fix(deploy-health): read other repos' main anonymously; never crash on a lookup

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AqpXh3hQMMaC74pTjFq4it

.gitea/actions/audit-direct-push/action.yml

@@ -0,0 +1,57 @@
+name: Audit - direct push to main
+description: >-
+  Tripwire (Gitea port of main-push-audit.yml): if the pushed commit is not tied
+  to a merged pull request, open an issue labelled policy-violation + audit.
+  Never blocks the push. Uses Gitea's /commits/{sha}/pull API.
+inputs:
+  token:
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Check commit came from a merged PR
+      shell: bash
+      env:
+        TOKEN: ${{ inputs.token }}
+        PUSHER: ${{ github.event.pusher.username || github.event.pusher.login || github.actor }}
+        HEAD_MSG: ${{ github.event.head_commit.message }}
+      run: |
+        set -euo pipefail
+        API="$GITHUB_SERVER_URL/api/v1/repos/$GITHUB_REPOSITORY"
+        H="Authorization: token $TOKEN"
+        SHA="$GITHUB_SHA"; S7="${SHA:0:7}"
+        for attempt in 1 2 3 4 5; do
+          code=$(curl -s -o pr.json -w '%{http_code}' -H "$H" "$API/commits/$SHA/pull" || echo 000)
+          if [ "$code" = 200 ] && python3 -c 'import json,sys; sys.exit(0 if json.load(open("pr.json")).get("merged") else 1)'; then
+            echo "OK: commit $S7 came from PR #$(python3 -c 'import json;print(json.load(open("pr.json"))["number"])')"
+            exit 0
+          fi
+          [ "$attempt" -lt 5 ] && sleep 10
+        done
+        # Ensure both labels exist, collect their ids.
+        ids=()
+        for L in policy-violation audit; do
+          id=$(curl -s -H "$H" "$API/labels?limit=100" | python3 -c "import json,sys; print(next((str(l['id']) for l in json.load(sys.stdin) if l['name']=='$L'),''))")
+          if [ -z "$id" ]; then
+            color=$([ "$L" = audit ] && echo '#1d76db' || echo '#d93f0b')
+            id=$(curl -s -H "$H" -H 'Content-Type: application/json' -X POST "$API/labels" \
+              -d "{\"name\":\"$L\",\"color\":\"$color\"}" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("id",""))')
+          fi
+          [ -n "$id" ] && ids+=("$id")
+        done
+        MSG=$(printf '%s' "$HEAD_MSG" | head -1)
+        python3 - "$S7" "${MSG:-(no message)}" "$PUSHER" "${ids[@]}" > issue.json <<'PY'
+        import json, os, sys
+        s7, msg, pusher, *ids = sys.argv[1:]
+        run = f"{os.environ['GITHUB_SERVER_URL']}/{os.environ['GITHUB_REPOSITORY']}/actions/runs/{os.environ.get('GITHUB_RUN_NUMBER','')}"
+        body = "\n".join([
+          "**Direct push to `main` detected** - commit was not associated with a merged PR.", "",
+          f"- Commit: `{s7}` - {msg}", f"- Pusher: @{pusher}", f"- Workflow run: {run}", "",
+          "The project policy is that all changes to `main` go through a pull request so they can be "
+          "reviewed before deploying to production. If this push was intentional (hotfix, infra change) "
+          "close this issue with a comment explaining why.", "",
+          "_Opened automatically by the audit-direct-push action (peptide-e2e)._"])
+        print(json.dumps({"title": f"Direct push to main: {s7}", "body": body, "labels": [int(i) for i in ids]}))
+        PY
+        code=$(curl -s -o /dev/null -w '%{http_code}' -H "$H" -H 'Content-Type: application/json' -X POST "$API/issues" --data-binary @issue.json)
+        echo "::warning::Opened audit issue for direct push $S7 (HTTP $code)"

.gitea/actions/ci-file-size/action.yml

@@ -0,0 +1,30 @@
+name: CI - 300-line rule
+description: Fail if any tracked *.php under the given paths exceeds 300 lines (estate hard rule).
+inputs:
+  paths:
+    required: false
+    default: includes
+runs:
+  using: composite
+  steps:
+    - name: Check for PHP files over 300 lines
+      shell: bash
+      env:
+        PATHS: ${{ inputs.paths }}
+      run: |
+        set -e
+        OFFENDERS=""
+        for DIR in $PATHS; do
+          if [ ! -e "$DIR" ]; then echo "Warning: path '$DIR' does not exist - skipping."; continue; fi
+          while IFS= read -r FILE; do
+            [ -z "$FILE" ] && continue
+            LINES=$(wc -l < "$FILE")
+            if [ "$LINES" -gt 300 ]; then OFFENDERS="${OFFENDERS}${LINES} lines: ${FILE}\n"; fi
+          done < <(git ls-files -- "$DIR" | grep '\.php$' || true)
+        done
+        if [ -n "$OFFENDERS" ]; then
+          echo "::error::Files exceeding 300-line limit (estate hard rule):"
+          printf "%b" "$OFFENDERS"
+          exit 1
+        fi
+        echo "All tracked PHP files under '$PATHS' are within the 300-line limit."

.gitea/actions/ci-lint-js/action.yml

@@ -0,0 +1,33 @@
+name: CI - JS lint
+description: >-
+  npm run lint if the repo declares it, else node --check on every *.js
+  (Gitea port of lint-js). Node 22: the GitHub job used Node 20, which is
+  end-of-life.
+runs:
+  using: composite
+  steps:
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: '22'
+        cache: npm
+
+    - name: Install npm dependencies
+      shell: bash
+      run: npm ci
+
+    - name: Lint JavaScript
+      shell: bash
+      run: |
+        if node -e "process.exit(require('./package.json').scripts?.lint ? 0 : 1)" 2>/dev/null; then
+          echo "npm run lint script found - running it."
+          npm run lint
+        else
+          echo "No 'lint' npm script - running node --check syntax scan."
+          find . -name '*.js' \
+            -not -path './vendor/*' \
+            -not -path './node_modules/*' \
+            -not -path './.git/*' \
+            -not -path './.peptide-e2e/*' \
+            -print0 | xargs -0 -r -I{} node --check {}
+        fi

.gitea/actions/ci-lint-php/action.yml

@@ -0,0 +1,37 @@
+name: CI - PHP lint
+description: PHP syntax check (Gitea port of the lint-php job in the reusable ci.yml).
+inputs:
+  php:
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Use preinstalled PHP ${{ inputs.php }} (peptide-php image)
+      id: pre
+      shell: bash
+      env:
+        V: ${{ inputs.php }}
+      run: |
+        if command -v "php$V" >/dev/null 2>&1; then
+          update-alternatives --set php "/usr/bin/php$V" >/dev/null 2>&1 || ln -sf "/usr/bin/php$V" /usr/local/bin/php
+          php -v | head -1; echo "hit=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "hit=false" >> "$GITHUB_OUTPUT"
+        fi
+    - name: Setup PHP ${{ inputs.php }} (fallback when not preinstalled)
+      if: ${{ steps.pre.outputs.hit != 'true' }}
+      uses: shivammathur/setup-php@v2
+      with:
+        php-version: ${{ inputs.php }}
+        coverage: none
+    - name: Syntax check all PHP files
+      shell: bash
+      run: |
+        set -e
+        find . -name '*.php' \
+          -not -path './vendor/*' \
+          -not -path './node_modules/*' \
+          -not -path './.git/*' \
+          -not -path './.github/*' \
+          -not -path './.gitea/*' \
+          -print0 | xargs -0 -r -n1 -P4 php -l > /dev/null

.gitea/actions/ci-phpcs/action.yml

@@ -0,0 +1,79 @@
+name: CI - PHPCS
+description: >-
+  WordPress Coding Standards (Gitea port of the phpcs job). On pull_request with
+  autofix enabled, runs phpcbf and pushes fixes back to the PR branch; the caller
+  must check out the PR head ref with a token that can push.
+inputs:
+  autofix:
+    required: false
+    default: 'true'
+runs:
+  using: composite
+  steps:
+    - name: Use preinstalled PHP 8.1 (peptide-php image)
+      id: pre
+      shell: bash
+      run: |
+        if command -v php8.1 >/dev/null 2>&1 && command -v composer >/dev/null 2>&1; then
+          update-alternatives --set php /usr/bin/php8.1 >/dev/null 2>&1 || ln -sf /usr/bin/php8.1 /usr/local/bin/php
+          php -v | head -1; echo "hit=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "hit=false" >> "$GITHUB_OUTPUT"
+        fi
+    - name: Setup PHP (fallback when not preinstalled)
+      if: ${{ steps.pre.outputs.hit != 'true' }}
+      uses: shivammathur/setup-php@v2
+      with:
+        php-version: '8.1'
+        coverage: none
+        tools: composer:v2, phpcs
+
+    - name: Install WordPress Coding Standards
+      shell: bash
+      run: |
+        composer global config --no-plugins \
+          allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
+        composer global require --no-interaction \
+          "dealerdirect/phpcodesniffer-composer-installer:^1.0" \
+          "wp-coding-standards/wpcs:^3.0" \
+          "phpcsstandards/phpcsutils:^1.0" \
+          "phpcsstandards/phpcsextra:^1.0"
+        # Without setup-php's `tools: phpcs`, phpcs/phpcbf come from the global
+        # composer bin dir (WPCS pulls in squizlabs/php_codesniffer).
+        composer global config bin-dir --absolute 2>/dev/null | tail -1 >> "$GITHUB_PATH"
+
+    - name: Auto-fix with phpcbf (PR only, commit back if changed)
+      if: ${{ github.event_name == 'pull_request' && inputs.autofix == 'true' }}
+      shell: bash
+      run: |
+        PHPCS_CONFIG=""
+        if [ -f phpcs.xml ]; then PHPCS_CONFIG="phpcs.xml"
+        elif [ -f phpcs.xml.dist ]; then PHPCS_CONFIG="phpcs.xml.dist"
+        elif [ -f .phpcs.xml.dist ]; then PHPCS_CONFIG=".phpcs.xml.dist"
+        fi
+        if [ -z "$PHPCS_CONFIG" ]; then echo "No phpcs config - phpcbf skipped."; exit 0; fi
+        phpcbf --standard="$PHPCS_CONFIG" --extensions=php \
+          --ignore=vendor/*,tests/*,node_modules/* . || true
+        if ! git diff --quiet; then
+          git config user.name "peptiderepo-ops"
+          git config user.email "ops@peptiderepo.com"
+          git add -A
+          git commit -m "style: auto-fix PHPCS violations via phpcbf"
+          git push
+        fi
+
+    - name: Run PHPCS strict (fail on remaining violations)
+      shell: bash
+      run: |
+        PHPCS_CONFIG=""
+        if [ -f phpcs.xml ]; then PHPCS_CONFIG="phpcs.xml"
+        elif [ -f phpcs.xml.dist ]; then PHPCS_CONFIG="phpcs.xml.dist"
+        elif [ -f .phpcs.xml.dist ]; then PHPCS_CONFIG=".phpcs.xml.dist"
+        fi
+        if [ -z "$PHPCS_CONFIG" ]; then
+          echo "No phpcs.xml / phpcs.xml.dist / .phpcs.xml.dist found - PHPCS skipped."
+          exit 0
+        fi
+        phpcs --standard="$PHPCS_CONFIG" --extensions=php \
+          --ignore=vendor/*,tests/*,node_modules/* \
+          --warning-severity=0 --report=full .

.gitea/actions/ci-phpunit/action.yml

@@ -0,0 +1,78 @@
+name: CI - PHPUnit
+description: >-
+  composer test for one PHP version (Gitea port of the phpunit job). For
+  tests=wp-framework the caller declares a `mysql` service; on Gitea runners it is
+  reached by its service name, not 127.0.0.1 as on GitHub VMs.
+inputs:
+  php:
+    required: true
+  tests:
+    description: "stubs | brain-monkey | wp-framework"
+    required: false
+    default: stubs
+  db_host:
+    required: false
+    default: mysql
+runs:
+  using: composite
+  steps:
+    - name: Install subversion (wp-framework only)
+      if: ${{ inputs.tests == 'wp-framework' }}
+      shell: bash
+      run: command -v svn >/dev/null || (sudo apt-get update -qq && sudo apt-get install -y --no-install-recommends subversion)
+
+    - name: Use preinstalled PHP ${{ inputs.php }} (peptide-php image)
+      id: pre
+      shell: bash
+      env:
+        V: ${{ inputs.php }}
+      run: |
+        if command -v "php$V" >/dev/null 2>&1 && command -v composer >/dev/null 2>&1; then
+          update-alternatives --set php "/usr/bin/php$V" >/dev/null 2>&1 || ln -sf "/usr/bin/php$V" /usr/local/bin/php
+          php -v | head -1; echo "hit=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "hit=false" >> "$GITHUB_OUTPUT"
+        fi
+    - name: Setup PHP ${{ inputs.php }} (fallback when not preinstalled)
+      if: ${{ steps.pre.outputs.hit != 'true' }}
+      uses: shivammathur/setup-php@v2
+      with:
+        php-version: ${{ inputs.php }}
+        coverage: none
+        tools: composer:v2
+        extensions: ${{ inputs.tests == 'wp-framework' && 'mysqli' || '' }}
+
+    - name: Install Composer dependencies
+      shell: bash
+      run: composer install --no-progress --no-interaction --prefer-dist
+
+    - name: Wait for MySQL (wp-framework only)
+      if: ${{ inputs.tests == 'wp-framework' }}
+      shell: bash
+      env:
+        DB_HOST: ${{ inputs.db_host }}
+      run: |
+        for i in $(seq 1 30); do
+          if (exec 3<>/dev/tcp/$DB_HOST/3306) 2>/dev/null; then echo "MySQL is up"; exit 0; fi
+          echo "Waiting for MySQL... ($i/30)"; sleep 2
+        done
+        echo "::error::MySQL at $DB_HOST:3306 never came up"; exit 1
+
+    - name: Install WordPress test suite (wp-framework only)
+      # skip-db-create=true: the service already created wp_tests.
+      # WP_CORE_DIR must end with a slash (concatenated verbatim into ABSPATH).
+      if: ${{ inputs.tests == 'wp-framework' }}
+      shell: bash
+      env:
+        WP_TESTS_DIR: /tmp/wordpress-tests-lib
+        WP_CORE_DIR: /tmp/wordpress/
+        DB_HOST: ${{ inputs.db_host }}
+      run: |
+        chmod +x bin/install-wp-tests.sh
+        bin/install-wp-tests.sh wp_tests root root "$DB_HOST:3306" latest true
+
+    - name: Run PHPUnit
+      shell: bash
+      env:
+        WP_TESTS_DIR: /tmp/wordpress-tests-lib
+      run: composer test

.gitea/actions/deploy/action.yml

@@ -0,0 +1,103 @@
+name: Deploy to Hostinger
+description: >-
+  rsync one plugin/theme to staging or production on Hostinger. Gitea port of the
+  GitHub reusable deploy-app.yml (Gitea 1.25 has no workflow_call): same rsync
+  excludes, retry-on-throttle (Hostinger rate-limits runner IPs), best-effort
+  plugin-inventory guard and health check. New: records the deployed commit in
+  ~/.peptide-deploys/<stage>/<target> (outside public_html) for deploy-health.
+
+inputs:
+  stage:
+    description: "staging | production"
+    required: true
+  target_path:
+    description: "wp-content subpath, e.g. wp-content/plugins/prautoblogger"
+    required: true
+  ssh_private_key:
+    required: true
+  ssh_host:
+    required: true
+  ssh_port:
+    required: true
+  ssh_username:
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: rsync to ${{ inputs.stage }} (retry-on-throttle + inventory guard)
+      shell: bash
+      env:
+        STAGE: ${{ inputs.stage }}
+        TARGET_PATH: ${{ inputs.target_path }}
+        SSH_PRIVATE_KEY: ${{ inputs.ssh_private_key }}
+        SSH_HOST: ${{ inputs.ssh_host }}
+        SSH_PORT: ${{ inputs.ssh_port }}
+        SSH_USERNAME: ${{ inputs.ssh_username }}
+      run: |
+        set -euo pipefail
+        case "$STAGE" in staging|production) ;; *) echo "::error::stage must be staging or production"; exit 1 ;; esac
+        case "$TARGET_PATH" in
+          *..*) echo "::error::'..' not allowed in target_path"; exit 1 ;;
+          wp-content/plugins/?*|wp-content/themes/?*|wp-content/mu-plugins/?*) ;;
+          *) echo "::error::refusing target_path '$TARGET_PATH'"; exit 1 ;;
+        esac
+        WORK=$(mktemp -d); trap 'rm -rf "$WORK"' EXIT
+        printf '%s\n' "$SSH_PRIVATE_KEY" > "$WORK/key"; chmod 600 "$WORK/key"
+        ssh-keyscan -p "$SSH_PORT" "$SSH_HOST" > "$WORK/known_hosts" 2>/dev/null || true
+        SSHOPT="-i $WORK/key -p $SSH_PORT -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=$WORK/known_hosts -o ConnectTimeout=30 -o BatchMode=yes"
+        R="$SSH_USERNAME@$SSH_HOST"
+        BASE="/home/$SSH_USERNAME/domains/peptiderepo.com/public_html"
+        if [ "$STAGE" = staging ]; then DEST="$BASE/staging/$TARGET_PATH"; else DEST="$BASE/$TARGET_PATH"; fi
+
+        PRE=0
+        if [ "$STAGE" = production ]; then
+          PRE=$(ssh -n $SSHOPT "$R" "wp --path=$BASE plugin list --status=active --field=name 2>/dev/null | wc -l" 2>/dev/null || echo 0)
+          echo "Pre-deploy active plugins (best-effort): $PRE"
+        fi
+
+        n=0
+        until [ "$n" -ge 4 ]; do
+          rsync -avz --delete \
+            --exclude '.git' --exclude '.github' --exclude '.gitea' --exclude 'tests' --exclude 'node_modules' \
+            --exclude 'vendor' --exclude 'composer.json' --exclude 'composer.lock' \
+            --exclude 'phpunit.xml' --exclude 'phpunit.xml.dist' --exclude 'phpcs.xml.dist' \
+            --exclude '.phpcs.xml.dist' --exclude 'ARCHITECTURE.md' --exclude 'CONVENTIONS.md' \
+            --exclude 'CHANGELOG.md' --exclude 'qa-reviews' \
+            -e "ssh $SSHOPT" \
+            ./ "$R:$DEST/" && break
+          n=$((n+1)); echo "$STAGE rsync failed (attempt $n/4) - Hostinger may be throttling runner IPs; retrying in 25s..."; sleep 25
+        done
+        [ "$n" -lt 4 ] || { echo "::error::$STAGE rsync failed after 4 attempts"; exit 1; }
+
+        if [ "$STAGE" = production ]; then
+          # Same remote command as the GitHub pipeline (the litespeed purge there runs
+          # relative to $HOME, i.e. is effectively a no-op; kept as-is, see port notes).
+          POST=$(ssh -n $SSHOPT "$R" "wp --path=$BASE plugin list --status=active --field=name 2>/dev/null | wc -l; find wp-content/litespeed/ -type f -delete 2>/dev/null; touch .lscache_purge 2>/dev/null || true" 2>/dev/null | head -1 || echo 0)
+          echo "Post-deploy active plugins (best-effort): $POST"
+          if [ "${PRE:-0}" -gt 0 ] && [ "${POST:-0}" -gt 0 ] && [ "${POST:-0}" -lt "${PRE:-0}" ]; then
+            echo "::error::active plugin count dropped ${PRE} -> ${POST} after deploy"; exit 1
+          fi
+        fi
+
+        # Stamp the commit that was actually rsynced (the checked-out tree), not
+        # GITHUB_SHA, so a rollback of an older commit is recorded truthfully.
+        DEPLOYED=$(git rev-parse HEAD 2>/dev/null || echo "$GITHUB_SHA")
+        SLUG=$(printf '%s' "$TARGET_PATH" | tr '/' '_')
+        ssh -n $SSHOPT "$R" "mkdir -p ~/.peptide-deploys/$STAGE && printf '%s %s %s\n' '$DEPLOYED' '$GITHUB_REPOSITORY' \"\$(date -u +%FT%TZ)\" > ~/.peptide-deploys/$STAGE/$SLUG" \
+          || echo "::warning::could not record deployed commit for deploy-health"
+        echo "Deployed ${DEPLOYED:0:7} to $STAGE:$TARGET_PATH"
+
+    - name: Health check (${{ inputs.stage }})
+      shell: bash
+      env:
+        STAGE: ${{ inputs.stage }}
+      run: |
+        sleep 5
+        if [ "$STAGE" = staging ]; then
+          echo "Staging responded: HTTP $(curl -s -o /dev/null -w '%{http_code}' https://staging.peptiderepo.com/ || echo 000)"
+          exit 0
+        fi
+        S=$(curl -s -o /dev/null -w '%{http_code}' https://peptiderepo.com)
+        if [ "$S" != "200" ] && [ "$S" != "403" ]; then echo "::error::site returned HTTP $S"; exit 1; fi
+        echo "Production healthy (HTTP $S)"

.gitea/actions/smoke/action.yml

@@ -0,0 +1,70 @@
+name: Smoke tests (staging)
+description: >-
+  Playwright smoke suite from peptide-e2e against staging. Gitea port of
+  smoke.yml. Checks peptide-e2e out into .peptide-e2e so it never clobbers the
+  caller's checkout. Uses upload-artifact@v3 (Gitea does not support v4).
+
+inputs:
+  base_url:
+    required: false
+    default: https://staging.peptiderepo.com
+  wp_admin_user:
+    required: true
+  wp_admin_password:
+    required: true
+  e2e_ref:
+    required: false
+    default: main
+
+runs:
+  using: composite
+  steps:
+    - name: Checkout peptide-e2e
+      uses: actions/checkout@v4
+      with:
+        repository: peptide-repo/peptide-e2e
+        ref: ${{ inputs.e2e_ref }}
+        path: .peptide-e2e
+
+    - name: Set up Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: '22'
+        cache: npm
+        cache-dependency-path: .peptide-e2e/package-lock.json
+
+    - name: Install dependencies
+      shell: bash
+      working-directory: .peptide-e2e
+      run: npm ci
+
+    - name: Install Playwright browsers
+      # OS deps are pre-installed on the runner host; --with-deps needs sudo.
+      shell: bash
+      working-directory: .peptide-e2e
+      run: npx playwright install chromium
+
+    - name: Run smoke tests
+      shell: bash
+      working-directory: .peptide-e2e
+      env:
+        BASE_URL: ${{ inputs.base_url }}
+        WP_ADMIN_USER: ${{ inputs.wp_admin_user }}
+        WP_ADMIN_PASSWORD: ${{ inputs.wp_admin_password }}
+      run: npx playwright test
+
+    - name: Upload test report
+      if: always()
+      uses: actions/upload-artifact@v3
+      with:
+        name: playwright-report
+        path: .peptide-e2e/playwright-report/
+        retention-days: 14
+
+    - name: Upload failure screenshots/videos
+      if: failure()
+      uses: actions/upload-artifact@v3
+      with:
+        name: playwright-failures
+        path: .peptide-e2e/test-results/
+        retention-days: 7

.gitea/workflows/deploy-health.yml

@@ -0,0 +1,62 @@
+name: Deploy health (daily drift check)
+
+# Gitea rewrite of .github/workflows/deploy-health.yml. GitHub's version read
+# GitHub Deployment objects, which Gitea does not have. This one compares what is
+# ACTUALLY on the server: the deploy composite action stamps
+# ~/.peptide-deploys/production/<target> with the deployed commit, and this job
+# compares that stamp with each repo's main HEAD. Drift (or a missing stamp after
+# cutover) opens one issue in peptide-e2e; it never opens duplicates.
+on:
+  schedule:
+    - cron: '0 13 * * *'   # 21:00 SGT, same slot as the GitHub job
+  workflow_dispatch: {}
+
+jobs:
+  drift:
+    name: Compare deployed commit with main
+    runs-on: peptide-vps
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check every deployable repo
+        shell: bash
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+          SSH_HOST: ${{ secrets.SSH_HOST }}
+          SSH_PORT: ${{ secrets.SSH_PORT }}
+          SSH_USERNAME: ${{ secrets.SSH_USERNAME }}
+          PROD_ENABLED: ${{ vars.PROD_DEPLOY_ENABLED }}
+        run: |
+          set -euo pipefail
+          WORK=$(mktemp -d); trap 'rm -rf "$WORK"' EXIT
+          printf '%s\n' "$SSH_PRIVATE_KEY" > "$WORK/key"; chmod 600 "$WORK/key"
+          ssh-keyscan -p "$SSH_PORT" "$SSH_HOST" > "$WORK/kh" 2>/dev/null || true
+          SSHOPT="-n -i $WORK/key -p $SSH_PORT -o UserKnownHostsFile=$WORK/kh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=30 -o BatchMode=yes"
+          API="$GITHUB_SERVER_URL/api/v1"; H="Authorization: token $TOKEN"
+          problems=""
+          for row in $(python3 -c 'import json; d=json.load(open("tools/gitea-pipeline/repos.json")); [print(k+"="+v["target_path"]) for k,v in d.items() if not k.startswith("_") and v.get("target_path")]'); do
+            repo=${row%%=*}; tp=${row#*=}; slug=$(printf '%s' "$tp" | tr '/' '_')
+            # The job token is scoped to peptide-e2e; the repos are public, so read
+            # their branches anonymously. Unreadable main = a problem, not a crash.
+            head=$(curl -s "$API/repos/peptide-repo/$repo/branches/main" | python3 -c 'import json,sys
+          try: print(json.load(sys.stdin)["commit"]["id"])
+          except Exception: print("")')
+            if [ -z "$head" ]; then problems="$problems\n- $repo: could not read main from Gitea"; continue; fi
+            stamp=$(ssh $SSHOPT "$SSH_USERNAME@$SSH_HOST" "cat ~/.peptide-deploys/production/$slug 2>/dev/null" || true)
+            dep=${stamp%% *}
+            if [ -z "$dep" ]; then
+              msg="$repo: no Gitea production deploy recorded"
+              if [ "$PROD_ENABLED" = "true" ]; then problems="$problems\n- $msg (main is ${head:0:7})"; else echo "::notice::$msg (expected before cutover)"; fi
+            elif [ "$dep" != "$head" ]; then
+              problems="$problems\n- $repo: production has ${dep:0:7}, main is ${head:0:7}"
+            else
+              echo "OK $repo ${head:0:7}"
+            fi
+          done
+          [ -z "$problems" ] && { echo "No drift."; exit 0; }
+          printf "Drift found:%b\n" "$problems"
+          open=$(curl -s -H "$H" "$API/repos/$GITHUB_REPOSITORY/issues?state=open&type=issues&limit=50" | python3 -c 'import json,sys;print(sum(1 for i in json.load(sys.stdin) if i["title"]=="Deploy drift detected"))')
+          if [ "$open" -gt 0 ]; then echo "An open drift issue already exists; not opening another."; exit 1; fi
+          python3 -c 'import json,sys; print(json.dumps({"title": "Deploy drift detected", "body": "Daily deploy-health found production out of step with main:\n" + sys.argv[1].replace("\\n","\n") + "\n\nRe-run the repo pipeline on main (workflow_dispatch) or investigate the failed deploy. Opened by deploy-health.yml."}))' "$problems" > issue.json
+          curl -s -o /dev/null -w "issue HTTP %{http_code}\n" -H "$H" -H 'Content-Type: application/json' -X POST "$API/repos/$GITHUB_REPOSITORY/issues" --data-binary @issue.json
+          exit 1

.gitea/workflows/pipeline.yml

@@ -0,0 +1,41 @@
+# GENERATED by peptide-e2e/tools/gitea-pipeline/render.py from repos.json.
+# Do not edit by hand: change repos.json or the template and re-render.
+name: CI / Deploy
+
+on:
+  push:
+    branches: [main]
+  pull_request: {}
+  workflow_dispatch: {}
+
+concurrency:
+  group: pipeline-peptide-e2e-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  lint-php:
+    name: PHP Lint (${{ matrix.php }})
+    runs-on: ubuntu-latest
+    container: git.protopeer.com/peptide-repo/ci-php:2026-10
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ["8.1", "8.2", "8.3"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: https://git.protopeer.com/peptide-repo/peptide-e2e/.gitea/actions/ci-lint-php@main
+        with:
+          php: ${{ matrix.php }}
+
+  phpcs:
+    name: PHPCS (WordPress standards)
+    runs-on: ubuntu-latest
+    container: git.protopeer.com/peptide-repo/ci-php:2026-10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.head_ref || github.ref_name }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: https://git.protopeer.com/peptide-repo/peptide-e2e/.gitea/actions/ci-phpcs@main
+        with:
+          autofix: 'false'

.gitea/workflows/smoke.yml

@@ -0,0 +1,24 @@
+name: Smoke Tests (manual)
+
+# Manual run of the staging smoke suite (the deploy pipeline runs it automatically
+# via the smoke composite action). Gitea port of the workflow_dispatch half of
+# .github/workflows/smoke.yml.
+on:
+  workflow_dispatch:
+    inputs:
+      base_url:
+        description: 'Target URL (defaults to staging)'
+        required: false
+        default: 'https://staging.peptiderepo.com'
+
+jobs:
+  smoke:
+    name: Playwright smoke suite
+    runs-on: peptide-vps
+    timeout-minutes: 15
+    steps:
+      - uses: https://git.protopeer.com/peptide-repo/peptide-e2e/.gitea/actions/smoke@main
+        with:
+          base_url: ${{ inputs.base_url }}
+          wp_admin_user: ${{ secrets.STAGING_WP_ADMIN_USER }}
+          wp_admin_password: ${{ secrets.STAGING_WP_ADMIN_PASSWORD }}

.github/workflows/ci.yml

@@ -5,7 +5,7 @@
 #
 #   jobs:
 #     ci:
-#       uses: peptiderepo/peptide-e2e/.github/workflows/ci.yml@main
+#       uses: peptide-repo/peptide-e2e/.github/workflows/ci.yml@main
 #       with:
 #         tests: stubs       # or wp-framework | brain-monkey | none
 #         has_js: false

.github/workflows/deploy-app.yml

@@ -72,7 +72,7 @@ jobs:
     name: Smoke tests (staging)
     needs: deploy-staging
     if: ${{ inputs.run_smoke }}
-    uses: peptiderepo/peptide-e2e/.github/workflows/smoke.yml@main
+    uses: peptide-repo/peptide-e2e/.github/workflows/smoke.yml@main
     secrets:
       STAGING_WP_ADMIN_USER: ${{ secrets.STAGING_WP_ADMIN_USER }}
       STAGING_WP_ADMIN_PASSWORD: ${{ secrets.STAGING_WP_ADMIN_PASSWORD }}

.github/workflows/deploy-health.yml

@@ -22,7 +22,7 @@ jobs:
       - uses: actions/github-script@v7
         with:
           script: |
-            const owner = 'peptiderepo';
+            const owner = 'peptide-repo';
             const repos = [
               'prautoblogger','peptide-repo-core','peptide-search-ai',
               'peptide-news-plugin','peptide-reconstitution-calculator','peptide-starter-theme'

.github/workflows/smoke.yml

@@ -39,7 +39,7 @@ jobs:
       - name: Checkout peptide-e2e (explicit — workflow_call defaults to caller repo)
         uses: actions/checkout@v4
         with:
-          repository: peptiderepo/peptide-e2e
+          repository: peptide-repo/peptide-e2e
           ref: main
 
       - name: Set up Node.js
@@ -53,7 +53,8 @@ jobs:
         run: npm ci
 
       - name: Install Playwright browsers
-        run: npx playwright install chromium --with-deps
+        # OS deps pre-installed on the self-hosted runner host; --with-deps needs sudo which the sandbox blocks
+        run: npx playwright install chromium
 
       - name: Run smoke tests
         env:

CHANGELOG.md

@@ -1,6 +1,30 @@
 # Changelog
 
-## [1.7.1] - 2026-06-17
+## [1.8.0] - 2026-06-23
+
+### Added
+- **`infra/vps/` PRAB generation orchestrator**: systemd timer + service + bash
+  script that SSHes from the Coolify KVM8 VPS to Hostinger and drives
+  `wp prautoblogger generate --sync` in a held-open SSH session. Sidesteps
+  Hostinger's ~10-min background-PHP-process kill that was blocking full
+  generation runs. Components:
+  - `orchestrate-generation.sh`: main script with DRY_RUN mode, structured
+    logging, reaper pre-sweep, failure email alert, and shellcheck-clean quoting.
+  - `prab-generation.service` / `prab-generation.timer`: systemd oneshot service
+    (2h timeout, no auto-restart) + daily 06:00 UTC timer with 5-min jitter.
+  - `install-orchestrator.sh`: one-time setup script; installs units but does NOT
+    enable the timer (requires explicit CEO greenlight post-QA).
+  - Security: `StrictHostKeyChecking=accept-new` with pre-seeded known_hosts for
+    the Hostinger IP; no hardcoded secrets; SSH key referenced by env-var path.
+
+## [1.7.2] - 2026-06-17
+
+### Fixed
+- **CI**: Drop `--with-deps` from `npx playwright install chromium` in `smoke.yml`.
+  The `peptide-vps` self-hosted runner has OS-level Playwright deps pre-installed by
+  root; `--with-deps` invokes `apt-get` which requires `sudo`, blocked by the runner's
+  `NoNewPrivileges=true` systemd hardening. Binary-only install works without
+  elevated privileges.## [1.7.1] - 2026-06-17
 
 ### Changed
 - **CI/CD**: Switch `deploy-staging`, `deploy-production`, and `smoke` jobs from

ci-image/Dockerfile

@@ -0,0 +1,15 @@
+# peptide-ci-php: Gitea runner image with PHP 8.1/8.2/8.3 + Composer preinstalled.
+# Why: shivammathur/setup-php treats the stock runner image as a bare self-hosted
+# box and apt-installs a whole compiler toolchain on every job (~5-10 min each).
+# Built into the gitea-dind daemon by ci-image/build.sh; runner label `peptide-php`.
+FROM docker.gitea.com/runner-images@sha256:fd911d7417bfbf0f454530e447da95b58001e1df41bbc5e1a8dd35d432575aae
+RUN set -eux; export DEBIAN_FRONTEND=noninteractive; \
+    apt-get update; apt-get install -y --no-install-recommends software-properties-common gnupg unzip mariadb-client; \
+    add-apt-repository -y ppa:ondrej/php; apt-get update; \
+    for v in 8.1 8.2 8.3; do \
+      apt-get install -y --no-install-recommends php$v-cli php$v-common php$v-mbstring php$v-xml php$v-curl php$v-zip php$v-mysql php$v-intl php$v-bcmath php$v-gd; \
+    done; \
+    update-alternatives --set php /usr/bin/php8.3; \
+    curl -fsSL https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer; \
+    composer --version; php8.1 -v | head -1; php8.2 -v | head -1; php8.3 -v | head -1; \
+    rm -rf /var/lib/apt/lists/*

ci-image/build.sh

@@ -0,0 +1,10 @@
+#!/bin/sh
+# Rebuild the CI image (PHP 8.1/8.2/8.3 + Composer) and publish it to the Gitea
+# registry. Run on the KVM8 as root. Pulls are anonymous (public org), but the
+# push needs `docker exec -i gitea-dind docker login git.protopeer.com` first with
+# a Gitea token that has write:package. Bump TAG and CI_IMAGE in
+# tools/gitea-pipeline/render.py together, then re-render the pipelines.
+set -e
+TAG=git.protopeer.com/peptide-repo/ci-php:2026-10
+docker exec -i gitea-dind docker build -t "$TAG" - < "$(dirname "$0")/Dockerfile"
+docker exec gitea-dind docker push "$TAG"

docs/gitea-pipeline.md

@@ -0,0 +1,68 @@
+# Gitea Actions pipeline (peptide-repo)
+
+Since 2026-10-24 every peptide-repo plugin/theme builds and deploys from
+`git.protopeer.com/peptide-repo`, not GitHub. GitHub's `.github/workflows` are
+left in the repos but Gitea ignores them (a repo with `.gitea/workflows` uses
+only that folder).
+
+## How it fits together
+
+- **Shared logic lives once**, as composite actions in this repo under
+  `.gitea/actions/`: `deploy`, `smoke`, `ci-lint-php`, `ci-phpcs`,
+  `ci-file-size`, `ci-phpunit`, `ci-lint-js`, `audit-direct-push`.
+  Gitea 1.25 cannot run reusable workflows (`workflow_call`), which is why this
+  is not a 1:1 copy of the GitHub `deploy-app.yml` / `ci.yml`.
+- **Each repo's `.gitea/workflows/pipeline.yml` is generated** by
+  `tools/gitea-pipeline/render.py` from `tools/gitea-pipeline/repos.json`.
+  Change a repo's settings in `repos.json`, re-render, commit the output. Do not
+  hand-edit the generated files.
+- **Job graph:** lint-php / phpcs / file-size / phpunit / lint-js (+ repo extras)
+  -> deploy-staging -> smoke (gate) -> deploy-production. Deploys run on pushes
+  to `main` and on manual runs of `main`.
+- **Runners:** CI jobs run on the shared docker runner (`ubuntu-latest`) inside
+  `git.protopeer.com/peptide-repo/ci-php:2026-10` (PHP 8.1/8.2/8.3 + Composer,
+  built from `ci-image/`). Deploy and smoke run on the host runner
+  `peptide-vps-gitea` (systemd `gitea-runner-peptide`, user `gtrunner`, label
+  `peptide-vps`) on the KVM8, one job at a time, like the old GitHub runner.
+- **Secrets / variables** are org-level on Gitea `peptide-repo`:
+  `SSH_PRIVATE_KEY` (deploy key `gitea-peptide-deploy-20261024` on Hostinger),
+  `SSH_HOST`, `SSH_PORT`, `SSH_USERNAME`, `STAGING_WP_ADMIN_USER` (`gitea-smoke`,
+  staging-only admin), `STAGING_WP_ADMIN_PASSWORD`; variable `PROD_DEPLOY_ENABLED`.
+
+## Switches and recovery
+
+- **Kill switch:** set org variable `PROD_DEPLOY_ENABLED` to anything but `true`
+  -> production deploys (and `peptide-news-plugin` rollback) are skipped;
+  staging + smoke still run.
+- **Redeploy / retry:** run the repo's `CI / Deploy` workflow on `main` manually.
+- **Roll back news plugin:** `peptide-news-plugin` -> `Rollback Deployment`
+  (workflow_dispatch, optional commit SHA). Same deploy action as normal.
+- **Drift:** `deploy-health.yml` (daily 13:00 UTC / 21:00 SGT) compares the
+  commit stamped in `~/.peptide-deploys/production/<target>` on Hostinger with
+  each repo's `main`, and opens one "Deploy drift detected" issue here.
+- **Back to GitHub (emergency):** `systemctl enable --now
+  actions.runner.peptide-repo.peptide-vps` on the KVM8 and set
+  `PROD_DEPLOY_ENABLED=false` here. Only works while GitHub's Hostinger deploy
+  key is still authorised.
+
+## Differences from the GitHub pipeline (deliberate)
+
+- `.gitea` is also excluded from rsync.
+- JS lint uses Node 22 (GitHub used Node 20, now end-of-life).
+- Smoke login confirms WordPress's periodic "Administration email verification"
+  screen instead of timing out on it (it had been blocking smoke since
+  2026-09-10, when staging's admin-email check expired).
+- Production stamps the deployed commit for deploy-health (replaces GitHub
+  Deployments).
+- PHP matrices are literal lists (avoids Gitea's `fromJson` matrix bug).
+
+## Known gaps
+
+- `pr-vision` `cto-review.yml` (AI PR review via OpenRouter) is **not ported**:
+  its `OPENROUTER_API_KEY` / `CTO_ADMIN_TOKEN` secrets only exist on GitHub and
+  it calls GitHub's review API.
+- The LiteSpeed purge in the production deploy runs relative to `$HOME`, so it is
+  effectively a no-op - same as on GitHub. Kept as-is, not fixed.
+- Issues / PR history of repos other than peptide-e2e stayed on GitHub (the
+  migration hit GitHub's anonymous API rate limit); GitHub repos are to be
+  archived, not deleted.

global.setup.ts

@@ -90,10 +90,24 @@ setup('authenticate as WP admin', async ({ browser }) => {
       // indicate a credential rejection or 2FA prompt) and then navigate
       // explicitly to wp-admin.
       await page.waitForURL(
-        (url) => !url.pathname.includes('/wp-login.php'),
+        (url) =>
+          !url.pathname.includes('/wp-login.php') ||
+          url.searchParams.get('action') === 'confirm_admin_email',
         { timeout: NAV_TIMEOUT }
       );
 
+      // WordPress periodically (every ~6 months) interrupts admin logins with
+      // "Administration email verification" (wp-login.php?action=confirm_admin_email).
+      // The login has already succeeded at that point; confirm and continue so the
+      // smoke gate does not time out on it.
+      if (new URL(page.url()).searchParams.get('action') === 'confirm_admin_email') {
+        console.log('[setup] Admin email verification screen - confirming and continuing');
+        await page.click('#correct-admin-email');
+        await page.waitForURL((url) => !url.pathname.includes('/wp-login.php'), {
+          timeout: NAV_TIMEOUT,
+        });
+      }
+
       // Navigate explicitly into wp-admin to capture the authenticated admin session.
       await page.goto('/wp-admin/', { timeout: NAV_TIMEOUT });
       await expect(page).toHaveURL(/\/wp-admin\//, { timeout: 20_000 });

infra/vps/install-orchestrator.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+# install-orchestrator.sh — One-time setup for the PRAB generation orchestrator on the VPS.
+#
+# Installs:
+#   1. orchestrate-generation.sh  -> /opt/prab-orchestrator/ (from this repo)
+#   2. prab-generation.service    -> /etc/systemd/system/
+#   3. prab-generation.timer      -> /etc/systemd/system/
+#
+# Does NOT enable or start the timer — that is an explicit post-QA cutover step.
+# Does NOT write secrets — the SSH key at /root/.ssh/hostinger_prod_ed25519 must
+# already be present (placed manually by the CTO from .env.credentials).
+#
+# Run as root on the KVM8 VPS (76.13.220.15):
+#   bash infra/vps/install-orchestrator.sh
+#
+# After install, validate with DRY_RUN=1 before enabling the timer:
+#   DRY_RUN=1 /opt/prab-orchestrator/orchestrate-generation.sh
+#   systemctl enable --now prab-generation.timer   # only after CEO greenlight
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+INSTALL_DIR="/opt/prab-orchestrator"
+SYSTEMD_DIR="/etc/systemd/system"
+ORCHESTRATE_SH="${SCRIPT_DIR}/orchestrate-generation.sh"
+SERVICE_FILE="${SCRIPT_DIR}/prab-generation.service"
+TIMER_FILE="${SCRIPT_DIR}/prab-generation.timer"
+
+# Must be root.
+if [[ "$(id -u)" -ne 0 ]]; then
+  echo "ERROR: install-orchestrator.sh must be run as root." >&2
+  exit 1
+fi
+
+# Validate source files exist.
+for f in "${ORCHESTRATE_SH}" "${SERVICE_FILE}" "${TIMER_FILE}"; do
+  if [[ ! -f "$f" ]]; then
+    echo "ERROR: source file not found: $f" >&2
+    exit 1
+  fi
+done
+
+echo "Installing PRAB orchestrator to ${INSTALL_DIR}..."
+mkdir -p "${INSTALL_DIR}"
+install -m 0750 "${ORCHESTRATE_SH}" "${INSTALL_DIR}/orchestrate-generation.sh"
+echo "  OK: ${INSTALL_DIR}/orchestrate-generation.sh"
+
+# Pre-seed known_hosts with Hostinger's host key so ssh(1) can verify
+# the server identity without StrictHostKeyChecking=no.
+# ssh-keyscan output is pinned here; re-run if Hostinger rotates its key.
+KNOWN_HOSTS_FILE="${INSTALL_DIR}/known_hosts"
+if [[ ! -f "${KNOWN_HOSTS_FILE}" ]]; then
+  echo "Pre-seeding known_hosts from Hostinger (${SSH_HOST:-145.223.107.228}:${SSH_PORT:-65002})..."
+  ssh-keyscan -p "${SSH_PORT:-65002}" "${SSH_HOST:-145.223.107.228}" \
+    > "${KNOWN_HOSTS_FILE}" 2>/dev/null \
+    && chmod 0600 "${KNOWN_HOSTS_FILE}" \
+    && echo "  OK: ${KNOWN_HOSTS_FILE}" \
+    || echo "  WARN: ssh-keyscan failed — known_hosts not seeded; first SSH will add key via accept-new"
+else
+  echo "  OK: ${KNOWN_HOSTS_FILE} (already exists, not overwritten)"
+fi
+
+echo "Installing systemd units..."
+install -m 0644 "${SERVICE_FILE}" "${SYSTEMD_DIR}/prab-generation.service"
+install -m 0644 "${TIMER_FILE}" "${SYSTEMD_DIR}/prab-generation.timer"
+echo "  OK: ${SYSTEMD_DIR}/prab-generation.service"
+echo "  OK: ${SYSTEMD_DIR}/prab-generation.timer"
+
+systemctl daemon-reload
+echo "  OK: systemctl daemon-reload"
+
+echo ""
+echo "Install complete. Timer is installed but NOT enabled."
+echo "Next steps (post-QA + CEO greenlight only):"
+echo "  1. Ensure SSH key exists: ls -la /root/.ssh/hostinger_prod_ed25519"
+echo "  2. Validate with dry run: DRY_RUN=1 /opt/prab-orchestrator/orchestrate-generation.sh"
+echo "  3. Run first real invocation: /opt/prab-orchestrator/orchestrate-generation.sh"
+echo "  4. Enable timer: systemctl enable --now prab-generation.timer"
+echo "  5. Confirm next run: systemctl list-timers prab-generation.timer"

infra/vps/orchestrate-generation.sh

@@ -0,0 +1,158 @@
+#!/usr/bin/env bash
+# orchestrate-generation.sh — VPS orchestrator for PRAutoBlogger article generation
+#
+# Runs as a systemd oneshot service (prab-generation.service) on the Coolify KVM8 VPS.
+# SSHes to Hostinger and drives wp prautoblogger generate --sync in a held-open SSH
+# session. SSH-attached processes survive Hostinger's ~10-min background-PHP-process kill.
+#
+# Usage:
+#   DRY_RUN=1 ./orchestrate-generation.sh   # echo commands, no generation
+#   ./orchestrate-generation.sh             # real run
+#
+# Alerting: on failure, sends email to cto@peptiderepo.com via system mail.
+# Logs:     structured log lines to stdout (captured by systemd journal).
+# Lock:     the plugin's Generation_Lock (DB mutex) prevents double-drive.
+#
+# Environment variables:
+#   DRY_RUN       Set to "1" to echo SSH/WP-CLI commands without executing. Default: 0.
+#   LOGFILE       Path for persistent log file. Default: /var/log/prab-generation.log.
+#   ALERT_EMAIL   Failure alert recipient. Default: cto@peptiderepo.com.
+#   SSH_KEY       Path to Hostinger SSH private key. Default: /root/.ssh/hostinger_prod_ed25519.
+#   SSH_HOST      Hostinger SSH host. Default: 145.223.107.228.
+#   SSH_PORT      Hostinger SSH port. Default: 65002.
+#   SSH_USER      Hostinger SSH user. Default: u117248512.
+#   WP_PATH       WordPress docroot on Hostinger. Default: /home/u117248512/domains/peptiderepo.com/public_html.
+
+set -euo pipefail
+
+# ---------------------------------------------------------------------------
+# Configuration (override via environment; no hardcoded secrets)
+# ---------------------------------------------------------------------------
+DRY_RUN="${DRY_RUN:-0}"
+LOGFILE="${LOGFILE:-/var/log/prab-generation.log}"
+ALERT_EMAIL="${ALERT_EMAIL:-cto@peptiderepo.com}"
+SSH_KEY="${SSH_KEY:-/root/.ssh/hostinger_prod_ed25519}"
+SSH_HOST="${SSH_HOST:-145.223.107.228}"
+SSH_PORT="${SSH_PORT:-65002}"
+SSH_USER="${SSH_USER:-u117248512}"
+WP_PATH="${WP_PATH:-/home/u117248512/domains/peptiderepo.com/public_html}"
+# Known-hosts file pre-seeded by install-orchestrator.sh with Hostinger's host key.
+# Pins the server identity; StrictHostKeyChecking=accept-new adds on first connect.
+KNOWN_HOSTS="${KNOWN_HOSTS:-/opt/prab-orchestrator/known_hosts}"
+
+# ---------------------------------------------------------------------------
+# Logging helpers
+# ---------------------------------------------------------------------------
+PID="$$"
+TS() { date -u '+%Y-%m-%dT%H:%M:%SZ'; }
+
+log() {
+  local msg="prab-generation[${PID}]: $*"
+  echo "$msg"
+  echo "$(TS) $msg" >> "${LOGFILE}" 2>/dev/null || true
+}
+
+die() {
+  log "FATAL: $*"
+  exit 1
+}
+
+# ---------------------------------------------------------------------------
+# Validate required key before doing anything
+# ---------------------------------------------------------------------------
+if [[ "${DRY_RUN}" != "1" ]] && [[ ! -f "${SSH_KEY}" ]]; then
+  die "SSH key not found at ${SSH_KEY}. Run install-orchestrator.sh first."
+fi
+
+# ---------------------------------------------------------------------------
+# DRY_RUN mode: echo commands and exit
+# ---------------------------------------------------------------------------
+if [[ "${DRY_RUN}" == "1" ]]; then
+  log "DRY_RUN=1 — echoing commands only, no generation"
+  log "WOULD RUN: ssh -i ${SSH_KEY} -p ${SSH_PORT} -o StrictHostKeyChecking=accept-new -o ConnectTimeout=15 ${SSH_USER}@${SSH_HOST} \\"
+  log "  'wp prautoblogger generate --sync --path=${WP_PATH} 2>&1'"
+  log "DRY_RUN complete"
+  exit 0
+fi
+
+# ---------------------------------------------------------------------------
+# Run start
+# ---------------------------------------------------------------------------
+START_TS="$(TS)"
+log "START ts=${START_TS}"
+
+# ---------------------------------------------------------------------------
+# Step 1: Reaper sweep — clear any stuck runs before starting.
+# Belt-and-suspenders: the plugin's daily reaper cron handles this too, but
+# running it explicitly here ensures a clean state before each generation.
+# ---------------------------------------------------------------------------
+log "REAPER_SWEEP: invoking Run_Reaper::reap()"
+REAP_CMD="wp eval 'echo json_encode(PRAutoBlogger_Run_Reaper::reap());' --path=${WP_PATH} 2>&1"
+
+REAP_OUT=""
+# shellcheck disable=SC2029
+REAP_OUT="$(ssh -i "${SSH_KEY}" \
+    -p "${SSH_PORT}" \
+    -o StrictHostKeyChecking=accept-new \
+    -o UserKnownHostsFile="${KNOWN_HOSTS}" \
+    -o ConnectTimeout=15 \
+    -o ServerAliveInterval=60 \
+    -o ServerAliveCountMax=30 \
+    "${SSH_USER}@${SSH_HOST}" \
+    "${REAP_CMD}" \
+    2>&1)" || true
+log "REAPER_RESULT: ${REAP_OUT}"
+
+# ---------------------------------------------------------------------------
+# Step 2: Run wp prautoblogger generate --sync
+# ---------------------------------------------------------------------------
+log "SSH_CONNECT: ${SSH_USER}@${SSH_HOST}:${SSH_PORT} key=${SSH_KEY}"
+
+WP_CMD="wp prautoblogger generate --sync --path=${WP_PATH} 2>&1"
+
+RESULT_OUTPUT=""
+EXIT_CODE=0
+
+# shellcheck disable=SC2029
+RESULT_OUTPUT="$(ssh -i "${SSH_KEY}" \
+    -p "${SSH_PORT}" \
+    -o StrictHostKeyChecking=accept-new \
+    -o UserKnownHostsFile="${KNOWN_HOSTS}" \
+    -o ConnectTimeout=15 \
+    -o ServerAliveInterval=60 \
+    -o ServerAliveCountMax=30 \
+    "${SSH_USER}@${SSH_HOST}" \
+    "${WP_CMD}" \
+    2>&1)" || EXIT_CODE=$?
+
+# Extract the last JSON summary line (the one from WP_CLI::log(json_encode(...)))
+LAST_JSON="$(echo "${RESULT_OUTPUT}" | grep -E '^\{' | tail -1 || true)"
+LAST_LINE="$(echo "${RESULT_OUTPUT}" | tail -1)"
+
+log "SSH_RESULT exit=${EXIT_CODE} json=${LAST_JSON:-none}"
+
+# ---------------------------------------------------------------------------
+# Step 3: Evaluate result
+# ---------------------------------------------------------------------------
+END_TS="$(TS)"
+
+if [[ ${EXIT_CODE} -eq 0 ]]; then
+  log "END result=success ts=${END_TS}"
+else
+  log "END result=failure exit=${EXIT_CODE} last_line=${LAST_LINE} ts=${END_TS}"
+
+  # Send failure alert via email (system mail; no external deps required).
+  # cto@peptiderepo.com forwards to peptiderepo@gmail.com via Cloudflare Email Routing.
+  ALERT_BODY="PRAutoBlogger generation FAILED on $(hostname) at ${END_TS}.
+Exit code: ${EXIT_CODE}
+Last output: ${LAST_LINE}
+Full log: ${LOGFILE}
+SSH: ${SSH_USER}@${SSH_HOST}:${SSH_PORT}
+WP path: ${WP_PATH}"
+
+  echo "${ALERT_BODY}" \
+    | mail -s "PRAB generation FAILED @ ${END_TS}" "${ALERT_EMAIL}" 2>/dev/null \
+    || log "ALERT_FAILED: could not send email to ${ALERT_EMAIL} (mail not configured?)"
+
+  exit "${EXIT_CODE}"
+fi

infra/vps/prab-generation.service

@@ -0,0 +1,22 @@
+[Unit]
+Description=PRAutoBlogger article generation (VPS orchestrator)
+Documentation=https://github.com/peptide-repo/peptide-e2e/tree/main/infra/vps/
+After=network.target
+# Do not start if the timer fires while another instance is still running.
+# Type=oneshot + TimeoutStartSec enforce this at the systemd level.
+
+[Service]
+Type=oneshot
+# root owns /root/.ssh/hostinger_prod_ed25519 and /opt/prab-orchestrator/known_hosts;
+# a dedicated service user would need its own keypair + sudo-less SSH access.
+# Acceptable on this dedicated lab VPS (not shared); revisit if VPS is multi-tenant.
+User=root
+ExecStart=/opt/prab-orchestrator/orchestrate-generation.sh
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=prab-generation
+# Allow up to 2 hours for a full generation run (orchestrate + draft LLM calls).
+# The longest observed single LLM call was 1925s (~32 min); normal runs 2-5 min.
+TimeoutStartSec=7200
+# Do not restart on failure — the timer will retry the next day.
+Restart=no

infra/vps/prab-generation.timer

@@ -0,0 +1,19 @@
+[Unit]
+Description=Daily PRAutoBlogger generation at 06:00 UTC
+Documentation=https://github.com/peptide-repo/peptide-e2e/tree/main/infra/vps/
+Requires=prab-generation.service
+
+[Timer]
+# Fire daily at 06:00 UTC — before Hostinger's daily wp-cron window.
+OnCalendar=*-*-* 06:00:00 UTC
+# Persistent=true: if the VPS was down at 06:00 UTC, fire immediately on next
+# boot so at most one day's generation is missed (not deferred indefinitely).
+Persistent=true
+# Up to 5 min random jitter to avoid thundering-herd if multiple VPS instances
+# are ever added. Harmless with a single instance.
+RandomizedDelaySec=300
+# Accuracy within 1 minute (default is 1 minute; explicit for clarity).
+AccuracySec=60
+
+[Install]
+WantedBy=timers.target

package.json

@@ -1,6 +1,6 @@
 {
   "name": "peptide-e2e",
-  "version": "1.7.1",
+  "version": "1.8.0",
   "description": "Playwright smoke tests for peptiderepo.com (staging + production)",
   "private": true,
   "scripts": {

tests/08-pr-vision-admin.spec.ts

@@ -34,7 +34,11 @@
  *   The stored OpenRouter key must NEVER appear in page source.
  *   #prv_api_key renders with value="" on every page load regardless of
  *   whether a key is stored. This spec asserts the empty value and asserts
- *   that known API key prefixes ("sk-or-") are absent from the full body.
+ *   that no structurally valid key token (regex /sk-or-v1-[A-Za-z0-9]{20,}/)
+ *   appears in the full body HTML. A regex is used instead of a naive
+ *   toContain('sk-or-') to avoid a false-positive on the password input's
+ *   placeholder="sk-or-…" attribute (the ellipsis is a format hint, not a
+ *   token body, and won't match the regex).
  *
  * @see peptiderepo/pr-vision includes/core/class-prv-admin-page.php
  * @see peptiderepo/pr-vision includes/core/class-prv-settings-page.php
@@ -170,10 +174,18 @@ test.describe('WP Admin - PR Vision Settings page (API-key-manager)', () => {
     const inputValue = await keyInput.getAttribute('value');
     expect(inputValue ?? '').toBe('');
 
-    // Security check: known OpenRouter key prefixes must not appear anywhere in
-    // the page HTML -- guards against accidental server-side leakage.
+    // Security check: a *real* OpenRouter key (format "sk-or-v1-<20+ alnum chars>")
+    // must not appear anywhere in the page HTML -- guards against accidental
+    // server-side leakage.
+    //
+    // NOTE: We use a regex rather than the naive toContain('sk-or-') to avoid
+    // a false-positive: the password input carries placeholder="sk-or-…"
+    // (an ellipsis format-hint, not a token body) which contains the literal
+    // string "sk-or-" but is NOT a leaked key.  A regex that requires the
+    // "v1-" segment and at least 20 alphanumeric characters only matches a
+    // structurally valid key, so the placeholder never trips it.
     const html = await page.content();
-    expect(html).not.toContain('sk-or-');
+    expect(html).not.toMatch(/sk-or-v1-[A-Za-z0-9]{20,}/);
   });
 });
 

tools/gitea-pipeline/render.py

@@ -0,0 +1,265 @@
+#!/usr/bin/env python3
+"""Render .gitea/workflows/pipeline.yml for a peptide-repo repository.
+
+Why this exists: Gitea 1.25 cannot run reusable workflows (workflow_call), so
+the shared CI/deploy logic lives in composite actions under .gitea/actions/ in
+peptide-e2e, and each repo gets a thin generated job graph that calls them.
+Edit repos.json or this template, never the generated files.
+
+usage: render.py <repo-name> [repos.json]   -> prints the workflow to stdout
+"""
+import json
+import sys
+
+A = "https://git.protopeer.com/peptide-repo/peptide-e2e/.gitea/actions"
+# CI image with PHP 8.1/8.2/8.3 + Composer preinstalled (peptide-e2e/ci-image).
+# Without it setup-php bootstraps a compiler toolchain on every job (5-20 min).
+CI_IMAGE = "git.protopeer.com/peptide-repo/ci-php:2026-10"
+DEFAULTS = {"tests": "stubs", "has_js": False, "line_limit_paths": "includes",
+            "enforce_300": True, "phpcs_autofix": True, "audit": True,
+            "php_versions": ["8.1", "8.2", "8.3"], "extras": []}
+MAIN_PUSH = "github.event_name == 'push' && github.ref == 'refs/heads/main'"
+# Deploys also run on a manual (workflow_dispatch) run of main, so a failed or
+# drifted deploy can be redone without a dummy commit (deploy-health says so).
+MAIN_DEPLOY = ("(github.event_name == 'push' || github.event_name == 'workflow_dispatch')"
+               " && github.ref == 'refs/heads/main'")
+
+EXTRAS = {
+    "check-constants": """
+  check-constants:
+    name: Check PRAUTOBLOGGER_* constants
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Use PHP 8.1 (preinstalled in the CI image)
+        run: update-alternatives --set php /usr/bin/php8.1 && php -v | head -1
+      # Fails if any PRAUTOBLOGGER_* constant referenced in shipped PHP is neither
+      # defined in prautoblogger.php nor guarded by defined() (v0.19.0 incident class).
+      - run: php scripts/check-constants.php
+      - name: Self-test the scanner
+        run: php scripts/check-constants.php --self-test
+""",
+    "validate-psa-version": """
+  validate:
+    name: Validate PSA_VERSION constant
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: |
+          if grep -q "define( 'PSA_VERSION'" peptide-search-ai.php; then
+            version=$(grep "define( 'PSA_VERSION'" peptide-search-ai.php | sed "s/.*'\\([^']*\\)'.*/\\1/")
+            echo "PSA_VERSION: $version"
+          else
+            echo "::error::PSA_VERSION not found"; exit 1
+          fi
+""",
+    "security-audit": """
+  security-audit:
+    name: Security Audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check for common PHP security issues
+        shell: bash
+        run: |
+          echo ":: Checking for direct SQL queries without prepare..."
+          if grep -r "query\\s*(\\s*['\\"].*\\$" --include="*.php" --exclude-dir=vendor . 2>/dev/null \\
+            | grep -v "\\$wpdb->prepare" \\
+            | grep -v "uninstall\\.php" \\
+            | grep -v "class-peptide-news-activator\\.php" \\
+            | grep -v "class-peptide-news-logger\\.php" \\
+            | grep -v "DROP TABLE" \\
+            | grep -v "TRUNCATE" \\
+            && [ ${PIPESTATUS[0]} -eq 0 ]; then
+            echo "WARNING: Found potential unescaped SQL queries. Use wpdb->prepare() for all dynamic SQL."
+            exit 1
+          fi
+          echo ":: Checking for eval() usage..."
+          if grep -r "eval\\s*(" --include="*.php" --exclude-dir=vendor . 2>/dev/null; then
+            echo "ERROR: eval() found. This is a critical security risk."; exit 1
+          fi
+          echo ":: Checking for base64_decode without validation..."
+          if grep -r "base64_decode\\s*(" --include="*.php" --exclude-dir=vendor . 2>/dev/null; then
+            echo "WARNING: Found base64_decode(). Ensure the input is properly validated."
+          fi
+          echo ":: Checking for file_get_contents with user input..."
+          if grep -r "file_get_contents\\s*(\\s*\\$" --include="*.php" --exclude-dir=vendor . 2>/dev/null; then
+            echo "WARNING: Found file_get_contents with variable. Ensure input is validated and restricted."
+          fi
+          echo "All security checks passed."
+""",
+}
+EXTRA_JOB_ID = {"check-constants": "check-constants", "validate-psa-version": "validate",
+                "security-audit": "security-audit"}
+
+
+def render(name, cfg):
+    c = {**DEFAULTS, **cfg}
+    php = json.dumps(c["php_versions"])
+    out = [f"""# GENERATED by peptide-e2e/tools/gitea-pipeline/render.py from repos.json.
+# Do not edit by hand: change repos.json or the template and re-render.
+name: CI / Deploy
+
+on:
+  push:
+    branches: [main]
+  pull_request: {{}}
+  workflow_dispatch: {{}}
+
+concurrency:
+  group: pipeline-{name}-${{{{ github.ref }}}}
+  cancel-in-progress: false
+
+jobs:
+  lint-php:
+    name: PHP Lint (${{{{ matrix.php }}}})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php: {php}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: {A}/ci-lint-php@main
+        with:
+          php: ${{{{ matrix.php }}}}
+
+  phpcs:
+    name: PHPCS (WordPress standards)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{{{ github.head_ref || github.ref_name }}}}
+          token: ${{{{ secrets.GITHUB_TOKEN }}}}
+      - uses: {A}/ci-phpcs@main
+        with:
+          autofix: '{str(c["phpcs_autofix"]).lower()}'
+"""]
+    ci_jobs = ["lint-php", "phpcs"]
+    if c["enforce_300"]:
+        out.append(f"""
+  file-size:
+    name: 300-line rule ({c["line_limit_paths"]})
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: {A}/ci-file-size@main
+        with:
+          paths: {c["line_limit_paths"]}
+""")
+        ci_jobs.append("file-size")
+    if c["tests"] != "none":
+        svc = ""
+        if c["tests"] == "wp-framework":
+            svc = """    services:
+      mysql:
+        image: mysql:8.0
+        env:
+          MYSQL_ROOT_PASSWORD: root
+          MYSQL_DATABASE: wp_tests
+        # First-boot init took 3.5 min on the CPU-limited shared runner under load
+        # (GitHub's 5 x 10s window is far too short here). Data dir on tmpfs: the
+        # test DB is throwaway and disk I/O dominated the init time.
+        options: >-
+          --tmpfs /var/lib/mysql:rw
+          --health-cmd="mysqladmin ping"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-start-period=120s
+          --health-retries=30
+"""
+        out.append(f"""
+  phpunit:
+    name: PHPUnit - {c["tests"]} (PHP ${{{{ matrix.php }}}})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php: {php}
+{svc}    steps:
+      - uses: actions/checkout@v4
+      - uses: {A}/ci-phpunit@main
+        with:
+          php: ${{{{ matrix.php }}}}
+          tests: {c["tests"]}
+""")
+        ci_jobs.append("phpunit")
+    if c["has_js"]:
+        out.append(f"""
+  lint-js:
+    name: JS Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: {A}/ci-lint-js@main
+""")
+        ci_jobs.append("lint-js")
+    for x in c["extras"]:
+        out.append(EXTRAS[x])
+        ci_jobs.append(EXTRA_JOB_ID[x])
+    if c["target_path"]:
+        needs = json.dumps(ci_jobs)
+        deploy_with = f"""          target_path: {c["target_path"]}
+          ssh_private_key: ${{{{ secrets.SSH_PRIVATE_KEY }}}}
+          ssh_host: ${{{{ secrets.SSH_HOST }}}}
+          ssh_port: ${{{{ secrets.SSH_PORT }}}}
+          ssh_username: ${{{{ secrets.SSH_USERNAME }}}}"""
+        out.append(f"""
+  deploy-staging:
+    name: Deploy to staging
+    needs: {needs}
+    if: ${{{{ {MAIN_DEPLOY} }}}}
+    runs-on: peptide-vps
+    steps:
+      - uses: actions/checkout@v4
+      - uses: {A}/deploy@main
+        with:
+          stage: staging
+{deploy_with}
+
+  smoke:
+    name: Smoke tests (staging)
+    needs: deploy-staging
+    runs-on: peptide-vps
+    timeout-minutes: 15
+    steps:
+      - uses: {A}/smoke@main
+        with:
+          wp_admin_user: ${{{{ secrets.STAGING_WP_ADMIN_USER }}}}
+          wp_admin_password: ${{{{ secrets.STAGING_WP_ADMIN_PASSWORD }}}}
+
+  deploy-production:
+    name: Deploy to production
+    # Smoke is a gate: production runs only if staging deploy AND smoke succeeded.
+    # PROD_DEPLOY_ENABLED (org variable) is the cutover switch / kill switch.
+    needs: [deploy-staging, smoke]
+    if: ${{{{ vars.PROD_DEPLOY_ENABLED == 'true' && {MAIN_DEPLOY} }}}}
+    runs-on: peptide-vps
+    steps:
+      - uses: actions/checkout@v4
+      - uses: {A}/deploy@main
+        with:
+          stage: production
+{deploy_with}
+""")
+    if c["audit"]:
+        out.append(f"""
+  audit-direct-push:
+    name: Audit - commit came from a PR
+    if: ${{{{ {MAIN_PUSH} }}}}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: {A}/audit-direct-push@main
+        with:
+          token: ${{{{ secrets.GITHUB_TOKEN }}}}
+""")
+    return "".join(out).replace(
+        "    runs-on: ubuntu-latest\n",
+        f"    runs-on: ubuntu-latest\n    container: {CI_IMAGE}\n")
+
+
+if __name__ == "__main__":
+    repos = json.load(open(sys.argv[2] if len(sys.argv) > 2 else __file__.rsplit("/", 1)[0] + "/repos.json"))
+    name = sys.argv[1]
+    sys.stdout.write(render(name, repos[name]))

tools/gitea-pipeline/repos.json

@@ -0,0 +1,11 @@
+{
+  "_comment": "Per-repo pipeline settings. Edit here, then run render.py and commit the generated .gitea/workflows/pipeline.yml in each repo. Values mirror each repo's former GitHub ci.yml / deploy.yml inputs.",
+  "peptide-repo-core":                {"target_path": "wp-content/plugins/peptide-repo-core",                "tests": "stubs"},
+  "prautoblogger":                    {"target_path": "wp-content/plugins/prautoblogger",                    "tests": "brain-monkey", "extras": ["check-constants"]},
+  "peptide-search-ai":                {"target_path": "wp-content/plugins/peptide-search-ai",                "tests": "stubs", "has_js": true, "extras": ["validate-psa-version"]},
+  "peptide-starter-theme":            {"target_path": "wp-content/themes/peptide-starter",                   "tests": "wp-framework", "has_js": true, "line_limit_paths": "inc"},
+  "pr-vision":                        {"target_path": "wp-content/plugins/pr-vision",                        "tests": "stubs"},
+  "peptide-news-plugin":              {"target_path": "wp-content/plugins/peptide-news-plugin",              "tests": "stubs", "has_js": true, "extras": ["security-audit"]},
+  "peptide-reconstitution-calculator":{"target_path": "wp-content/plugins/peptide-reconstitution-calculator","tests": "stubs", "has_js": true},
+  "peptide-e2e":                      {"target_path": null, "tests": "none", "enforce_300": false, "phpcs_autofix": false, "audit": false}
+}