=== Cobalt Checkout Diagnostics for WooCommerce ===
Contributors: bananaSaging
Tags: woocommerce, checkout, cart, diagnostics, hpos
Requires at least: 6.9
Tested up to: 7.1
Requires PHP: 8.2
WC requires at least: 10.8
WC tested up to: 11.0
Stable tag: 0.1.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Local, read-only cart and checkout diagnostics. Does not prove that a real external customer can complete payment.

== Description ==

Cobalt Checkout Diagnostics for WooCommerce is an admin diagnostic plugin. A shop manager with `manage_woocommerce` can run **local, read-only** checks to see whether cart and checkout look configured and renderable on this site.

It does **not** process payments, place orders, or watch the store from the public internet.

= Video overview =

https://www.youtube.com/watch?v=-hCtNeDn4YI

= Product truth =

Local checks do not prove that a real external customer can complete payment. This plugin must never be described as a live checkout or payment monitor.

= What this version does =

* Support-matrix guard for PHP 8.2+, WordPress 6.9+, and WooCommerce 10.8+
* Manual diagnostic run from **WooCommerce → Checkout Diagnostics**
* Read-only checks for versions, HTTPS, permalinks, cart/checkout pages, block vs classic type, catalog, enabled payment gateway ids, shipping, HPOS vs posts storage, WP-Cron, and Action Scheduler
* Safe loopback cart probe and checkout-render probe (GET to this site’s assigned URLs only)
* Configuration snapshots and a changes check against the previous run
* Run history on this site, grouped results, evidence, and allowlisted remediation links
* Optional scheduled runs (Action Scheduler when ready, otherwise WP-Cron)
* Optional operator incident email to the site admin address (off by default)

= What this version does not do =

* Charge a gateway, create orders, change stock, send customer mail, or trigger fulfilment
* Expose a public REST API
* Accept arbitrary probe URLs
* Claim that a real customer can complete payment

= Requirements =

* PHP 8.2+ (8.3 or 8.4 recommended)
* WordPress 6.9+ (tested up to 7.1)
* WooCommerce 10.8+ (tested up to 11.0)
* Block Cart/Checkout, classic shortcodes, mixed setups, and HPOS or posts storage are all in scope

== Installation ==

1. Upload the `cobalt-checkout-diagnostics` folder to `/wp-content/plugins/`, or install the zip via **Plugins → Add New → Upload Plugin**.
2. Activate **WooCommerce** first, then activate **Cobalt Checkout Diagnostics for WooCommerce**.
3. Open **WooCommerce → Checkout Diagnostics** and run checks.
4. Optionally enable scheduled runs and operator incident email in the settings on that screen.

If WooCommerce is missing or too old, the plugin shows an admin error and does not register the diagnostic screen.

== Frequently Asked Questions ==

= Can this tell me that customers can pay? =

No. Local diagnostics do not prove that a real external customer can complete payment.

= Does a run create a test order? =

No. Checks are read-only. They do not create orders, change stock, send customer mail, or charge a gateway.

= Who can run checks? =

Users with the `manage_woocommerce` capability. State-changing forms also require a WordPress nonce.

= Does the plugin send data off-site? =

No. History stays in this WordPress database. Optional incident emails use WordPress mail to the site admin address (and any extra addresses a developer adds with a filter). There is no telemetry.

= Are scheduled runs exact? =

When WooCommerce has initialized Action Scheduler, recurring jobs use that. Otherwise WP-Cron is the fallback. WP-Cron timing is approximate and depends on site traffic.

= Does uninstall delete my diagnostic history? =

Scheduled jobs are always cleared. Tables and options are deleted only if you enabled **Delete plugin data on uninstall** before removing the plugin.

== Limitations ==

* Local checks do not prove that a real external customer can complete payment.
* Probes are loopback HTTP GETs to this site’s cart and checkout permalinks. They do not POST checkout, call `process_payment`, or hit Store API write endpoints.
* Probe timeouts are capped (default 10 seconds, maximum 15). TLS verification is never disabled.
* Scheduled WP-Cron runs are approximate. Action Scheduler jobs are not unscheduled during uninstall if Action Scheduler has not initialized yet; leftover actions then fire a no-op hook.
* Incident email is not sent on every run. Fail and warning are both incidents. Recipients cannot be typed in the UI.
* This plugin has no REST API.

== Screenshots ==

1. Dashboard summary after a diagnostic run, including the product-truth disclaimer.
2. Grouped check results with status, explanation, and allowlisted remediation links.
3. Evidence details for an individual check.
4. Run history with a previous-run view.
5. Settings for retention, thresholds, optional schedule, and optional operator email.

== Changelog ==

= 0.1.1 =

* Update Author to Cobalt Branch Labs and Author URI to https://cobaltbranchlabs.com/.
* Add "Diagnostics" shortcut and "View details" link on the WordPress Plugins screen.
* Add video demonstration walkthrough to readme.

= 0.1.0 =

* First public-ready package: trademark-safe name/slug, Author bananaSaging.
* Support-matrix bootstrap, 15 read-only checks, safe cart and checkout-render probes, snapshots, history, accessible admin dashboard, optional schedule, and optional operator incident email.
* Local checks do not prove that a real external customer can complete payment.
* Translations rely on WordPress.org language packs (no load_plugin_textdomain call).
