TrustBeacon 0.1.12 - optional WPVibe integration

Requirements
- WordPress 6.9+ with the WordPress Abilities API.
- TrustBeacon active on the target site.
- A separately authorized WPVibe connection to that site, with a WordPress user who has manage_options (normally an administrator).
- WPVibe is optional. TrustBeacon's normal dashboard works without it.
- No new AI account, AI API key, or pairing system is added by TrustBeacon. WPVibe and the AI client have their own account terms and usage limits.

The notice on TrustBeacon's admin page reports API availability, not connection status. It is not evidence that WPVibe is installed, connected, or authorized.

Using the integration
1. Connect and authorize the site through WPVibe.
2. Ask the assistant to discover the site's TrustBeacon abilities.
3. Inspect the ability schema before calling it.
4. Run trustbeacon/run-audit, then review completed_at, findings, evidence, and limitations.
5. Use trustbeacon/get-last-audit to retrieve the same saved snapshot without running checks again.

Example request
"Use WPVibe to discover TrustBeacon abilities, run its audit, and show the timestamped findings and limitations. Do not change site configuration."

DKIM selectors
- Omit selectors to use the dashboard's saved list.
- Supply selectors such as ["selector1"] for a one-run override.
- [] requests limited automatic discovery using common selector names.
- Only enter names from the active sender/provider or DKIM-Signature header. Examples are not a recommendation for a particular provider.
- Automatic discovery cannot identify the active mail service and cannot enumerate every possible selector. Its summary is informational, never a scored configuration pass.
- If a provider changes its selectors, supply the new names. Core auditing does not depend on that provider. Changed algorithms or DNS behavior may require a later plugin update.

Scope and storage
- Only this installed site's host is audited. Arbitrary target URLs are not accepted.
- Both abilities require manage_options and use the existing authenticated WordPress user.
- Running an audit saves only the latest timestamped report. It does not send mail or alter DNS, mail settings, content, or security controls.
- A dashboard audit can also save the selectors explicitly entered there. An API override does not change that setting.
- Repeated identical requests within 60 seconds reuse the report and retain its original timestamp.
- get-last-audit is read-only and returns an error if no report for this site and plugin version exists.
- TrustBeacon does not continuously monitor or run scheduled background audits.
- Reports and selector settings remain in local WordPress options until overwritten or manually removed. No private keys, messages, mailbox credentials, or visitor information are collected.
- Requested report data passes through WPVibe and the AI client under their own data policies. TrustBeacon itself does not contact an AI service.

Interpreting findings
- A public key passing supported DNS/key checks does not prove that outgoing mail is signed, passes authentication, aligns with DMARC, reaches an inbox, or is delivered.
- Actual outgoing authentication is always marked not_tested by this release.
- DNS failure, unsupported key validation, and incomplete automatic discovery are unknown/INFO rather than false assurances or absence claims.
- INFO findings do not affect the numerical score. Excluding an unknown is not a pass.
- Other public-indicator checks retain their limitations; absence of a public security-plugin indicator is not proof of no installed security plugin.

Troubleshooting
- Abilities missing: confirm TrustBeacon is active, WordPress supports the API, and the connection targets the correct site.
- Permission denied: the authorized WordPress user must have manage_options.
- No saved audit: run an audit first; older-version or other-domain snapshots are deliberately not reused.
- Old timestamp: get-last-audit is a snapshot; run-audit repeats checks after the 60-second identical-request cache expires.
- A transport timeout does not prove that the audit did not finish. Retrieve get-last-audit and inspect the timestamp before retrying.
- Storage failure: the run result reports saved=false. Do not claim that get-last-audit contains the new result.

Validation status
The 0.1.11 run-audit and get-last-audit abilities were invoked successfully through WPVibe on itechguide.com (WordPress 7.1.3), with a matching snapshot completed at 2026-10-18T00:07:13+00:00. The 0.1.12 ability code and audit engine are unchanged. This does not establish nonadministrator HTTP denial, compatibility with every WordPress release, or a clean final Plugin Check run.
