WordPress 6.9 Abilities API provides standardized capability discovery and execution for Data Machine operations. All REST API, CLI, and Chat tool operations delegate to registered abilities.

Overview

The Abilities API in inc/Abilities/ provides a unified interface for Data Machine operations. Each ability implements execute_callback with permission_callback for consistent access control across REST API, CLI commands, and Chat tools.

Total registered abilities: 193

The tables below document the core ability groups most commonly used by REST, CLI, and chat integrations. For a generated live inventory, run wp abilities list --category=datamachine-* or inspect the current wp_register_ability() callsites under inc/Abilities/.

Multi-Agent Scoping

All abilities support agent_id and user_id parameters for multi-agent scoping. The PermissionHelper class resolves scoped agent and user IDs, enforces ownership checks via owns_resource() and owns_agent_resource(), and controls access grants via can_access_agent().

Registered Abilities

Pipeline Management (7 abilities)

Pipeline Steps (5 abilities)

Flow Management (5 abilities)

Flow Steps (4 abilities)

Queue Management (13 abilities)

Webhook Triggers (8 abilities)

Job Execution (9 abilities)

Engine (4 abilities)

Internal abilities for the pipeline execution engine.

Agent Management (6 abilities)

Agent Memory (4 abilities)

Daily Memory (5 abilities)

Agent Files (5 abilities)

Flow Files (5 abilities)

Chat Sessions (4 abilities)

Coding / GitHub Extension Abilities

Workspace and GitHub coding abilities live in the data-machine-code extension plugin. Data Machine core no longer registers the old workspace, GitHub issue, or GitHub repository ability names.

Handler Execution (8 abilities)

Duplicate Check (2 abilities)

Extensions: datamachine/check-duplicate runs extension strategies before core’s generic matching via the datamachine_duplicate_strategies filter. See Duplicate Detection Filters for the strategy contract and registration example.

Post Query (2 abilities)

Content / Block Editing (4 abilities)

Extensions: datamachine/check-duplicate runs extension strategies before core’s generic matching via the datamachine_duplicate_strategies filter. See Duplicate Detection Filters for the strategy contract and registration example.

Extensions: datamachine/check-duplicate runs extension strategies before core’s generic matching via the datamachine_duplicate_strategies filter. See Duplicate Detection Filters for the strategy contract and registration example.

Media (7 abilities)

Image Templates (1 ability)

Image Optimization (2 abilities)

Internal Linking (7 abilities)

SEO — Meta Descriptions (2 abilities)

SEO — IndexNow (4 abilities)

Analytics (4 abilities)

Taxonomy (5 abilities)

Settings (7 abilities)

Authentication (3 abilities)

Logging (5 abilities)

Local Search (1 ability)

Handler Discovery (5 abilities)

Step Types (2 abilities)

Processed Items (6 abilities)

Agent Ping (1 ability)

System Infrastructure (3 abilities)

Category Registration

content_format is the caller’s authoring/source format (markdown, html, or blocks). It is distinct from the stored post_content format, which is chosen per post type by datamachine_post_content_format. Normal AI-authored prose should be markdown; only set content_format when the caller intentionally supplies HTML or serialized block markup.

wp_register_ability_category(
    'datamachine-flow',
    array(
        'label' => 'Flow',
        'description' => 'Flow CRUD, scheduling, queue management, and webhook triggers.',
    )
);

The block editing abilities are storage-format aware. They read the post type’s canonical stored format through DataMachineCoreContentContentFormat, convert to block markup for the edit operation, then convert the result back before writing.

Permission Model

Data Machine registers multiple ability categories via wp_register_ability_category() on the wp_abilities_api_categories_init hook. Category slugs use the datamachine-{domain} format (e.g. datamachine-content, datamachine-flow, datamachine-pipeline):

// Standard permission check
PermissionHelper::can_manage(); // WP-CLI always returns true; web requires manage_options

// Multi-agent scoped permission check
PermissionHelper::can_access_agent($agent_id);
PermissionHelper::owns_resource($resource_user_id);
PermissionHelper::resolve_scoped_agent_id($params);
PermissionHelper::resolve_scoped_user_id($params);

Architecture

Delegation Pattern

See inc/Abilities/AbilityCategories.php for the full list of registered categories.

REST API Endpoint → Ability → Database / WordPress API
CLI Command → Ability → Database / WordPress API
Chat Tool → Ability → Database / WordPress API

Facade Pattern

All abilities support both WordPress admin and WP-CLI contexts via the shared PermissionHelper:

• inc/Abilities/ChatAbilities.php → inc/Abilities/Chat/CreateChatSessionAbility.php, etc.
• inc/Abilities/EngineAbilities.php → inc/Abilities/Engine/RunFlowAbility.php, etc.
• Flow abilities are registered from inc/Abilities/Flow/CreateFlowAbility.php, inc/Abilities/Flow/QueueAbility.php, inc/Abilities/Flow/WebhookTriggerAbility.php, etc.

Ability Registration

REST API endpoints, CLI commands, and Chat tools delegate to abilities for business logic. Abilities are the canonical, public-facing primitive; implementation classes below an ability are internal details.

public function register(): void {
    add_action( 'wp_abilities_api_init', array( $this, 'register_abilities' ) );
}

Testing

Several top-level ability classes serve as facades that instantiate sub-ability classes from subdirectories; other domains are registered directly from their subdirectory classes:

• AuthAbilitiesTest.php – Authentication abilities
• FileAbilitiesTest.php – File management abilities
• FlowAbilitiesTest.php – Flow CRUD abilities
• FlowStepAbilitiesTest.php – Flow step abilities
• JobAbilitiesTest.php – Job execution abilities
• LogAbilitiesTest.php – Logging abilities
• PipelineAbilitiesTest.php – Pipeline CRUD abilities
• PipelineStepAbilitiesTest.php – Pipeline step abilities
• PostQueryAbilitiesTest.php – Post query abilities
• ProcessedItemsAbilitiesTest.php – Processed items abilities
• SettingsAbilitiesTest.php – Settings abilities

WP-CLI Integration

Each abilities class registers abilities on the wp_abilities_api_init hook:

Post Tracking

Unit tests in tests/Unit/Abilities/ verify ability registration, schema validation, permission checks, and execution logic:

CLI commands execute abilities directly. See individual command files in inc/Cli/Commands/ for available commands.

• _datamachine_post_handler: Handler slug that created the post
• _datamachine_post_flow_id: Flow ID associated with the post
• _datamachine_post_pipeline_id: Pipeline ID associated with the post

The PostTracking class in inc/Core/WordPress/PostTracking.php provides post tracking functionality for handlers creating WordPress posts.

use DataMachineCoreWordPressPostTracking;

// After creating a post
$this->storePostTrackingMeta($post_id, $handler_config);