WP HoloDev Documentation

Getting Started

WP HoloDev is designed as a local development application. The main application runs on your computer and provides the workspace, project management, AI connections, development tools and validation environment used throughout your work.

1. Install and Open WP HoloDev

Install WP HoloDev and launch the application. The local workspace opens in your browser and connects to the WP HoloDev application running on your computer.

You do not need Python, PostgreSQL or Redis to use the main application. WP HoloDev uses its own local application services and embedded storage.

2. Complete the First-Run Setup

The first-run setup guides you through the initial configuration. This includes connecting at least one supported AI provider and setting the basic environment required for development work.

Your API credentials are stored separately from your projects and are not placed inside normal AI prompts or project files.

3. Create Your First Project

Create a project and give it a clear name and description. You can start with an existing codebase or create a workspace for a new project.

For WordPress development, a project will normally represent a plugin, theme or custom website development codebase.

4. Start a Development Conversation

Open the project and describe what you want to achieve. WP HoloDev can inspect the project, gather relevant context and begin working through the task using the tools and permissions available to it.

Core Concepts

Understanding a few core ideas makes the rest of WP HoloDev much easier to use.

The Harness

The harness is the trusted control layer surrounding the AI. Models can suggest actions, but the harness decides whether files may be accessed, commands may be executed, tools may be used and specialist agents may be created.

The model is therefore not treated as the security boundary.

The Project

A project is the persistent development workspace containing the codebase, project information, conversations, memory, rules, development history and validation evidence associated with that piece of software.

The Job

A job represents a development task being carried out inside a project. Jobs can move through stages such as analysis, planning, editing, validation, testing, review and packaging.

The Agent

An agent uses an AI model to perform development work inside the limits defined by the harness. Agents can inspect code, request tools, make changes and respond to validation results.

Validation Evidence

WP HoloDev does not need to accept a model's claim that work is complete. Tests, syntax checks, standards checks, browser results and other validators provide evidence that the requested work has actually passed its required checks.

Projects

Projects keep development work separated and provide persistent context for each codebase.

Creating a Project

Create a separate project for each plugin, theme, website or software codebase you want WP HoloDev to work with.

A project can store its own description, development rules, conversations, model preferences, memory, validation history and release information.

Existing Projects

WP HoloDev can work with existing source code rather than requiring a new project to be generated from scratch. This is particularly important for maintenance, debugging and feature development.

The repository can be inspected before changes are made so the coding agent has a better understanding of the existing architecture.

Separate Project Context

Information from one project should not become an assumption inside another. Keeping projects separate helps prevent unrelated rules, code knowledge or development history from contaminating other work.

AI Providers & Models

WP HoloDev uses a bring-your-own-API model. You choose the AI services you want to connect and use your own provider credentials.

OpenAI

Connect your own OpenAI API access and make compatible OpenAI models available to WP HoloDev.

OpenCode

OpenCode support gives you another route for using coding models within the same WP HoloDev development workflow.

OpenRouter

OpenRouter can provide access to a broad range of models through one API connection, making it easier to compare models and choose different options for different development tasks.

More Providers Coming

WP HoloDev is designed around an extensible provider layer. Additional providers and compatible model services can be added without rebuilding the development workflow around a new vendor.

Development Workflow

A normal WP HoloDev task follows a structured development process rather than a single prompt-and-response cycle.

Analyse

The harness gathers the information needed to understand your request and the relevant areas of the project.

Plan

The work can be divided into logical stages and the agent determines which files, tools and checks are likely to be required.

Edit

The agent makes the required changes within the permitted working environment.

Validate

Syntax checks, coding standards, static analysis, security validation or other project checks can be run against the modified code.

Test

Automated tests and browser workflows can verify behaviour rather than relying only on source-code inspection.

Review

The implementation and actual diff can be reviewed before completion.

Package

When appropriate, validated WordPress work can be prepared as a release package.

Complete

The task reaches completed status when its required checks have passed, rather than simply because an agent has announced that the work is finished.

Chat Interface

The main chat is where you communicate with WP HoloDev about the development task.

Keep the Conversation Focused

The normal conversation is intended for your request, useful progress information, questions requiring your input, approval requests, warnings, errors requiring action and the final result.

Low-level operational activity does not need to fill the conversation while the task is running.

Multiple Conversations

A project can contain separate conversations for different pieces of work while continuing to use the same underlying project context.

This allows you to keep unrelated tasks organised without losing the broader project environment.

Execution Trace

The execution trace provides a detailed view of what WP HoloDev is doing during a development task.

Thinking View

The Thinking view can show harness-level development activity such as task plans, stages, agent assignments, model routing, tool use, filesystem activity, commands, tests, browser actions, retries, validation results and completion checks.

It is intended to expose the development process without exposing hidden provider chain-of-thought.

Show Thinking

Use the Show thinking control when you want to inspect the current task in more detail. The main conversation remains uncluttered while operational information appears in the execution workspace.

Structured Events

Execution information should be presented as readable stages and events rather than an uncontrolled dump of raw internal objects.

Browser Testing

Browser testing allows WP HoloDev to validate the behaviour of web interfaces rather than stopping at code-level checks.

Integrated Browser Workspace

The Browser view provides a dedicated place for browser-based development and validation alongside the main conversation and execution trace.

Real User Workflows

Browser tests can cover actions such as opening pages, logging in, navigating admin screens, changing settings, creating content, submitting forms and checking AJAX or REST behaviour.

Screenshots

Screenshots can be captured during validation so visual results can become part of the development evidence.

WordPress Testing

For WordPress work, browser testing is particularly useful for confirming that changes have not caused broken admin pages, incorrect layouts, JavaScript failures or unexpected permission behaviour.

Permissions & Approvals

WP HoloDev controls development actions through the harness rather than automatically granting agents unrestricted access.

Least Privilege

Agents should receive only the files, tools and capabilities required for the task they are performing.

Approval Requests

Sensitive or higher-risk operations can require your approval before they are allowed to proceed.

Tool Permissions

File operations, command execution, network access, specialist agent creation and other tools can be governed independently.

The Agent Cannot Grant Itself Access

A model or skill may request an action, but it cannot give itself additional permissions. The harness remains responsible for enforcing the policy.

Project Memory

WP HoloDev can retain useful project knowledge between sessions so important context does not need to be rediscovered for every task.

Project Facts

Stable facts about the project can be retained for future work.

Architectural Decisions

Important design and architecture decisions can be recorded so future development remains consistent with previous choices.

Task History

Previous development work can provide useful context about what changed and why.

Project Rules

Development requirements can be kept as versioned project rules and applied to future jobs.

Code Intelligence

Repository analysis can maintain an up-to-date understanding of important code structures and relationships.

Validation History

Previous test and validation results can provide context when investigating regressions or preparing releases.

Release Records

Completed releases and their associated validation evidence can remain part of the project history.

WordPress Skills

WP HoloDev includes specialist WordPress development knowledge that can be made available to agents when it is relevant to the task.

Built-In Specialist Skills

The built-in skill library covers areas including plugin and theme development, WordPress Coding Standards, security, REST, AJAX, admin interfaces, Settings and Options APIs, database access, custom post types, taxonomies, cron, WP-CLI, multisite, internationalisation, WooCommerce, testing, performance, packaging and wordpress.org requirements.

Skill Trust Levels

Skills can have different trust levels depending on their source, including built-in trusted skills, approved skills, project-local skills and untrusted skills.

Skills Do Not Override Permissions

A skill can guide an agent in how to perform development work, but it cannot give itself additional filesystem, network or execution permissions.

Specialist Agents

Large development tasks can be divided between specialist agents when focused expertise or independent review would improve the result.

Repository Analysis

A specialist can map and inspect relevant areas of a large project before implementation begins.

Security Review

A security-focused agent can inspect changes for WordPress-specific and general application security concerns.

Database Review

Database specialists can focus on queries, schema changes, custom tables and data access patterns.

Testing and Validation

Testing specialists can concentrate on reproducing problems, creating validation scenarios and checking final behaviour.

Release Verification

A separate release reviewer can inspect the final implementation and validation evidence before packaging or deployment.

Specialist agents operate within defined objectives, permissions, file scope and resource budgets rather than receiving unrestricted access.

Validation & Testing

Validation is a central part of WP HoloDev. Generated code is not assumed to be correct simply because it appears plausible.

PHP Syntax

PHP source can be checked for syntax errors before later validation proceeds.

WordPress Coding Standards

PHPCS with WordPress Coding Standards can verify formatting, escaping, sanitisation and other WordPress development requirements.

Static Analysis

PHPStan and other static analysis tools can identify potential errors that are not obvious from syntax checking alone.

Automated Tests

Unit and integration test suites can be run where they are available for the project.

Plugin Check

WordPress Plugin Check can be incorporated into plugin validation where appropriate.

Security Validation

Deterministic security checks can look for issues such as missing nonces, missing capability checks, unescaped output, unsafe SQL, unsafe redirects and inappropriate REST or AJAX permissions.

Browser Validation

Playwright workflows can test behaviour inside a real browser.

Baseline Comparison

Existing project warnings can be recorded before editing so validation can distinguish between pre-existing issues, resolved issues and new regressions.

WordPress Development

WordPress development is a specialist workflow within WP HoloDev rather than a generic code mode with a WordPress label applied to it.

Plugins

WP HoloDev can inspect, modify, validate, test and package WordPress plugins while working with their existing file structure and architecture.

Themes

Theme development can include PHP templates, JavaScript, CSS, theme configuration, hooks and WordPress-specific rendering behaviour.

Hooks and Filters

The repository intelligence system can recognise WordPress actions and filters and help trace behaviour across the project.

REST and AJAX

REST routes, AJAX handlers and admin-post workflows can be identified, tested and reviewed for permissions and security.

Database Work

WordPress database queries, options and custom tables can be included in repository analysis and security review.

WP-CLI

WP-CLI can be used as part of supported development, testing and environment workflows.

Disposable WordPress Environments

When requested and available, disposable WordPress test environments can provide a clean installation with controlled WordPress and PHP versions for compatibility and integration testing.

Docker is used only where this type of disposable environment is required. It is not required to run the main WP HoloDev desktop application.

Release Packaging

Validated WordPress projects can move from development into a controlled release process.

Final Validation

The required release checks can be rerun against the final source before packaging.

Release Locking

The final source can be locked and associated with the validation evidence produced by the release checks.

ZIP Packaging

WordPress plugins can be prepared as distributable ZIP files ready for installation, client delivery or wordpress.org workflows.

Integrity Information

Release artifacts can include manifests and SHA-256 fingerprints so the packaged release can be matched to the validated source.

WordPress Bridge & Deployment

The WordPress Bridge provides a controlled route between a WP HoloDev project and an authorised WordPress installation.

Pairing

A generated companion plugin can be installed on the destination WordPress site and paired with the correct WP HoloDev project.

Controlled Deployment

Validated releases can be deployed through the bridge without giving the coding model ordinary hosting, FTP or server credentials.

Post-Deployment Checks

After deployment, WP HoloDev can verify that the expected version is installed and that the site remains available.

Rollback

Where a previous verified release is available, rollback provides a controlled route back to a known package if a deployment needs to be reversed.

Model Routing

Different development tasks can use different AI models rather than forcing one model to perform every job.

Efficient Tier

Use lower-cost or faster models for straightforward work where deep reasoning is unnecessary.

Balanced Tier

Balanced models can handle more involved coding, debugging and project coordination tasks.

Expert Tier

More capable models can be reserved for high-risk work, difficult debugging, architecture decisions, security review or final release verification.

Automatic Escalation

If validation repeatedly fails or a task becomes more difficult than expected, WP HoloDev can escalate the work to a stronger model instead of repeatedly using a model that is struggling with the task.

Manual Override

You can retain direct control over model choice when you want to force, forbid or prefer particular providers or models.

Usage & Cost Controls

AI development can involve several model calls and specialist agents, so WP HoloDev includes resource controls designed to keep usage predictable.

Model Call Limits

Jobs can be restricted by the number of model calls they are allowed to make.

Token Limits

Input and output token budgets can help prevent unexpectedly large model usage.

Agent Limits

You can control how many specialist agents may be created and how many can run concurrently.

Runtime Limits

Jobs and agents can operate within defined time limits.

Cost Tracking

Estimated model costs can be associated with projects, jobs and agents, giving you a clearer view of where AI usage is being consumed.

Security

WP HoloDev is designed around the assumption that an AI model should not be trusted with unrestricted access simply because it is useful at writing code.

Controlled Execution

Tool activity passes through the harness and its permission system.

Read-Only Originals

Original source can remain separate from the working copy so changes are observable and reversible.

Path Protection

Filesystem access can be restricted to authorised project locations rather than allowing arbitrary access to the computer.

Prompt-Injection Resistance

Repository files and package contents are treated as untrusted project data. Instructions found inside source files do not become harness or system instructions.

Secret Protection

API credentials are kept outside ordinary prompts, project memory and packaged artifacts. Supported Windows credentials can be protected using local encryption.

Safe ZIP Handling

Archives can be checked for unsafe paths, links, excessive compression ratios and other dangerous extraction behaviour before their contents are accepted.

Audit History

Important development and security events can be recorded so you can inspect what happened during a job.

Recovery & Cancellation

Development work should not become unusable because the application closes during a long-running job.

Persistent Job State

Objectives, plans, completed steps, findings, validation results and other job information can be persisted throughout execution.

Resume After Restart

If WP HoloDev restarts during a job, saved state can be used to recover the development workflow rather than discarding everything that has already happened.

Clean Cancellation

Cancelling a task should terminate active model calls, specialist agents, browser activity and temporary execution resources associated with the job.

Commands

WP HoloDev includes slash commands for common project and development actions.

/models

View or manage the models available to the current workflow.

/connect

Open provider or connection-related options.

/deploy

Begin the controlled deployment workflow for an eligible validated WordPress release.

/new

Create a new project or development context where appropriate.

/open

Open an existing project or supported development resource.

/help

Display available commands and guidance.

Troubleshooting

When something does not work as expected, start with the evidence already available inside the project and job.

Check the Execution Trace

Look for failed tool calls, validation results, command errors, retries or permission denials associated with the task.

Check Provider Connectivity

If a model cannot respond, confirm that the relevant provider connection is configured correctly and that the selected model is currently available through that provider.

Check Permissions

A development action may have failed because the agent was not permitted to access a file, run a command, use the network or create a specialist agent.

Check Validation Output

When a task remains incomplete, inspect the failing validator rather than assuming the completion gate itself is the problem.

Check Browser Results

For interface or website problems, inspect the browser workflow and captured screenshots as well as the source code.

Retry With a Stronger Model

If a model repeatedly fails to solve a difficult issue, use model routing or manual selection to move the task to a more capable model.