Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Deliver a production-readiness package for a custom WordPress site. Build one immutable theme/plugin artifact and a gated promotion path; separate environment configuration and secrets; define compatibility and update policy; measure query, PHP, remote, and frontend cost; implement permission-safe caching with explicit invalidation; back up database and uploads outside the server; restore them in isolation; rehearse a retry-safe data migration and code rollback; and provide health checks, alerts, ownership, incident, and recovery evidence tied to declared RPO and RTO targets.
A revision-addressed artifact moves through reviewed gates with environment separation, compatibility checks, critical-journey smokes, stop conditions, and an addressable prior release.
Database and uploads have encrypted off-system retention, named owners, stated RPO/RTO, and a timed isolated restore with data and workflow verification.
Least privilege, secret handling, extension inventory, advisory review, staged core/plugin/theme updates, audit events, and incident responsibilities are explicit and exercised.
Cold/warm measurements, cache keys and invalidation, privacy isolation, service health, actionable alerts, migration reconciliation, and rollback boundaries are backed by repeatable evidence.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# A production WordPress operations package ## Goal Deliver a production-readiness package for a custom WordPress site. Build one immutable theme/plugin artifact and a gated promotion path; separate environment configuration and secrets; define compatibility and update policy; measure query, PHP, remote, and frontend cost; implement permission-safe caching with explicit invalidation; back up database and uploads outside the server; restore them in isolation; rehearse a retry-safe data migration and code rollback; and provide health checks, alerts, ownership, incident, and recovery evidence tied to declared RPO and RTO targets. ## Acceptance criteria - [ ] Reproducible gated delivery: A revision-addressed artifact moves through reviewed gates with environment separation, compatibility checks, critical-journey smokes, stop conditions, and an addressable prior release. - [ ] Backup and recovery proof: Database and uploads have encrypted off-system retention, named owners, stated RPO/RTO, and a timed isolated restore with data and workflow verification. - [ ] Security and update discipline: Least privilege, secret handling, extension inventory, advisory review, staged core/plugin/theme updates, audit events, and incident responsibilities are explicit and exercised. - [ ] Performance and operational evidence: Cold/warm measurements, cache keys and invalidation, privacy isolation, service health, actionable alerts, migration reconciliation, and rollback boundaries are backed by repeatable evidence. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.