Set first release version to 0.0.8

Author: Tsvetan Stoychev

.agents/skills/change-basicrum-settings/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: change-basicrum-settings
-description: Change Basicrum WordPress settings across defaults, admin UI, validation, migrations, and runtime gates. Use for Beacon URL, Brum Site ID, monitoring enablement, HTTP Strictness, Script Position, or any basicrum_settings option.
+description: Change Basicrum WordPress settings across defaults, admin UI, validation, future migrations, and runtime gates. Use for Beacon URL, Brum Site ID, monitoring enablement, HTTP Strictness, Script Position, or any basicrum_settings option.
 ---
 
 # Change Basicrum Settings
@@ -13,15 +13,18 @@ runtime use, upgrades, tests, documentation, and translations.
 1. Inspect `plugins/basicrum/src/Helpers.php` for keys and defaults.
 2. Inspect `Admin/Settings/Page.php` and `Validate.php` for rendering,
    sanitization, validation, and error messages.
-3. Inspect `Admin/Upgrades.php` before changing an existing stored value.
+3. After the first public release, inspect the migration service before changing
+   an existing stored value. Do not add migration machinery for unreleased
+   development schemas.
 4. Find every runtime consumer and existing test with `rg`.
 5. Define behavior for new installs, existing installs, enabled monitoring, and
    disabled monitoring before editing.
 
 ## Implement the complete behavior
 
 - Keep the `basicrum_settings` schema synchronized across defaults, UI,
-  validation, migrations, runtime code, tests, docs, and translations.
+  validation, runtime code, tests, docs, translations, and any post-release
+  migrations.
 - Make server-side validation authoritative. Client-side disabled states and
   invalid-field styling are usability aids, not security controls.
 - Require a valid Beacon URL and Brum Site ID when monitoring is enabled. Keep
@@ -35,8 +38,9 @@ runtime use, upgrades, tests, documentation, and translations.
   invalid icon with the field it describes and render it only while invalid.
 - Sanitize by data type, escape for the final output context, and preserve
   capability and nonce protections already supplied by the settings flow.
-- Add a version-gated migration when stored data must change. Make migrations
-  idempotent.
+- Once a public version exists, add a version-gated migration when stored data
+  must change. Make migrations idempotent. Before the first public release,
+  keep one clean schema without compatibility aliases.
 
 If user-facing text changes, also apply `$update-basicrum-copy`.
 

AGENTS.md

@@ -19,16 +19,17 @@ namespace, PSR-4 Composer autoloading, PHP 7.4+, and WordPress 6.0+.
 - Settings use the `basicrum_settings` option. Keep defaults, UI, and
   sanitization in sync in `Helpers`, `Admin\Settings\Page`, and
   `Admin\Settings\Validate`.
-- Add version-gated migrations to `Admin\Upgrades`; use the option/version
-  constants from `Helpers`.
+- Version `0.0.8` is the first public release and has no upgrade migrations.
+  After it is published, use version-gated, idempotent migrations only when a
+  stored schema change requires one.
 
 ## Project Skills
 
 Repository-owned workflows live in `.agents/skills/`. Claude discovers the
 same canonical files through links in `.claude/skills/`.
 
-- `change-basicrum-settings` - options, validation, dependencies, migrations,
-  and runtime gates.
+- `change-basicrum-settings` - options, validation, dependencies, future
+  migrations, and runtime gates.
 - `update-basicrum-copy` - naming, administrator copy, branding, and gettext
   catalogs.
 - `integrate-basicrum-consent` - external consent adapters, callback contracts,
@@ -63,9 +64,9 @@ in the matching skill.
   displays those exact files as escaped copyable text, and automatic handling
   may enqueue exactly one after the consent loader. Prefer WP Consent API; when
   it is unavailable, select a direct adapter only if exactly one supported
-  provider is detected. Ambiguous combinations fail closed. Existing sites
-  without the integration setting remain manual; new installations default to
-  automatic. Browser tests must execute the same packaged files.
+  provider is detected. Ambiguous combinations fail closed. Automatic handling
+  is the first-release default; manual callbacks remain an explicit choice.
+  Browser tests must execute the same packaged files.
 - Keep automatic and manual administrator guidance visually separate. Automatic
   handling shows a compact verdict, provider evidence, one next action, and
   copyable non-secret diagnostics. Reveal the callback contract, provider tabs,

README.md

@@ -84,11 +84,8 @@ evidence for all three supported providers, one next action, and copyable
 non-secret diagnostics. A blocked result can reveal the matching manual setup
 without silently saving the mode change.
 
-Sites upgraded from a version without the connection setting remain on **Manual
-callbacks** to avoid running a second adapter beside an existing webmaster
-snippet. Manual handling loads no adapter automatically. The webmaster must
-load one adapter after the Basicrum consent loader and call one callback on
-every page.
+Manual handling loads no adapter automatically. The webmaster must load one
+adapter after the Basicrum consent loader and call one callback on every page.
 
 Basicrum does not persist a separate consent choice across page loads; the
 external tool is authoritative on every page. If consent is withdrawn after
@@ -246,7 +243,7 @@ security advisories. CI runs all three checks on every push and pull request.
 It also verifies that the plugin header version, `BASICRUM_VERSION`, WordPress
 `Stable tag`, and top changelog version match. Release workflows additionally
 compare the GitHub release tag to that version. Release tags must use the
-`v<version>` form, such as `v1.0.2`. To check a planned release locally, run
+`v<version>` form, such as `v0.0.8`. To check a planned release locally, run
 `BASICRUM_RELEASE_TAG=v<version> make conventions`.
 
 Dependabot checks npm, Composer dependencies, and GitHub Actions weekly. CI

checklist.md

@@ -24,16 +24,15 @@ Acceptance criteria:
 - [x] Decide whether each mode has distinct runtime behavior.
 - [x] Implement the defined behavior, or remove modes that do not represent real
   behavior and keep a single consent-enabled switch.
-- [x] Keep defaults, settings UI, validation, migrations, documentation, and
-  translations synchronized.
+- [x] Keep defaults, settings UI, validation, runtime behavior, documentation,
+  and translations synchronized.
 - [x] Add PHP tests for every supported setting and loader selection path.
 
 Decision:
 
 - Immediate loading and consent-controlled loading are the only observable
-  policies. The retired `explicit`, `implicit`, and `cookie_popup` values all
-  selected the same loader and have been removed without changing existing
-  sites' consent gate.
+  policies. The unused `explicit`, `implicit`, and `cookie_popup` development
+  values were removed before the first public release.
 - Basicrum supplies an integration gate, not a consent popup, legal-basis
   decision, or compliance guarantee.
 - In consent-controlled loading, the site's external consent tool is the source

docs/audits/checklist.md

@@ -61,10 +61,9 @@ operator-journey defect, P3 = minor/polish.
   browser coverage, and release ZIP required-file checks.
 - [x] P2 Replace the proposed "persistent consent warning" with contextual
   detection and privacy-safe automatic handling in `render_consent_info()` -
-  never a site-wide notice. New installations default to automatic handling;
-  existing installations without the setting remain manual. WP Consent API
-  takes priority, exactly one direct Borlabs Cookie or CookieYes provider may
-  be selected, and ambiguous or missing providers fail closed. The settings
+  never a site-wide notice. Automatic handling is the first-release default.
+  WP Consent API takes priority, exactly one direct Borlabs Cookie or CookieYes
+  provider may be selected, and ambiguous or missing providers fail closed. The settings
   page shows an Active, Action needed, Off, or Blocked verdict with provider
   evidence, one next action, and copyable non-secret diagnostics. Only manual
   handling reveals the callback contract and matching packaged adapter tabs;
@@ -123,7 +122,7 @@ operator-journey defect, P3 = minor/polish.
   category, stale caches). (UX 3 / BR-DOC-08, BR-DOC-09, walkthrough-06)
 - [ ] P2 Lifecycle docs: purge caches after disabling/deactivating (cached
   pages keep the loader; browser-cached HTML cannot be purged at all);
-  what deactivation keeps vs uninstall removes; migration notes; multisite
+  what deactivation keeps vs uninstall removes; multisite
   guidance. (UX 8 / BR-DOC-13, BR-DOC-17, BR-DOC-18, BR-DOC-20)
 - [ ] P2 wp.org listing: add the four screenshots or drop the section;
   fix Installation step order; add a Support section; align page-type

docs/audits/operator-experience-audit.md

@@ -1,6 +1,6 @@
 # Basicrum WordPress Operator Experience Audit (2026-07-18)
 
-Webmaster operating-comfort audit of `plugins/basicrum/` at version 1.0.2:
+Webmaster operating-comfort audit of `plugins/basicrum/` at version 0.0.8:
 how comfortable, clear, and safe the plugin is for a WordPress-competent
 non-developer to install, configure, verify, operate, and maintain. Method:
 four tracers (settings UX and copy, live wp-admin walkthrough on the real
@@ -144,8 +144,6 @@ settings screen. (issue-backoffice-unlinked, walkthrough-05, BR-DOC-16)
   (documentation side of privacy audit item 3). (BR-DOC-13)
 - [ ] State what deactivation keeps (settings) and uninstall removes.
   (BR-DOC-17)
-- [ ] Surface a notice after silent upgrade migrations (e.g. legacy installs
-  kept on immediate loading). (BR-DOC-18)
 - [ ] Add multisite guidance; network activation leaves every subsite
   unconfigured. (BR-DOC-20)
 
@@ -204,7 +202,6 @@ settings screen. (issue-backoffice-unlinked, walkthrough-05, BR-DOC-16)
   admin sidebar" matches reality). (BR-DOC-01)
 - [x] A corrupt install aborts with an actionable notice instead of a white
   screen. (BR-DOC-03)
-- [x] Upgrade Notice sections truthfully describe migration behavior.
   (BR-DOC-04)
 - [x] The Privacy Policy Guide contribution reflects the live configuration.
   (BR-DOC-05)

docs/audits/privacy-audit.md

@@ -1,7 +1,7 @@
 # Basicrum WordPress Privacy Audit (2026-07-18)
 
 Evidence-based privacy engineering and compliance-readiness audit of
-`plugins/basicrum/` at version 1.0.2, including the uncommitted privacy-first
+`plugins/basicrum/` at version 0.0.8, including the uncommitted privacy-first
 header and readme edits. Method: four parallel code tracers over data flow,
 cookies/consent, WordPress integration, and disclosures; every claimed defect
 adversarially verified by three independent refuters (majority rule); full test
@@ -114,9 +114,8 @@ documentation, though excluded from the release ZIP.
 ## 8. Clean up multisite uninstall residue (BR-WP-14)
 
 `uninstall.php` deletes options only on the site where uninstall runs. On
-multisite networks, `basicrum_settings` and `basicrum_version` rows persist on
-other subsites. Low severity: the residue is operator configuration, not
-visitor personal data.
+multisite networks, `basicrum_settings` rows persist on other subsites. Low
+severity: the residue is operator configuration, not visitor personal data.
 
 - [ ] Iterate `get_sites()` with `switch_to_blog()`/`restore_current_blog()`
   on multisite, or document the limitation in `readme.txt`.
@@ -156,9 +155,9 @@ visitor personal data.
 - [x] Opt-in is idempotent; opt-out disables collection and removes RT/BA at
   the host and all parent domains, runtime-verified (COOKIE-04, COOKIE-06,
   DF-04).
-- [x] Validation fails closed: invalid consent input selects consent mode;
-  retired `consent_mode` cannot be re-saved; migrations never flip consent
-  posture or silently enable monitoring (BR-WP-09, BR-WP-10).
+- [x] Validation fails closed: invalid consent input selects manual callbacks;
+  no pre-release compatibility path can flip consent posture or silently enable
+  monitoring (BR-WP-09, BR-WP-10).
 - [x] HTTPS enforced: `http://` beacon URLs upgrade unless development mode is
   explicitly on and warned; the bundle also defaults `beacon_url_force_https`.
   Tracer claim BR-WP-06 (protocol-relative bypass) was overturned in
@@ -228,7 +227,7 @@ visitor personal data.
   `examples/integrations/README.md` rides on generic WP Consent API evidence;
   verify or soften it.
 - [ ] Run the release packaging verification so the new privacy copy provably
-  lands in the 1.0.2 ZIP before shipping.
+  lands in the 0.0.8 ZIP before shipping.
 
 ## 14. Primary sources (accessed 2026-07-18)
 

plugins/basicrum/README.md

@@ -2,7 +2,7 @@
 Plugin Name:       Basicrum WordPress Plugin
 Plugin URI:        https://www.basicrum.com/
 Description:       Open source Real User Monitoring for WordPress.
-Version:           1.0.2
+Version:           0.0.8
 Author:            Tsvetan Stoychev
 Author URI:        https://www.basicrum.com/contact/
 License:           MIT

plugins/basicrum/basicrum.php

@@ -3,7 +3,7 @@
  * Plugin Name:       Basicrum - Real User Monitoring
  * Plugin URI:        https://www.basicrum.com/
  * Description:       Privacy-first Real User Monitoring with consent-controlled loading, page types, and Web Vitals.
- * Version:           1.0.2
+ * Version:           0.0.8
  * Author:            Tsvetan Stoychev
  * Author URI:        https://www.basicrum.com/contact/
  * License:           MIT
@@ -19,7 +19,7 @@
 }
 
 // Plugin constants.
-define( 'BASICRUM_VERSION', '1.0.2' );
+define( 'BASICRUM_VERSION', '0.0.8' );
 define( 'BASICRUM_PLUGIN_FILE', __FILE__ );
 define( 'BASICRUM_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
 

plugins/basicrum/languages/basicrum.pot

@@ -2,7 +2,7 @@
 # This file is distributed under the MIT.
 msgid ""
 msgstr ""
-"Project-Id-Version: Basicrum - Real User Monitoring 1.0.2\n"
+"Project-Id-Version: Basicrum - Real User Monitoring 0.0.8\n"
 "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/basicrum\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"