QuizWizz F program — canonical recovery handoff

Historical record — 2026-08-02

Preserved as observed. This packet records schema 1.6.6; the live bench now runs schema 1.6.8. Current truth: Program Masterplan.

Authority and boundary

• approval basis:
  • the operator selected the F program and explicitly authorized the schema migration plus the complete guest-AI security substrate
  • the operator explicitly authorized Nginx-only heavy-route hardening, including configuration test and reload
  • the operator requested drafted public legal/operator pages with operator-specific values left as placeholders
• implementation authority:
  • /home/loca/dev/wrdp/wp/wp-content/plugins/quizwizz/ is the verified live bench source, not a canonical release repository
  • the exact pre-program plugin preimage was recovered from the root-owned backup /home/loca/backups/wrdp/20260802T013057Z/content.tar.gz
  • this packet transfers reviewed source changes; it does not authorize a release, version bump, reconstructed build, or hand-edited distribution artifact
• product decisions:
  • supported UI languages remain English and German
  • anonymous AI is an optional operator-controlled capability and is disabled by default
  • no guest AI request is accepted until every readiness gate is satisfied
  • guest prompts and model responses are not persisted by the new substrate

Delivered source contract

• database schema: 1.6.6
• exposure-settings schema: 1.6.4
• new tables:
  • {$wpdb->prefix}qwizz_ai_guest_ledger: pseudonymous guest budget/rate accounting
  • {$wpdb->prefix}qwizz_ai_guest_reservations: in-flight guest budget reservations
  • {$wpdb->prefix}qwizz_ai_audit: metadata-only AI audit records with 30-day retention
• anonymous request identity:
  • cookie-bound pseudonymous request context
  • guest and authenticated accounting remain separate
  • no user-supplied forwarding chain is trusted by the plugin
• guest route:
  • POST /quizwizz/v1/guest-assistant
  • operations: allowlisted find and craft
  • strict JSON content type, 8 KiB body ceiling, explicit field/shape validation
  • no persistence of guest prompts or generated content
  • disabled/unready response is generic and does not disclose internal readiness failures
  • all route responses receive no-store/no-cache, no-referrer, and nosniff protections
• provider policy:
  • guest traffic requires a dedicated model and provider slug
  • OpenRouter routing is forced to allow_fallbacks: false, data_collection: deny, and zdr: true
  • an authenticated/operator path cannot silently substitute for missing guest configuration
• operator controls:
  • guest enable switch
  • daily guest budget, per-network rate, dedicated model, and dedicated provider
  • defaults: disabled, zero budget, rate 3, empty model, empty provider
  • Site Health reports the disabled posture as safe and reports unmet readiness gates without enabling the feature
• privacy/retention:
  • audit data is metadata-only and retained for 30 days
  • ephemeral craft retention is capped consistently at 30 days
  • privacy disclosures and readme.txt document the guest/provider behavior
• admin wording:
  • onboarding headings now say Getting started, avoiding a false setup action

Live migration result

• plugin active: yes
• installed schema: 1.6.6
• guest enabled: no
• guest budget: 0
• guest rate: 3
• guest model/provider: empty
• new table row counts at verification: 0, 0, and 0
• readiness: false by design; Site Health result is QuizWizz guest assistant is safely disabled
• rollback boundary:
  • applying the reverse source patch does not remove migrated tables or rewrite settings
  • the tables are dormant while guest AI is disabled
  • a canonical rollback requiring physical schema removal must be authored and reviewed as a separate migration; do not drop these tables ad hoc

Public legal and operator surfaces

• WordPress pages:
  • Privacy Policy: page ID 3, /?page_id=3
  • Terms of Use: page ID 1057, /?page_id=1057
  • Operator Information: page ID 1058, /?page_id=1058
• footer template part: post ID 900, linked with query permalinks because the site currently uses plain permalinks
• page state:
  • complete contextual drafts are installed
  • operator identity, address, contacts, jurisdiction, retention owner, and comparable deployment-specific facts remain visibly marked [INSERT-YOUR-DATA-HERE: ...]
  • these placeholders are launch blockers, not optional polish

Nginx hardening

• changed files:
  • /etc/nginx/conf.d/wrdp_limits.conf
  • /etc/nginx/sites-available/wrdp.loca.zone
• policy:
  • zone wrdp_public_heavy, rate 2r/s
  • burst 10, nodelay, rejection status 429
  • protected REST operations: craft-draft, reroll, pdf-preview, and guest-assistant
  • both pretty /wp-json/quizwizz/v1/... paths and the live site’s plain-permalink ?rest_route=/quizwizz/v1/... equivalents are keyed
  • loopback and the local public host address are exempt so operator checks do not consume public capacity
• applied proof:
  • final nginx -t: success; the only warning concerned unrelated flxr OCSP stapling
  • final systemctl reload nginx: success
  • public home after reload: HTTP 200
  • live non-exempt burst against the protected pretty-path location: 11 route responses followed by 19 HTTP 429 responses
  • isolated Nginx proof using the final query-route map: 11 upstream responses followed by 19 HTTP 429 responses
• evidence boundary:
  • a final live query-route burst was not observed because the WordPress container could no longer reach the host bridge gateway during that check
  • Nginx remained active/listening and the public site remained HTTP 200
  • therefore the evidence proves the applied final syntax/reload, the live rate-limit zone/status on the protected pretty path, and the final query-map mechanics in isolation; it does not claim a final live query-route 429 observation

Canonical handoff artifacts

Artifact	Purpose
2026-08-02-f-source.patch	source-only no-index patch for 15 plugin paths
2026-08-02-f-preimage.sha256	exact drift gate, including two expected-absent files
2026-08-02-f-postimage.sha256	candidate integrity gate
2026-08-02-f-materialize.sh	transactional candidate materializer; never edits the canonical source tree
2026-08-02-f-nginx.patch	infrastructure-owner review record for the two applied Nginx files

Materialization command:

q5vault/audits/qwizz/2026-08-02-f-materialize.sh \
  /path/to/canonical/quizwizz \
  /path/to/review/quizwizz-f-candidate

The materializer:

1. verifies every canonical preimage checksum and expected-absent path
2. copies the canonical tree to a temporary sibling candidate
3. dry-runs and applies the patch only inside that candidate
4. verifies every postimage checksum
5. atomically moves the verified candidate to the requested output path

Any drift failure is a stop condition. Rebase the patch deliberately; do not bypass the checksum gate.

Verification ledger

Check	Observed result
PHP lint, all 14 changed PHP files	pass
./scripts/quizwizz-probe.sh --wave 2	34 PHP assertions plus 3 outer assertions; 0 failures
./scripts/quizwizz-probe.sh --wave all	30 harness assertions; all wave failure counts 0
./scripts/wrdp-health.sh	7/7 checks passed
installed source against postimage manifest	all 15 paths passed
source patch dry-run/apply/round trip	exact match
materializer against exact preimage	candidate exactly matched verified postimage
REST namespace discovery	guest route advertised as POST; guest setting patterns present
disabled guest request	HTTP 403 generic response with no-store/no-cache and no-referrer headers
settings UI, desktop and 390×844	controls present, safe defaults visible, no horizontal overflow
Site Health UI	safe-disabled passed test visible
Privacy, Terms, Operator pages, desktop and 390×844	one H1 each, working footer links, no horizontal overflow
debug log fatal/uncaught/parse scan	no matches
/home/loca/dev/wikis/build.sh wrdp --check-only	41 Markdown inputs, 308 files, success
final nginx -t and reload	pass

Canonical-owner procedure

1. obtain the real canonical source repository and establish a clean branch from its release lineage
2. run the materializer against that exact plugin root; stop on any checksum drift
3. review the 15-path candidate and migrate the changes into the canonical source/build layout rather than copying generated artifacts
4. preserve schema 1.6.6 and settings schema 1.6.4; run the canonical migration tests against representative upgrades
5. run canonical lint, unit/integration, REST, privacy, and release suites
6. regenerate compiled assets, dependency manifests, translation catalogs, provenance, SBOM/signatures, and release package only through the locked canonical toolchain
7. verify the built package in a clean WordPress installation and an upgrade installation
8. have the release owner approve and sign the resulting artifact
9. keep anonymous AI disabled until provider credentials, model/provider slugs, budget, privacy text, legal placeholders, monitoring, and incident ownership are all production-ready

Release and launch blockers

• release blockers:
  • canonical repository/history is absent from this bench
  • canonical dependency manifests, lockfiles, release tools, CI, provenance, and signing authority are absent
  • this bench must not bump QUIZWIZZ_VERSION or construct a release ZIP
  • releaseEligible remains false
• public-launch blockers:
  • complete every legal/operator [INSERT-YOUR-DATA-HERE: ...] field
  • configure and prove an off-host encrypted backup plus scratch restore
  • configure and prove an external alert destination
  • assign Nginx/access-log review ownership and data-minimization cadence
  • define image review, digest-pinning, approval, backup, and rollback policy
  • if guest AI will be enabled, provide a dedicated supported model/provider, non-zero budget, incident owner, and completed provider/privacy review

Related records

• frontier.md: current decision frontier and launch gates
• can-do.md: capability status
• masterplan.md: remediation status
• ../../operations.md: operated ingress, logs, backups, health, and placeholder-owned production duties
• 2026-07-30-canonical-port-packet.md: preceding canonical recovery context