=== Shipping Contract Guard for WooCommerce ===
Tags: woocommerce, shipping, testing, qa
Requires at least: 6.5
Tested up to: 7.0
Requires PHP: 8.1
Stable tag: 0.14.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Catch broken WooCommerce shipping rules before customers do.

== Description ==

Shipping Contract Guard checks whether important WooCommerce shipping rules
still behave the way you expect. If free shipping starts at EUR 75, it checks
EUR 74.99, EUR 75.00, and EUR 75.01. You review the expected methods and prices,
save them, and run the check again after configuration or software changes.

Local mode needs no account and makes no external request. It supports core Flat
Rate, Free Shipping, and Local Pickup. Unsupported shipping extensions and
incomplete observations are reported as could not verify, never working. Test
products and destinations must not contain customer data. The plugin does not
create orders or access merchant payment-processor data.

The optional Operator service adds scheduled checks, missed-run detection,
offsite history, and alerts. The plugin makes no compatibility claim for
unlisted versions or unsupported third-party methods.

== Installation ==

1. Install and activate WooCommerce.
2. Install and activate Shipping Contract Guard.
3. Open WooCommerce > Shipping Contract Guard as a user with the
   `manage_woocommerce` capability.
4. Choose a detected free-shipping rule, a shippable product, and invented
   test destination. Preview the expected checkout results.
5. Select Save and run first check, then review the plain-language result.
6. Run the saved check again after shipping, WooCommerce, or plugin changes.
7. Optionally review the fixed service disclosure, consent, and start the
   Operator checkout; verified billing events pair the site automatically.

== External service ==

The plugin is independently useful without a service. It makes no service
request until a WooCommerce manager checks the informed-consent control. The
package fixes the Shipping Contract Guard HTTPS origin, service name, privacy
notice, terms, and Stripe Payment Link. The settings screen shows those values
before consent.

Starting Operator generates an opaque site-bound checkout reference and a
private signing key locally, then opens Stripe's hosted checkout. The private
key and activation secret never go to Stripe. After payment, WordPress cron
contacts the service until signed Stripe payment and active-subscription events
have been verified, then pairs the exact site automatically. A browser success
redirect never grants access.

After explicit pairing, the plugin contacts only the configured origin to:

* pair or revoke the site and rotate its site signing key;
* complete automatic verified subscription onboarding;
* retrieve signed entitlement and scheduling policy; and
* deliver signed minimized run evidence for offsite history, missed-run
  supervision, alerts, and agency portfolio views.

Pairing sends a one-time code, hashed site-URL fingerprint, public signing key,
key ID, timestamp, and nonce. Paired requests can send opaque site, run, and
contract IDs; public signing-key material; timestamps and nonces; contract and
configuration fingerprints; pass, fail, unknown, and completeness states;
boundary-type names without raw boundary values; supported core method classes,
hashed method-instance fingerprints, bounded amounts and currency; error codes;
and bounded semantic configuration-change facts. The connector excludes product
records, raw destinations, customer data, orders, payment details, and merchant
payment-processor data.

Policy checks and queued delivery occur only while paired and only on the signed
schedule. Key rotation and unpairing contact the service only when requested.
The service retains offsite history according to the subscribed plan. Unpairing
revokes the site and stops new transfer but does not erase existing organization
history. An organization owner can export service data or request account
deletion. Deletion remains cancelable and exportable for 24 hours, then the
worker purges tenant records while retaining a minimal idempotency tombstone.

== Privacy ==

Locally, the plugin stores approved contract definitions, configuration
fingerprints and semantic change facts, synthetic case results, run timestamps,
queued service events, and optional service keys in dedicated tables and
non-autoloaded options. Completed local runs are retained for up to 90 days and
500 records. Deactivation preserves data. Uninstall preserves data unless an
administrator first enables delete-on-uninstall; when enabled, uninstall removes
the plugin tables, options, queued service events, and local signing keys.

The plugin registers complete suggested text in Settings > Privacy for the site
privacy-policy guide. It provides no personal-data exporter or eraser because
its supported data model does not collect WordPress user or customer personal
data. Site operators must use invented synthetic fixtures and must update their
privacy policy with the configured external service disclosure before pairing.

== Frequently Asked Questions ==

= Does local verification require an account? =

No. Setup, saved expectations, manual checks, and local export work
without pairing or an external request.

= Does the plugin test my store checkout or payment? =

No. Supported calculations use WooCommerce shipping APIs without submitting a
store checkout or creating an order. Stripe is contacted only when a manager
chooses to buy the optional Shipping Contract Guard subscription.

= What does could not verify mean? =

It means a method or observation is unsupported or incomplete. It is never
treated as working.

== Changelog ==

= 0.14.0 =
* Reduced first value to one action after preview: approve the expected results and immediately run the first local check.

= 0.13.0 =
* Replaced the technical administration page with guided setup, readable previews, plain-language status and history, and a value-first Operator offer.

= 0.12.0 =
* Added automatic verified Stripe subscription onboarding with local site-bound checkout identity and fail-closed background pairing.

= 0.11.0 =
* Added complete optional-service disclosure, WordPress privacy-policy text, accessible administration markup, and reproducible release QA with a free local browser workflow plus install, upgrade, uninstall, multisite-refusal, and compromised-entitlement evidence.

= 0.10.0 =
* Added a rendered classic/block checkout and PHP 8.1/8.3 compatibility matrix, with WooCommerce 8.2 block checkout explicitly excluded for its checkout-draft side effect.

= 0.9.0 =
* Added merchant-authored positive/negative postcode validation plus numeric, exact alphanumeric, wildcard, normalization, and selected unsupported-extension runtime fixtures.

= 0.8.0 =
* Added merchant-selected coupon matrices with isolated WooCommerce discount calculation and runtime coverage for Free Shipping coupon, amount, both, either, before-discount, after-discount, and quantity-two workflows.

= 0.7.0 =
* Added a disposable generated-suite WooCommerce runtime harness and an isolated in-memory cart context for core Free Shipping amount evaluation.

= 0.6.0 =
* Added typed core boundary fixtures with exact weight normalization and fail-closed unsupported scenario handling.

= 0.5.0 =
* Added explicit acknowledgement-loss-safe unpairing that revokes the remote site and stops all queued local service transfer.

= 0.4.0 =
* Added acknowledgement-loss-safe site-key rotation and old-key-authorized service policy-key transitions.

= 0.3.0 =
* Added explicitly paired, signed, entitlement-gated scheduled verification and delivery.

= 0.2.0 =
* Added local semantic configuration-change attribution and minimized schema-v2 run evidence.

= 0.1.0 =
* Private development started.
