# Agent Instructions

## Verification

- This is a WordPress plugin with custom tables and Google Search Console, Ahrefs, OpenAI, and Yoast integration points.
- Run `php -l` on every touched PHP file. If available, also run `phpcs --standard=WordPress` on touched code.
- Validate affected admin pages in a local or staging WordPress site and confirm the debug log has no new warnings or fatals.
- For database changes, exercise activation or the normal versioned upgrade path and verify the expected schema.
- For imports or AI analysis, run one known end-to-end flow and confirm failures remain visible and actionable in the admin UI.

## Guardrails

- Keep the existing WordPress direct-access guard in PHP entry files.
- Pair every `SEOAUDP_DB_VERSION` change with its actual create or migration logic; never bump the constant alone.
- Preserve bootstrap required-class checks so missing files produce an admin notice instead of a fatal.
- Protect AJAX and admin mutations with nonce verification and capability checks.
- Use `$wpdb->prepare()` for dynamic SQL; sanitize input and escape output at render time.
- Treat Google Search Console, Ahrefs, OpenAI, Yoast, DataTables, and Chart.js as external contracts. Verify current official documentation and installed versions before changing their behavior.
- Keep debug logging behind `SEOAUDP_DEBUG_ENABLED` and the existing option gates.
- Never include API credentials, imported SEO data, customer site data, or raw CSV rows in documentation, fixtures, or logs.

## Change Coupling

- Schema changes must keep the database layer, callers, version constant, and migration path aligned.
- Admin and AJAX changes must keep controller, view, and handler behavior consistent and cover unauthorized requests.
- Feature-module changes must account for shared models, views, helpers, and the linked admin surface.
- Asset changes must be checked on the intended admin screen with cache effects excluded.