# CYBERMAPS release notes

Review the changes in CYBERMAPS 8.0.2 and previous releases.

The latest documented release is **8.0.2**. Free and available now. WordPress.org listing awaiting approval.

## 8.0.2

*   Enforce producer byte budgets before Markdown, JSON and link allocations; preserve completeness evidence and avoid caching partial publications.
*   Clean up worker-owned native cache entries during discovery scans; use supported runtime-only flushes for external caches.
*   Restore bounded post and metadata cache priming for uncached publications without caching failed database reads as empty results.
*   Move static ownership to per-path rows with resumable legacy migration, fenced writes and bounded reconciliation and lifecycle cleanup.
*   Validate identity and imported configuration independently from partial settings forms; use exact-byte conflict detection and rollback only owned changes.
*   Preserve concurrent settings saves and explicit choices during retired MCP cleanup, static-mode normalization and automatic translation defaults.
*   Preserve origin response headers and native REST serialization; reject incomplete Cloudflare rule responses and isolate concurrent authorization transactions.
*   Correct RSS UTC dates, XML character handling, multisite sitemap output, query aliases, canonical decisions and old-permalink notifications.
*   Report incomplete sitemap and audit scans explicitly; preserve queued edge invalidations and surface backpressure or scheduling failures.
*   Bound browser delivery checks, fence stale page-search responses and preserve disabled controls during overlapping operations.
*   Extend local release checks and retain exact candidate, runtime, website and review evidence.

## 8.0.1

*   Replace retired MCP mode configuration with an explicit read-only adapter switch.
*   Delete obsolete settings, migration notices and the unused OAuth upgrade placeholder.
*   Preserve 8.0 adapter consent and retain deletion-only cleanup for direct 7.x upgrades.
*   Guard against reintroducing legacy runtime configuration; update setup and migration docs.

## 8.0.0

*   Optional WordPress MCP Adapter replaces the custom transport and OAuth stack.
*   Read-only public discovery/search; removed remote operations and generic ability execution.
*   Guided setup, explicit migration, remote-capability release gates and matching website guides.

## 7.5.4

*   Make public sitemap attribution optional and off by default, including upgrades.
*   Require frozen candidate validation and evidence-backed policy review before release.
*   Harden Plugin Check parsing and preserve failed-validation evidence.

## 7.5.3

*   Sanitize Quick Setup fields at the request boundary and reject excessive proxy chains.
*   Escape admin HTML at output while preserving native accessible tooltip controls.
*   Separate HTML and JSON sinks from reviewed non-HTML protocol emission.
*   Publish editable asset source links and verify real WordPress input/output behavior.
*   Include clearer setup icons and the canonical local release/install workflow.

## 7.5.2

*   Hardened action authorization and setup survey validation before payload use.
*   Centralized contextual output, enqueued report CSS, bounded IP hook context, and prepared every IndexNow list value.
*   Removed reserved transient-option access and added fail-closed source, Plugin Check, artifact, and runtime release validation.
*   Restored and validated the WordPress 7.1 / PHP 8.2 runtime baseline, including native Cybermaps ability registration.

## 7.5.1

*   Added a bounded local internal-link graph using stored published content, assigned classic menus, and active-theme block navigation.
*   Added potential-orphan, unreachable-from-homepage, and three-plus-click-depth findings with evidence, focused action reports, and exports.
*   Suppressed link findings when coverage is incomplete and limited trend comparisons to reports with matching complete analysis contracts.
*   Preserved safe links and headings in Markdown alternates, full LLMS output, and RAG chunks through shared stored-content analysis.

## 7.5.0

*   Replaced Guided Setup with a three-step Quick Setup survey covering website type, AI discovery, activity logging versus lightweight delivery, and basic public identity.
*   Apply bounded site-wide presets and show a settings receipt while preserving advanced configuration outside the setup fields.
*   Fixed stale setup assets in same-version testing builds, adopted modern React mounting, and removed the placeholder brand mark.
*   Added generated publication limits and route inventories plus a documentation handoff checked against the exact release commit.

## 7.4.2

*   Counted raw candidates before SEO evaluation: briefings share a 250-candidate budget across pinned and ordinary posts; summaries examine at most 1,000 candidates and disclose incomplete coverage.
*   Fetched inventory batches as complete post rows, retained hydrated objects through URL/title and SEO helpers, primed pinned metadata, and stopped flushing unrelated runtime cache entries between batches.
*   Serialized cached, forced, full, and localized LLMS generation with durable ownership leases and MySQL session fences where supported; cache invalidation and eviction cannot authorize another owner.
*   Added a cooperative 20-second generation deadline, early pagination-progress checks, and uncached HTTP 503 responses with Retry-After when a build cannot complete. Failed builds never populate caches or replace static publications.
*   Corrected candidate-scan reporting when SEO exclusions exhaust the inventory, and isolated localized publication caches.

## 7.4.1

*   Improved sanitization of request flags, headers, OAuth callback values, and request paths.
*   Prepared database column identifiers for OAuth lookups and documented bounded database queries.
*   Clarified Cloudflare OAuth and specification links flagged by older WordPress Plugin Check versions.

## 7.4.0

*   Added opt-in managed `.htaccess` delivery with ownership-safe removal and routing diagnostics.
*   Added per-publication server-side evidence and manual public inspection links.
*   Corrected Cloudflare media types and root publication coverage.
*   Fixed report comparison SQL parameters and exception handling.
*   Fixed LLMS inventory pagination and expanded bounded full-corpus publication.

## 7.3.4

*   Fixed cross-site origin caching for `/ai-discovery` without changing its public URL.

## 7.3.3

*   Added an ownership-safe `/ai-discovery` fallback for origins with unpurgeable path caches.

## 7.3.2

*   Isolated APCu and shared object-cache entries across independent WordPress installations.

## 7.3.1

*   Fixed the Advanced Cloudflare eligibility control fatal and confirmation-row visibility.

## 7.3.0

*   Added opt-in, expiring redacted diagnostics/support bundles; renamed System Status to Debugging.

## 7.2.2

*   Disabled Cloudflare mutations when proxy traffic is not detected, with an exact-host, page-scoped manual confirmation for advanced deployments.

## 7.2.1

*   Fixed recoverable OAuth completion, canonical rule paths, and automatic browser-visible verification with per-resource diagnostics.
*   Added Cloudflare execution proof and complete OAuth metadata cache bypass.

## 7.2.0

*   Added public Cloudflare OAuth with PKCE, account consent, automatic combined rule installation, immediate token revocation, and no stored credential.
*   Added a bounded open-source callback relay, ambiguity-safe zone selection, OAuth lifecycle status, and a one-time-token fallback.
*   Added self-managed Cloudflare OAuth for organizations that want the callback, PKCE transaction, code exchange, and token revocation to remain on WordPress.

## 7.1.0

*   Added System Status with stack detection and explicit optimization-utilization evidence.
*   Added one-time-token Cloudflare header and cache-safety automation plus default-on LiteSpeed and APCu controls.
*   Unified edge diagnostics with the static publication header contract and added scoped Cybermaps-only cache invalidation.

## 7.0.1

*   Added ownership-safe `.well-known` fallbacks with explicit conformance status.
*   Unified OAuth metadata, bounded LLMS scans, and fixed duplicate-header diagnostics.

## 7.0.0

*   Raised the minimum to WordPress 7.1 and added a native public Ability kernel shared by MCP, WebMCP, API Catalog, OpenAPI, and ARD discovery.
*   Replaced nested well-known configuration with exact WordPress global rewrite rules, removed physical well-known defaults, and retained ownership-safe cleanup and public verification.

## 6.6.1

*   Added automatic ownership-safe `/.well-known/` routing for header-sensitive discovery endpoints on compatible Apache and LiteSpeed servers.
*   Added public GET/HEAD verification and explicit blocked-before-WordPress diagnostics without substituting wrong-MIME static files.

## 6.6.0

*   Added enriched per-API RFC 9727/RFC 9264 Linksets and a public REST health endpoint.
*   Added OAuth metadata, optional RFC 8628 device approval, and opt-in Auth.md without unsupported OIDC or fabricated JWKS claims.
*   Added the experimental current MCP Server Card, draft ARD AI Catalog, and opt-in read-only WebMCP with explicit maturity guidance.
*   Added server/cache/CDN rules and Configured, Advertised, Publicly verified, and canonical-interception diagnostics.

Read the [complete plugin release history](https://cybermaps.dev/changelog.txt) for earlier versions.