@prefix sioc: <http://rdfs.org/sioc/ns#> .
@prefix dc: <http://purl.org/dc/elements/1.1/> .
@prefix dcterms: <http://purl.org/dc/terms/> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
@prefix content: <http://purl.org/rss/1.0/modules/content/> .
@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .

<https://lhero.org/portfolio/lh-knowledge-base/>
  a sioc:Post ;
  dc:title "Notes" ;
  dcterms:identifier 150260 ;
  dc:modified "2026-10-15T01:05:24Z"^^xsd:dateTime ;
  dc:created "2026-10-14T15:01:29Z"^^xsd:dateTime ;
  sioc:link <https://lhero.org/portfolio/lh-knowledge-base/notes/> ;
  sioc:has_creator <https://lhero.org/author/1/#account> ;
  sioc:has_container <https://lhero.org/#posts> ;
  content:encoded """<ul class="lh_portfolio-meta"><li><strong>Part of:</strong> <a href="https://lhero.org/portfolio/lh-knowledge-base/">LH Knowledge Base</a></li></ul>
<h2 class="wp-block-heading">Locking entries</h2>



<p class="wp-block-paragraph">Knowledge base entries support custom fields, so LH Post Locking can lock them. A locked entry can only be changed, trashed or deleted by an account with the lock capability (<code>manage_options</code> by default). Lock entries whose content drives unattended agent runs, so that an account with only <code>edit_posts</code> cannot rewrite the instructions an agent will follow. The daily health check procedure, <code>workflows/health-check</code> and <code>workflows/health-check/baselines</code>, is locked for this reason.</p>



<h2 class="wp-block-heading">Per-entry permission checks</h2>



<p class="wp-block-paragraph">The write abilities&#8217; permission callback checks <code>edit_posts</code>, which is type-level and cannot see restrictions on a single entry. So <code>update-entry</code> also checks <code>edit_post</code> on the entry and <code>trash-entry</code> checks <code>delete_post</code>. When the entry is locked, the refusal says so and includes <code>locked: true</code>. If a write still reaches WordPress and LH Post Locking&#8217;s backstop refuses it, the ability replaces core&#8217;s &#8220;Content, title, and excerpt are empty&#8221; message with the same locked error. Any new ability that writes to one entry should use the same check.</p>



<p class="wp-block-paragraph"><code>create-entry</code> can still add a child under a locked entry, since that does not change the locked entry itself.</p>



<h2 class="wp-block-heading">Reading entries that are not active</h2>



<p class="wp-block-paragraph">The read abilities need only <code>read</code>, so any signed-in user can use them. <code>list-entries</code> only ever returns active entries. <code>get-entry</code> returns an active entry to anyone with <code>read</code>, but a draft, pending, private or trashed one only to a user with <code>edit_post</code> on it; anyone else gets &#8220;Entry not found.&#8221;, so the call does not reveal that the entry exists. Before 1.8.0, any signed-in user could read such entries by ID, slug or path.</p>
"""^^rdf:XMLLiteral ;
  sioc:content """Part of: LH Knowledge Base
Locking entries



Knowledge base entries support custom fields, so LH Post Locking can lock them. A locked entry can only be changed, trashed or deleted by an account with the lock capability (manage_options by default). Lock entries whose content drives unattended agent runs, so that an account with only edit_posts cannot rewrite the instructions an agent will follow. The daily health check procedure, workflows/health-check and workflows/health-check/baselines, is locked for this reason.



Per-entry permission checks



The write abilities&#8217; permission callback checks edit_posts, which is type-level and cannot see restrictions on a single entry. So update-entry also checks edit_post on the entry and trash-entry checks delete_post. When the entry is locked, the refusal says so and includes locked: true. If a write still reaches WordPress and LH Post Locking&#8217;s backstop refuses it, the ability replaces core&#8217;s &#8220;Content, title, and excerpt are empty&#8221; message with the same locked error. Any new ability that writes to one entry should use the same check.



create-entry can still add a child under a locked entry, since that does not change the locked entry itself.



Reading entries that are not active



The read abilities need only read, so any signed-in user can use them. list-entries only ever returns active entries. get-entry returns an active entry to anyone with read, but a draft, pending, private or trashed one only to a user with edit_post on it; anyone else gets &#8220;Entry not found.&#8221;, so the call does not reveal that the entry exists. Before 1.8.0, any signed-in user could read such entries by ID, slug or path.
""" ;
  sioc:topic <https://lhero.org/?taxonomy=author&term=cap-1> .

<https://lhero.org/author/1/#account> rdfs:seeAlso <https://lhero.org/author/1/?feed=lhrdf&format=turtle> .
<https://lhero.org/?taxonomy=author&term=cap-1> rdfs:seeAlso <https://lhero.org/?taxonomy=author&term=cap-1&feed=lhrdf&format=turtle> .