wp-deploy now has signing, manifest validation, runtime capability checks, admin public-key management, and theme allowlisting foundations; recoverable release operations remain the planned MVP.
The local CLI is designed to run production build steps, apply explicit inclusion rules, and create one complete standalone, parent, or child theme package.
Manifest validation checks theme identity, requirements, paths, duplicate entries, checksums, and package semantics before deployment work begins.
Ed25519 signatures, exact body hashes, timestamps, one-time nonces, registered public keys, theme scopes, revocation, and WordPress capabilities form the authorization foundation.
The current plugin and CLI can report runtime capabilities and setup readiness. The planned deployment worker will use those checks to select an approved driver and refuse production deployment when the minimum recovery guarantee is unavailable.
Planned health checks and recovery protect theme files and the previous activation state. They do not roll back databases, options, uploads, plugins, or generated files outside the theme directory.
Join early access for product updates and launch availability.