Add read-only support for the Abilities API

[donnapep]

Proposed Changes

Registers Sensei with the WordPress Abilities API (core in WP 6.9+) so AI agents can discover courses, lessons, questions, and students through a standard interface.

New class: Sensei_Abilities (includes/abilities/class-sensei-abilities.php) registers the sensei category and four abilities.

• sensei/courses-list — paginated list. Teachers see only their own.
• sensei/lessons-list — paginated list. Teachers see only their own.
• sensei/questions-list — paginated list keyed by lesson id.
• sensei/students-list — paginated list scoped to a required course. Teachers only read students on courses they author.

Design principle. Bounded identity refs ({id, title}) are embedded; unbounded rosters are exposed through separate listing abilities keyed by parent id. Inline content counts are omitted — each listing envelope's total serves the same need without forcing every call to pay for full id lists. Quiz configuration scalars (pass mark, auto-grade) are not exposed: every other ability returns identity/relationships/content, and a single ability for three settings was inconsistent with the rest of the surface.

WP 6.7/6.8 safety. Sensei_Abilities::init() short-circuits when wp_register_ability isn't defined; nothing registers on older WordPress versions.

Testing Instructions

The proper end-to-end test is to drive the abilities through the MCP adapter the way an AI agent would. WP 6.9+ ships the Abilities API in core; the MCP adapter is a separate plugin.

Set up an MCP-enabled local site

1. WordPress 6.9+ with this branch installed and activated. (Or open the checks at the bottom of this PR, find the Plugin Build Download line item and click View details.)
2. Install the MCP adapter from https://github.com/WordPress/mcp-adapter (clone into wp-content/plugins/mcp-adapter, run composer install --no-dev, activate). The default MCP server registers automatically at /wp-json/mcp/mcp-adapter-default-server.
3. Application Password for an admin user (/wp-admin/profile.php → Application Passwords). Local sites need define( 'WP_ENVIRONMENT_TYPE', 'local' ); for the section to appear.
4. Seed data: a course with at least one published lesson, a quiz with questions, and one enrolled student.

Drive it from an MCP client

Add a .mcp.json (project-level) or equivalent client config pointing at the default server, with the application password as HTTP Basic auth:

{
  "mcpServers": {
    "sensei-local": {
      "type": "http",
      "url": "http://your-site.test/wp-json/mcp/mcp-adapter-default-server",
      "headers": { "Authorization": "Basic <base64(admin:app-password)>" }
    }
  }
}

Then ask the agent natural-language questions and confirm it chains the three default meta-tools (discover-abilities → get-ability-info → execute-ability) to drive the underlying Sensei abilities. Useful prompts:

• "List the courses on this site."
• "How many lessons does the course have?"
• "Who is enrolled in and what's their progress?"
• "Show me the questions on the lesson."

Permission and scoping checks

Repeat the natural-language prompts above with the agent authenticated as different users. Confirm:

• Subscriber: every ability is denied (the agent receives a permission error).
• Teacher A: agent only surfaces Teacher A's courses/lessons; asking about another teacher's course/lesson is refused.
• Admin: full access.

Pre-Merge Checklist

• PR title and description contain sufficient detail and accurately describe the changes
• Adheres to coding standards
• All strings are translatable
• Follows naming conventions
• Hooks and functions are documented
• New UIs are responsive and use a mobile-first approach (no UI changes)
• Code is tested on the minimum supported PHP and WordPress versions (guarded for WP < 6.9)

[Copilot]

Pull request overview

This PR adds initial integration with the WordPress Abilities API by registering a Sensei abilities category and three abilities to expose course listing, learner listing, and bulk enrollment updates.

Changes:

• Load and initialize a new Sensei_Abilities registrar from core Sensei initialization.
• Register sensei/get-courses, sensei/get-students, and sensei/update-enrollment abilities (with schemas + permission callbacks).
• Add unit tests for the new abilities behavior.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

File	Description
includes/class-sensei.php	Loads the Abilities registrar and calls Sensei_Abilities::init() during global initialization.
includes/abilities/class-sensei-abilities.php	Implements abilities category + ability registration and execute/permission callbacks.
tests/unit-tests/abilities/test-class-sensei-abilities.php	Adds unit tests intended to validate registration, execution, and permissions.
config/psalm/psalm-baseline.xml	Updates baseline for the new require_once include path.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.