Everything listed here is implemented and verified in the current 1.1.0-beta codebase — no roadmap promises.
Encrypted license storage
License values are stored only inside an encrypted order-item payload using libsodium secretbox, with an AES-256-GCM fallback. Keys are never written to public files, downloadable files, or order notes.
Strict supplier contract
Every supplier response is validated against a documented allocation contract: identity, request fingerprint, quantities, license counts, duplicates, and retry semantics. Untrusted responses never touch storage.
Bounded automatic retries
Temporary failures retry automatically via Action Scheduler: five attempts with 5, 15, 30, 60, and 180-minute backoff, honoring supplier retry hints. Successful deliveries are never repeated.
Manual recovery
Admins get a recovery panel on the order screen: delivery state, attempts, retry schedule, and a permission- and nonce-protected Retry Now action that refuses to race a running automatic retry.
Ownership-first product sync
ZadKeys only manages products it explicitly owns. It never overwrites merchant-created products, never links by SKU similarity, and reports every conflict instead of guessing.
Safe operational logging
Logs pass through a strict allowlist: order IDs, statuses, error codes, and safe references only. License values, API secrets, and raw supplier responses can never reach a log file.
HPOS compatible
Fully compatible with WooCommerce High-Performance Order Storage, using official WooCommerce CRUD APIs for all runtime order data.