# a2zz AI Catalog Bridge for WooCommerce regression matrix

## Historical v0.2.0 baseline

The verified v0.2.0 test store demonstrated:

- 20 published products -> storefront A2ZZ WebMCP tools registered.
- 21 published products -> storefront tools were blocked.
- Returning to 20 -> registration returned.
- `search_products`, `get_product_details`, and `check_stock` executed against WooCommerce.
- Public tools were read-only.

The 20/21 quota behavior is historical only. It is intentionally superseded in v0.3.0.

## WordPress.org free-core architecture

- 20 published products -> included storefront tools remain available.
- 21 published products -> included storefront tools remain available.
- Larger catalogs -> no A2ZZ Free product-count gate is applied.
- No `tier_blocked` response exists for the three free-core storefront tools.
- No time limit, request quota, or payment boundary disables the three included tools.
- `search_products`, `get_product_details`, and `check_stock` remain independently enable/disable-able by the merchant.
- Any future paid add-on adds distinct functionality instead of unlocking/restoring free-core functionality.

## v0.3.0 hardening

- Empty search query returns structured error.
- Search query >100 characters returns structured error.
- Search limit is capped at 20.
- Invalid/non-public product IDs return structured error.
- Private/draft products are not returned.
- Missing SKU/image are returned as empty strings rather than fatal errors.
- Sale pricing is represented.
- Variable products include a bounded variation summary.
- Descriptions are text-only and length bounded.
- Tool disabled -> structured `tool_disabled` error.
- WooCommerce inactive -> structured `woocommerce_inactive` error.

## AI Assistant Access

- Off -> A2ZZ server abilities not registered; admin WebMCP tools not enqueued.
- Assisted -> read-only A2ZZ admin abilities available to authorized users.
- Assisted -> no A2ZZ update tool.
- Full -> A2ZZ update-tool-settings ability available to authorized users.
- Full -> AI can only change the three A2ZZ shopping-tool toggles.
- AI cannot change `ai_access` itself.
- AI cannot change any future add-on licensing.
- AI cannot edit WooCommerce/WordPress data through A2ZZ.

## Frontend exposure / IP regression

Before each candidate or release:

- Inspect all files under `a2zz-webmcp/assets/` as if they were public.
- No API keys, passwords, tokens, private keys, shared secrets, database credentials, or license secrets are present in browser assets.
- No proprietary pricing/licensing algorithm is implemented in browser JavaScript.
- The free core contains no product-count or usage-quota unlock logic in PHP or JavaScript.
- Any future paid-add-on entitlement enforcement remains server-side and outside the WordPress.org free core.
- Admin authorization remains enforced in PHP capability/nonce checks, not only by hiding UI controls.
- Public browser code does not contain product/order/customer write logic.
- Public REST/WebMCP responses contain only explicitly allowlisted fields.
- No sensitive behavior depends on minification, obfuscation, hidden DOM state, or an undiscoverable endpoint.
- Browser-visible WebMCP schemas/descriptions are treated as public and contain no confidential implementation details.

## One-click browser verification

- Browser test mode is available only to an authenticated user with manage_woocommerce or manage_options.
- Normal storefront visitors do not receive the browser-test UI/assets.
- Test discovers tools with document.modelContext.getTools().
- Test passes the returned RegisteredTool object to document.modelContext.executeTool().
- Test executes search_products with a published-product-derived query.
- Test uses the returned product ID to execute get_product_details and check_stock.
- Test displays text PASS/FAIL results without requiring DevTools.
- Test is read-only and does not alter WooCommerce data.

## Accessibility / UX

- All settings have visible labels and descriptions.
- Native checkboxes/radios are keyboard operable.
- Focus indication remains visible.
- Status indicators include text/icons, not color alone.
- Headings and diagnostics table are semantic.
- Help icons duplicate already-visible/helpful content and include screen-reader text.

## Command-line checks

Run:

`studio wp a2zz status`

`studio wp a2zz test`

The self-test is non-destructive and validates the free-core no-quota status plus backend catalog calls. Browser-level WebMCP registration/execution still requires Chrome testing.