08 Research API And Programs - Source Excerpt 02 - Form Security

Summary

This source excerpt begins near Form Security and preserves the surrounding evidence from Wiki.FFTAC.org/raw/system-archives/anti-christ.org/docs-archive/2026-05-10/docs/08-research-api-and-programs.md.

**Source path:** Wiki.FFTAC.org/raw/system-archives/anti-christ.org/docs-archive/2026-05-10/docs/08-research-api-and-programs.md

AI Engine prompts are not part of the private intake export layer. The current AI console is owned server-side by `wp-content/plugins/fftac-ai-engine`, is signed-in and AJAX-based, has a TypeScript-owned fullscreen/rich-output client, exposes command-map, prompt-lane, response-contract, and handoff-route surfaces, shows session usage meters, supports browser-local workspace briefs, local transcript copy/export/import, JSON and Markdown transcript exports, local session snapshots, and keeps conversation history in the browser. Personal OpenAI keys are stored separately in encrypted user meta.

When a signed-in user explicitly shares an AI output, the selected answer becomes a normal user-authored WordPress post rather than an intake record. It can be saved as a draft, queued for journal review, or published to the public site under the user's profile slug. Shared code fences are escaped into safe post markup. See [11-user-ai-architecture.md](11-user-ai-architecture.md).

## Form Security

Public intake uses:

- WordPress nonces
- safe redirects
- scalar-only POST reads
- server-side length caps
- honeypot fields
- timestamp checks
- transient-backed rate limits
- known option validation for select fields

Shared helpers live in `wp-content/plugins/fftac-foundation-core/inc/foundation.php`.

## Program Layer

The program system currently includes:

- program blueprints
- readiness packets
- public intake form
- participation ladder
- output rhythm
- member workflow handoff
- homepage, recovery, journal, search, and navigator discovery routes

Program lanes are public orientation and intake routes, not proof that cohorts, summits, or affiliate relationships are already operational. Operational launch work belongs in [07-infrastructure-roadmap.md](07-infrastructure-roadmap.md).

## Edit Rules

- Change datasets and copy in `wp-content/plugins/fftac-foundation-core/inc/foundation-content.php`.
- Change REST route behavior, exports, validation, storage, dedupe logic, and post types in `wp-content/plugins/fftac-foundation-core/inc/foundation.php`.
- Change Participants Database sync behavior in `wp-content/plugins/fftac-foundation-core/inc/participants-database.php`.
- Change public rendering in `template-research.php`, `template-downloads.php`, `template-sitemap.php`, `template-join.php`, `template-membership-portal.php`, and `template-journal.php`.
- Change filter sync, navigator behavior, or AI client behavior in `assets/ts/theme.ts`, then compile `assets/js/theme.js`.
- If the API grows beyond Foundation Core-backed arrays, update [07-infrastructure-roadmap.md](07-infrastructure-roadmap.md).
- If record IDs, export formats, or query parameters change, update [09-discoverability-and-search.md](09-discoverability-and-search.md) too.