Let an agent apply recommendations that are a single setting

[ilicfilip]

Adds progress-planner/complete-recommendation, which applies a recommendation either by provider ID or — with no argument — the highest-priority one that needs no value from the caller.

Stacked on #782. Review that first; this PR targets its branch, so the diff here is only the write surface.

The fixable set is vetted, not inferred

Seventeen providers qualify: six core settings (tagline, timezone, date format, search-engine visibility, and two comment settings), seven Yoast, four All in One SEO.

The list is explicit, not "everything extending Tasks_Interactive". That inference is wrong, and I made it before checking: the same base class also covers sending a test email (a diagnostic, not a fix), deleting terms (irreversible), and rewriting permalinks (flushes rewrite rules and changes every URL on the site). Each entry in Recommendation_Fixes was read individually and is listed because it writes one known setting and nothing else.

Yoast's tasks had no server-side save path at all. They predate the AIOSEO integration and only ever got a UI affordance: the popover deep-links into Yoast's own settings screen and highlights the field. That is useful to a person and meaningless to an agent, which never loads the page — the underlying setting is a plain boolean.

aioseo-crawl-settings-feed-comments is deliberately left out: it writes two settings, which the single-path model does not express.

Safety

• The setting and its value always come from the table, never from caller input, so no ability argument can reach an arbitrary option.
• Anything outside the list is returned with status manual and an admin URL, never half-applied.
• Each SEO entry checks its plugin is active before writing, so an entry reached on a site without that plugin returns an error instead of fatalling.
• There is no nonce, deliberately. An authenticated agent call is not a forged cross-origin form post, so manage_options and the fixed settings list are what bound this. Worth a reviewer's eye: that list is the real control.

Completion is observed, not asserted

After writing the setting, the provider decides whether the site now satisfies the task. Claiming otherwise would award points for work that did not happen, and there is a distinct status for "setting changed but task not satisfied yet".

Because evaluation runs on admin_init, a just-fixed task is still pending in the database. Next-mode therefore skips providers that already report themselves satisfied, instead of picking the same one twice — found by testing a repeated run, not by reasoning about it.

Next-mode also skips any fix needing a value: there is no correct tagline to invent on the site owner's behalf.

Verified

Against a live WordPress 7.1 install with Yoast active:

• Set blog_public to 0, called the ability, it wrote 1 and reported completed. Called next-mode again and it moved on to the next task rather than repeating.
• Yoast: remove_emoji_scripts and remove_feed_authors both flipped through the ability and reported completed. Both restored afterwards.
• Refusal paths: manual task → manual; invalid timezone → progress_planner_invalid_timezone with nothing written; missing value → rejected.
• 32 PHPUnit tests (12 new), passing single-site and multisite. PHPStan level 10 clean, check-cs clean.

Guessing the AIOSEO paths would have broken one: media-pages writes redirectAttachmentUrls under dynamicOptions as a string, not a boolean show under options. The paths were read from each provider's own submit handler.

🤖 Generated with Claude Code

[github-actions]

Test on Playground
Test this pull request on the Playground
or download the zip

[github-actions]

🔍 WordPress Plugin Check Report

⚠️ Status: Passed with warnings

📊 Report

🎯 Total Issues	❌ Errors	⚠️ Warnings
10	0	10

---

⚠️ Warnings (10)

📁 classes/suggested-tasks/providers/class-content-review.php (4 warnings)

📍 Line	🔖 Check	💬 Message
232	WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_post__not_in	Using exclusionary parameters, like post__not_in, in calls to get_posts() should be done with caution, see https://docs.wpvip.com/databases/optimize-queries/using-post__not_in/ for more information.
377	WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_post__not_in	Using exclusionary parameters, like post__not_in, in calls to get_posts() should be done with caution, see https://docs.wpvip.com/databases/optimize-queries/using-post__not_in/ for more information.
381	WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_post__not_in	Using exclusionary parameters, like post__not_in, in calls to get_posts() should be done with caution, see https://docs.wpvip.com/databases/optimize-queries/using-post__not_in/ for more information.
388	WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_post__not_in	Using exclusionary parameters, like post__not_in, in calls to get_posts() should be done with caution, see https://docs.wpvip.com/databases/optimize-queries/using-post__not_in/ for more information.

📁 classes/suggested-tasks/data-collector/class-unpublished-content.php (1 warning)

📍 Line	🔖 Check	💬 Message
103	WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_post__not_in	Using exclusionary parameters, like post__not_in, in calls to get_posts() should be done with caution, see https://docs.wpvip.com/databases/optimize-queries/using-post__not_in/ for more information.

📁 classes/suggested-tasks/data-collector/class-terms-without-posts.php (1 warning)

📍 Line	🔖 Check	💬 Message
120	PluginCheck.Security.DirectDB.UnescapedDBParameter	Unescaped parameter $query used in $wpdb->get_results()\n$query assigned unsafely at line 118.

📁 classes/suggested-tasks/data-collector/class-yoast-orphaned-content.php (1 warning)

📍 Line	🔖 Check	💬 Message
111	PluginCheck.Security.DirectDB.UnescapedDBParameter	Unescaped parameter $query used in $wpdb->get_row()\n$query assigned unsafely at line 98.

📁 classes/suggested-tasks/data-collector/class-terms-without-description.php (1 warning)

📍 Line	🔖 Check	💬 Message
108	PluginCheck.Security.DirectDB.UnescapedDBParameter	Unescaped parameter $query used in $wpdb->get_results()\n$query assigned unsafely at line 106.

📁 classes/activities/class-query.php (2 warnings)

📍 Line	🔖 Check	💬 Message
71	PluginCheck.Security.DirectDB.UnescapedDBParameter	Unescaped parameter $table_name used in $wpdb->query()\n$table_name assigned unsafely at line 58.
163	PluginCheck.Security.DirectDB.UnescapedDBParameter	Unescaped parameter $where_args used in $wpdb->get_results()\n$where_args assigned unsafely at line 153.

---

🤖 Generated by WordPress Plugin Check Action • Learn more about Plugin Check

[github-actions]

✅ Code Coverage Report

Metric	Value
Total Coverage	36.40% 📉
Base Coverage	34.46%
Difference	📈 1.94%

⚠️ Coverage below recommended 40% threshold

🎉 Great job maintaining/improving code coverage!

📊 File-level Coverage Changes (7 files)

🆕 New Files

Class	Coverage	Lines
🟡 Progress_Planner\Abilities\Recommendation_Fixes	68.29%	84/123

📈 Coverage Improved

Class	Before	After	Change
Progress_Planner\Admin\Page_Settings	39.34%	59.02%	+19.68%
Progress_Planner\Suggested_Tasks	9.60%	15.04%	+5.44%
Progress_Planner\Page_Types	52.68%	55.36%	+2.68%
Progress_Planner\Suggested_Tasks\Providers\Hello_World	0.00%	2.50%	+2.50%
Progress_Planner\Abilities\Abilities	94.03%	95.35%	+1.32%

📉 Coverage Decreased

Class	Before	After	Change
Progress_Planner\Abilities\Recommendations	96.97%	91.20%	-5.77%

ℹ️ About this report

• All tests run in a single job with Xdebug coverage
• Security tests excluded from coverage to prevent output issues
• Coverage calculated from line coverage percentages