HAL Site Core WP Registry grade A. No security issues foundWP RegistryNo security issues foundOpen the reportA

Infrastructure-only WordPress core plugin for hossamadellaw.com — provides the shared infrastructure (module registry, assets/settings/i18n, security helpers, GitHub-based updates); every real feature lives as an isolated module inside it.

Modules

Modules are enabled by default once registered; disabling is the explicit exception, managed from Settings → HAL Site Core.

Isolation guarantee

Any failure while booting a module — including a parse error in its own file (\ParseError is a \Throwable since PHP 7) — is caught, recorded as an admin notice naming the module, and never takes down other modules or the site. Emergency layers beyond that (native Recovery Mode, file-level disable, HAL_SITE_CORE_FORCE_DISABLE_MODULES wp-config kill-switch below the DB layer) are documented in the architecture doc §5.3.

Development

composer install            # production + dev tooling (WPCS, wp-cli i18n)
vendor/bin/phpcs            # WordPress coding standards gate
composer i18n:pot           # regenerate translation template from source
composer i18n:mo            # compile .po → .mo files

Dependency resolution is pinned to the documented minimum via config.platform.php = 8.0.0, so the lock file installs on any PHP ≥ 8.0 environment.

Releases

Pushing a tag vX.Y.Z triggers a single-job GitHub Actions workflow: verifies the plugin header version and readme Stable tag match the tag, builds the ZIP (production deps only), and publishes it as a Release asset. The bundled update checker detects new releases through PUC's default scheduling with release assets explicitly enabled.

Documentation

The full architecture document lives at docs/ARCHITECTURE.md — governing principles, module contract, boot lifecycle, isolation guarantees and emergency layers, security rules, update pipeline and acceptance criteria.