page load, reducing API load.
• 🔧 Settings Import/Export Batch (4 fixes). Credential merge, save key wipe, subtab sanitization, export consistency — all resolved.
• 🛡️ Validated Tool Slug Allowlist. Tool slug matching fixed for validated variants.

✨ What's New at a Glance (v1.1.39)

• 🤖 Page Agent Addon v0.1.0. New addon (addons/page-agent/) — AI-powered browser page control copilot powered by Alibaba Page Agent (MIT). Give any WordPress page its own AI agent that can click, type, and navigate via natural language, running entirely client-side with no headless browser required. Includes shortcode, Elementor widget, REST endpoints, and MCP tool bridge.
• 💬 Pro SPA v2 — Major Parity Update. Voice pipeline, tasks drawer, workflow tracker, and file attachment upload to WordPress Media Library. Tool Shortcuts and Slash Commands drawers. Mobile hamburger sidebar toggle. Speech/audio button fixes using correct REST endpoint. Conversation title improvements and turn count display fix. Button and token NaN display fixes. Model sync and auth bypass fixes. Assistant preloading in runtime config.
• 🎨 Pro SPA v2 — UI Polish. Autoscroll fixes (submit, streaming start, user-at-bottom guard, scrollTop vs scrollIntoView). Viewport height fixes via CSS height chain instead of viewport calc. overflow:hidden on height-chain ancestors. filemtime cache-busting across all SPA addons. Lint errors resolved.
• 👤 Per-User Chat Memory Preferences. Users can now toggle chat memory on/off from their WordPress user profile. Individual control over AI memory retention without affecting site-wide defaults.
• 📝 create_post / save_post Tool Enhancements. Markdown-to-HTML conversion via new WP_MCP_AI_Tool_Markdown_Converter trait. Smart taxonomy suggestions auto-detect relevant categories and tags. Block content corruption fixed for non-post post types.
• 🔄 Workflow Blueprint & Schedule Improvements. Existing-content awareness in Content Publisher and Keyword Pipeline blueprints. Blog schedule presets now check for duplicate content before publishing. Readable response generation for workflow schedule result delivery.
• ♿ SPA Accessibility. Annotation pills made clickable with meaningful screen-reader labels.
• 🛡️ Security. OWASP ZAP DAST medium findings triaged as false positives.

✨ What's New at a Glance (v1.1.37)

• 🏭 EZuite Inventory Sync Pro Toolkit. ERP-integrated inventory sync bridging EZuite ERP with WooCommerce/WordPress. Pull products, query inventory, create/update items, manage orders, and configure API credentials — all via AI tools. Admin UI with connection selector, field mapping, and sync direction controls. CLI sync commands for batch operations.
• 🔄 Ralph Loop CCT Migration & Orchestration. Circuit breaker pattern with configurable failure thresholds. Execution logger with step-by-step tracking. CCT migration tools for safe cross-environment JetEngine data operations. Orchestration tools for multi-step workflows.
• 📅 JetBooking/JetAppointment Integration (8 tools). Adapter layer for Crocoblock booking and appointment plugins. 8 new tools + 4 enhanced calendar tools with booking/appointment awareness.
• 🧠 Moonshot AI (Kimi) & Z.AI (GLM) Provider Parity. Both providers upgraded to full DeepSeek-level chat client capabilities — streaming, tool use, token tracking. ZAI client + baseten service in DI container. Provider count now 15 first-class.
• 📋 Unified Sync Log Manager. Per-item audit trail across EZuite, FlowHub, and Shopify sync toolkits. Sync history with timestamps, status, and error tracking. Status dashboards on admin pages.
• 🎛️ Tool Presets Auto-Select & Chips Bar. Selected tools display as clickable chips with +N overflow toggle. Tool payload cap raised from 50 to 100 tools per assistant.
• 🌐 HTTrack Cache & Place-to-Service Bridge. HTML mirror import now supports HTTrack cache directories. Auto-creates bookable services during batch place import. URL backfill for mirrors without hts-cache.
• 🔌 FlowHub Per-Connection Overview. Remote Sites connection selector on FlowHub config tab. Per-connection sync controls. Proxy support via http_api_curl hook.
• 🔍 Web Search 429 Retry. Exponential backoff for rate-limited search requests.
• 🐛 45+ Bug Fixes. CCT module API mismatches across EZuite/FlowHub/Shopify (canonical Module.instance/Factory/ItemHandler). EZuite sync (missing return, field mapping, connections, CCT registration). FlowHub sync (silent failure, proxy persistence, auth headers, null cct, dry-run). Shopify sync (Catalog API guard, CCT registration lifecycle). Duplicate column errors in ensure_columns. SQLite meta cache explosion. masterminds/html5 case collision. Base-version guard blocking toolkits. Tool registry fatal guards. HTTrack import (URL resolution, hex filenames, subdirectory content, mirror detection). Necessity Gate request context crash. Auto-select compute timeout. Place-to-Service bridge collision.
• 📖 Documentation. Abilities registration plan (~1,000 tools as WordPress Abilities). Laravel-scale deployment architecture proposal. WP.org submission prep. Agent context sync.

✨ What's New at a Glance (v1.1.35)

• 🏪 FlowHub Inventory Sync Pro Toolkit. 6-tool cannabis dispensary management: products, inventory, locations, sync, analytics, alerts. P1 proxy support via http_api_curl hook. P2 CCT auto-registration in JetEngine custom content type tables. Auth, decryption, location_id, and null-guard fixes (PRs #5500, #5501, #5502, #5503, #5507, #5510). Admin UI toggle on Features tab.
• 🛒 Shopify Sync Pro Toolkit. 5-tool bi-directional e-commerce sync: products, orders, inventory, analytics, settings. Connection resolver trait. Dashboard widget with sync status and recent activity. Tool reference docs at docs/tools/shopify-sync-toolkit.md (PR #5502).
• 🛡️ Necessity Gate Layer J. Pre-execution safety layer that scores tool calls by irreversibility risk. Write operations (create/update/delete) assigned risk scores by resource type. Safety profile trait with clean autoload. Request context crash fix.
• 🎙️ Local Voice Embedded STT. Three pluggable browser-side speech-to-text backends: Web Speech API, Whisper.cpp (WASM), Vosk (WASM). Offline-first — no server dependency. Auto-detection based on browser capabilities (PR #5498).
• 🌐 Remote Site Administrator Blueprint. 22-tool assistant blueprint in Site Creator toolkit for full remote/local WP/WooCommerce management with JetEngine, JetFormBuilder, and REST API control. Auto-discovered by Unified Blueprints page.
• 📦 Places & Calendar Bulk Import. Batch import tools for Places and Calendar Booking toolkits — import multiple records in a single call (PR #5509).
• 💻 CLI site-import Subcommand. Multi-phase HTML mirror import for migrating static sites into WordPress — page structure extraction, content mapping, media sideloading.
• 🎤 Voice Realtime Auto-Detect. WebRTC/WebSocket auto-selection, duplicate message prevention, VAD threshold improvements (PR #5508).
• 🔧 Remote Connections Fixes. WordPress case handling normalized. FlowHub and Printful credential storage fixed (at-rest encryption). Printful connection type added (PR #5499).
• 🐛 7 Bug Fixes. Token-scoped assistant resolution (PR #5497), user_id empty fallback (PR #5495), credential token mapping (PR #5493), post type name lengths (PR #5484), OpenAI image deprecation cleanup (PRs #5489-#5491).
• 📋 Documentation. GPT-Realtime-2 upgrade proposal + 1,166-line implementation plan. FastAPI porting implementation plan (PR #5467).
• 🧹 Housekeeping. Stale build artifacts and toolkit-addons directory removed.

• 🔌 WP 7.0 Connectors Credential Integration. Credential_Resolver now integrated into all 17 AI client get_api_key() methods. Fallback chain: WP 7.0 Connectors → plugin settings → env vars → PHP constants. Credential source badges and WP 7.0 Connectors hints rendered in admin settings UI. All 13 provider API key field descriptions updated. Provider diagnostics show key source column. Settings health check counts credentials via resolver.
• 🧩 nvoos-graphify v1.0.0. Standalone nvoos-graphify plugin released at v1.0.0 (Plugin Check compliant). nvoos-graphify-ai released at v1.0.0-dev. Fixed critical ->prepare() spread-operator bug in Db::listNodes(). Renamed vector column → embedding_vector to avoid MariaDB/MySQL reserved-word conflict. Fixed snake_case→camelCase method calls across tools, controllers, and cross-plugin integrations.
• 🛡️ Security Dependencies. guzzlehttp/guzzle 7.10.0 → 7.12.1 (CVE-2026-55568, CVE-2026-55767). guzzlehttp/psr7 2.11.0 → 2.12.1 (CVE-2026-55766). guzzlehttp/promises 2.3.0 → 2.5.0. undici npm override tightened >=7.28.0 → >=8.5.0.
• 🔒 npm Security. 29 alerts resolved across 14 packages: undici (TLS bypass CVE-2026-9697, cache info CVE-2026-9678), http-proxy-middleware (CRLF injection CVE-2026-55603), nodemailer (GHSA-p6gq-j5cr-w38f), webpack-dev-server (HMR CVE-2026-9595), dompurify (GHSA-cmwh-pvxp-8882). Fixed critical duplicate overrides key in root package.json.
• 🪲 Bug Fixes. Fixed missing -pro- in WP All Import/Export require_once paths causing fatal errors when those Pro tools load. Fixed fragile @file_get_contents() warning suppression in tool status label loader — replaced with explicit set_error_handler('__return_true') to prevent leaked warnings from corrupting MCP JSON-RPC HTTP responses.
• 📦 Dependencies. 15 Dependabot bumps across Composer, npm (stripe, zod, p-queue, csv-parse, react-query, puppeteer, vitest, wrangler, eslint-plugin, workers-types, types/node), and GitHub Actions (codecov 4→7, action-gh-release 2→3).
• 🧹 Housekeeping. Stale 1.1.31 and 1.1.32 build zips removed. SPA addon ZIPs rebuilt with updated security overrides.

✨ What's New at a Glance (v1.1.32)

• 📝 Content Format Templates & Featured Images. Content Format Template CPT with user-editable blog templates. Content Template Engine generates Anthropic-optimised AI prompts. Featured Image Service with 3-provider fallback (DALL-E → Gemini → Cloudflare) and 5 image styles. Provider image settings now respected instead of hardcoded defaults.
• 📬 Result Delivery Pipeline. 1,056-line service routes schedule results to 8 channels (email, Slack, Discord, Telegram, SMS, Paper Store, WordPress post, webhook). Both success and failure paths now deliver — previously only failures were surfaced.
• 📄 ECA Document Generation. ECA Consolidate & Add page with document generation tools.
• 🪲 Duplicate Posts Fixed. WordPress delivery channel removed from weekly_blog_post_writer and weekly_blog_topic_research presets. Systemic guard skips WordPress delivery when AI tool calls already include create_post or save_post.
• ⏱️ 6 Provider Clients Timeout Fix. DeepSeek, Baseten, DigitalOcean, OpenRouter, Kimi, and Cloudflare clients now respect the global request_timeout setting instead of hardcoding 60 seconds.
• 🔧 Schedule Trigger Stability. Trigger crash on rest_do_request() fixed with try/catch + pre-flight REST check. Result delivery sanitizer preserves channels wrapper so edit modal shows saved values. AJAX handler captures PHP warnings that corrupt JSON.
• 📋 Paper Store Delete Fix. Hidden inputs added to delete confirmation form so handle_delete_record() receives required POST fields.
• 🧪 npm CI & Jest Resilience. Babel ESM override pinned for Node 18/20 compatibility. Jest config probes for setup files at load time with graceful fallback. npm ci lockfile sync for 5 addons.
• 📦 Dependencies. 14 safe Dependabot bumps. 8 npm audit CVEs (nodemailer, tar, tar-fs). phpspreadsheet 5.7.0 → 5.8.0.

✨ What's New at a Glance (v1.1.31)

• 🎬 Media Command Center. Top-level NV Media admin menu with command center for media templates, presets, and blueprints.
• 💬 Pro SPA v2 — Rich Rendering & Scoping. Rich markdown rendering, per-assistant scoping, agent selector dropdown. Conversations primary, threads read-only. Version 2.0.1.
• 🧰 34 Workflow Preset Tools. All missing workflow presets implemented across 10 toolkits. Full PHPCS compliance and test suite for 36 tools.
• 🔒 npm Audit CVEs Resolved. 12 CVEs fixed: vite, launch-editor, markdown-it, ws, js-yaml, form-data, hono, dompurify, babel, opentelemetry, joi.
• 🎨 Gemini 3.1 Flash Image. Default Gemini image model upgraded to gemini-3.1-flash-image.
• 🖼 Media Toolkit Blueprints & Presets. Blueprints and scheduler presets synced to Data Management page.
• ⚡ OpenAI/DeepSeek stream_options. Streaming usage payloads now include proper stream_options for accurate usage tracking.
• 💰 Agentic-Loop Cost Tracking. Tool result costs computed from tokens when not explicitly provided. Missing provider pricing added.
• 🛡️ Vite CVEs. vite ^8.0.16 for CVE-2026-53571 (server.fs.deny bypass) and CVE-2026-53632 (NTLMv2 disclosure).
• 🧹 1,658 PHPCS Lint Fixes. Across base + pro addon (44 toolkits).
• 🔧 CI Disk Space. Free disk space step added to all build workflows.

✨ What's New at a Glance (v1.1.30)

• 💬 Chat SPA Phase 8 — Message Actions. Edit, delete, regenerate, copy, and content enrichment cards on every assistant message. Conversations sidebar with assistant scoping. Auto-create thread on first message.
• 📊 PM Toolkit Enhancement Phase A–D. Shared engine powering Command Center dashboard with real-time task visibility. Work Ingestion panel. 28 new AI tools for task management, resource allocation, timeline generation, and reporting.
• 🏢 CRM Toolkit — Duplicates & Hygiene. Duplicate detection engine with safe one-click merge. Email hygiene module: domain reputation classification, exclusion/priority lists, auto-pruning. Top Customers/Clients analytics. LinkedIn & Upwork external sourcing.
• 🥧 DietPi Pro Toolkit Phases 0–3. 19+ tools for server management: system info, package/service control, backup/restore, storage, provisioning, SSH proxy. Registered as MCP server.
• 🛡️ Layer I Guardrails — Jailbreak Prevention. Stay-on-target guardrails blocking prompt-injection and role-change attacks. Configurable per-assistant via LLM Harness metabox.
• 🪟 Context Window Management. Pre-flight validation across all 13 AI providers. tiktoken integration, estimator metabox, token-budget tool capping, chat parity drift detection.
• 🌉 WP 7.0 Connectors API Bridge. Forward-compatible provider credential bridge. Classes load unconditionally on WP < 7.0.
• 🧠 Chat Transcript & Agent Memory Retention. Configurable TTL-based transcript cleanup (base). Agent memory lifecycle management with pruning and retention windows (Pro).
• ⚡ Pro Toolkit Optimizations Phase 1–3. Performance optimization across 6 Pro toolkits with autoload control, caching, and lazy loading.
• 🔌 OAuth & API Disconnect Buttons. One-click disconnect for OAuth and API connections with automatic token clearing.
• 💬 LibreChat Addon. New standalone addon with code interpreter, speech-to-text/text-to-speech, and web search reranker.
• 🪲 30+ Bug Fixes. SPA reliability sweep (thread endpoints, router context, event serialization). Agentic loop tool result persistence. CPT slug limits. Security CVEs (guzzlehttp/psr7, shell-quote, esbuild).

✨ What's New at a Glance (v1.1.29)

• 🔧 Chat Bubble Assistant Dropdown. Settings UX fixed: chat_bubble_assistant_id changed from manual ID input to proper assistant <select> dropdown.
• 🪟 Context-Window Pre-Flight Validation. Added to all AI provider clients with shared validate_context_window() helper, tiktoken integration, and estimator metabox.
• ⚡ OpenAI SSE Streaming Fix. stream_options payload flag corrected so OpenAI real-time SSE streaming triggers properly.
• 📅 Schedule Preset Data Mismatches. Fixed presets losing configuration data after save. Improved error logging for preset operations.
• 🧹 Playbook Orphan Cleanup & Batching. Fixed orphan accumulation and sync timeouts with configurable chunk size batching.
• 🔄 Stale Provider Validation Lists. Provider checks moved to dynamic discovery instead of hardcoded arrays, fixing DeepSeek rejection.
• 📊 CRM Activity Titles, Due Dates & Block API v3. Activity post titles, recurring due dates, and admin blocks migrated to WordPress Block API v3.
• 🎯 OpenAI-Compatible Client — DeepSeek Parity. OpenRouter, Baseten, Kimi, DigitalOcean, NVIDIA NIM clients upgraded to DeepSeek parity.
• 🎤 Voice & Embedded LLM Missing Assets. Missing .min.js files added for voice recording/transcription and embedded LLM worker scripts.
• 🪲 25+ Additional Fixes. Chat config messagesEndpoint, debug console, OOS bridge fatal error, embedding service WP_Error, SSE header warnings, memory cookie nonce, graphify content leak, model limits sync, shell-quote CVE-2026-9277, and more.
• 🧪 Tests. Chat transcript REST controller tests improved from ~4% to 87% pass rate.

✨ What's New at a Glance (v1.1.28)

• 🏢 CRM Phase C Complete. IMAP email polling, Twilio SMS webhook, Meta WhatsApp webhook, and Gmail OAuth bridge for multichannel inbound ingestion — all triaged through CRM Classifier and routed to the Workflow Command Center.
• 👥 Customer CPT + Customer 360. 5 CRUD tools for mcp_ai_customer CPT. Customer Research & Add page with Customer 360 dashboard. Lead-to-customer conversion with deal promotion.
• 🎫 Support Ticket Module — 10 AI Tools + SLA. Full ticket lifecycle: create, get, update, list, classify, escalate, resolve, reopen, merge, SLA report. Ticket automation, SLA breach detection via cron, email notifications, and optional Zendesk sync.
• 🔍 TF-IDF + BM25 Relevance Search. Dual-algorithm relevance ranking across CRM, healthcare, and base content search tools. Shared traits in both Base and Pro.
• 🧠 Transformer-Inspired Attention Routing. QKV multi-head attention (5 heads: semantic, capability, recency, dependency, risk) for semantic tool selection. Sliding-window conversation compressor. Persistent tool embedding store. RRF fusion with harness scoring.
• 🔌 Funiq Bridge Addon. Payload-to-WordPress bridge with React admin SPA, REST controllers, transformers, post types, and taxonomies.
• 🕸️ NVOOS Graphify Ecosystem. Three standalone plugins: nvoos-graphify (visual knowledge graph, 14 tools), nvoos-graphify-ai (13 providers, streaming chat, RAG, embeddings), nvoos-graphify-ai-platform (Agents, A2A, ACP, Blueprints, Federation, Harness, Measurement, Professions, Skills, Slash Commands). Framework-agnostic lib/core and lib/wordpress-adapter packages.
• 🏗️ NV Platform AI Addon. Top-level admin dashboard + CPTs (Project, Resource, Template).
• 🎬 Automated Demo Video Pipeline (Phases 1–3). Scripted scene recording, AI voiceover generation, automated video assembly.
• 🛡️ CRM Lead/Deal Enhancements. Enriched lead/company tables, dedicated Leads tab, data completeness KPI. Lead CPT admin expanded with contact details and remote channel link.
• 📋 Documentation & Unix Theory. Folder READMEs for new CRM subdirectories (customers/, inbound/, support/). Compliance check errors in includes/data/ and addons/pro/includes/traits/ READMEs resolved. CRM enhancement plan updated.

✨ What's New at a Glance (v1.1.27)

• ⚡ Real-Time SSE Streaming. Real-time streaming enabled for OpenAI, DeepSeek, and all OpenAI-compatible providers. "Disable Native Streaming" control in Settings.
• 🧰 35 New OOS Core Tools. Data tools (GetPostTaxonomies, CountPosts, GetPostMeta, TruncateText, MergeArrays), format tools (FormatDate, TimeAgo, ParseCsv, MathEval, ColorConvert), infrastructure (EventDispatcher, Queue), and cache management tools.
• 📸 Extended Cognition Vision Recognition. Visual product/brand recognition with camera viewfinder UI, detection overlays, and consent gate.
• 🔧 JetFormBuilder Submission Tools — 8 Fixes. Empty results for non-admin users, form discovery pipeline, PHPCS warnings, REST route matching, form-type auto-detection, and plugin detection all fixed.
• 🎯 Graphify Tools Capability Compliance. Missing trait and explicit get_required_capability() added to all Graphify tools.
• 🤖 DeepSeek Agentic Tool Handling. Tool message filtering and payload normalisation for agentic multi-turn workflows.
• 📝 Docs Fixes. Broken links after Unix-theory reorganization resolved.
• 💰 June 2026 Model Pricing. All 13 provider pricing updated.
• 📋 Plugin Restructuring Proposals v3.0. Graphify-centric architecture spec and roadmap.
• 🛡️ Pro Toolkits Security Audit. 9 HIGH-severity security findings fixed.
• 📋 Reviewer Onboarding Docs. Complete reviewer documentation suite (docs/project/FOR_REVIEWERS.md).
• 🐳 Docker Dev Environments. WordPress, Laravel, and Craft CMS Docker environments all fixed.
• 🧪 Test Infrastructure. 95% of PHPUnit failures resolved across base, pro, and addon test suites.
• 🔧 Infrastructure Fixes. TCPDF autoloader fix, Pro vendor files committed, puppeteer detection path fix, shallow clone recommendation.

✨ What's New at a Glance (v1.1.25)

• 🧩 Unified Blueprint System. 55 pre-built AI assistant blueprints across 25 toolkits.
• ☁️ Cloudways Pro Toolkit. 60 AI tools for server and application management via Cloudways API v2.
• 🏢 CRM Toolkit Phases A–E Complete. 70+ tools: lead management, multi-channel triage, sequences, command center, compliance.
• 💬 Chat UI Enhancements. 7 features: profile card, stop generation, feedback, code copy, dark mode, prompts, search.
• 📂 Unix-Theory Tool Reorganisation Phase 4–5 Complete.
• 🎛 Pro Toolkit MCP Server Settings Pages. Phases A–C.
• 🏥 Aerlinn + Healthcare Blueprints.
• 🔧 Build Infrastructure Hardening.

✨ What's New at a Glance (v1.1.24)

• 🧹 Bug-Fix & Stabilisation Sweep. Paper Store Pro interface load order fix (deferred to wp_mcp_ai_bootstrapped hook). Chat SPA duplicate-message and SSE protocol-mismatch fixes. Markdown rendering enabled in Chat SPA responses.
• 🛡️ Skill Manager Canonical Envelope — Unix Theory P0/P1 Refinement. Skill manager now returns WP_Error on failure instead of the legacy array('success' => false, ...) pattern. Skills sync endpoint added for idempotent import/export. YAML frontmatter parsing hardened against colons in description fields.
• 📝 Assistant Tool Presets Coverage. 24 missing tools added to assistant creation presets. Out-of-date tests fixed.
• 🔒 CVE Patches. tmp bumped to >=0.2.6 and symfony/cache to ^6.4.40 to resolve upstream CVEs. Composer vendor state committed.
• 🗄️ Paper Store Admin CRUD. Full CRUD admin UI for Paper Store collections and records under Assistants menu, matching Skills admin convention.
• 🖥️ CLI Coverage Enhancements. Comprehensive WP-CLI command coverage improvements across the plugin toolchain.
• 📚 Folder README Convention — Unix Theory P7. Folder READMEs added for every PHP-bearing subdirectory across includes/ and addons/pro/includes/. Agent context docs (CLAUDE.md, AGENTS.md) synced with recent features.
• 🔧 Build & CI. build-spa-addons GitHub Actions workflow added. Missing SPA addon ZIPs restored. All SPA bundles rebuilt.

Privacy & Terms Notice: This plugin connects to external AI services. Review each provider's policies:

• OpenAI: Terms | Privacy
• Google Gemini: Terms | Privacy
• Anthropic: Terms | Privacy
• Cloudflare: Terms | Privacy
• Hugging Face: Terms | Privacy
• Ollama: Self-hosted (no external data transmission)
• OpenRouter: Terms | Privacy
• DigitalOcean Serverless Inference: Terms | Privacy
• DeepSeek: Terms | Privacy
• NVIDIA NIM: Terms | Privacy
• LM Studio: Self-hosted (no external data transmission)
• Baseten: Terms | Privacy

See the complete External Services Reference for all 20 services.

The plugin works standalone with ~195 base tools and optionally extends through the Pro addon, which adds ~830+ Pro tools for advanced integrations (WooCommerce, JetEngine, social media APIs, GitHub, Google services, Shopify, QuickBooks Desktop, Yahoo Fantasy Sports, ESPN Fantasy, ECA management, CRE Debt & Securitization, Cloudways server management, CRM lead/deal/customer lifecycle, support ticket management, multichannel inbound/outbound messaging) and exec-based tools (FFmpeg, WP-CLI, Python rembg, Jukebox), bringing the total to ~1,025+ built-in tools (~195 base + ~830+ Pro; live count via WP_MCP_AI_Tool_Registry::get_tools() is authoritative).

Note on Tool Count: Tools include base WordPress operations, content management, media generation, research capabilities, and optional third-party integrations. The base version (~195 tools) works standalone. The full version requires the Pro addon and provides ~1,025+ total tools including specialized toolkits for e-commerce, social media, analytics, document generation, vehicle estimation, image validation, JetEngine MCP, A2A agent delegation, CRE Debt & Securitization, Cloudways infrastructure management, CRM lead/deal/customer lifecycle + support tickets + multichannel, MCP Apps, and more. Live count via WP_MCP_AI_Tool_Registry::get_tools() is authoritative.

Addon Ecosystem: NV oOS ships a growing family of 24 installable addons: Pro (addons/pro/ — ~830+ additional tools), Chat SPA (addons/chat-spa/ — React chat replacement), Docs Hub (addons/docs-hub/ — in-site documentation SPA), SaaS Controller + Cloud Worker (addons/saas-controller/ + addons/cloud-worker/ — NV oOS Cloud control plane), Cloudways Dashboard (addons/cloudways-dashboard/ — Cloudways server management), Toolkit Shell / Canvas / Canvas Toolkit / Document Editor / Media Studio (addons/toolkit-shell/ etc. — Toolkit SPA Blueprint Tier A–D), Graphify (addons/graphify/ — knowledge graph), Comic Reader (addons/comic-reader/ — CBR/CBZ/CB7/CBT reader), Funiq Bridge (addons/funiq-bridge/ — Payload-to-WordPress bridge with React SPA), AI Platform (addons/ai-platform/ — AI platform admin dashboard + CPTs), LibreChat (addons/librechat/ — code interpreter, speech, web search reranker), Schedule Anything Platform + SPA (addons/schedule-anything-platform/ + addons/schedule-anything-spa/ — SaaS booking with Stripe), Tenant Router (addons/tenant-router/ — multi-tenant routing), Page Agent (addons/page-agent/ — AI-powered browser page control copilot), Algorave, Cornerstone3D, Embedded, Fantasy Football. Separate standalone plugins: NVOOS Graphify (plugins/nvoos-graphify/ — visual knowledge graph), NVOOS Graphify AI (plugins/nvoos-graphify-ai/ — AI providers + chat + RAG), NVOOS Graphify AI Platform (plugins/nvoos-graphify-ai-platform/ — agents, A2A, blueprints, skills). See docs/developer/addons/toolkit-spa-blueprint.md for the blueprint all SPA addons follow.

🎯 Mission: Modernizing Small to Medium Business Websites

NV oOS is specifically designed to help small to medium-sized businesses fast-track their outdated, stale, or insecure company websites to modern technology standards—without the need to add yet another wrapper around API calls. Instead, we're trying to peel back decades of API wrappers with the help of AI, providing:

• Direct AI Integration - No middleware required. Connect directly to OpenAI, Gemini, Anthropic, Hugging Face, Cloudflare Worker AI, Ollama, LM Studio, OpenRouter, and DeepSeek without custom development
• Security-First Architecture - Built-in protection against nefarious usage with active monitoring and prevention systems
• Enterprise-Grade Features - Access to capabilities typically requiring expensive custom development
• Compliance & Audit Tools - Comprehensive logging, rate limiting, and usage tracking built-in
• Zero Technical Debt - Modern codebase following WordPress standards, ready for current technology stacks

🛡️ Active Security Monitoring

NV oOS actively prevents and monitors against nefarious behavior. The plugin includes:

• Nefarious Usage Monitor - Real-time detection of suspicious patterns and automatic emergency shutdown capabilities【F:includes/class-wp-mcp-ai-nefarious-usage-monitor.php†L1-L676】
• Root Security Key - Optional emergency authentication layer to prevent unauthorized reactivation after security incidents【F:docs/features/security/root-security-key.md†L1-L511】
• Granular Capability Controls - Every tool and API endpoint enforces WordPress capabilities to prevent unauthorized access
• Rate Limiting - Built-in protection against abuse with configurable limits per user, model, and time period
• Comprehensive Audit Logging - Track all API calls, tool executions, and security events for compliance and forensic analysis
• Input Sanitization & Output Escaping - All user input sanitized, all output escaped following WordPress security best practices

This is not a tool for circumventing security or promoting bad practices. Every feature is designed with security, transparency, and responsible AI usage as core principles. The plugin actively works to stop and prevent misuse before it happens.

Latest audit: See docs/operations/compliance/SECURITY_AUDIT_2026_04.md — the published summary of the April 2026 security & compliance code review (no Critical findings; 5 High items, 3 Fixed and 2 Partially Fixed). Full deliverables under docs/project/audits/2026-04/.

WordPress.org compliance hardening (May 9, 2026): docs/operations/compliance/WORDPRESS_ORG_COMPLIANCE_2026_05_09.md — findings B3, B8, B10, B13, and production vendor remap all resolved.

⚠️ Warranty & Safe Use

We make every effort to keep NV oOS safe and secure — but by design, it can be destructive and resource-intensive when not properly configured.

NV oOS grants AI assistants access to powerful WordPress operations. The same capability that automates real work can cause irreversible harm if misconfigured:

• Destructive tools — bulk content deletion, user management, file writes, mass email, WP-CLI, direct database operations
• API billing exposure — uncapped AI provider calls can exhaust quotas and trigger unexpected charges
• Server resource exhaustion — concurrent agentic loops and SSE streams can saturate CPU/memory on shared hosting

Before going live: test on staging, take verified backups, apply least-privilege tool permissions, enable rate limiting, and review the system prompt of every public-facing assistant.

📄 Full details: WARRANTY.md — security commitment, "AS IS" disclaimer, destructive-operations table, resource-consumption guide, and mitigation checklist aligned with OWASP, NIST SP 800-53, ISO/IEC 27001, and the WordPress Plugin Developer Handbook.

Patent Pending

NV oOS is the subject of a pending patent application for its novel System and Method for Dynamic AI Orchestration Layer with Real-Time Capability Gating and Resource Budgeting.

Application Number: 19/410,504

The patent covers NV oOS's innovative approach to implementing sophisticated AI orchestration in WordPress's request-based PHP architecture—a platform not designed for real-time streaming, asynchronous operations, or persistent state management. This technical achievement enables enterprise-grade AI capabilities on WordPress by recreating event-driven behavior within PHP's synchronous execution model.

Key Innovations Covered:

• Dynamic resource budget allocation during streaming operations
• Capability-based access control for AI tool execution
• Registry-state-based scheduling in stateless environments
• Metrics-driven budget adjustment for real-time optimization
• Persistent-behavior illusion in request-based architectures

The orchestration layer makes NV oOS unique in the WordPress ecosystem by solving fundamental architectural limitations that prevent traditional WordPress plugins from supporting advanced AI features. See the System Architecture section below for technical details on how these innovations work together.

🏗 System Architecture

NV oOS implements a comprehensive orchestration layer for managing AI operations during real-time streaming events. The system architecture comprises:

• 15 language-model providers — OpenAI, Gemini, Anthropic, DeepSeek, OpenRouter, Baseten, Kimi (Moonshot), Z.AI (GLM), DigitalOcean, NVIDIA NIM, Cloudflare Worker AI, Ollama, LM Studio, Hugging Face, Flowhub
• ~990 tool classes (~195 base + ~795 Pro; live count via WP_MCP_AI_Tool_Registry::get_tools() is authoritative) registered through a singleton Tool Registry
• 36 REST controllers (16 base + 20 pro) under the mcp-ai/v1 namespace
• 64 service classes powering orchestration, budgets, and workflows
• 5 authentication methods — WordPress nonce, assistant credentials, mesh keys, Auth0 JWT, guest tokens
• Toolkit MCP servers — per-toolkit JSON-RPC 2.0 servers exposed under /wp-json/mcp-ai-pro/v1/mcp/{slug}; discoverable at /.well-known/mcp
• 8 inline-async-tick consumers — cooperative tick-lock pattern eliminates WP-Cron startup latency for background jobs (transcript mining, async tool executor, SaaS Apply, Crawl4AI, Docs Hub rebuild, Graphify reindex, Harness eval, Gemini Veo polling)
• 7 LLM Harness layers (+ 1 Pro) — opt-in epistemic layers A–H activated per-assistant via the LLM Harness metabox
• Orchestration Phases 1–7 — HITL approval queue, prompt-injection detector, structured output, OTel exporter, DAG builder, durable runs, triggers/webhooks, sub-agents

📖 For a detailed explanation of how NV oOS extends standard SSE and MCP protocols with novel orchestration features, see ORCHESTRATION-LAYER-ARCHITECTURE.md

Core Orchestration Layer: Overcoming PHP's Limitations

Critical Context: Most real-time AI streaming systems are built with Node.js, Python FastAPI, or Go — platforms designed for asynchronous, event-driven operations. These platforms natively support:

• Long-lived connections and persistent state
• Non-blocking I/O and parallel execution
• Event loops and asynchronous callbacks
• WebSocket protocols and SSE streaming

NV oOS achieves the same capabilities in PHP/WordPress — an environment fundamentally not designed for these patterns — through a sophisticated orchestration layer that creates a "persistent-behavior illusion":

1. Real-Time Budget Enforcement - Monitors token/memory usage during streaming, prevents exhaustion through predictive allocation
2. Capability-Based Tool Gating - WordPress role-based access control for AI tool execution
3. Predictive Optimization - Analyzes usage patterns to prevent resource overruns before they occur
4. Distributed Orchestration - Multi-provider support with policy-aware routing
5. Auditability & Compliance - Complete governance layer with logging and rate limiting
6. Cron-Based Task Orchestration - Extends orchestration to async operations with budget inheritance

Multi-Agent Orchestration Enhancement (DeepSeek V4-Inspired)

Added: January 2026 (v1.1.0)

Building upon the core orchestration layer, NV oOS now includes a sophisticated multi-agent coordination framework inspired by DeepSeek V4's orchestration patterns:

Key Components:

• Agent Role System - Four specialized roles (Planner, Executor, Critic, Specialist) with role-specific capabilities
• Team Composition - Automated team assembly based on task requirements and profession expertise
• Coordinated Workflows - Multi-step workflows with agent delegation, result aggregation, and validation
• Team CPT Integration - Persistent team configurations with orchestration modes (single/sequential/parallel/swarm)
• Profession-Based Discovery - 296 professions auto-assigned agent roles via intelligent seeding across 17 knowledge bases

Example Multi-Agent Workflow: ```php // 1. Compose research team (planner + executors + critic) $orchestrator = new WP_MCP_AI_Agent_Team_Orchestrator(); $team = $orchestrator->compose_team( array( 'task_type' => 'research' ) );

// 2. Execute coordinated workflow // Planner decomposes task → Executors research subtasks → // Communication service aggregates → Critic validates quality $result = $orchestrator->execute_team_workflow( $team, $task, $context ); ```

Documentation:

• See Multi-Agent Orchestration for complete technical details
• See DEEPSEEK-V4-README.md for documentation suite overview
• See DEEPSEEK-V4-USAGE-GUIDE.md for practical examples

Why This Architecture Is Novel: Overcoming PHP's Limitations

• Event loops and background workers

PHP/WordPress, by contrast, is fundamentally request-based:

• Every HTTP request spawns a new process that dies after responding
• I/O operations block execution
• No persistent memory between requests
• No native event loop or async coordination

NV oOS solves this by implementing an orchestration layer that creates a "persistent-behavior illusion" — effectively recreating Node.js's event loop behavior within WordPress's synchronous, request-based architecture. This architectural compensation is the system's core technical innovation:

| PHP Limitation | NV oOS Solution | |----------------|-----------------| | No persistent state | Registry & policy engine maintain state via database/cache | | No event loop | Cron Manager extends orchestration across time-shifted operations | | Blocking I/O | Predictive budget allocator prevents blocking operations | | Request-based lifecycle | SSE controller implements streaming within request boundaries | | No background workers | WordPress cron system simulates async job processing |

This makes NV oOS patent-worthy as a technical workaround — it achieves sophisticated AI orchestration in an environment specifically not designed for such patterns. See ORCHESTRATION-LAYER-ARCHITECTURE.md for the complete technical analysis.

Computer-Implemented Resource Management

The system operates as a computer-implemented method executing on a processor with memory, performing:

1. Dynamic Resource Budget Allocation: The orchestration layer dynamically allocates token and memory budgets to tool execution requests based on real-time system capacity and operation requirements. The WP_MCP_AI_Resource_Manager continuously monitors server resources (PHP memory limits, execution time constraints) and automatically adjusts operational parameters.

1. Capability-Based Access Control: Tool execution endpoints enforce granular capability-based access controls. Each tool in the registry declares required WordPress capabilities, and the REST API controller validates user permissions before allowing execution. This ensures secure, policy-driven access to all operations.

1. Registry-State-Based Scheduling: The WP_MCP_AI_Tool_Registry maintains tool availability state and schedules execution based on policy constraints. Tools are loaded conditionally based on dependency availability, and execution is scheduled according to assistant configuration and user permissions.

1. Metrics-Driven Budget Adjustment: The system continuously monitors execution metrics (memory usage, API response times, token consumption) and adjusts resource budgets in response to prevent resource exhaustion and reduce latency. The WP_MCP_AI_Token_Budget_Manager implements safety margins and dynamic chunking to prevent API limit overruns.

System Components

The system comprises a processor and memory storing instructions that:

• Monitor real-time resource availability through PHP runtime introspection
• Enforce capability checks at REST endpoint boundaries
• Schedule tool execution through a centralized registry
• Adjust token and memory budgets based on detected system metrics
• Maintain operation logs for audit and optimization

This architecture is embodied in non-transitory computer-readable media (PHP source files) that, when executed by a web server processor, cause the system to perform the complete resource management workflow. The implementation prioritizes stability, security, and efficient resource utilization across diverse hosting environments.

Symfony Process Integration (December 2025)

NV oOS Pro addon integrates the Symfony Process component for secure external command execution. This modern framework replaces direct exec() calls in 6 Pro tools and 2 supporting services, providing:

• Enhanced Security: Proper argument escaping and command validation
• Timeout Management: Configurable timeouts with graceful handling
• Better Error Handling: Comprehensive exception catching and WordPress-friendly error reporting
• Process Control: Real-time output streaming and cancellation support

Migrated Tools & Services:

• FFmpeg operations (video frame extraction, metadata reading)
• Python rembg (background removal)
• WP-CLI execution
• Meta AI Jukebox (music generation)
• Supporting services for video and audio processing

The Proc