fix(smoke): use regex to avoid false-positive on placeholder in key assertion

The write-only security check in 08-pr-vision-admin.spec.ts asserted
page.content() does not contain 'sk-or-'. The password input for the
API key renders with placeholder="sk-or-…" (an ellipsis format hint
shown when the key is admin-managed). This placeholder contains the
literal string 'sk-or-' so the naive toContain assertion trips even
though value="" and no real key is in the page.

Fix: replace toContain('sk-or-') with toMatch(/sk-or-v1-[A-Za-z0-9]{20,}/).
A real OpenRouter key uses the format 'sk-or-v1-<20+ alnum chars>';
the placeholder ellipsis 'sk-or-…' never matches this pattern, so the
false-positive is eliminated. The assertion still catches any real key
accidentally rendered in server-side HTML.

The value="" assertion is unchanged and continues to guard the core
write-only invariant independently.

Agent-Session: fix-smoke-key-assertion-20260617

.github/workflows/ci-self-test.yml

@@ -0,0 +1,27 @@
+# Self-test: exercises the reusable ci.yml on this repo itself.
+# Uses tests: none (peptide-e2e is a Playwright/Node repo, no PHP suite).
+# permissions: contents: write is required at the caller level — any caller of
+# ci.yml must declare this so the phpcs job can commit phpcbf fixes back to the
+# PR branch. Even with phpcs_autofix: false here, the permission must be declared
+# for the reusable workflow to pass GH's startup permission-escalation check.
+
+name: CI Self-Test (reusable ci.yml)
+
+on:
+  push:
+    branches: [main, 'claude/**']
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: write  # required: called ci.yml phpcs job declares job-level write for phpcbf
+
+jobs:
+  ci:
+    uses: ./.github/workflows/ci.yml
+    with:
+      tests: none
+      enforce_300: false
+      has_js: false
+      phpcs_autofix: false
+    secrets: inherit

.github/workflows/ci.yml

@@ -0,0 +1,388 @@
+##
+# Reusable CI workflow — peptiderepo estate
+#
+# Usage (in any repo's .github/workflows/ci.yml):
+#
+#   jobs:
+#     ci:
+#       uses: peptide-repo/peptide-e2e/.github/workflows/ci.yml@main
+#       with:
+#         tests: stubs       # or wp-framework | brain-monkey | none
+#         has_js: false
+#       secrets: inherit
+#
+# Inputs:
+#   php_versions      (string)  JSON array of PHP versions to matrix over.
+#                               Default: '["8.1","8.2","8.3"]'
+#   tests             (string)  PHPUnit environment. One of:
+#                                 stubs        — WP stubs only; no DB/service; fast.
+#                                 brain-monkey — Brain Monkey mocking; no DB/service.
+#                                 wp-framework — Full WordPress test framework with MySQL.
+#                                 none         — Skip phpunit entirely (temporary; remove
+#                                                at rollout when the repo gains a suite).
+#                               Default: stubs
+#   enforce_300       (boolean) Fail if any tracked *.php under line_limit_paths exceeds
+#                               300 lines (the estate hard rule). Default: true
+#   line_limit_paths  (string)  Space-separated directory/path(s) the 300-line rule
+#                               applies to. Default: 'includes'
+#   has_js            (boolean) Whether to run JS linting. Default: false
+#   phpcs_autofix     (boolean) On pull_request events: run phpcbf and commit any fixes
+#                               back to the branch before strict phpcs. On push events:
+#                               skip the commit (no loop) but still run strict phpcs.
+#                               Default: true
+#
+# Job names (fixed — callers and deploy-app.yml gate on these):
+#   lint-php    PHP syntax check across php_versions matrix.
+#   phpcs       WordPress Coding Standards; phpcbf auto-commit on PRs.
+#   file-size   300-line rule enforcement (skipped when enforce_300: false).
+#   phpunit     PHPUnit across php_versions matrix (skipped when tests: none).
+#   lint-js     JS linting (skipped when has_js: false).
+#
+# Design notes:
+#   - phpcbf auto-commit pattern is the prautoblogger gold standard (see
+#     prautoblogger/.github/workflows/ci.yml). The GITHUB_TOKEN commit does
+#     NOT trigger a new CI run per GitHub's loop-prevention rules.
+#   - WP test framework path replicates peptide-starter-theme's three gotchas:
+#     (1) install svn — ubuntu-latest no longer ships it;
+#     (2) MySQL service pre-creates the DB via MYSQL_DATABASE, so pass
+#         skip-db-create=true as the 6th arg to install-wp-tests.sh;
+#     (3) WP_CORE_DIR must have a trailing slash (bootstrapped into ABSPATH
+#         and concatenated verbatim — missing slash produces wrong path).
+#   - Every repo calls `composer test` regardless of the `tests` input; the
+#     input only controls environment provisioning, not the command.
+#   - permissions: the phpcs job declares `contents: write` at job level for
+#     phpcbf commit-back. GitHub requires the CALLING WORKFLOW to also declare
+#     `permissions: contents: write` at the caller's workflow level — GH enforces
+#     that callers cannot be escalated beyond their declared scope, even by job-level
+#     overrides in the reusable workflow. All caller repos must include this.
+##
+
+name: CI — Reusable
+
+on:
+  workflow_call:
+    inputs:
+      php_versions:
+        description: >-
+          JSON array of PHP versions to matrix over.
+          Example: '["8.1","8.2","8.3"]'
+        required: false
+        default: '["8.1","8.2","8.3"]'
+        type: string
+      tests:
+        description: >-
+          PHPUnit environment. One of: stubs | wp-framework | brain-monkey | none.
+          All environments run `composer test`; this input controls setup only.
+        required: false
+        default: stubs
+        type: string
+      enforce_300:
+        description: >-
+          Fail if any tracked *.php under line_limit_paths exceeds 300 lines.
+        required: false
+        default: true
+        type: boolean
+      line_limit_paths:
+        description: >-
+          Space-separated directory/path(s) to which the 300-line rule applies.
+        required: false
+        default: includes
+        type: string
+      has_js:
+        description: >-
+          Whether to run JS linting (node --check / npm run lint).
+        required: false
+        default: false
+        type: boolean
+      phpcs_autofix:
+        description: >-
+          On pull_request: run phpcbf and commit fixes back to the branch before
+          strict phpcs. On push: skip the commit but still run strict phpcs.
+        required: false
+        default: true
+        type: boolean
+
+jobs:
+
+  # ---------------------------------------------------------------------------
+  # lint-php: PHP syntax check — matrix over php_versions
+  # ---------------------------------------------------------------------------
+  lint-php:
+    name: PHP Lint (${{ matrix.php }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ${{ fromJson(inputs.php_versions) }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup PHP ${{ matrix.php }}
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          coverage: none
+
+      - name: Syntax check all PHP files
+        # Exclude vendor/, node_modules/, .git/, .github/ (mu-plugins may use
+        # version-specific syntax). -P4 parallelises across 4 cores.
+        run: |
+          set -e
+          find . -name '*.php' \
+            -not -path './vendor/*' \
+            -not -path './node_modules/*' \
+            -not -path './.git/*' \
+            -not -path './.github/*' \
+            -print0 | xargs -0 -n1 -P4 php -l > /dev/null
+
+  # ---------------------------------------------------------------------------
+  # phpcs: WordPress Coding Standards + phpcbf auto-fix on PRs
+  # ---------------------------------------------------------------------------
+  phpcs:
+    name: PHPCS (WordPress standards)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write  # allows phpcbf auto-fix commits back to the PR branch
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Check out the actual PR branch head so phpcbf can push fixes back.
+          # On push events github.head_ref is empty; fall back to github.ref_name.
+          ref: ${{ github.head_ref || github.ref_name }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.1'
+          coverage: none
+          tools: composer:v2, phpcs
+
+      - name: Install WordPress Coding Standards
+        run: |
+          composer global config --no-plugins \
+            allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
+          composer global require --no-interaction \
+            "dealerdirect/phpcodesniffer-composer-installer:^1.0" \
+            "wp-coding-standards/wpcs:^3.0" \
+            "phpcsstandards/phpcsutils:^1.0" \
+            "phpcsstandards/phpcsextra:^1.0"
+
+      - name: Auto-fix with phpcbf (PR only — commit back to branch if changed)
+        # Only runs on pull_request events AND when phpcs_autofix is enabled.
+        # phpcbf exits 1 when it makes fixes and 0 when nothing to fix; both are
+        # treated as success here (|| true). Commits via GITHUB_TOKEN do NOT
+        # trigger a new CI run — GitHub prevents loops on bot commits.
+        if: ${{ github.event_name == 'pull_request' && inputs.phpcs_autofix }}
+        run: |
+          # Detect which phpcs config file is present; pass it explicitly to
+          # --standard so phpcbf and phpcs always agree with the guard check.
+          PHPCS_CONFIG=""
+          if [ -f phpcs.xml ]; then PHPCS_CONFIG="phpcs.xml"
+          elif [ -f phpcs.xml.dist ]; then PHPCS_CONFIG="phpcs.xml.dist"
+          elif [ -f .phpcs.xml.dist ]; then PHPCS_CONFIG=".phpcs.xml.dist"
+          fi
+          if [ -z "$PHPCS_CONFIG" ]; then
+            echo "No phpcs.xml / phpcs.xml.dist / .phpcs.xml.dist — phpcbf skipped."
+            exit 0
+          fi
+          phpcbf --standard="$PHPCS_CONFIG" \
+            --extensions=php \
+            --ignore=vendor/*,tests/*,node_modules/* \
+            . || true
+          if ! git diff --quiet; then
+            git config user.name "peptiderepo"
+            git config user.email "peptiderepo@users.noreply.github.com"
+            git add -A
+            git commit -m "style: auto-fix PHPCS violations via phpcbf"
+            git push
+          fi
+
+      - name: Run PHPCS strict (fail on remaining violations)
+        # Runs on all events (push AND pull_request). After phpcbf has committed
+        # any auto-fixable issues on PRs, only non-auto-fixable violations land
+        # here. On push events phpcbf is skipped but phpcs is still strict.
+        # Guard: skip gracefully if no phpcs config file exists (repo not yet configured).
+        run: |
+          # Detect which phpcs config file is present (mirrors the phpcbf step above).
+          PHPCS_CONFIG=""
+          if [ -f phpcs.xml ]; then PHPCS_CONFIG="phpcs.xml"
+          elif [ -f phpcs.xml.dist ]; then PHPCS_CONFIG="phpcs.xml.dist"
+          elif [ -f .phpcs.xml.dist ]; then PHPCS_CONFIG=".phpcs.xml.dist"
+          fi
+          if [ -z "$PHPCS_CONFIG" ]; then
+            echo "No phpcs.xml / phpcs.xml.dist / .phpcs.xml.dist found — PHPCS skipped."
+            echo "Add a phpcs.xml to enable coding standards enforcement."
+            exit 0
+          fi
+          phpcs --standard="$PHPCS_CONFIG" \
+            --extensions=php \
+            --ignore=vendor/*,tests/*,node_modules/* \
+            --warning-severity=0 \
+            --report=full \
+            .
+
+  # ---------------------------------------------------------------------------
+  # file-size: 300-line rule enforcement
+  # ---------------------------------------------------------------------------
+  file-size:
+    name: 300-line rule (${{ inputs.line_limit_paths }})
+    runs-on: ubuntu-latest
+    if: ${{ inputs.enforce_300 }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check for PHP files over 300 lines
+        # Scans only tracked *.php files under line_limit_paths (not vendor etc.).
+        # Prints every offender with its line count, then fails the job so the
+        # engineer has a clear list to split.
+        env:
+          # Use env: block to avoid shell-injection from caller-controlled input.
+          PATHS: ${{ inputs.line_limit_paths }}
+        run: |
+          set -e
+          OFFENDERS=""
+          for DIR in $PATHS; do
+            if [ ! -e "$DIR" ]; then
+              echo "Warning: path '$DIR' does not exist in this repo — skipping."
+              continue
+            fi
+            while IFS= read -r FILE; do
+              if [ -z "$FILE" ]; then continue; fi
+              LINES=$(wc -l < "$FILE")
+              if [ "$LINES" -gt 300 ]; then
+                OFFENDERS="${OFFENDERS}${LINES} lines: ${FILE}\n"
+              fi
+            done < <(git ls-files -- "$DIR" | grep '\.php$')
+          done
+          if [ -n "$OFFENDERS" ]; then
+            echo "::error::Files exceeding 300-line limit (estate hard rule):"
+            printf "%b" "$OFFENDERS"
+            exit 1
+          fi
+          echo "All tracked PHP files under '$PATHS' are within the 300-line limit."
+
+  # ---------------------------------------------------------------------------
+  # phpunit: PHPUnit — matrix over php_versions
+  # Skipped entirely when tests == 'none'.
+  # ---------------------------------------------------------------------------
+  phpunit:
+    name: PHPUnit — ${{ inputs.tests }} (PHP ${{ matrix.php }})
+    runs-on: ubuntu-latest
+    if: ${{ inputs.tests != 'none' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ${{ fromJson(inputs.php_versions) }}
+
+    # MySQL service is declared for all variants but only connected when
+    # tests == 'wp-framework'. On stubs/brain-monkey the service starts but is
+    # never touched — marginal overhead, keeps the YAML unconditional.
+    services:
+      mysql:
+        image: mysql:8.0
+        env:
+          MYSQL_ROOT_PASSWORD: root
+          # The WP test bootstrap expects this DB to exist. Passing
+          # skip-db-create=true (6th arg) to install-wp-tests.sh relies on
+          # MySQL having created it already via this env var.
+          MYSQL_DATABASE: wp_tests
+        ports:
+          - 3306:3306
+        options: >-
+          --health-cmd="mysqladmin ping"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-retries=5
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install subversion (wp-framework only)
+        # ubuntu-latest no longer ships svn. The WP test-suite bootstrap script
+        # checks out develop.svn.wordpress.org via svn.
+        # Gotcha #1 of the three known WP PHPUnit CI gotchas.
+        if: ${{ inputs.tests == 'wp-framework' }}
+        run: sudo apt-get update -qq && sudo apt-get install -y --no-install-recommends subversion
+
+      - name: Setup PHP ${{ matrix.php }}
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          coverage: none
+          tools: composer:v2
+          extensions: ${{ inputs.tests == 'wp-framework' && 'mysqli' || '' }}
+
+      - name: Install Composer dependencies
+        run: composer install --no-progress --no-interaction --prefer-dist
+
+      - name: Wait for MySQL (wp-framework only)
+        if: ${{ inputs.tests == 'wp-framework' }}
+        run: |
+          for i in {1..30}; do
+            if mysqladmin ping -h 127.0.0.1 -P 3306 -u root -proot --silent; then
+              echo "MySQL is up"; break
+            fi
+            echo "Waiting for MySQL... ($i/30)"; sleep 2
+          done
+
+      - name: Install WordPress test suite (wp-framework only)
+        # Gotcha #2: pass skip-db-create=true (6th arg) — the MySQL service
+        #   already created wp_tests via MYSQL_DATABASE; re-creating it fails.
+        # Gotcha #3: WP_CORE_DIR must end with a trailing slash. The bootstrap
+        #   concatenates this verbatim as ABSPATH + 'wp-settings.php'. Without
+        #   the slash: '/tmp/wordpresswp-settings.php' -> fatal bootstrap error.
+        if: ${{ inputs.tests == 'wp-framework' }}
+        env:
+          WP_TESTS_DIR: /tmp/wordpress-tests-lib
+          WP_CORE_DIR: /tmp/wordpress/
+        run: |
+          chmod +x bin/install-wp-tests.sh
+          bin/install-wp-tests.sh wp_tests root root 127.0.0.1:3306 latest true
+
+      - name: Run PHPUnit
+        # Every repo calls `composer test` regardless of environment.
+        # The repo's composer.json `test` script points to vendor/bin/phpunit
+        # with the appropriate phpunit.xml config for that repo.
+        env:
+          WP_TESTS_DIR: /tmp/wordpress-tests-lib
+        run: composer test
+
+  # ---------------------------------------------------------------------------
+  # lint-js: JavaScript linting (only when has_js == true)
+  # ---------------------------------------------------------------------------
+  lint-js:
+    name: JS Lint
+    runs-on: ubuntu-latest
+    if: ${{ inputs.has_js }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install npm dependencies
+        run: npm ci
+
+      - name: Lint JavaScript
+        # Prefer `npm run lint` if the repo defines it (catches ESLint etc.).
+        # Fall back to `node --check` syntax-only scan on all *.js files.
+        # NOTE: `npm run lint --if-present` exits 0 even when no lint script
+        # exists (npm 10+ / ubuntu-latest Node 20 behaviour), so the fallback
+        # branch is dead code under --if-present. Instead, explicitly detect
+        # whether a lint script is declared and branch on that.
+        run: |
+          if node -e "process.exit(require('./package.json').scripts?.lint ? 0 : 1)" 2>/dev/null; then
+            echo "npm run lint script found — running it."
+            npm run lint
+          else
+            echo "No 'lint' npm script — running node --check syntax scan."
+            find . -name '*.js' \
+              -not -path './vendor/*' \
+              -not -path './node_modules/*' \
+              -not -path './.git/*' \
+              -print0 | xargs -0 -I{} node --check {}
+          fi

.github/workflows/deploy-app.yml

@@ -35,7 +35,7 @@ permissions:
 jobs:
   deploy-staging:
     name: Deploy to Staging
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, peptide-vps]
     environment: staging
     steps:
       - uses: actions/checkout@v4
@@ -72,7 +72,7 @@ jobs:
     name: Smoke tests (staging)
     needs: deploy-staging
     if: ${{ inputs.run_smoke }}
-    uses: peptiderepo/peptide-e2e/.github/workflows/smoke.yml@main
+    uses: peptide-repo/peptide-e2e/.github/workflows/smoke.yml@main
     secrets:
       STAGING_WP_ADMIN_USER: ${{ secrets.STAGING_WP_ADMIN_USER }}
       STAGING_WP_ADMIN_PASSWORD: ${{ secrets.STAGING_WP_ADMIN_PASSWORD }}
@@ -83,7 +83,7 @@ jobs:
     # skipped smoke (run_smoke: false) still allows prod via the if-condition.
     needs: [deploy-staging, smoke]
     if: ${{ !cancelled() && needs.deploy-staging.result == 'success' && needs.smoke.result != 'failure' }}
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, peptide-vps]
     environment: production
     steps:
       - uses: actions/checkout@v4

.github/workflows/smoke.yml

@@ -32,14 +32,14 @@ on:
 jobs:
   smoke:
     name: Playwright smoke suite
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, peptide-vps]
     timeout-minutes: 15
 
     steps:
       - name: Checkout peptide-e2e (explicit — workflow_call defaults to caller repo)
         uses: actions/checkout@v4
         with:
-          repository: peptiderepo/peptide-e2e
+          repository: peptide-repo/peptide-e2e
           ref: main
 
       - name: Set up Node.js
@@ -53,7 +53,8 @@ jobs:
         run: npm ci
 
       - name: Install Playwright browsers
-        run: npx playwright install chromium --with-deps
+        # OS deps pre-installed on the self-hosted runner host; --with-deps needs sudo which the sandbox blocks
+        run: npx playwright install chromium
 
       - name: Run smoke tests
         env:

CHANGELOG.md

@@ -1,7 +1,93 @@
 # Changelog
 
+## [1.7.2] - 2026-06-17
+
+### Fixed
+- **CI**: Drop `--with-deps` from `npx playwright install chromium` in `smoke.yml`.
+  The `peptide-vps` self-hosted runner has OS-level Playwright deps pre-installed by
+  root; `--with-deps` invokes `apt-get` which requires `sudo`, blocked by the runner's
+  `NoNewPrivileges=true` systemd hardening. Binary-only install works without
+  elevated privileges.## [1.7.1] - 2026-06-17
+
+### Changed
+- **CI/CD**: Switch `deploy-staging`, `deploy-production`, and `smoke` jobs from
+  `ubuntu-latest` (GitHub-hosted) to `[self-hosted, peptide-vps]` (org runner on
+  KVM8 VPS). This routes all Hostinger SSH/rsync traffic through our stable VPS IP,
+  fixing the Azure-region throttle that caused intermittent deploy failures.
+  Callers' CI/validate jobs are unaffected (remain on `ubuntu-latest`).
+
+## [1.7.0] - 2026-06-17
+
+### Added
+- **Peptide News admin smoke (07)** (`07-peptide-news-admin.spec.ts`).
+  Covers the Peptide News Plugin admin surfaces: dashboard (HTTP 200, no fatal,
+  h1 "Peptide News Analytics" heading, `.pn-summary-cards`, `.pn-date-filter`),
+  settings (form present), articles, and LLM costs sub-pages. Skip-if-absent guard
+  on all tests using the standard 05/06 merge-early binding pattern. Slugs sourced
+  from `admin/class-pn-admin-menu.php`.
+
+- **PR Vision admin smoke (08)** (`08-pr-vision-admin.spec.ts`).
+  Covers the PR Vision plugin admin surfaces: dashboard (HTTP 200, no fatal,
+  h1 "PR Vision" visible), Settings page (API-key-manager card `#prv-key-card`
+  present, status badge `#prv-key-source-badge` visible), write-only security
+  invariant (`#prv_api_key` value="" + full HTML must not contain "sk-or-"),
+  Costs sub-page (`pr-vision-costs`), and Call Log sub-page (`pr-vision-calls`).
+  Skip-if-absent at two levels: plugin absent (loud annotation + skip), and
+  `#prv-key-card` absent (Settings v0.2.0 not yet deployed on environment).
+  Selectors sourced from `class-prv-admin-page.php`, `class-prv-key-manager-renderer.php`.
+
+
 All notable changes to the peptide-e2e smoke suite will be documented here.
 
+## [1.6.0] - 2026-06-16
+
+## [1.6.1] - 2026-06-16
+
+### Fixed
+- **P2-A injection** (`ci.yml:239`): `${{ inputs.line_limit_paths }}` moved
+  from raw shell assignment into an `env:` block (`PATHS`); shell now reads
+  `$PATHS` — eliminates template-injection surface for caller-supplied input.
+- **P2-B lint-js fallback** (`ci.yml:378`): replaced `npm run lint --if-present`
+  (exits 0 when no lint script exists, killing the fallback branch) with
+  explicit `node -e "process.exit(…)"` detection; `node --check` scan now
+  actually runs when no `lint` npm script is defined.
+- **P2-C phpcs config mismatch** (`ci.yml:178-199, 206-223`): both phpcbf
+  and phpcs steps now detect which of `phpcs.xml` / `phpcs.xml.dist` /
+  `.phpcs.xml.dist` is present and pass that file to `--standard`; guard and
+  command now agree for all three variants.
+
+
+### Added
+- **Reusable CI workflow** (`.github/workflows/ci.yml`).
+  `on: workflow_call` entrypoint that every estate repo will adopt as a thin
+  caller. Inputs: `php_versions` (JSON matrix), `tests`
+  (stubs|wp-framework|brain-monkey|none), `enforce_300`, `line_limit_paths`,
+  `has_js`, `phpcs_autofix`. Fixed job names (`lint-php`, `phpcs`, `file-size`,
+  `phpunit`, `lint-js`) so deploy-app.yml can `needs:` them uniformly.
+  - **phpcbf auto-commit** (prautoblogger gold-standard pattern): on
+    `pull_request` events, phpcbf runs and pushes any fixes back to the branch
+    before strict PHPCS; on `push` events auto-commit is skipped to prevent
+    loops.
+  - **wp-framework PHPUnit path** replicates all three peptide-starter-theme
+    gotchas: (1) install svn; (2) pass skip-db-create=true so the MySQL
+    service's pre-created DB is reused; (3) WP_CORE_DIR trailing slash.
+  - **Self-test caller** (`.github/workflows/ci-self-test.yml`): exercises
+    the reusable workflow on this repo with `tests: none` so the workflow is
+    validated on this PR itself.
+  - **README.md**: adoption snippet documenting how any repo becomes a caller.
+
+
+## [1.5.0] - 2026-06-14
+
+### Added
+- **Board Generate Now smoke (M4, skip-if-absent)** (`06-board-generate-now.spec.ts`).
+  Asserts the PRAutoBlogger board page loads, `#prab-generate-now` button is present
+  and carries a nonce, and the kick-off AJAX action returns valid JSON (no PHP fatal).
+  READ-ONLY: never waits for generation to complete; `kick_off()` is idempotent.
+  SKIPS with a loud annotation when `#prab-board` or `#prab-generate-now` is absent
+  (v0.21.0 M4 not yet deployed) so the e2e PR can merge before prautoblogger PR #166
+  per the M2/M3 merge-order binding. 27 tests total (was 25), delta = 2.
+
 ## [1.4.0] - 2026-06-12
 
 ### Added

README.md

@@ -0,0 +1,99 @@
+# peptide-e2e
+
+Playwright smoke tests and shared CI/CD pipelines for the [peptiderepo.com](https://peptiderepo.com) estate.
+
+## Reusable workflows
+
+This repo hosts shared GitHub Actions workflows called by all 7 app repos.
+
+### `deploy-app.yml` — shared deploy pipeline
+
+Handles staging rsync → Playwright smoke → production rsync → inventory guard →
+LiteSpeed cache purge → health check. Called by every app's `deploy.yml` via
+`uses: peptiderepo/peptide-e2e/.github/workflows/deploy-app.yml@main`.
+
+### `ci.yml` — reusable CI (PHP lint, PHPCS, 300-line, PHPUnit, JS lint)
+
+Standardised CI for every estate repo. Consistent job names so `deploy-app.yml`
+can gate on them uniformly.
+
+**Adopt in any repo** — create `.github/workflows/ci.yml` in the caller repo:
+
+```yaml
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+# Required: the called ci.yml phpcs job declares contents: write for phpcbf
+# commit-back. GitHub enforces that callers must grant at least the permission
+# level the reusable workflow's jobs request.
+permissions:
+  contents: write
+
+jobs:
+  ci:
+    uses: peptiderepo/peptide-e2e/.github/workflows/ci.yml@main
+    with:
+      tests: stubs        # stubs | wp-framework | brain-monkey | none
+      has_js: false       # set true if the repo ships JS
+    secrets: inherit
+```
+
+**Full input reference:**
+
+| Input | Type | Default | Description |
+|-------|------|---------|-------------|
+| `php_versions` | string | `'["8.1","8.2","8.3"]'` | JSON array of PHP versions to matrix over |
+| `tests` | string | `stubs` | PHPUnit environment: `stubs`, `wp-framework`, `brain-monkey`, or `none` |
+| `enforce_300` | boolean | `true` | Fail if any tracked `*.php` file under `line_limit_paths` exceeds 300 lines |
+| `line_limit_paths` | string | `includes` | Space-separated paths the 300-line rule applies to |
+| `has_js` | boolean | `false` | Whether to run JS linting (`npm run lint` or `node --check`) |
+| `phpcs_autofix` | boolean | `true` | On PRs: run phpcbf and commit fixes back before strict PHPCS |
+
+**PHPUnit `tests` values explained:**
+
+- `stubs` — WP stubs only (fast, no DB); just runs `composer test`.
+- `brain-monkey` — Brain Monkey mocking; no DB; runs `composer test`.
+- `wp-framework` — Full WordPress test framework: provisions MySQL service,
+  installs svn, runs `bin/install-wp-tests.sh`, then `composer test`. Handles
+  the three known gotchas: svn install, `--skip-db-create` with MySQL service,
+  `WP_CORE_DIR` trailing slash.
+- `none` — Skips the `phpunit` job entirely (temporary; repos without a suite
+  yet; remove at rollout).
+
+**phpcbf auto-commit:** on `pull_request` events, phpcbf runs first and commits
+any auto-fixable violations back to the PR branch via `GITHUB_TOKEN`. GitHub
+prevents loops — bot commits do not trigger a new CI run. Strict PHPCS then
+runs and fails only on non-auto-fixable violations.
+
+**Job names** (fixed — callers and `deploy-app.yml` `needs:` these):
+`lint-php`, `phpcs`, `file-size`, `phpunit`, `lint-js`.
+
+## Smoke tests
+
+The `tests/` directory contains Playwright specs that run against
+`https://staging.peptiderepo.com` (via `deploy-app.yml`) and can also target
+production. See `playwright.config.ts` for environment configuration.
+
+```
+tests/
+  00-homepage.spec.ts
+  01-reconstitution-calculator.spec.ts
+  02-peptide-search.spec.ts
+  03-admin-plugins.spec.ts
+  04-rest-api.spec.ts
+  05-dossier-edit.spec.ts
+  06-board-generate-now.spec.ts
+```
+
+## Development
+
+```bash
+npm ci
+npx playwright install --with-deps chromium
+BASE_URL=https://staging.peptiderepo.com npm test
+```

package.json

@@ -1,6 +1,6 @@
 {
   "name": "peptide-e2e",
-  "version": "1.4.0",
+  "version": "1.7.2",
   "description": "Playwright smoke tests for peptiderepo.com (staging + production)",
   "private": true,
   "scripts": {

tests/06-board-generate-now.spec.ts

@@ -0,0 +1,156 @@
+/**
+ * 06-board-generate-now.spec.ts
+ *
+ * What: Smoke for the PRAutoBlogger board "Generate Now" control (v0.21.0, M4).
+ *       Asserts that the board page renders the generate-now button and that
+ *       clicking it sends the kick-off AJAX request without a PHP fatal.
+ *       Read-only assertions only — this test NEVER waits for article generation
+ *       to complete (that would make LLM API calls in CI).
+ *
+ * SKIP-IF-ABSENT (M4 binding): the generate-now surface ships with v0.21.0
+ *   (prautoblogger PR #166). This spec guards against the board container
+ *   (#prab-board) being absent or the generate-now button (#prab-generate-now)
+ *   missing. When those selectors are absent (v0.21.0 not yet deployed), the
+ *   entire test suite skips with a loud annotation so this PR can merge before
+ *   the plugin PR — matching the M2 merge-order binding.
+ *
+ * Selectors sourced from prautoblogger v0.21.0:
+ *   templates/admin/board-page.php: #prab-board, #prab-generate-now
+ *   assets/js/board-generate.js:    data-nonce, wp.ajax / admin-ajax.php
+ *
+ * Who triggers it: Playwright chromium project (post-auth setup).
+ * Dependencies: wp-admin authenticated session (from global.setup.ts).
+ *
+ * @see prautoblogger PR #166 (v0.21.0) — the surface under test.
+ */
+
+import { test, expect } from '@playwright/test';
+
+const ADMIN = '/wp-admin';
+const BOARD_URL = `${ADMIN}/admin.php?page=prautoblogger-board`;
+
+test.describe('WP Admin — PRAutoBlogger board Generate Now (M4)', () => {
+  test('board page loads and generate-now button is present (skip-if-absent)', async ({ page }) => {
+    // Navigate to the board page.
+    const res = await page.goto(BOARD_URL);
+
+    // Must be HTTP 200 (guards menu-registration regression).
+    expect(res?.status()).toBe(200);
+
+    // wp-admin chrome must be present.
+    await expect(page.locator('#wpbody')).toBeVisible();
+
+    // Body must not contain PHP fatal or wp_die error strings.
+    const body = await page.textContent('body');
+    expect(body).not.toContain('Fatal error');
+    expect(body).not.toContain('Invalid plugin page');
+
+    // ── SKIP-IF-ABSENT guard ────────────────────────────────────────────────
+    // The generate-now surface ships with v0.21.0. If the board container or
+    // the button is absent, the M4 plugin is not yet deployed — skip loudly.
+    const boardContainer = page.locator('#prab-board');
+    const boardPresent = await boardContainer.count() > 0;
+
+    if ( ! boardPresent ) {
+      test.info().annotations.push({
+        type: 'skip',
+        description:
+          '[generate-now smoke] #prab-board absent: v0.21.0 (M4) not yet deployed. ' +
+          'Skipping generate-now assertions — they will gate once the plugin PR ships.',
+      });
+      test.skip();
+      return;
+    }
+
+    // Board container must be visible.
+    await expect(boardContainer).toBeVisible({ timeout: 10_000 });
+
+    // ── Generate-now button (skip-if-absent) ────────────────────────────────
+    const generateBtn = page.locator('#prab-generate-now');
+    const btnPresent = await generateBtn.count() > 0;
+
+    if ( ! btnPresent ) {
+      test.info().annotations.push({
+        type: 'skip',
+        description:
+          '[generate-now smoke] #prab-generate-now absent: M4 button not yet in deployed build. ' +
+          'Skipping button assertions.',
+      });
+      test.skip();
+      return;
+    }
+
+    // Button must be visible and carry a nonce for the AJAX call.
+    await expect(generateBtn).toBeVisible({ timeout: 5_000 });
+    const nonce = await generateBtn.getAttribute('data-nonce');
+    expect(nonce).toBeTruthy();
+
+    console.log(
+      '[generate-now smoke] Generate Now button found with nonce — M4 surface is deployed.'
+    );
+  });
+
+  test('generate-now AJAX responds with JSON (no fatal) — skip-if-absent', async ({ page, request }) => {
+    // Navigate first to establish auth cookies for the request context.
+    await page.goto(BOARD_URL);
+
+    const body = await page.textContent('body');
+    if ( ! body?.includes('prab-board') ) {
+      test.info().annotations.push({
+        type: 'skip',
+        description: '[generate-now smoke] Board container absent — v0.21.0 not deployed. Skipping.',
+      });
+      test.skip();
+      return;
+    }
+
+    const generateBtn = page.locator('#prab-generate-now');
+    if ( await generateBtn.count() === 0 ) {
+      test.info().annotations.push({
+        type: 'skip',
+        description: '[generate-now smoke] #prab-generate-now absent — skipping AJAX test.',
+      });
+      test.skip();
+      return;
+    }
+
+    // Read the nonce from the button (set by wp_localize_script).
+    const nonce = await generateBtn.getAttribute('data-nonce') ?? '';
+
+    // Fire the kick-off AJAX action (same as board-generate.js would).
+    // We use the request context to intercept without actually triggering
+    // the full pipeline — the action is idempotent (kick_off() guards against
+    // duplicate scheduling with wp_next_scheduled()).
+    //
+    // NOTE: We assert the response is valid JSON with a 'success' or 'data'
+    // key only. We do NOT check that generation actually runs (LLM calls).
+    const adminAjax = `${ADMIN}/admin-ajax.php`;
+    const formData = new URLSearchParams({
+      action: 'prautoblogger_generate_now',
+      nonce,
+    });
+
+    const ajaxRes = await request.post(adminAjax, {
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      data: formData.toString(),
+    });
+
+    // Must be HTTP 200 (not 403/500).
+    expect(ajaxRes.status()).toBe(200);
+
+    // Response must be valid JSON (no PHP fatal/notice dumped as HTML).
+    const text = await ajaxRes.text();
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      throw new Error(
+        `[generate-now smoke] AJAX response is not valid JSON — possible PHP fatal.\nRaw: ${text.slice(0, 500)}`
+      );
+    }
+
+    // WordPress wp_send_json_success / _error always wraps in { success: bool }.
+    expect(parsed).toHaveProperty('success');
+    console.log('[generate-now smoke] AJAX response:', JSON.stringify(parsed).slice(0, 200));
+  });
+});

tests/07-peptide-news-admin.spec.ts

@@ -0,0 +1,144 @@
+/**
+ * 07-peptide-news-admin.spec.ts
+ *
+ * What: Smoke tests for the Peptide News Plugin admin surfaces.
+ *       Verifies the dashboard, settings, articles, and cost sub-pages
+ *       load without PHP fatals and checks expected UI elements.
+ *       Guards against activation failures, missing menu registration, or
+ *       PHP fatals introduced by a bad deploy.
+ *
+ * Who triggers it: Playwright chromium project (post-auth setup).
+ * Dependencies: wp-admin authenticated session (from global.setup.ts).
+ *
+ * SKIP-IF-ABSENT: When the Peptide News Plugin is not installed/activated on
+ *   this environment, each test detects the absent menu page and skips with a
+ *   loud annotation — consistent with the 05/06 merge-early binding pattern.
+ *
+ * Admin menu slugs (sourced from admin/class-pn-admin-menu.php):
+ *   Dashboard  -> admin.php?page=peptide-news-dashboard
+ *   Settings   -> admin.php?page=peptide-news-settings
+ *   Articles   -> admin.php?page=peptide-news-articles
+ *   LLM Costs  -> admin.php?page=peptide-news-costs
+ *
+ * Selectors sourced from admin/partials/dashboard.php:
+ *   h1 "Peptide News Analytics"  - page heading (text match)
+ *   .pn-summary-cards            - summary card row
+ *   .pn-date-filter              - date range filter form
+ *
+ * @see peptiderepo/peptide-news-plugin admin/class-pn-admin-menu.php
+ * @see peptiderepo/peptide-news-plugin admin/partials/dashboard.php
+ */
+
+import { test, expect } from '@playwright/test';
+
+const ADMIN = '/wp-admin';
+
+/**
+ * Detect the "page not registered" condition WordPress returns when a plugin
+ * menu slug is unknown. Returns true when the plugin is absent.
+ *
+ * WordPress either:
+ * (a) Shows "You do not have sufficient permissions to access this page."
+ * (b) Shows a notice that the page cannot be found
+ * (c) Redirects back to /wp-admin/ stripping the ?page= param
+ */
+function isPluginAbsent(body: string, url: string): boolean {
+  return (
+    body.includes('Invalid plugin page') ||
+    body.includes('do not have sufficient permissions') ||
+    body.includes('The page you are looking for') ||
+    ( url.includes('/wp-admin/') && ! url.includes('page=peptide-news') )
+  );
+}
+
+/** Push a loud skip annotation and call test.skip(). */
+function skipMissing(): void {
+  test.info().annotations.push({
+    type: 'skip',
+    description:
+      '[peptide-news smoke] Peptide News Plugin is not installed or activated ' +
+      'on this environment. Skipping per the merge-early binding.',
+  });
+  test.skip();
+}
+
+test.describe('WP Admin - Peptide News Plugin dashboard', () => {
+  test('dashboard page loads (HTTP 200, no PHP fatal)', async ({ page }) => {
+    const res = await page.goto(`${ADMIN}/admin.php?page=peptide-news-dashboard`);
+    expect(res?.status()).toBe(200);
+
+    await expect(page.locator('#wpbody')).toBeVisible();
+
+    const body = (await page.textContent('body')) ?? '';
+    expect(body).not.toContain('Fatal error');
+
+    if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
+  });
+
+  test('dashboard renders analytics heading, summary cards, and date filter', async ({ page }) => {
+    await page.goto(`${ADMIN}/admin.php?page=peptide-news-dashboard`);
+
+    await expect(page.locator('#wpbody')).toBeVisible();
+    const body = (await page.textContent('body')) ?? '';
+    expect(body).not.toContain('Fatal error');
+
+    if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
+
+    // Heading from admin/partials/dashboard.php: <h1>Peptide News Analytics</h1>
+    await expect(
+      page.locator('h1').filter({ hasText: 'Peptide News Analytics' })
+    ).toBeVisible({ timeout: 10_000 });
+
+    // Summary card row: <div class="pn-summary-cards">
+    await expect(page.locator('.pn-summary-cards')).toBeVisible({ timeout: 10_000 });
+
+    // Date range filter form: <form class="pn-date-filter">
+    await expect(page.locator('.pn-date-filter')).toBeVisible({ timeout: 10_000 });
+  });
+});
+
+test.describe('WP Admin - Peptide News Plugin settings page', () => {
+  test('settings page loads (HTTP 200, no fatal, settings form present)', async ({ page }) => {
+    const res = await page.goto(`${ADMIN}/admin.php?page=peptide-news-settings`);
+    expect(res?.status()).toBe(200);
+
+    await expect(page.locator('#wpbody')).toBeVisible();
+    const body = (await page.textContent('body')) ?? '';
+    expect(body).not.toContain('Fatal error');
+
+    if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
+
+    // Every settings page rendered by class-pn-admin-settings-page.php contains a form
+    await expect(page.locator('form').first()).toBeVisible({ timeout: 10_000 });
+  });
+});
+
+test.describe('WP Admin - Peptide News Plugin articles page', () => {
+  test('articles page loads without fatal error', async ({ page }) => {
+    const res = await page.goto(`${ADMIN}/admin.php?page=peptide-news-articles`);
+    expect(res?.status()).toBe(200);
+
+    await expect(page.locator('#wpbody')).toBeVisible();
+    const body = (await page.textContent('body')) ?? '';
+    expect(body).not.toContain('Fatal error');
+
+    if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
+
+    expect(body).not.toContain('Invalid plugin page');
+  });
+});
+
+test.describe('WP Admin - Peptide News Plugin LLM costs page', () => {
+  test('costs page loads without fatal error', async ({ page }) => {
+    const res = await page.goto(`${ADMIN}/admin.php?page=peptide-news-costs`);
+    expect(res?.status()).toBe(200);
+
+    await expect(page.locator('#wpbody')).toBeVisible();
+    const body = (await page.textContent('body')) ?? '';
+    expect(body).not.toContain('Fatal error');
+
+    if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
+
+    expect(body).not.toContain('Invalid plugin page');
+  });
+});

tests/08-pr-vision-admin.spec.ts

@@ -0,0 +1,220 @@
+/**
+ * 08-pr-vision-admin.spec.ts
+ *
+ * What: Smoke tests for the PR Vision plugin admin surfaces.
+ *       Covers the dashboard, Settings (API-key-manager card + write-only
+ *       invariant), Costs, and Call Log sub-pages. Guards against PHP fatals,
+ *       missing menu registration, and key leakage regressions.
+ *
+ * Who triggers it: Playwright chromium project (post-auth setup).
+ * Dependencies: wp-admin authenticated session (from global.setup.ts).
+ *
+ * SKIP-IF-ABSENT: When PR Vision is not installed/activated on this
+ *   environment, each test detects the absent page and skips with a loud
+ *   annotation - consistent with the 05/06 merge-early binding pattern.
+ *
+ * Admin menu slugs (sourced from includes/core/class-prv-admin-page.php
+ *   and includes/core/class-prv-settings-page.php,
+ *       includes/core/class-prv-costs-page.php,
+ *       includes/core/class-prv-call-log-page.php):
+ *   Dashboard  -> admin.php?page=pr-vision           (MENU_SLUG = 'pr-vision')
+ *   Settings   -> admin.php?page=pr-vision-settings  (MENU_SLUG = 'pr-vision-settings')
+ *   Costs      -> admin.php?page=pr-vision-costs     (MENU_SLUG = 'pr-vision-costs')
+ *   Call Log   -> admin.php?page=pr-vision-calls     (MENU_SLUG = 'pr-vision-calls')
+ *
+ * Selectors sourced from includes/core/class-prv-admin-page.php:
+ *   h1 "PR Vision - AI Visibility"  - dashboard page heading
+ *
+ * Selectors sourced from includes/core/class-prv-key-manager-renderer.php:
+ *   #prv-key-card                  - the API-key-manager card container
+ *   #prv-key-source-badge          - key source status indicator span
+ *   #prv_api_key                   - password input (must render empty - write-only invariant)
+ *
+ * Write-only invariant (security):
+ *   The stored OpenRouter key must NEVER appear in page source.
+ *   #prv_api_key renders with value="" on every page load regardless of
+ *   whether a key is stored. This spec asserts the empty value and asserts
+ *   that no structurally valid key token (regex /sk-or-v1-[A-Za-z0-9]{20,}/)
+ *   appears in the full body HTML. A regex is used instead of a naive
+ *   toContain('sk-or-') to avoid a false-positive on the password input's
+ *   placeholder="sk-or-…" attribute (the ellipsis is a format hint, not a
+ *   token body, and won't match the regex).
+ *
+ * @see peptiderepo/pr-vision includes/core/class-prv-admin-page.php
+ * @see peptiderepo/pr-vision includes/core/class-prv-settings-page.php
+ * @see peptiderepo/pr-vision includes/core/class-prv-key-manager-renderer.php
+ */
+
+import { test, expect } from '@playwright/test';
+
+const ADMIN = '/wp-admin';
+
+/**
+ * Detect the "page not registered" condition WordPress returns when a plugin
+ * menu slug is unknown. Returns true when the plugin is absent.
+ */
+function isPluginAbsent(body: string, url: string): boolean {
+  return (
+    body.includes('Invalid plugin page') ||
+    body.includes('do not have sufficient permissions') ||
+    body.includes('The page you are looking for') ||
+    ( url.includes('/wp-admin/') && ! url.includes('page=pr-vision') )
+  );
+}
+
+/** Push a loud skip annotation and call test.skip(). */
+function skipMissing(): void {
+  test.info().annotations.push({
+    type: 'skip',
+    description:
+      '[pr-vision smoke] PR Vision plugin is not installed or activated ' +
+      'on this environment. Skipping per the merge-early binding.',
+  });
+  test.skip();
+}
+
+test.describe('WP Admin - PR Vision dashboard', () => {
+  test('dashboard page loads (HTTP 200, no PHP fatal)', async ({ page }) => {
+    const res = await page.goto(`${ADMIN}/admin.php?page=pr-vision`);
+    expect(res?.status()).toBe(200);
+
+    await expect(page.locator('#wpbody')).toBeVisible();
+
+    const body = (await page.textContent('body')) ?? '';
+    expect(body).not.toContain('Fatal error');
+
+    if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
+
+    // Heading from class-prv-admin-page.php render_page():
+    // echo '<h1>' . esc_html__( 'PR Vision - AI Visibility', 'pr-vision' ) . '</h1>';
+    await expect(
+      page.locator('h1').filter({ hasText: 'PR Vision' })
+    ).toBeVisible({ timeout: 10_000 });
+  });
+});
+
+test.describe('WP Admin - PR Vision Settings page (API-key-manager)', () => {
+  test('settings page loads (HTTP 200, no PHP fatal)', async ({ page }) => {
+    const res = await page.goto(`${ADMIN}/admin.php?page=pr-vision-settings`);
+    expect(res?.status()).toBe(200);
+
+    await expect(page.locator('#wpbody')).toBeVisible();
+
+    const body = (await page.textContent('body')) ?? '';
+    expect(body).not.toContain('Fatal error');
+
+    if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
+  });
+
+  test('API-key-manager card is present and status indicator visible', async ({ page }) => {
+    await page.goto(`${ADMIN}/admin.php?page=pr-vision-settings`);
+
+    await expect(page.locator('#wpbody')).toBeVisible();
+    const body = (await page.textContent('body')) ?? '';
+    expect(body).not.toContain('Fatal error');
+
+    if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
+
+    // ── SKIP-IF-ABSENT guard: Settings page may not have key-card if Settings
+    //    subpage (v0.2.0) is not yet deployed on this environment.
+    const keyCard = page.locator('#prv-key-card');
+    const cardPresent = await keyCard.count() > 0;
+
+    if ( ! cardPresent ) {
+      test.info().annotations.push({
+        type: 'skip',
+        description:
+          '[pr-vision smoke] #prv-key-card absent: PR Vision Settings page ' +
+          '(v0.2.0 admin) is not deployed on this environment. Skipping key-manager assertions.',
+      });
+      test.skip();
+      return;
+    }
+
+    // API-key-manager card container from class-prv-key-manager-renderer.php:
+    // <div class="prv-card" id="prv-key-card">
+    await expect(keyCard).toBeVisible({ timeout: 10_000 });
+
+    // Key source status indicator: <span ... id="prv-key-source-badge">
+    // Shows one of: "Set via wp-config", "Set via admin", "Not set"
+    await expect(page.locator('#prv-key-source-badge')).toBeVisible({ timeout: 10_000 });
+  });
+
+  test('password input is present and renders EMPTY (write-only invariant)', async ({ page }) => {
+    await page.goto(`${ADMIN}/admin.php?page=pr-vision-settings`);
+
+    await expect(page.locator('#wpbody')).toBeVisible();
+    const body = (await page.textContent('body')) ?? '';
+    expect(body).not.toContain('Fatal error');
+
+    if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
+
+    const keyCard = page.locator('#prv-key-card');
+    const cardPresent = await keyCard.count() > 0;
+    if ( ! cardPresent ) {
+      test.info().annotations.push({
+        type: 'skip',
+        description:
+          '[pr-vision smoke] #prv-key-card absent: skipping write-only invariant check.',
+      });
+      test.skip();
+      return;
+    }
+
+    // Password input from class-prv-key-manager-renderer.php render_key_form():
+    // <input type="password" id="prv_api_key" name="prv_api_key" ... value="" ...>
+    // The renderer explicitly passes value="" -- the stored key is NEVER output.
+    const keyInput = page.locator('#prv_api_key');
+
+    // When the key source is SOURCE_CONSTANT the input is disabled but still rendered.
+    // In all cases it must be present in the DOM.
+    await expect(keyInput).toBeAttached({ timeout: 10_000 });
+
+    // Write-only invariant: value attribute must be empty string, not the stored key.
+    const inputValue = await keyInput.getAttribute('value');
+    expect(inputValue ?? '').toBe('');
+
+    // Security check: a *real* OpenRouter key (format "sk-or-v1-<20+ alnum chars>")
+    // must not appear anywhere in the page HTML -- guards against accidental
+    // server-side leakage.
+    //
+    // NOTE: We use a regex rather than the naive toContain('sk-or-') to avoid
+    // a false-positive: the password input carries placeholder="sk-or-…"
+    // (an ellipsis format-hint, not a token body) which contains the literal
+    // string "sk-or-" but is NOT a leaked key.  A regex that requires the
+    // "v1-" segment and at least 20 alphanumeric characters only matches a
+    // structurally valid key, so the placeholder never trips it.
+    const html = await page.content();
+    expect(html).not.toMatch(/sk-or-v1-[A-Za-z0-9]{20,}/);
+  });
+});
+
+test.describe('WP Admin - PR Vision Costs page', () => {
+  test('costs page loads without fatal error', async ({ page }) => {
+    const res = await page.goto(`${ADMIN}/admin.php?page=pr-vision-costs`);
+    expect(res?.status()).toBe(200);
+
+    await expect(page.locator('#wpbody')).toBeVisible();
+    const body = (await page.textContent('body')) ?? '';
+    expect(body).not.toContain('Fatal error');
+
+    if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
+
+    expect(body).not.toContain('Invalid plugin page');
+  });
+});
+
+test.describe('WP Admin - PR Vision Call Log page', () => {
+  test('call log page loads without fatal error', async ({ page }) => {
+    const res = await page.goto(`${ADMIN}/admin.php?page=pr-vision-calls`);
+    expect(res?.status()).toBe(200);
+
+    await expect(page.locator('#wpbody')).toBeVisible();
+    const body = (await page.textContent('body')) ?? '';
+    expect(body).not.toContain('Fatal error');
+
+    if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
+
+    expect(body).not.toContain('Invalid plugin page');
+  });
+});