LUNARA Journal Foundation

Version: 1.3.1

The Foundation owns the journal content model, ACF fields, versioned WordPress Control Plane, draft-first scope-gated security, provenance, validation, and the Fast Journal Desk used by the private LUNARA GPT.

Journal voice lives in the compiler (1.2.14)

Foundation 1.2.14 moves the full LUNARA Journal register into the Control Plane prompt compiler as code-owned defaults: the talk-not-essay register, the standing principles, the flexible structure, headline rules, Not this / This contrast pairs, a drift catalog, a cut-on-sight list of performed-expertise phrases, and the per-entry landing plus engagement question. Before 1.2.14 the compiled prompt carried a one-sentence voice summary and the rest of the voice lived in a Dispatch fallback prompt that never executes while Foundation is active. The new keys sit under editorial.voice and are filled from code on every read, so every stored configuration version, including ones created before 1.2.14, compiles with the full voice while keeping its admin-edited summary, refinement note, and banned phrases. The validator reports the cut-on-sight phrases as warnings, never as errors. Contracts: tests/prompt-compiler-voice-runtime.php and tests/validator-house-tells-runtime.php.

Journal Workflow handoff and labeled sources

Foundation 1.2.13 contributes a capability-gated Journal Workflow destination to Lunara Site Studio when the theme registry is available. The contribution is inert without that registry and always hands administrators to the canonical WordPress tool at Journal → Control Plane. Its status is deliberately minimal: availability, validity, last activation time, enabled-source count, and the protected administrative URL. It never returns source URLs or labels, prompts, banned phrases, Notion identifiers, credentials, bridge tokens, raw provider errors, or full configuration.

The Control Plane now edits sources as recognizable labeled rows rather than raw JSON. Each row has an immutable server-owned ID, enabled state, source name, HTTP(S) URL, maximum item count from 1–50, and priority from 1–10. Unsafe schemes, malformed rows, duplicate IDs, duplicate normalized URLs, and out-of-range values are rejected before any immutable version or Notion setting is written. Invalid rows are retained briefly for the submitting WordPress user only. Successful changes continue through the single versioned create_and_activate() repository path, and removing a source or restoring a prior version requires confirmation.

Fast Journal Desk

Use the included OpenAPI schema:

openapi/lunara-journal-fast-desk.openapi.json

Authentication remains a separate GPT Action setting. Use the standard Bearer scheme for ChatGPT Actions:

Authorization: Bearer {ChatGPT Editorial Bridge key}

The legacy X-Lunara-Bridge-Token header remains supported. The key is never stored in the JSON schema, and query-string tokens are rejected.

Consolidated operations:

• GET /journal/desk — identity, health, Control Plane summary, Dispatch state, searchable and paginated drafts, attention items, and the recommended next draft. Use search, page, and limit to traverse the complete inventory without oversized responses.
• GET /journal/desk/drafts/{id} — complete editing workspace with active editorial rules and current validation, without the full audit log.
• POST /journal/desk/drafts/{id}/save-validate — save Dalton-approved fields and run deterministic validation in one call.
• POST /journal/desk/run-dispatch — queue a manual Dispatch run asynchronously and return immediately.
• POST /dispatch/drafts/{id}/mark-ready — mark a validated draft ready while preserving WordPress draft status.
• GET /dispatch/drafts/{id}/audit — retrieve full provenance only when explicitly needed.
• POST /journal/desk/drafts/{id}/publish — optional single-entry publish action. It is disabled by default, absent from the standard ChatGPT editor scope, and still requires validation plus explicit confirmation.

Dispatch 3.2.5 Hub telemetry

The private Desk and Automation snapshots now expose the same bounded, non-secret Dispatch status contract. The active runtime reports its provider, selected model, 2,200-token output cap, and three-source run budget. The last-run summary reports requested and effective model names, token counts, estimated cost, fallback/error state, processed and deferred source counts, Source Radar count, and source-packet draft count. Usage values that an older run did not report remain null and are explicitly marked unreported; a genuine reported zero remains zero. Draft summaries also identify source-packet generation without returning prompts, source bodies, response identifiers, credentials, or API keys.

OpenAI runtime configuration is constrained to gpt-5.4-mini or gpt-5.4-nano. Existing immutable Control Plane versions are preserved; reading or cloning an older version safely normalizes unsupported OpenAI model names to gpt-5.4-mini and caps output at 2,200 tokens.

Settled validation alert guard

Foundation 1.2.12 prevents a transient validation failure from producing a false IFTTT Needs Attention alert after the draft has already recovered. Validation-origin alerts settle at request shutdown after image sideload and revalidation: Foundation runs the deterministic validator again and queues an alert only if the final stored status is still failed, errors, or invalid. Returning to passed, unchecked, or any other non-invalid status clears the draft's failure signature. The signature is stored only after cron queueing succeeds and is cleared after queue or delivery failure so a persistent failure can be retried. When a queued post-specific alert reaches WordPress cron, Foundation reads the current stored validation status again and silently skips delivery unless it remains invalid. Dispatch-run failure and connection-test alerts remain independent and are never suppressed by this post-specific check.

Featured Image Guard

Every Fast Desk draft now carries deterministic featured-image diagnostics.

Hard validation failures:

• no featured image attached
• missing or unresolved media-library attachment
• featured media is not an image
• image URL or dimensions cannot be resolved
• image is smaller than 800x450

Quality warnings:

• image is below the preferred 1200x630 resolution
• aspect ratio falls outside the landscape-friendly 1.50-2.10 range
• attachment alt text is missing

openJournalDesk reports compact image status and aggregate image counts. openJournalWorkspace returns full dimensions, MIME type, URL, aspect ratio, alt text, hard errors, and warnings. saveAndValidateJournalDraft and markJournalDraftReady fail when the image is missing or unusable.

Featured image sideload

Foundation can attach a featured image to a Journal draft directly from a remote image URL, closing the gap where only an already-uploaded attachment id was accepted. This lets the editor choose the image for a story and attach it in the same pass as the writing, so the words and the picture are reviewed together.

Trigger it by writing the post-meta key _lunara_journal_set_featured_image_url on a Journal draft, for example through the standard update-post bridge path. Optional companion keys _lunara_journal_set_featured_image_alt and _lunara_journal_set_featured_image_credit supply alt text and credit; alt text defaults to the entry title when omitted.

On the request that writes the trigger key, Foundation:

• validates the URL (http/https only) and downloads it with media_sideload_image
• reuses an existing attachment when the same source URL was sideloaded before
• sets the media-library image as the draft's featured image and reads the assignment back before trusting it
• mirrors the source URL, alt text, and credit onto the journal_image_* fields
• clears the Featured Image Guard cache and re-runs validation so the image diagnostics reflect the new image immediately

The outcome (attachment id, dimensions, and any error) is recorded on the draft as _lunara_journal_image_sideload_result for inspection. Sideloading only applies to draft, pending, and private Journal entries; published, scheduled, and trashed content is refused. A public Lunara_Journal_Image_Sideload::sideload_from_url() is also available for same-process callers.

Speed behavior

• The default first Journal Desk page is cached for 60 seconds. Search results and later pages are always queried directly.
• Active configuration is cached within each WordPress request.
• Compiled prompts are memoized within each WordPress request.
• Normal workspace responses omit full audit history.
• Manual Dispatch runs are queued in WordPress rather than holding the GPT Action request open during feed, AI, and image processing.

Access profiles

The chatgpt_editor profile has these scopes:

read, update, validate, mark_ready, run_dispatch, audit, schema

Existing ChatGPT keys automatically receive the run_dispatch scope when the profile registry is loaded. Publishing remains absent by default, but an administrator may explicitly add the publish scope to this dedicated profile without granting wildcard WordPress access. Scoped keys do not need to be regenerated.

IFTTT Pro+ Journal Automation

Foundation 1.2.12 keeps the dedicated ifttt_operator profile and private Automation Inbox. IFTTT is transport only: Foundation authenticates each request, deduplicates event IDs, stores a bounded audit history, and keeps WordPress authoritative. The profile may call only the server-enforced draft ingest in addition to its existing capture, run, and notification actions; it still has no read, update, validation, audit, conversion, schema, publication, deletion, or wildcard authority. Draft ingest queues the existing guarded image sideload when an external transport supplies journal_image_source_url, so a private draft can receive its source image without media-library or publication authority. Human-readable Feedly publication dates are normalized to the site's ACF database format before strict readback verification. Long unstructured draft copy gains editable paragraph markup without changing its words, and capped WordPress source images request a 1920px derivative while retaining the original provenance URL.

Supported first-release workflows:

• Morning Desk — asks WordPress to compile operational Journal/Dispatch status and queues an allowlisted IFTTT notification.
• Run Lunara — reuses Fast Journal Desk's existing asynchronous Dispatch queue.
• Capture Idea — stores a private Automation Inbox draft.
• Source Radar — stores a private source candidate with its exact source URL. Dispatch can consume only new Source Radar entries through a bounded same-process bridge; successful or editorially terminal outcomes are triaged, while retryable failures stay queued.
• Screening Follow-Up — stores private post-screening notes without creating a public article.
• Needs Attention — emits only for failed Dispatch reports or failed Journal validation.

Generate the dedicated IFTTT profile token from Journal → Journal Bridge. Send it only in an Authorization: Bearer or X-Lunara-Bridge-Token header. Configure outbound IFTTT delivery only through LUNARA_IFTTT_WEBHOOK_KEY in wp-config.php or the deployment environment; the key is never stored in a WordPress option or rendered in Control Desk.

The IFTTT profile has only three scopes: capture private signals, queue Dispatch, and trigger the allowlisted notification workflow. It cannot read the private inbox or broader Journal audit API, and it can never publish, schedule, delete, change plugins/themes, or change cache/CDN settings. Exact Applet recipes and the activation/rollback gate are in docs/IFTTT-PRO-PLUS-SETUP.md.

Safety

The default ChatGPT Editorial Bridge key refuses:

• publish
• schedule/future
• delete/trash
• WordPress post-status changes
• published, scheduled, or trashed content
• external Control Plane activation or rollback

The dedicated publish route remains available only to an explicitly publish-scoped key or a WordPress user who can both edit the selected entry and publish posts. Control Plane publishing is off by default.

Authentication is header-only. Send access keys with Authorization: Bearer <token> (recommended for ChatGPT Actions) or the legacy X-Lunara-Bridge-Token; query-string tokens are rejected.

Legacy migration safety

• Auto-conversion defaults to off and no conversion cron is created during activation.
• Saved-post conversion runs only after an administrator explicitly enables it.
• Bulk legacy conversion requires a read-only preview followed by the exact confirmation phrase shown in WordPress.
• Only IDs preserved in the current server-side preview are eligible for the confirmed conversion.
• The conversion completion marker is written only after the post type change is successfully read back as journal.

Dependencies

• WordPress 6.4 or newer.
• ACF Pro for the fully editable Journal field interface.
• Lunara Dispatch 3.2.5 or newer for Foundation 1.2.13 automated OpenAI collection, cost-safe Responses API requests, source-packet fallback, and complete Hub telemetry.
• Journal protocol 1.x compatibility between Foundation and Dispatch.

WordPress remains the authoritative runtime. The private GPT is the daily editorial interface. Notion is optional and is not required by Fast Journal Desk.

Install order

1. Confirm Lunara Dispatch Automation 3.2.5 or newer is active. When upgrading an older paired stack, disable automated runs until Dispatch has been upgraded first.
2. Replace the existing LUNARA Journal Foundation with version 1.3.1.
3. For production, update the private GPT Action schema using openapi/lunara-journal-fast-desk.openapi.json.
4. For staging, use openapi/lunara-journal-fast-desk.staging.openapi.json and replace its staging host variable before importing it.
5. Keep the current GPT instructions; the 1.2.13 automation routes are separate from the Journal Editor Action schema.
6. Configure the GPT Action to use Bearer authentication. Existing scoped keys remain valid; reissue a key only if the installation still uses the retired legacy wildcard token.

Private Journal Desk app (1.3.1)

Open /journal-desk/ with your existing WordPress administrator login to review drafts, propose revisions, adjust the Journal voice, manage sources, run Dispatch, and approve publication. Add it to your iPhone Home Screen for a standalone view. The same canonical voice powers Dispatch and rewrite proposals. Existing publication gates remain in force. See Journal Desk installation and verification.