Zunnesco WordPress Migration & Clone Studio

Standalone plugin / panel for migration, clone, backup, and staging. This tree is Core 1.0.0: Foundation + Transfer Engine plus a working clone / staging / backup slice. Author: zunnesco-dev.

Label: sandbox — not a live cutover engine / not zero-downtime / not unverified recoverable.

Hosting Manager is a separate product. This studio reuses its ideas (allowlisted ops, checksums, restore_verified) and does not rebuild it.

Hard rules

• Every migration is a durable, resumable workflow. Steps are idempotent. Locks prevent duplicate execution.
• Source is preserved unless the user explicitly requests an authorized source-side action.
• Destination overwrite requires a backup whose integrity is at least checksum_ok. Confirm destructive actions. Restore / overwrite / cutover / source cleanup need zunnesco_migration_studio_restore.
• Stream / chunk files and DB. Do not load complete archives or SQL dumps into memory.
• Zip-slip, symlink escape, zip-bomb, and SSRF are rejected.
• Credentials and package artifacts are encrypted. Secrets are never logged.
• Serialized-safe replace only. Never blind-replace serialized PHP. Dry-run. Report malformed data; do not silently rewrite.
• Preflight + postflight. Report uncertainty — do not declare unverified success. Failed jobs cannot appear completed.
• Customer-owned exports without lock-in. Cancellation does not block export.
• No arbitrary shell or SQL. Allowlisted WP-CLI verbs are documented only; Core does not exec them.
• Woo staging→prod push excludes orders/customers/carts/sessions/stock by default.
• AI is 501 unless zunnesco_ai() exists. AI cannot start or approve destructive ops.
• Backups are created | checksum_ok | restore_verified | failed. Not recoverable until restore_verified.
• Money/meters are integers. Entitlements via SaaS Creator if present.

How to create a project, run preflight, export a package, dry-run replace, restore-verify

1. Activate Zunnesco WordPress Migration & Clone Studio.
2. Open Migration Studio → Projects. Seeded: Local clone rehearsal (this site as source, destination = package export — not overwrite live).
3. New project: title, intent (package / clone / backup / staging_push), source URL, optional dest URL, clone-intent flag for same-target clones.
4. Open the project and click Run preflight. Blockers prevent start. A stale fingerprint invalidates a previous approval.
5. Click Export package (zunnesco_migration_studio_run). Manifest is versioned with SHA-256 parts. No connector credentials. Signed download tokens are one-time.
6. Use Dry-run replace for URL/path search-replace. Serialized PHP is unserialized with classes disabled. Nothing is written.
7. Open Backups (zunnesco_migration_studio_restore), enter a backup ID, and Restore-verify to temp. Only then is the point restore_verified. Protected points cannot be deleted.

Core does not modify the source by default, does not blind-replace serialized data, does not claim unverified success, and does not run arbitrary shell/SQL.

Caps

• zunnesco_migration_studio_manage
• zunnesco_migration_studio_run
• zunnesco_migration_studio_restore (stronger)

REST

GET/POST /wp-json/zunnesco-migration-studio/v1/projects
GET      /wp-json/zunnesco-migration-studio/v1/projects/{id}
POST     /wp-json/zunnesco-migration-studio/v1/projects/{id}/preflight
POST     /wp-json/zunnesco-migration-studio/v1/projects/{id}/export
POST     /wp-json/zunnesco-migration-studio/v1/projects/{id}/replace
POST     /wp-json/zunnesco-migration-studio/v1/projects/{id}/duplicate
POST     /wp-json/zunnesco-migration-studio/v1/backups/{id}/restore-verify

Responses never include secrets.

Tests

php tests/test-schema.php

Stub WordPress. Covers: duplicate job does not duplicate steps, resume from checkpoint, project dup excludes credentials, cross-project isolation, path jail / symlink escape, replay rejected, zip-slip and zip-bomb, SSRF, serialized replace + dry-run, malformed serialize reported, dest backup required, source unmodified on dest failure, chunk resume, package tamper / missing part / no credentials, clone rotates salts/identity and disables mail/payments, Woo tables excluded by default, failed migration cannot be completed, backup not recoverable until restore_verified, protected point cannot delete, no arbitrary SQL/shell, AI cannot start migration, no eval, sandbox label, prefix collision warning.

Delayed (README only)

Incremental zero-downtime, full multisite engine, live Woo HPOS cutover, agency template factory, AI planner execution, analytics warehouse, JVZoo, production GO, Testing Lab.

License

GPL-2.0-or-later