Tati Pilates

Private WordPress plugin to manage classes, students, bookings, payments, makeup sessions, attendance, and the student portal for Tati Pilates.

This repository contains only the plugin code. It does not include credentials, sensitive documentation, local data, or generated ZIP packages.

Main features

• Management of schedules, spots, and class formats.
• Student registration linked to native WordPress users.
• Weekly and individual plans.
• Bookings from wp-admin and from the /mi-pilates portal.
• Booking cancellation, absence reporting, and makeup sessions.
• Private weekly agenda and agenda copy for WhatsApp.
• Simple monthly payments, without amounts or currency.
• Attendance, absences, and automatic makeup-session generation.
• Personal achievements, medical data, allergies, birthdays, and start date.
• Internal notifications for admin and students.
• Lightweight PWA for the student portal.
• Test data for local environments.
• Restricted roles tp_admin_pilates and tp_tatiana; Tatiana gets access to medical data without receiving native WordPress privileges.

Structure

tatipilates.php
uninstall.php
includes/
admin/
public/
assets/
docs/
tests/
.github/workflows/
updates.json
pre-release-check.sh

Local files excluded from the repo:

• CONTEXTO.md
• dev/
• release/
• guia-rapida-tatiana.*
• checklist-pruebas-tati-pilates.*
• mipilates.zip
• logs and Mac files

Local development

In LocalWP, the plugin can be mounted with a symlink to the project folder:

ln -s "/Users/vicunav/Documents/Codex/Mi Pilates Admin" "/path/to/wordpress/wp-content/plugins/tatipilates"

Then activate the plugin from wp-admin.

The student portal lives at:

/mi-pilates

Pre-release

Before generating a ZIP for staging or live, run:

./pre-release-check.sh

To run it without interactive prompts:

./pre-release-check.sh --yes

The script checks:

• PHP syntax using LocalWP's PHP.
• PHP files with a UTF-8 BOM.
• Forgotten debug code.
• That release/tatipilates/ does not exist.
• Plugin version in tatipilates.php.
• WordPress version used for the local regression run.

Confirmed compatibility is saved to release-metadata.json, and the workflows copy it automatically into the published channel's manifest.

If everything passes, it generates a ZIP at:

release/tatipilates-VERSION-YYYYMMDD-HHMM.zip

The ZIP includes:

• tatipilates.php
• uninstall.php
• includes/
• admin/
• public/
• assets/

The ZIP does not include local documentation, credentials, dev/, release/, dotfiles, or auxiliary files.

Recommended workflow

1. Create or work on a feature locally.
2. Test in LocalWP.
3. Review changes:

git status
git diff

4. Registrar el cambio en docs/releases/changelog.json; luego regenerar y verificar CHANGELOG.md:

php scripts/generate-changelog.php
php scripts/generate-changelog.php --check

5. If the change is going to staging, bump the version in tatipilates.php.
6. Run the pre-release check:

./pre-release-check.sh --yes

7. If the checks pass, commit:

git add .
git commit -m "type: short description"
git push

Message examples:

feat: add student notification preferences
fix: prevent duplicate recovery booking
chore: update release checks

8. Upload the generated ZIP to staging.
9. Test staging, especially:

• Login and password reset at /mi-pilates.
• Student dashboard.
• Bookings, cancellations, and makeup sessions.
• Weekly agenda.
• Payments, attendance, and notifications.
• PWA/offline.
• Admin Pilates with limited operational permissions.
• Tatiana with the same operational permissions plus medical access.

10. If staging looks correct, upload the same ZIP to live.
11. After the live deploy, create a version tag:

git tag v1.0.1
git push origin v1.0.1

12. If a bug shows up in staging or live, fix it locally, generate a new ZIP, and test again. Do not edit the plugin directly on staging/live without replicating the change in Git.

Important rules

• Do not upload credentials or CONTEXTO.md to the repo.
• Do not upload generated ZIPs.
• Do not upload dev/.
• Do not edit the plugin directly on staging/live without replicating the change in this repo.
• If the database structure changes, update activation/migration and test on staging before live.
• If security or permissions change, test with administrator, Tatiana, Admin Pilates, and student accounts.
• Deactivating the plugin preserves data. Deleting it also preserves data by default; data is only deleted if explicitly enabled in the Danger Zone.
• Before debugging risky changes on staging/live, download a JSON backup from Tati Pilates > Settings.

Deploy to staging and live

The traditional manual flow is:

LocalWP -> pre-release ZIP -> staging -> testing -> live

For staging, upload the ZIP generated by pre-release-check.sh from wp-admin or through the available deploy mechanism.

For live, use the same ZIP that already passed staging. If something needs to be fixed after staging, generate a new ZIP, test again, and only then publish.

Private updater

Since 1.1.0, the plugin includes a private channel-based updater:

• staging: for the test site.
• stable: for the live site.

The first version that includes the updater must be installed manually with a regular ZIP. After that bootstrap, WordPress can detect private updates from:

Plugins > Tati Pilates > Update now

Configuration on each site:

Tati Pilates > Settings > Private updates

On staging:

Channel: staging

On live:

Channel: stable

The GitHub token is stored only in WordPress. It is never uploaded to the repo.

Recommended new flow:

Local changes
-> commit/push main
-> GitHub Action: Publish staging release 1.1.1-rc.1
-> staging updates from WordPress
-> testing
-> GitHub Action: Promote stable release 1.1.1
-> live updates from WordPress

Full documentation:

docs/updater-workflow.md

Operational guides

• docs/README.md: index of technical and operational documentation.
• docs/architecture.md: map of classes, layers, and responsibilities.
• docs/codex-workflow-guide.md: how to open new chats, request changes, version, and document.
• docs/codex-workflow-guide.pdf: printable/quick version of the Codex workflow guide.
• docs/data-model.md: custom tables, relationships, indexes, and data rules.
• docs/local-development.md: LocalWP, symlink, local PHP, demo data, and local workflow.
• docs/product-decisions.md: functional decisions that must be respected.
• docs/release-runbook.md: steps to publish to staging and promote to live.
• docs/roadmap.md: future improvements and technical debt.
• docs/security-checklist.md: security checklist for sensitive changes.
• docs/testing-checklist.md: tests to run before publishing a version.
• docs/troubleshooting.md: common issues and diagnostics.
• docs/updater-workflow.md: releases across the staging and stable channels.

Security

The plugin uses:

• Nonces on sensitive actions.
• tp_manage_pilates capability for administration.
• Ownership checks for student actions.
• Sanitization on save and escaping on output.
• $wpdb->prepare() and typed $wpdb methods.
• Strict false === checks on database operations.
• Internal logging controlled by WP_DEBUG.
• Rate limiting on portal login.
• Generic messages on password reset to prevent user enumeration.
• Private updater with no tokens hardcoded in the code.

Repository

Private repository:

https://github.com/mariovicunadev/tatipilates-plugin

Base prompt for new chats

Use this prompt when opening a new Codex conversation for future changes:

We're working in the local repo:
/Users/vicunav/Documents/Codex/Mi Pilates Admin

Private WordPress plugin: Tati Pilates.
Private GitHub repo: https://github.com/mariovicunadev/tatipilates-plugin
Main branch: main.

Read README.md, CHANGELOG.md, and docs/updater-workflow.md before touching code.
If CONTEXTO.md exists locally, read it too, but do not upload it to the repo.

Workflow:
- Do not commit or push until I ask for it.
- Log relevant changes in CHANGELOG.md.
- Keep credentials, release/, dev/, CONTEXTO.md, and ZIPs out of the repo.
- Before closing a batch for staging, run ./pre-release-check.sh --yes.
- To publish updates, use the staging/stable channels documented in docs/updater-workflow.md.

Goal of this chat:
[describe the change or bug here]