Restore the wordpress-source section's purpose; close the wp-admin/wp-config/mu-plugins gaps

[chubes4]

Closes #322. Supersedes #320 — that fixed false claims inside a shape that was itself wrong, so it is folded in here.

The section had lost its purpose

It exists so the agent is an expert on its own runtime by reading the WordPress installed underneath it. That is what lets a small free model be competent about WordPress with no skills and no fine-tuning. Direct Reference was the point; Read-Only was the qualifier.

The managed variant from #315 inverted it into an editable list, a read-only list, a justification, a production contract and a "not source" appendix — with "verify core APIs, hooks, conventions, and runtime behavior" surviving as one clause in the middle.

That restriction half was redundant. lib/source-policy.sh makes the runtime enforce it; prose enforces nothing. Restating the deny list bought no safety while crowding out the one thing prose is uniquely good at.

Both variants now lead with what the source is for. The managed section is about half its previous length.

Core was half-defined — in both directions

wp-admin/ and wp-includes/ are siblings, not nested. The root set was:

wp-content/plugins   wp-content/themes   wp-includes

As policy: every install ever created could edit wp-admin/** and every root PHP file — including wp-config.php, which holds the DB credentials, the salts, and the constants gating AGENTS.md composition. An agent able to rewrite it can switch off its own governance. Confirmed live on h44lacrosse.com.

As reference: the same omission pointed the agent away from list tables, get_plugins(), media handling and the upgrade routines — undercutting the section's actual purpose.

One definition of core fixes both.

wp-content/mu-plugins/ is denied too: it is agent governance, not a site extension — wp-coding-agents installs the mu-plugin that generates AGENTS.md there. wp-content/uploads/ stays open, because the agent's memory lives under it.

Declared exceptions, not a blanket deny

wp-config.php has legitimate uses (WP_DEBUG, memory limits), so --managed-writable re-opens a denied path.

It deliberately does not reuse --managed-source. That flag means editable and captured, which is what makes the "your work is recorded" promise true. wp-config.php is not captured by a component harvest. Conflating them would have AGENTS.md assert a safety property that does not hold — #318 again. Separate category, separate prose: "nothing captures them — a rebuild or migration will not carry the change."

The limitation that was backwards

We were strict about editing core (correct — an update overwrites it anyway) and accidentally strict about reading the one thing needed to recover from a fatal.

/var/log/nginx/ and /var/log/php8.5-fpm.log sit outside the site root. OpenCode gates those behind external_directory, which defaults to ask — and an autonomous Discord agent has nobody to ask. So the most important recovery capability in the whole design sat behind a prompt that could never be answered.

--log-path grants read via external_directory and explicitly denies edit, so logs are diagnostic input rather than something to rewrite.

Glob trap worth knowing

Root files are exact literals, never globs. OpenCode's matcher turns * into .*, which spans slashes, so wp-*.php would also match wp-content/plugins/acme/wp-thing.php and over-deny inside a site's own component. source_policy_edit_rules now emits a dir/file kind so each runtime formats correctly.

Tests

tests/posture.sh (79 assertions) pins:

• the purpose — reference framing present in both variants, wp-admin/ named as reference
• enumerate-never-generalise (managed posture grants edit on all of wp-content/plugins and themes, including commerce plugins and the agent's own runtime #318)
• writable-is-not-captured distinction
• log paths readable but not writable
• wp-content/uploads/ untouched by any managed rule
• deny-before-allow ordering, by index rather than sorted comparison
• the managed guidance hardcodes one install's stack (commerce plugins, Data Machine, a specific harvest exclude list) into text shipped to every managed site #320 guard: prose names none of WooCommerce, Stripe, commerce, payment, money, composer.lock, node_modules, Data Machine, homeboy, harvest.yml

tests/opencode-local-plugin-path.sh and tests/repair-opencode-json.sh had frozen copies of the old three-rule map; they now assert the properties that matter and leave the canonical list to posture.sh.

Full suite: no new failures (same 7 pre-existing environment failures as main, none in shell.yml). bash -n clean.

Follow-up

h44lacrosse.com needs a re-run after release, with --managed-writable/--log-path decided by the operator. Not part of this PR.