Vibe Coding a WordPress Plugin Under Client Pressure  🔗 **Source:** [Vibe Coding a WordPress Plugin Under Client Pressure](https://manananomas.com/2026/09/12/fluentcart-wishlist-plugin/) > [!note]+ Document Notes > tags: [wordpress-plugins, fluentcart, ai-assisted-development, project-scoping, agency-pricing] > author: manananomas > source: Manana No Mas > reference: https://manananomas.com/2026/09/12/fluentcart-wishlist-plugin/ > date created: 2026-09-12 > > > [!info] Generated analysis — not the author's words. Sections below are machine-written > > from the captured source. Only text inside `> [!quote]` blocks is verbatim from the author. > > Do not quote or attribute any other line to the named author. > > # 🏷️ Title: Vibe Coding a WordPress Plugin Under Client Pressure > <!-- deep-read:sections start --> ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - [Source article: Vibe Coding a WordPress Plugin Under Client Pressure](https://manananomas.com/2026/09/12/fluentcart-wishlist-plugin/) — published 2026-09-12; the byline is the site account `manananomas`. - [LifterLMS for WordPress agencies](https://lifterlms.com/solutions/wordpress-professionals/) — linked in the article (HTTP 200 on 2026-09-12). - [FluentCRM marketing automation for WordPress](https://podcast.lifterlms.com/marketing-automation-in-wordpress-fluentcrm/) — linked in the article (HTTP 200). - [AI for WordPress online courses](https://podcast.lifterlms.com/ai-and-wordpress-online-courses/) — linked in the article; the page title reads "AI For WordPress Learning Management System Websites" (HTTP 200). - [FluentCart on WordPress.org](https://wordpress.org/plugins/fluent-cart/) — not linked in the article; added for verification. - [GoWishCart – Wishlist for FluentCart on WordPress.org](https://wordpress.org/plugins/gowishcart-wishlist-for-fluentcart/) — not linked in the article; the article's unnamed "option in the WordPress repository" matches this listing. - [Pros/Cons of Being a Professional (YouTube)](https://www.youtube.com/watch?v=UFN0WAUDr7c) — embedded in the live article after its second paragraph; Reader's article capture drops the embed. ## 📝 Summary - **What happened:** Manana No Mas took a local art-kit store build for $6,000, against a normal range of $12,000 to $18,000. Days before a Friday launch, the client asked for a wish list. FluentCart doesn't ship one, the third-party options failed the agency's checks, and the team spent about three hours building a custom plugin with AI assistance. The article calls it MananaWishCart. - **Why it matters:** The post shows the gap between a one-line feature request and a specification. The agency lists account creation, guest access, list ownership, variations, inventory, and notifications as separate decisions. It also shows AI shrinking build time to three hours while styling, testing, and review stay on the agency. - **Key stakeholders:** The client (a local art-kit seller, seven products at launch), the agency and its founder Kurt von Ahnen (named in the third person), the FluentCart vendor WPManageNinja, the GoWishCart developers, and agencies pricing fixed-scope WordPress builds. - **Risks and tradeoffs:** The agency absorbed a feature it values at $3,500 and time it values at about $600. A custom plugin now needs maintenance on a $6,000 build. The plugin creates WordPress user accounts from a guest email field, and the article shows no code, so nobody outside the agency can check that flow for nonces, rate limits, or ownership checks. - **Bottom line:** The post argues that professional judgment, not AI output, decides whether an out-of-scope request gets built, quoted, or declined. Its own naming slips (GoWishCart used for both the rejected plugin and the agency's build) weaken the case study's reliability as a record. ## 📖 Main Content - **Diagnostics as lead generation.** The first third covers DealerGaps.com, an AI diagnostic built for the Powersport Academy. Dealers enter their own numbers, and the tool estimates revenue opportunity. The article's example: $45,000 in training against an estimated $840,000 in added revenue. A planned diagnostic for learning and development managers estimates LMS savings, with an example of $227,000 per year, then routes the prospect into FluentCRM follow-up. DealerGaps.com resolves, and its page title reads "PowerSport Academy — Fixed Ops Growth Diagnostic." The dollar figures are illustrations, not measured results. - **Hot leads and founder dependence.** A "hot lead" in the article has shared contact details, shown interest, and welcomed a conversation. The agency asks "Who do you know that I should know?" and names podcasts, WordPress meetups, and Hutch Connect as intake channels. It raises founder dependence: how much of the business depends on Kurt von Ahnen's relationships. - **The discounted build.** The stack is FluentCart for e-commerce and shipping, FluentCRM, Fluent Forms, and a LifterLMS architecture for future courses. The agency priced it at $6,000 to gain a local e-commerce portfolio example. - **Store-first redesign.** The first design put a store inside a website. The client wanted a store with the website behind it. The agency made the shop page the front door, moved other pages to secondary navigation, and adjusted the FluentCart shop layout with Gutenberg blocks. - **The wish list request.** The client saw wish lists on larger sites, and ChatGPT told her a site at this price could include one. The agency breaks the request into logged-in and guest flows, account creation, list ownership, item removal, variations, out-of-stock handling, a path back to cart, and optional notifications. - **ChatGPT as a pricing check.** The agency asked ChatGPT to estimate the full stack. It returned $12,500 to $25,000 for the first year, a likely agency quote of $15,000 to $18,000, and $25,000 to $40,000 for a broader engagement. The agency reads this as confirmation that $12,000 sat at the low end. - **Rejecting existing plugins.** One WordPress.org plugin "did not work," had blocked support and contact paths, and showed no active installations. Another vendor offered a $169 lifetime license, but its checkout didn't work. WordPress.org's API on 2026-09-12 shows GoWishCart (slug `gowishcart-wishlist-for-fluentcart`) at version 2.0.3 with 0 active installs, 0 ratings, and 0 support threads. Its homepage, gowishcart.com, returned HTTP 521 twice. That listing matches the first description. The $169 vendor isn't named, so it can't be checked. - **The build.** About three hours of work turned a code snippet into a plugin with button styling options. It adds a heart "Add to Wishlist" button, a per-user wishlist page, and guest email capture that creates a user account. Users can remove items or move them to the cart. It reads existing product and customer data. Testing covered product states, variations, guest registration, duplicate saves, and stock changes. The article doesn't name the AI tool used to build the plugin. ChatGPT is named only for pricing and the client's expectation. - **Trade-offs.** A custom wish list could have been a $3,500 line item. The agency built it anyway because the client is local, the project paid, and the launch at a fair was close. Future work (back-in-stock alerts, price-drop alerts, subscription management, FluentAffiliate) would need separate scope. - **Uncertainties and contested claims:** - The GoWishCart listing's description advertises guest wishlists, saved variations, price-drop and back-in-stock notifications, and FluentCRM triggers. Those are the features the article treats as missing or future. The article says the plugin "did not work." This analysis didn't install it, so that claim is unverified. - The article spells the product three ways: MananaWishCart (38 times), ManananWishCart (1), and GoWishCart (4, some describing the agency's own build). It uses "Fluent Cart" twice and FluentCart 20 times, and mentions FluentAffiliate 9 times despite calling it a future integration. The repetition pattern fits a keyword-optimization rewrite. That's an inference from counts, not a confirmed cause. - The article says it "reviewed the REST API, license management, and update history first" and "considered" a REST API for "later integrations." Whether the plugin exposes REST routes today isn't stated. ## 🗒️ Notes - Title: "Vibe Coding a WordPress Plugin Under Client Pressure." Published 2026-09-12 on manananomas.com. The article runs 2,335 words by body-text count and has 12 H2 sections and 5 FAQ H3s. - The byline on the live page (`posted-by vcard author`) links to `/author/manananomas/`. `/wp-json/wp/v2/users?slug=manananomas` returns user ID 1 with display name "manananomas." No person is credited as author. - The opening pairs a $6,000 build with a client who expects every feature seen on a large store. - Key Takeaways bullets list five points: request vs. specification, a custom plugin after unreliable options, three hours of AI-assisted build, a connected Fluent-family system, and balancing relationship against cost. - DealerGaps.com is an AI diagnostic for the Powersport Academy. The article presents the $45,000 cost against $840,000 in estimated revenue as an example. - The enterprise eLearning diagnostic estimates savings, with an example of $227,000 per year, and routes leads into FluentCRM. - "Hot lead" means contact info plus interest plus an invitation to talk. - Intake channels named: podcasts, WordPress meetups, Hutch Connect, and meet-and-greets. - Founder dependence: the article names Kurt von Ahnen's personality as part of the business. - The client sells art kits and physical products. Another agency referred her. - Stack: FluentCart, FluentCRM, Fluent Forms, a LifterLMS architecture, and FluentAffiliate as a possible future integration. - Usual price range is $12,000 to $18,000. This project closed at $6,000. - The first sample missed: "website with a store" vs. "store with a website behind it." - Fixes: a new header and hero, the shop page as the front door, secondary navigation, color and logo background changes, and a Gutenberg-block shop layout. - The wish list request came late. The client had seen it elsewhere, and ChatGPT had told her the price range could include it. - The shop held seven products, and the wish list wasn't required for the Friday launch. - Bolded thesis: a feature request isn't a specification. - ChatGPT estimate: $12,500 to $25,000 first year, $15,000 to $18,000 likely quote, $25,000 to $40,000 broader. - Existing options: a WordPress.org plugin with dead support paths and no installs, and a $169 lifetime license vendor whose checkout failed. - WPManageNinja is described as "a vendor or ecosystem option to investigate." The FluentCart WordPress.org listing names WPManageNinja as author, with contributors `wpmanageninja` and `techjewel`. - The build took about three hours, went from snippet to plugin, and has button styling options. - Features: heart button, wishlist page, per-user lists, guest email creates an account, remove item, and move to cart. - Email notifications aren't in the first release. - Testing covered product states, variations, guest registration, duplicate saves, and stock changes. - Next steps named: test on more sites and show it to "Juel at Fluent" as a possible add-on. The FluentCart listing's `techjewel` contributor handle may refer to that person. This analysis didn't confirm it. - Value framing: $3,500 as a line item, about $600 of time absorbed. - The FAQ restates features and says a wishlist isn't automatically included in fixed-price work. - Closing: the lesson is balancing scope, satisfaction, deadlines, reputation, and cost, not that AI can write a plugin. - **Embedded video:** the live page embeds a YouTube iframe titled "Pros/Cons of Being a Professional" (video ID UFN0WAUDr7c) after the second paragraph. Reader's captured HTML omits it. - **Code shown:** none. Reader's captured HTML has zero `<pre>` or `<code>` blocks and zero images, and the live article has 0 `<img>` elements. Any security assessment below is limited to described behavior. ## 📚 References - [FluentCart on WordPress.org](https://wordpress.org/plugins/fluent-cart/) — API check 2026-09-12: version 1.6.4, 8,000+ active installs, added 2025-10-14, last updated 2026-09-11, requires WordPress 6.7, tested to 7.1, PHP 7.4+, rating 88/100 from 39 ratings. The word "wishlist" doesn't appear in the plugin description, which supports the article's claim that FluentCart lacks the feature. FluentCart Pro wasn't checked. - [GoWishCart – Wishlist for FluentCart](https://wordpress.org/plugins/gowishcart-wishlist-for-fluentcart/) — version 2.0.3, 0 active installs, added 2026-03-25, last updated 2026-05-24, tested to 7.0.4, 0 ratings, 0 support threads, author `azizultex`, contributors `azizultex` and `sabbirxprt`. Homepage https://gowishcart.com returned HTTP 521. - [FluentCRM](https://wordpress.org/plugins/fluent-crm/) — version 3.2.0, 80,000+ active installs. - [Fluent Forms](https://wordpress.org/plugins/fluentform/) — version 6.2.13, 700,000+ active installs. - [FluentAffiliate](https://wordpress.org/plugins/fluent-affiliate/) — version 1.6.5, 1,000+ active installs. - [LifterLMS](https://wordpress.org/plugins/lifterlms/) — version 10.2.0, 10,000+ active installs. - [DealerGaps.com](https://dealergaps.com/) — resolves. Page title "PowerSport Academy — Fixed Ops Growth Diagnostic." - [WordPress Developer Resources: Security](https://developer.wordpress.org/apis/security/) — sanitizing, validating, and escaping reference. - [Plugin Handbook: Nonces](https://developer.wordpress.org/plugins/security/nonces/) - [Plugin Handbook: Checking user capabilities](https://developer.wordpress.org/plugins/security/checking-user-capabilities/) - [REST API Handbook: Adding custom endpoints](https://developer.wordpress.org/rest-api/extending-the-rest-api/adding-custom-endpoints/) — `permission_callback` requirement for any future wishlist routes. - Related capture: the Reader doc "Pros/Cons of Being a Professional" comes from the YouTube channel "Manana No Mas!", the same business name this article uses for itself. The live article embeds that same video (iframe `src` https://www.youtube.com/embed/UFN0WAUDr7c), and the Reader YouTube doc's source URL uses the same video ID, so the article and the video are companion pieces from one publisher. ## 🗣️ Paraphrase - **Opening:** A client sees a feature on a big store and assumes a $6,000 site includes it. When the request lands days before launch and outside the approved scope, the agency has to decide fast. - **Diagnostics:** The agency built DealerGaps.com so dealership owners can enter their own numbers and see a revenue estimate. That makes a $45,000 training cost easier to weigh against a projected $840,000. It's applying the same idea to LMS cost diagnostics that feed FluentCRM. - **Leads:** A diagnostic gives the prospect a reason to talk about a problem using their own data. The agency uses FluentCRM to organize follow-up, asks for referrals, and worries about how much of the business rests on its founder. - **The build:** A referred local client wanted to sell art kits with FluentCart, FluentCRM, Fluent Forms, and room for LifterLMS courses. The agency normally charges $12,000 to $18,000 for this and took it at $6,000 for local visibility. - **Redesign:** The first draft put the store inside a site. The client wanted the store up front. The agency rebuilt the header, hero, and navigation around the shop page. - **The request:** Late in the project, the client asked for a wish list. She'd seen one elsewhere, and ChatGPT had told her it fit the budget. FluentCart doesn't include one, and the store had seven products, so launch didn't depend on it. - **Specification:** A wish list means decisions about accounts, guests, ownership, removal, variations, stock, the path back to checkout, and notifications. - **Price check:** ChatGPT put the full stack at $12,500 to $25,000 for year one, so the agency concludes its $12,000 was already low before halving it. - **Existing options:** The one WordPress.org plugin didn't work and had no reachable support. A second vendor's checkout didn't work, so it couldn't be bought. The agency decided not to put an untested tool on a client store. - **Vibe coding:** In about three hours, the team turned a snippet into a plugin that adds a heart button, a wishlist page, guest-to-account signup, removal, and move-to-cart. It tested variations, guest registration, duplicates, and stock changes. - **Trade-offs:** The feature could have been a $3,500 add-on, and the time was worth about $600. The agency absorbed both for a local, paying client with a fair deadline, and says future enhancements need their own scope. - **Close:** The lesson isn't that AI can write a plugin. It's that professional judgment weighs scope, satisfaction, deadlines, reputation, and cost after the contract is signed. ## 📰 Newsletter - **An agency's three-hour FluentCart wishlist, and the invoice it didn't send.** Manana No Mas priced a local art-kit store at $6,000, half its usual floor. Then the client asked for a wish list that FluentCart 1.6.4 doesn't include. The one wishlist plugin on WordPress.org for FluentCart, GoWishCart, shows 0 active installs and a homepage returning HTTP 521, so the team built its own with AI help in about three hours. The takeaway for your next fixed-price build: write down "wish list" as eight decisions (accounts, guests, ownership, removal, variations, stock, checkout path, notifications) before anyone says yes. [Read the post](https://manananomas.com/2026/09/12/fluentcart-wishlist-plugin/). - **If your AI-built plugin creates user accounts from a guest email field,** review it against the Plugin Handbook's [nonces](https://developer.wordpress.org/plugins/security/nonces/) and [capability checks](https://developer.wordpress.org/plugins/security/checking-user-capabilities/) pages before launch. The post shows no code, so you can't borrow its implementation. Borrow its checklist instead. - **Fluent-family stack notes:** FluentCRM 3.2.0 has 80,000+ installs, Fluent Forms 6.2.13 has 700,000+, and FluentAffiliate 1.6.5 has 1,000+ (WordPress.org, 2026-09-12). ## ✅ Action Items #### DevRel - **Developer advocacy:** Build a 20-minute demo that takes one feature request ("add a wish list") and produces the eight-decision spec the article lists before any code gets written. Measure how many attendees reuse the template in a follow-up survey. - **Education:** Run a workshop on security review for AI-generated WordPress plugins. Use a guest-signup wishlist as the example, and cover nonces, `sanitize_email()`/`is_email()`, role assignment, rate limiting, and ownership checks. - **Developer experience:** Publish a starter checklist for FluentCart add-on authors that maps each wishlist behavior (add, remove, move to cart, guest signup) to the WordPress security API that protects it. - **Developer marketing:** Pitch a case-study format that reports hours spent, dollar value absorbed ($600 and $3,500 here), and testing coverage, so AI-build posts carry comparable numbers. - **Community management:** Add a pinned forum or Slack prompt asking builders to report which AI tool and model they used. This article names ChatGPT only for pricing, not for the build. - **Internal/external/cross-project:** Share the article's scope-creep pattern with plugin vendors so FluentCart's feature roadmap hears that clients now arrive with ChatGPT-sourced feature expectations. #### OSPO - **Policy & Governance:** Draft a policy that any AI-assisted plugin deployed to a client site gets a named human reviewer and a written security checklist before launch. - **License Compliance:** Record the license of AI-generated plugin code. A snippet promoted to a plugin needs a GPL-compatible header if it's ever offered to "Juel at Fluent" as an add-on. - **Security Management:** Set an intake path for vulnerability reports on client-specific plugins. MananaWishCart has no public listing, so reporters have nowhere to send findings. - **Software Inventory:** Log every custom plugin per client site with owner, version, and last review date. A three-hour build becomes a maintenance liability on a $6,000 contract. - **Developer Support:** Offer one office hour per sprint where a second developer reviews AI-generated code paths that touch user creation or authentication. - **Community Engagement:** If the plugin gets published, open a WordPress.org support forum so it doesn't repeat GoWishCart's 0-thread, dead-homepage state. - **Strategic Alignment:** Track absorbed out-of-scope hours per quarter as a KPI. This project absorbed about three hours valued at $600. #### Community - **Maintainers:** Run a release-hygiene clinic for small add-on maintainers. GoWishCart shipped version 2.0.3 with a homepage that returns 521 and no support activity. - **Contributors:** Create "first issue" tasks that ask new contributors to test niche add-ons (FluentCart wishlists) and file reproducible bug reports. - **Sponsors:** Fund a small bounty for a security review of the most-installed FluentCart add-ons, starting with any that create accounts for guests. - **Ecosystem:** Coordinate disclosure contacts between WPManageNinja and third-party FluentCart add-on authors so a broken add-on has a reachable owner. #### WordPress - **Core:** Not applicable to this source. The article doesn't touch core APIs or core behavior. - **Core Performance:** Not applicable to this source. The article reports no performance measurements. - **Core AI:** Build an evaluation set from real "vibe-coded" plugin prompts (wishlist, guest signup, move to cart) and score the outputs on nonce use, capability checks, escaping, and `permission_callback` presence. This article is one data point: three hours to a working release with no public code. - **Core Program Team:** Not applicable to this source. No cross-team WordPress project process appears. - **Mobile:** Not applicable to this source. The article doesn't cover the mobile apps. - **Playground:** Offer a Playground blueprint that installs FluentCart plus a wishlist add-on, so agencies can test add-ons like GoWishCart before recommending or rejecting them. The article's rejection of an untested plugin would have had a reproducible record. - **Community:** Add a meetup talk slot on scoping fixed-price client work. The article names WordPress meetups as a lead source. - **Training:** Write a Learn WordPress lesson on turning a feature request into a specification, using the article's wish list decision list as the worked example. - **Marketing:** Not applicable to this source. The article promotes an agency, not WordPress project messaging. - **Support:** Add a support-forum guide for reporting a plugin whose homepage and contact paths are unreachable. The article describes this situation and gives no sign the agency reported it. - **Design:** Review icon-only toggle patterns (the heart "Add to Wishlist" button) for an accessible name and pressed state in block-based shop layouts. - **Documentation:** Add an "AI-assisted plugin review" page to the Plugin Handbook security section that links [Security](https://developer.wordpress.org/apis/security/), [Nonces](https://developer.wordpress.org/plugins/security/nonces/), and [Checking user capabilities](https://developer.wordpress.org/plugins/security/checking-user-capabilities/) into one pre-launch checklist. - **Photos:** Not applicable to this source. No photo directory content appears. - **TV:** Not applicable to this source. No WordPress.tv content appears. The embedded video is hosted on YouTube, not WordPress.tv. - **Polyglots:** Not applicable to this source. The article doesn't address translation. A custom plugin built in three hours probably lacks a text domain, but the article shows no code to confirm it. - **Accessibility:** Add the wishlist heart button, guest email prompt, and "moved to cart" feedback to an accessibility test matrix for e-commerce add-ons. - **Meta:** Consider surfacing homepage reachability on plugin directory listings. GoWishCart's listed homepage returned HTTP 521 on 2026-09-12. - **CLI:** Not applicable to this source. No WP-CLI use appears. - **Hosting:** Not applicable to this source. Hosting appears only as a line item in ChatGPT's estimate. - **Tide:** Not applicable to this source. No code is published for scoring. - **Openverse:** Not applicable to this source. No media licensing appears. - **Themes:** Not applicable to this source. The redesign used Gutenberg blocks but names no theme. - **Plugins:** Open a support thread on `gowishcart-wishlist-for-fluentcart` documenting the failure the article describes (0 threads exist as of 2026-09-12). If MananaWishCart is submitted to the directory, run it through Plugin Check first and document its guest account creation flow in the readme. #### The WPOCC - **Programs:** Offer microgrants for security reviews of AI-assisted plugins built by small agencies, since this build had no published code or third-party review. - **Projects:** Run a documentation sprint producing a "feature request to spec" template for fixed-price agency builds. - **Funding experiments:** Pilot a milestone payout tied to a published security checklist for client-built plugins released as open source. #### FAIR - **Technical independence:** Test whether FAIR package metadata would show a publisher's support endpoint as unreachable before install, given GoWishCart's HTTP 521 homepage. - **Policies and covenants:** Draft a covenant that a listed add-on must keep at least one reachable support channel. - **Productized governance artifacts:** Create a scorecard for small add-ons: active installs, support threads, homepage status, and last update. GoWishCart scores 0, 0, 521, and 2026-05-24. ## 🧪 Hypotheses - **H1:** Clients who cite ChatGPT for feature expectations request more out-of-scope features after contract signature than clients who don't. Measure change requests per project. - **H2:** AI-assisted WordPress plugins built in under four hours by agencies omit at least one of nonce verification, capability checks, or output escaping in 50% or more of reviewed samples. - **H3:** WordPress.org plugins with 0 active installs and an unreachable homepage fail a basic function test on a current WordPress release more often than plugins with 1,000+ installs. - **H4:** Agencies that write a feature request as a decision list (like the article's eight wish list decisions) before quoting absorb fewer unbilled hours per project. - **H5:** Diagnostic lead tools that use prospect-entered numbers produce more booked discovery calls per 100 visitors than plain contact forms. ### 📊 Methodology - **H1:** Pull change-request logs from 30+ agency projects. Code each client intake for explicit AI-tool citations. Compare post-signature change requests with a Mann-Whitney U test. - **H2:** Collect 20+ public plugins that state AI-assisted authorship. Run Plugin Check and PHPCS with the WordPress-Extra and WordPress-VIP-Go rulesets, then manually review every AJAX and REST handler for nonce and capability checks. Report the omission rate with a 95% confidence interval. - **H3:** Sample 50 plugins with 0 installs and an unreachable homepage, plus 50 with 1,000+ installs from the same category. Install each in a WordPress Playground instance on the current release and record activation errors and core-feature failures. - **H4:** Run an A/B test across one agency's quotes for a quarter: half use a structured decision-list intake, half don't. Track unbilled hours per project. - **H5:** Instrument a diagnostic form and a contact form on the same site with split traffic. Measure booked calls per 100 unique visitors over 90 days. ### ❓ Questions - Which AI tool and model built MananaWishCart, and what prompts produced it? - Does the guest email flow respect the site's `users_can_register` setting, and which role does it assign? - How does the plugin stop one user from removing items from another user's list? - Did the agency file a report about GoWishCart on its WordPress.org support forum or with the plugin's authors? - What did the GoWishCart failure look like: an activation error, missing buttons, or broken saves? - Who maintains MananaWishCart after launch, and is that cost inside the $6,000 contract? - Did "Juel at Fluent" or WPManageNinja respond about a possible add-on? - How did the agency decide on the $3,500 and $600 figures? ### 🔮 Future Research - Nobody has published a security audit rate for AI-generated WordPress plugins deployed to client sites. - There's no public data on how often clients arrive with feature expectations sourced from chatbots. - The FluentCart add-on ecosystem (first listed on WordPress.org 2025-10-14) has no published survey of add-on quality or support responsiveness. - Nobody has studied how well LLM price estimates for WordPress projects match actual agency quotes. - Research is thin on keyword-optimization rewrites that introduce product-name errors into technical case studies (this article has 3 spellings for one plugin). ### 💡 Implications - **Practice:** Agencies can build small features in hours with AI, which makes "just add it" requests cheaper to say yes to. It doesn't make those features cheaper to maintain or secure. - **Policy:** Fixed-price contracts need a written clause for post-signature feature requests. The article's $3,500 absorbed value shows the cost of not having one. - **Security:** A plugin that creates accounts from an unauthenticated email field widens a store's attack surface. Without code, neither the client nor any reviewer can confirm nonce use, rate limiting, or ownership checks. - **Education:** Training on scoping needs a module on clients who bring ChatGPT estimates, since both the client and the agency in this article used ChatGPT to set expectations. - **Funding models:** Discounted local builds that absorb custom plugin work shift maintenance costs onto the agency, with no revenue line to cover them. - **Ecosystem:** Newer commerce plugins like FluentCart (8,000+ installs) have thin add-on markets. A 0-install add-on can be the only option, and that pushes agencies toward custom code. ### 🧠 Learning Styles Assessment - **Reading level estimate:** Flesch-Kincaid Grade Level 11.7, Flesch Reading Ease 41.6. Computed over 2,335 body words and 137 sentences with a heuristic syllable counter, so treat both as approximate. A general audience reads comfortably at Grade 8 to 9. #### 👀 Visual learners - **Present:** 12 H2 headings, a bulleted Key Takeaways list, a bulleted feature list, and one embedded YouTube video on the live page. The article has 0 images, screenshots, or diagrams. - **Improve:** Add before-and-after screenshots of the store-first redesign, a screenshot of the heart button and wishlist page, and a flow diagram of guest email → account → wishlist. #### 🔊 Aural learners - **Present:** The live article embeds a Manana No Mas! YouTube video, "Pros/Cons of Being a Professional." Reader's capture drops it. - **Improve:** Add a 3-minute audio summary of the build itself. The video's title doesn't show whether it covers the plugin. #### 🗣️ Verbal learners - **Present:** Plain-language explanations of scope, a bolded thesis sentence, and a five-question FAQ. - **Improve:** Define "vibe coding," "hot lead," and "FluentCart" at first use. Keep one product name instead of three. #### 🧩 Kinesthetic learners - **Present:** No step-by-step build instructions, code, or sandbox. - **Improve:** Publish the eight wish list decisions as a fillable scoping checklist, or offer a Playground blueprint of the FluentCart store with the wishlist plugin installed. #### 🧠 Logical learners - **Present:** Dollar figures ($6,000, $12,000 to $18,000, $3,500, $600) and ChatGPT's ranges. - **Improve:** Put the price comparisons in one table. Add a decision tree for "quote, absorb, or decline" an out-of-scope request. #### 🧑‍🤝‍🧑 Social learners - **Present:** References to meetups, Hutch Connect, podcasts, and a comment form on the live page. - **Improve:** Close with a discussion prompt asking agencies how they price late feature requests. #### 🧘‍♀️ Solitary learners - **Present:** The FAQ works as a self-check. - **Improve:** Add a reflection prompt: "List every decision hidden inside the last feature request you accepted." #### 🌿 Naturalistic learners - **Present:** Not applicable to this source. The article has no environmental or lifecycle framing. - **Improve:** Frame plugin maintenance as a lifecycle cost (build, update, retire) with an estimate per year. ### 📊 Accessibility Assessment #### Screen reader semantics - **Present:** The Reader capture shows 12 H2s and 5 H3s in logical order. The live page wraps the byline in a schema.org Person `vcard` block, sets `lang="en-US"`, and includes a skip link. - **Improve:** The Key Takeaways and FAQ are well structured. The product itself needs an accessible name on the icon-only heart button and an announced state change when an item is saved. #### Keyboard navigation - **Present:** The article describes no keyboard behavior for the wishlist button, email prompt, or move-to-cart action. - **Improve:** Confirm the heart button is a `<button>`, reachable by Tab, and toggled by Enter and Space. Confirm the guest email prompt traps focus only while open and returns focus to the button on close. #### Contrast and readability - **Present:** The article mentions "button styling options" and color changes but gives no contrast values. - **Improve:** Check that the heart icon and its saved state meet 3:1 non-text contrast (WCAG 1.4.11) and that button text meets 4.5:1 (WCAG 1.4.3). #### Text resizing and reflow - **Present:** Not assessed. The article gives no information on zoom or responsive behavior of the shop layout. - **Improve:** Test the Gutenberg shop grid and wishlist page at 320 CSS px width for WCAG 1.4.10 reflow. #### Media and captions - **Present:** The live article embeds one YouTube iframe with a `title` attribute ("Pros/Cons of Being a Professional"), which gives it an accessible name (WCAG 4.1.2). This analysis didn't check the video's captions. - **Improve:** Link a transcript below the embed and confirm the video has reviewed captions (WCAG 1.2.2). #### Forms and interactions - **Present:** The guest email prompt is the one form. The article doesn't describe its label, error handling, or success message. - **Improve:** Give the email field a visible label (WCAG 3.3.2) and an `autocomplete="email"` attribute (1.3.5). Announce errors in text (3.3.1) and confirm "added to wishlist" and "moved to cart" through a live region (4.1.3). Keep the heart target at least 24×24 CSS px (2.5.8). #### Standards reference - **Gaps mapped to WCAG 2.2 AA:** 1.1.1 (icon button name), 1.3.5 (email autocomplete), 1.4.3 and 1.4.11 (contrast), 1.4.10 (reflow), 2.1.1 (keyboard), 2.5.8 (target size), 3.3.1 and 3.3.2 (form errors and labels), 4.1.2 (button name, role, and pressed state), 4.1.3 (status messages). All are unverified, because the plugin isn't public. ### 🌍 DEIB Assessment #### Cultural breadth - **Present:** The examples are all U.S.-local: a town fair, a local art-kit seller, and motorcycle dealerships. All prices are in USD. - **Improve:** Note that guest email capture and account creation carry different consent rules under GDPR and similar laws for stores selling outside the U.S. #### Inclusive language - **Present:** The client is referred to as "she" and "her," which is the article's own usage. Jargon like "vibe coding," "hot lead," and "discovery call" appears without definitions. - **Improve:** Define "vibe coding" at first use and add a two-line glossary. #### Neurodiversity support - **Present:** Key Takeaways up front, short sections, and a FAQ. The three spellings of the product name (MananaWishCart, ManananWishCart, GoWishCart) add avoidable confusion. - **Improve:** Use one product name throughout and move the DealerGaps lead-generation material to its own post so the article follows one story. #### Representation - **Present:** One founder is named (Kurt von Ahnen). The client is unnamed. "Juel at Fluent" is named by first name only. - **Improve:** Credit the developers and reviewers who did the CSS and testing work the article says was required. #### Psychological safety - **Present:** The article describes the client's ChatGPT-sourced expectation without blaming her. It says design preferences are subjective and the agency's role is to honor her direction. - **Improve:** Add guidance on how to tell a client a request is out of scope without implying they were wrong to ask. ### ✅ Logical Validity #### Strong reasoning - **Decomposition (Wish list request section):** The article breaks "add a wish list" into concrete decisions: logged-in vs. guest, account creation, ownership, removal, variations, stock, checkout path, and notifications. This deductive breakdown shows why a request isn't a spec, and a reader can check each item. It'd be clearer as a numbered list. - **Cost framing (Trade-offs section):** Stating both the absorbed line-item value ($3,500) and the actual time cost (about $600) lets the reader see the gap between price and effort. That's a transparent causal account of the decision. - **Risk-based vendor rejection (Building instead of trusting):** Rejecting a plugin with no installs and no reachable support is inductive reasoning from observable signals. The WordPress.org API confirms the listing it describes (0 installs, 0 support threads, homepage HTTP 521). The case would be stronger if the article named the plugin and described how it failed. #### Fallacies - **Equivocation (Building instead of trusting an untested plugin):** > [!quote] ID:rw_01m2bsqfce1d78hwc26xrdatv9 > That support risk made GoWishCart a more sensible build. [view highlight](https://read.readwise.io/read/01m2bsqfce1d78hwc26xrdatv9) - **Weakness:** GoWishCart is the name of the third-party WordPress.org plugin that matches the failed option, yet this sentence calls GoWishCart the sensible build. Elsewhere the article uses GoWishCart for its own build's journey and pricing. The name slides between the rejected product and the agency's product, so a reader can't tell which one was tested. - **Fix:** Name the rejected plugin once and use MananaWishCart for the agency's build every other time. - **Appeal to authority (ChatGPT confirmed the original estimate):** > [!quote] ID:rw_01m2bsqpdp7qvjd7acmkhs0ccx > Our original $12,000 number sat near the lower end of a reasonable range, before we cut it in half for this local project. [view highlight](https://read.readwise.io/read/01m2bsqpdp7qvjd7acmkhs0ccx) - **Weakness:** The section heading says ChatGPT "confirmed" the estimate, but an LLM's price range isn't market evidence. The article earlier treats the client's reliance on ChatGPT as the source of a mistaken expectation. That's a double standard: ChatGPT is wrong when it favors the client and authoritative when it favors the agency. - **Fix:** Cite comparable quotes, published agency rate surveys, or the agency's own past invoices, and present ChatGPT's output as one input. - **Hasty generalization (Vibe coding section):** Three hours of work and one site's test pass support "a working first release," but the FAQ presents the plugin as a general "custom FluentCart Wishlist Plugin." Fix: say it's tested on one store with seven products. #### Tone of voice - **Tone:** Reflective and business-practical, with a first-person plural agency voice ("We built," "We chose"). Example: "The trade-off is real." - **Register:** It reads as marketing and lessons learned more than a technical write-up. It shows no code, and the FAQ repeats product and ecosystem names (MananaWishCart 38 times, FluentAffiliate 9 times) in a pattern that fits search optimization. ### 🛡️ DARVO Analysis - **Not applicable to this source.** The article responds to no accusation, dispute, or critique, so DARVO patterns have nothing to attach to. - **Deny:** None found. The article acknowledges the $3,500 and $600 absorbed costs. - **Attack:** None found. It describes the failed plugin vendors by their observable state (blocked support, broken checkout), not by name or motive. - **Reverse victim/offender:** None found. The client's ChatGPT-based expectation is described without casting the agency as wronged. - **Emotional cues and related fallacies:** The "client pressure" framing in the title adds urgency. The appeal-to-authority issue above is the closest related rhetorical weakness. ## 🎯 Conclusion - **Bottom line:** A wish list is eight decisions, not one feature. AI got a working FluentCart wishlist plugin built in about three hours, and the agency absorbed $3,500 of value to keep a local client on schedule. The post shows no code, uses three names for one plugin, and leans on ChatGPT for price validation, so treat it as a scoping lesson, not a build reference. - **Next steps for readers:** - Before quoting any late feature request, list its decisions the way the article lists the wish list's. - If you vibe-code a plugin that creates accounts, check it against the Plugin Handbook's [nonces](https://developer.wordpress.org/plugins/security/nonces/) and [capabilities](https://developer.wordpress.org/plugins/security/checking-user-capabilities/) pages and rate-limit the signup path. - Before rejecting or adopting a small add-on, check its WordPress.org installs, support threads, and homepage status. GoWishCart showed 0, 0, and HTTP 521 on 2026-09-12. ## 🔄 Refactor Appendix — Vibe Coding a WordPress Plugin Under Client Pressure > Density: 2–5 Literature atoms (H3), 0–3 Permanent candidates (H4). > Defaults: 3 Literature, 1 Permanent. Resonance filter: if you can't > articulate in one line why a claim matters, drop it. > > Konik claim-header rules: present tense, declarative, ≤10 words when > possible, searchable, unique, mirrors annotation focus if present. > > Atomicity: one declarative sentence per atom. "and"/"also" → split. > > Tag pool: #bmf · #addendum · #xref · #articleseed · #storystem · #share · #aphorisms ### 📚 Literature Atoms (H3) #### [H1] Feature requests aren't specifications > [!quote] ID:rw_01m2bsq9axeeaj9w4jbr6svdnw > A feature request is not the same as a complete specification. **Context & use**: - Section "The wish list request changed the project," bolded standalone paragraph. - The article's thesis: the sentence sits between the client's request and the eight-decision breakdown, which makes it a reusable scoping rule. **Tags**: #xref #aphorisms **Highlight**: [view highlight](https://read.readwise.io/read/01m2bsq9axeeaj9w4jbr6svdnw) <!-- atomicity: 1 idea ✓ --> #### [H2] AI builds the draft; security review stays human > [!quote] ID:rw_01m2bsqcr1kbd6p8kg2ymt7c86 > AI-assisted development helped create the first MananaWishCart release in about three hours, but styling, testing, integrations, security, and professional review were still required. **Context & use**: - Key Takeaways, third bullet. - It puts a number (three hours) on AI build time and names security as work AI didn't remove, which fits DevRel talks on AI-assisted plugin development. **Tags**: #xref #articleseed **Highlight**: [view highlight](https://read.readwise.io/read/01m2bsqcr1kbd6p8kg2ymt7c86) <!-- atomicity: 1 idea ✓ --> #### [H3] Absorbed scope costs $3,500 value, $600 time > [!quote] ID:rw_01m2bsqvnfsnzwgzj2qb4bmwqj > A fully custom MananaWishCart wish list could have been a separate $3,500 item. Three hours of our time also represents about $600 in value. **Context & use**: - Section "Professional work means weighing the trade-offs," second and third sentences. - It separates price value from effort cost, the gap agencies need to see before absorbing a request. **Tags**: #xref #share **Highlight**: [view highlight](https://read.readwise.io/read/01m2bsqvnfsnzwgzj2qb4bmwqj) <!-- atomicity: 1 idea ✓ --> #### [H4] Guest email signup creates accounts needing security review > [!quote] ID:rw_01m2bsqry0j071ga8sdtryb97a > Prompts guests for an email address, then creates a user account and wishlist. **Context & use**: - Feature list under "Vibe coding the Fluent Cart wish list plugin," fourth item. - Unauthenticated account creation is the highest-risk behavior described, and the article shows no code for it. Check it against nonces, `is_email()`, role assignment, and rate limiting. **Tags**: #xref #share **Highlight**: [view highlight](https://read.readwise.io/read/01m2bsqry0j071ga8sdtryb97a) <!-- atomicity: 1 idea ✓ --> ### 🧠 Permanent Candidates (H4) #### [P1] A late feature request is a bundle of unpriced decisions **Claim** (one sentence, Courtney's voice): When a client names a feature late in a fixed-price project, I quote the list of decisions it contains, not the feature's name. **Evidence pointer**: [[#[H1] Feature requests aren't specifications]] — the article's wish list request breaks into eight decisions (accounts, guests, ownership, removal, variations, stock, checkout path, notifications). **Scope & conditions**: Holds for fixed-price and fixed-scope builds. It weakens for retainer or time-and-materials work, where the client already pays per decision. **Links** (≥1 with annotation): - [[Scope creep]] — because extends - [[Security review for AI-generated plugins]] — because applies-in guest account flows - [[Fixed-price contracts]] — because applies-in agency pricing <!-- atomicity: 1 idea ✓ --> #### [P2] AI shortens the build, not the review **Claim** (one sentence, Courtney's voice): AI cuts the time to a first working plugin, but the security review still has to happen at full length. **Evidence pointer**: [[#[H2] AI builds the draft; security review stays human]] **Scope & conditions**: Holds for plugins that touch authentication, user creation, or payments. A read-only display snippet carries less review load. Counterexample to test: an AI tool that runs Plugin Check and PHPCS on its own output. **Links** (≥1 with annotation): - [[Vibe coding]] — because extends - [[WordPress Security Trinity]] — because applies-in plugin review <!-- atomicity: 1 idea ✓ --> ### ✏️ Fleeting Queue - [F1] Check whether GoWishCart's homepage (HTTP 521 on 2026-09-12) comes back, and whether the listing gets a support thread — https://wordpress.org/plugins/gowishcart-wishlist-for-fluentcart/ #fleeting #inbox - [F2] Watch the embedded video (UFN0WAUDr7c, captured in Reader as "Pros/Cons of Being a Professional") for the plugin's name, the AI tool used, or a code demo #fleeting #inbox - [F3] Idea for a post: "Ask ChatGPT, get a scope fight," about both client and agency using LLM estimates to set expectations #fleeting #inbox ### → Things 3 (max 2 actions) - [ ] Draft a feature-request-to-spec checklist using the article's eight wish list decisions — scoping template for agency and DevRel talks #things - [ ] Outline a security review checklist for AI-built plugins that create guest accounts — nonces, capability checks, is_email(), rate limiting #things <!-- deep-read:sections end --> 📄 **Full text:** [[Full Document Contents/Articles/Vibe Coding a WordPress Plugin Under Client Pressure.md|Vibe Coding a WordPress Plugin Under Client Pressure by manananomas]] ## Highlights - - AI-assisted development helped create the first MananaWishCart release in about three hours, but styling, testing, integrations, security, and professional review were still required. ([View Highlight](https://read.readwise.io/read/01m2bsqcr1kbd6p8kg2ymt7c86)) - Note: Permanent candidate: AI shortens the first draft; it doesn't remove security review or ownership. - Tags: atom/zettel/z1 - **A feature request is not the same as a complete specification.** ([View Highlight](https://read.readwise.io/read/01m2bsq9axeeaj9w4jbr6svdnw)) - Note: Core scoping claim: a wish list request hides account, guest, variation, inventory, and notification decisions. - Tags: atom/literature/h1 - ChatGPT suggested a likely agency quote around $15,000 to $18,000, while a broader custom engagement could reach $25,000 to $40,000 with copywriting, photography, branding, product configuration, deeper custom UX, or FluentAffiliate referral workflows. Our original $12,000 number sat near the lower end of a reasonable range, before we cut it in half for this local project. Subscription management and inventory management could raise a future estimate, but neither was a confirmed project deliverable. ([View Highlight](https://read.readwise.io/read/01m2bsqpdp7qvjd7acmkhs0ccx)) - Note: The article treats a ChatGPT price range as confirmation of the agency's number, after faulting the client for trusting ChatGPT on scope. No market data or comparable quotes are cited. - Tags: fallacy/appeal-to-authority - One option appeared in the WordPress repository, but it did not work. Its developer website, support channels, and contact paths were blocked, and it appeared to have no active installations. That support risk made GoWishCart a more sensible build. Unlike the failed options, MananaWishCart gave us a testable path. We reviewed the REST API, license management, and update history first. ([View Highlight](https://read.readwise.io/read/01m2bsqfce1d78hwc26xrdatv9)) - Note: GoWishCart is the third-party wp.org plugin (slug gowishcart-wishlist-for-fluentcart, 0 installs) matching the failed option, yet this paragraph calls GoWishCart the sensible build. The name slides between the rejected plugin and the in-house one. - Tags: fallacy/equivocation - - Prompts guests for an email address, then creates a user account and wishlist. ([View Highlight](https://read.readwise.io/read/01m2bsqry0j071ga8sdtryb97a)) - Note: Security review item: unauthenticated account creation from an email field needs a nonce, rate limiting, spam protection, and a check against user enumeration. No code is shown in the article. - Tags: action/h1 - When a client asks for work outside the scope, an agency can provide a new quote or decide whether the relationship and business case justify doing more. A fully custom MananaWishCart wish list could have been a separate $3,500 item. Three hours of our time also represents about $600 in value. ([View Highlight](https://read.readwise.io/read/01m2bsqvnfsnzwgzj2qb4bmwqj)) - Note: Pricing trade-off: $3,500 quoted value vs. about $600 of time absorbed. - Tags: atom/literature/h2