[ericmann]

Core took the Secrets API in r64337 and left the WP-CLI commands to this plugin. The plugin, though, went fully dark once core shipped the API, so wp secret and wp network-secret disappeared on 7.2. This keeps them, running on core's implementation. See ADR 0014.

What changes on a WordPress that ships the API

• The commands register. The stand-down branch of wp_secrets_api_bootstrap() now registers both commands under WP-CLI, and still loads none of src/ or plugin/. Registration moved into wp_secrets_api_register_cli(), which both branches call.
  • cli/ calls only the public API and internals core has as well: _wp_secrets_get_key_manager(), _wp_secrets_get_provider(), _wp_secrets_get_store(), and WP_Secrets_Config_Key_Provider. So it runs unchanged on core.
• wp secret health loads core's wp-admin/includes/secrets-site-health.php itself. Core loads that file only for the Site Health screen, so its test functions don't exist under WP-CLI otherwise.
• migrate-legacy exits 1 with "not available on a WordPress that ships the Secrets API. Migrate legacy secrets before upgrading." It used to fatal on the unloaded migrator.
  • The prototype bits (migrator, legacy reader, fallback store) stay off on 7.2, per the prototype's deprecation.
  • The subcommand stays listed, because WP-CLI registers every public method.
• A conflict still registers nothing. When something other than core declared wp_get_secret(), the commands would run on an unknown credential store.
• The admin notice now says the plugin provides only its WP-CLI commands, and can be deactivated if you don't use them.

Also: phpcs.xml.dist still told WordPressCS the minimum was 6.6, a leftover from #12. It's now 6.8.

Tests

• The CLI test classes run on a WordPress that ships the API again. The six migrate-legacy cases skip there, and a new test checks the refusal.
• The mock WP_CLI now records add_command(). Gate tests check that the core branch registers both commands and that a conflict registers none.
• Smoke on nightly. CI ran the real-wp smoke test only on latest. A PHP 8.3 / WP nightly leg now covers the core case. smoke.sh detects core's API and expects migrate-legacy to refuse there. The existing smoke check names are unchanged.

Testing

WordPress	PHP	Single site	Multisite
latest (7.1.3)	7.4	506 pass, 31 skipped	506 pass, 20 skipped
trunk (7.2-beta1)	8.5	506 pass, 84 skipped	506 pass, 73 skipped

• On trunk, skips drop from 124 to 84 and from 114 to 73, because the CLI tests now run there.
• Smoke, real WP-CLI 2.12.0 on PHP 8.5:
  • latest: 146/146 pass.
  • nightly 7.2-beta1-64701: 147/147 pass, with detection reporting core's implementation.
  • Control: main's plugin against nightly fails at the first command, 'secret' is not a registered wp command.
• make lint compat analyse reference-check all pass.