fix(deploy-health): read other repos' main anonymously; never crash on a lookup

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AqpXh3hQMMaC74pTjFq4it

.gitea/actions/audit-direct-push/action.yml

@@ -0,0 +1,57 @@
+name: Audit - direct push to main
+description: >-
+  Tripwire (Gitea port of main-push-audit.yml): if the pushed commit is not tied
+  to a merged pull request, open an issue labelled policy-violation + audit.
+  Never blocks the push. Uses Gitea's /commits/{sha}/pull API.
+inputs:
+  token:
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Check commit came from a merged PR
+      shell: bash
+      env:
+        TOKEN: ${{ inputs.token }}
+        PUSHER: ${{ github.event.pusher.username || github.event.pusher.login || github.actor }}
+        HEAD_MSG: ${{ github.event.head_commit.message }}
+      run: |
+        set -euo pipefail
+        API="$GITHUB_SERVER_URL/api/v1/repos/$GITHUB_REPOSITORY"
+        H="Authorization: token $TOKEN"
+        SHA="$GITHUB_SHA"; S7="${SHA:0:7}"
+        for attempt in 1 2 3 4 5; do
+          code=$(curl -s -o pr.json -w '%{http_code}' -H "$H" "$API/commits/$SHA/pull" || echo 000)
+          if [ "$code" = 200 ] && python3 -c 'import json,sys; sys.exit(0 if json.load(open("pr.json")).get("merged") else 1)'; then
+            echo "OK: commit $S7 came from PR #$(python3 -c 'import json;print(json.load(open("pr.json"))["number"])')"
+            exit 0
+          fi
+          [ "$attempt" -lt 5 ] && sleep 10
+        done
+        # Ensure both labels exist, collect their ids.
+        ids=()
+        for L in policy-violation audit; do
+          id=$(curl -s -H "$H" "$API/labels?limit=100" | python3 -c "import json,sys; print(next((str(l['id']) for l in json.load(sys.stdin) if l['name']=='$L'),''))")
+          if [ -z "$id" ]; then
+            color=$([ "$L" = audit ] && echo '#1d76db' || echo '#d93f0b')
+            id=$(curl -s -H "$H" -H 'Content-Type: application/json' -X POST "$API/labels" \
+              -d "{\"name\":\"$L\",\"color\":\"$color\"}" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("id",""))')
+          fi
+          [ -n "$id" ] && ids+=("$id")
+        done
+        MSG=$(printf '%s' "$HEAD_MSG" | head -1)
+        python3 - "$S7" "${MSG:-(no message)}" "$PUSHER" "${ids[@]}" > issue.json <<'PY'
+        import json, os, sys
+        s7, msg, pusher, *ids = sys.argv[1:]
+        run = f"{os.environ['GITHUB_SERVER_URL']}/{os.environ['GITHUB_REPOSITORY']}/actions/runs/{os.environ.get('GITHUB_RUN_NUMBER','')}"
+        body = "\n".join([
+          "**Direct push to `main` detected** - commit was not associated with a merged PR.", "",
+          f"- Commit: `{s7}` - {msg}", f"- Pusher: @{pusher}", f"- Workflow run: {run}", "",
+          "The project policy is that all changes to `main` go through a pull request so they can be "
+          "reviewed before deploying to production. If this push was intentional (hotfix, infra change) "
+          "close this issue with a comment explaining why.", "",
+          "_Opened automatically by the audit-direct-push action (peptide-e2e)._"])
+        print(json.dumps({"title": f"Direct push to main: {s7}", "body": body, "labels": [int(i) for i in ids]}))
+        PY
+        code=$(curl -s -o /dev/null -w '%{http_code}' -H "$H" -H 'Content-Type: application/json' -X POST "$API/issues" --data-binary @issue.json)
+        echo "::warning::Opened audit issue for direct push $S7 (HTTP $code)"

.gitea/actions/ci-file-size/action.yml

@@ -0,0 +1,30 @@
+name: CI - 300-line rule
+description: Fail if any tracked *.php under the given paths exceeds 300 lines (estate hard rule).
+inputs:
+  paths:
+    required: false
+    default: includes
+runs:
+  using: composite
+  steps:
+    - name: Check for PHP files over 300 lines
+      shell: bash
+      env:
+        PATHS: ${{ inputs.paths }}
+      run: |
+        set -e
+        OFFENDERS=""
+        for DIR in $PATHS; do
+          if [ ! -e "$DIR" ]; then echo "Warning: path '$DIR' does not exist - skipping."; continue; fi
+          while IFS= read -r FILE; do
+            [ -z "$FILE" ] && continue
+            LINES=$(wc -l < "$FILE")
+            if [ "$LINES" -gt 300 ]; then OFFENDERS="${OFFENDERS}${LINES} lines: ${FILE}\n"; fi
+          done < <(git ls-files -- "$DIR" | grep '\.php$' || true)
+        done
+        if [ -n "$OFFENDERS" ]; then
+          echo "::error::Files exceeding 300-line limit (estate hard rule):"
+          printf "%b" "$OFFENDERS"
+          exit 1
+        fi
+        echo "All tracked PHP files under '$PATHS' are within the 300-line limit."

.gitea/actions/ci-lint-js/action.yml

@@ -0,0 +1,33 @@
+name: CI - JS lint
+description: >-
+  npm run lint if the repo declares it, else node --check on every *.js
+  (Gitea port of lint-js). Node 22: the GitHub job used Node 20, which is
+  end-of-life.
+runs:
+  using: composite
+  steps:
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: '22'
+        cache: npm
+
+    - name: Install npm dependencies
+      shell: bash
+      run: npm ci
+
+    - name: Lint JavaScript
+      shell: bash
+      run: |
+        if node -e "process.exit(require('./package.json').scripts?.lint ? 0 : 1)" 2>/dev/null; then
+          echo "npm run lint script found - running it."
+          npm run lint
+        else
+          echo "No 'lint' npm script - running node --check syntax scan."
+          find . -name '*.js' \
+            -not -path './vendor/*' \
+            -not -path './node_modules/*' \
+            -not -path './.git/*' \
+            -not -path './.peptide-e2e/*' \
+            -print0 | xargs -0 -r -I{} node --check {}
+        fi

.gitea/actions/ci-lint-php/action.yml

@@ -0,0 +1,37 @@
+name: CI - PHP lint
+description: PHP syntax check (Gitea port of the lint-php job in the reusable ci.yml).
+inputs:
+  php:
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Use preinstalled PHP ${{ inputs.php }} (peptide-php image)
+      id: pre
+      shell: bash
+      env:
+        V: ${{ inputs.php }}
+      run: |
+        if command -v "php$V" >/dev/null 2>&1; then
+          update-alternatives --set php "/usr/bin/php$V" >/dev/null 2>&1 || ln -sf "/usr/bin/php$V" /usr/local/bin/php
+          php -v | head -1; echo "hit=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "hit=false" >> "$GITHUB_OUTPUT"
+        fi
+    - name: Setup PHP ${{ inputs.php }} (fallback when not preinstalled)
+      if: ${{ steps.pre.outputs.hit != 'true' }}
+      uses: shivammathur/setup-php@v2
+      with:
+        php-version: ${{ inputs.php }}
+        coverage: none
+    - name: Syntax check all PHP files
+      shell: bash
+      run: |
+        set -e
+        find . -name '*.php' \
+          -not -path './vendor/*' \
+          -not -path './node_modules/*' \
+          -not -path './.git/*' \
+          -not -path './.github/*' \
+          -not -path './.gitea/*' \
+          -print0 | xargs -0 -r -n1 -P4 php -l > /dev/null

.gitea/actions/ci-phpcs/action.yml

@@ -0,0 +1,79 @@
+name: CI - PHPCS
+description: >-
+  WordPress Coding Standards (Gitea port of the phpcs job). On pull_request with
+  autofix enabled, runs phpcbf and pushes fixes back to the PR branch; the caller
+  must check out the PR head ref with a token that can push.
+inputs:
+  autofix:
+    required: false
+    default: 'true'
+runs:
+  using: composite
+  steps:
+    - name: Use preinstalled PHP 8.1 (peptide-php image)
+      id: pre
+      shell: bash
+      run: |
+        if command -v php8.1 >/dev/null 2>&1 && command -v composer >/dev/null 2>&1; then
+          update-alternatives --set php /usr/bin/php8.1 >/dev/null 2>&1 || ln -sf /usr/bin/php8.1 /usr/local/bin/php
+          php -v | head -1; echo "hit=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "hit=false" >> "$GITHUB_OUTPUT"
+        fi
+    - name: Setup PHP (fallback when not preinstalled)
+      if: ${{ steps.pre.outputs.hit != 'true' }}
+      uses: shivammathur/setup-php@v2
+      with:
+        php-version: '8.1'
+        coverage: none
+        tools: composer:v2, phpcs
+
+    - name: Install WordPress Coding Standards
+      shell: bash
+      run: |
+        composer global config --no-plugins \
+          allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
+        composer global require --no-interaction \
+          "dealerdirect/phpcodesniffer-composer-installer:^1.0" \
+          "wp-coding-standards/wpcs:^3.0" \
+          "phpcsstandards/phpcsutils:^1.0" \
+          "phpcsstandards/phpcsextra:^1.0"
+        # Without setup-php's `tools: phpcs`, phpcs/phpcbf come from the global
+        # composer bin dir (WPCS pulls in squizlabs/php_codesniffer).
+        composer global config bin-dir --absolute 2>/dev/null | tail -1 >> "$GITHUB_PATH"
+
+    - name: Auto-fix with phpcbf (PR only, commit back if changed)
+      if: ${{ github.event_name == 'pull_request' && inputs.autofix == 'true' }}
+      shell: bash
+      run: |
+        PHPCS_CONFIG=""
+        if [ -f phpcs.xml ]; then PHPCS_CONFIG="phpcs.xml"
+        elif [ -f phpcs.xml.dist ]; then PHPCS_CONFIG="phpcs.xml.dist"
+        elif [ -f .phpcs.xml.dist ]; then PHPCS_CONFIG=".phpcs.xml.dist"
+        fi
+        if [ -z "$PHPCS_CONFIG" ]; then echo "No phpcs config - phpcbf skipped."; exit 0; fi
+        phpcbf --standard="$PHPCS_CONFIG" --extensions=php \
+          --ignore=vendor/*,tests/*,node_modules/* . || true
+        if ! git diff --quiet; then
+          git config user.name "peptiderepo-ops"
+          git config user.email "ops@peptiderepo.com"
+          git add -A
+          git commit -m "style: auto-fix PHPCS violations via phpcbf"
+          git push
+        fi
+
+    - name: Run PHPCS strict (fail on remaining violations)
+      shell: bash
+      run: |
+        PHPCS_CONFIG=""
+        if [ -f phpcs.xml ]; then PHPCS_CONFIG="phpcs.xml"
+        elif [ -f phpcs.xml.dist ]; then PHPCS_CONFIG="phpcs.xml.dist"
+        elif [ -f .phpcs.xml.dist ]; then PHPCS_CONFIG=".phpcs.xml.dist"
+        fi
+        if [ -z "$PHPCS_CONFIG" ]; then
+          echo "No phpcs.xml / phpcs.xml.dist / .phpcs.xml.dist found - PHPCS skipped."
+          exit 0
+        fi
+        phpcs --standard="$PHPCS_CONFIG" --extensions=php \
+          --ignore=vendor/*,tests/*,node_modules/* \
+          --warning-severity=0 --report=full .

.gitea/actions/ci-phpunit/action.yml

@@ -0,0 +1,78 @@
+name: CI - PHPUnit
+description: >-
+  composer test for one PHP version (Gitea port of the phpunit job). For
+  tests=wp-framework the caller declares a `mysql` service; on Gitea runners it is
+  reached by its service name, not 127.0.0.1 as on GitHub VMs.
+inputs:
+  php:
+    required: true
+  tests:
+    description: "stubs | brain-monkey | wp-framework"
+    required: false
+    default: stubs
+  db_host:
+    required: false
+    default: mysql
+runs:
+  using: composite
+  steps:
+    - name: Install subversion (wp-framework only)
+      if: ${{ inputs.tests == 'wp-framework' }}
+      shell: bash
+      run: command -v svn >/dev/null || (sudo apt-get update -qq && sudo apt-get install -y --no-install-recommends subversion)
+
+    - name: Use preinstalled PHP ${{ inputs.php }} (peptide-php image)
+      id: pre
+      shell: bash
+      env:
+        V: ${{ inputs.php }}
+      run: |
+        if command -v "php$V" >/dev/null 2>&1 && command -v composer >/dev/null 2>&1; then
+          update-alternatives --set php "/usr/bin/php$V" >/dev/null 2>&1 || ln -sf "/usr/bin/php$V" /usr/local/bin/php
+          php -v | head -1; echo "hit=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "hit=false" >> "$GITHUB_OUTPUT"
+        fi
+    - name: Setup PHP ${{ inputs.php }} (fallback when not preinstalled)
+      if: ${{ steps.pre.outputs.hit != 'true' }}
+      uses: shivammathur/setup-php@v2
+      with:
+        php-version: ${{ inputs.php }}
+        coverage: none
+        tools: composer:v2
+        extensions: ${{ inputs.tests == 'wp-framework' && 'mysqli' || '' }}
+
+    - name: Install Composer dependencies
+      shell: bash
+      run: composer install --no-progress --no-interaction --prefer-dist
+
+    - name: Wait for MySQL (wp-framework only)
+      if: ${{ inputs.tests == 'wp-framework' }}
+      shell: bash
+      env:
+        DB_HOST: ${{ inputs.db_host }}
+      run: |
+        for i in $(seq 1 30); do
+          if (exec 3<>/dev/tcp/$DB_HOST/3306) 2>/dev/null; then echo "MySQL is up"; exit 0; fi
+          echo "Waiting for MySQL... ($i/30)"; sleep 2
+        done
+        echo "::error::MySQL at $DB_HOST:3306 never came up"; exit 1
+
+    - name: Install WordPress test suite (wp-framework only)
+      # skip-db-create=true: the service already created wp_tests.
+      # WP_CORE_DIR must end with a slash (concatenated verbatim into ABSPATH).
+      if: ${{ inputs.tests == 'wp-framework' }}
+      shell: bash
+      env:
+        WP_TESTS_DIR: /tmp/wordpress-tests-lib
+        WP_CORE_DIR: /tmp/wordpress/
+        DB_HOST: ${{ inputs.db_host }}
+      run: |
+        chmod +x bin/install-wp-tests.sh
+        bin/install-wp-tests.sh wp_tests root root "$DB_HOST:3306" latest true
+
+    - name: Run PHPUnit
+      shell: bash
+      env:
+        WP_TESTS_DIR: /tmp/wordpress-tests-lib
+      run: composer test

.gitea/actions/deploy/action.yml

@@ -0,0 +1,103 @@
+name: Deploy to Hostinger
+description: >-
+  rsync one plugin/theme to staging or production on Hostinger. Gitea port of the
+  GitHub reusable deploy-app.yml (Gitea 1.25 has no workflow_call): same rsync
+  excludes, retry-on-throttle (Hostinger rate-limits runner IPs), best-effort
+  plugin-inventory guard and health check. New: records the deployed commit in
+  ~/.peptide-deploys/<stage>/<target> (outside public_html) for deploy-health.
+
+inputs:
+  stage:
+    description: "staging | production"
+    required: true
+  target_path:
+    description: "wp-content subpath, e.g. wp-content/plugins/prautoblogger"
+    required: true
+  ssh_private_key:
+    required: true
+  ssh_host:
+    required: true
+  ssh_port:
+    required: true
+  ssh_username:
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: rsync to ${{ inputs.stage }} (retry-on-throttle + inventory guard)
+      shell: bash
+      env:
+        STAGE: ${{ inputs.stage }}
+        TARGET_PATH: ${{ inputs.target_path }}
+        SSH_PRIVATE_KEY: ${{ inputs.ssh_private_key }}
+        SSH_HOST: ${{ inputs.ssh_host }}
+        SSH_PORT: ${{ inputs.ssh_port }}
+        SSH_USERNAME: ${{ inputs.ssh_username }}
+      run: |
+        set -euo pipefail
+        case "$STAGE" in staging|production) ;; *) echo "::error::stage must be staging or production"; exit 1 ;; esac
+        case "$TARGET_PATH" in
+          *..*) echo "::error::'..' not allowed in target_path"; exit 1 ;;
+          wp-content/plugins/?*|wp-content/themes/?*|wp-content/mu-plugins/?*) ;;
+          *) echo "::error::refusing target_path '$TARGET_PATH'"; exit 1 ;;
+        esac
+        WORK=$(mktemp -d); trap 'rm -rf "$WORK"' EXIT
+        printf '%s\n' "$SSH_PRIVATE_KEY" > "$WORK/key"; chmod 600 "$WORK/key"
+        ssh-keyscan -p "$SSH_PORT" "$SSH_HOST" > "$WORK/known_hosts" 2>/dev/null || true
+        SSHOPT="-i $WORK/key -p $SSH_PORT -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=$WORK/known_hosts -o ConnectTimeout=30 -o BatchMode=yes"
+        R="$SSH_USERNAME@$SSH_HOST"
+        BASE="/home/$SSH_USERNAME/domains/peptiderepo.com/public_html"
+        if [ "$STAGE" = staging ]; then DEST="$BASE/staging/$TARGET_PATH"; else DEST="$BASE/$TARGET_PATH"; fi
+
+        PRE=0
+        if [ "$STAGE" = production ]; then
+          PRE=$(ssh -n $SSHOPT "$R" "wp --path=$BASE plugin list --status=active --field=name 2>/dev/null | wc -l" 2>/dev/null || echo 0)
+          echo "Pre-deploy active plugins (best-effort): $PRE"
+        fi
+
+        n=0
+        until [ "$n" -ge 4 ]; do
+          rsync -avz --delete \
+            --exclude '.git' --exclude '.github' --exclude '.gitea' --exclude 'tests' --exclude 'node_modules' \
+            --exclude 'vendor' --exclude 'composer.json' --exclude 'composer.lock' \
+            --exclude 'phpunit.xml' --exclude 'phpunit.xml.dist' --exclude 'phpcs.xml.dist' \
+            --exclude '.phpcs.xml.dist' --exclude 'ARCHITECTURE.md' --exclude 'CONVENTIONS.md' \
+            --exclude 'CHANGELOG.md' --exclude 'qa-reviews' \
+            -e "ssh $SSHOPT" \
+            ./ "$R:$DEST/" && break
+          n=$((n+1)); echo "$STAGE rsync failed (attempt $n/4) - Hostinger may be throttling runner IPs; retrying in 25s..."; sleep 25
+        done
+        [ "$n" -lt 4 ] || { echo "::error::$STAGE rsync failed after 4 attempts"; exit 1; }
+
+        if [ "$STAGE" = production ]; then
+          # Same remote command as the GitHub pipeline (the litespeed purge there runs
+          # relative to $HOME, i.e. is effectively a no-op; kept as-is, see port notes).
+          POST=$(ssh -n $SSHOPT "$R" "wp --path=$BASE plugin list --status=active --field=name 2>/dev/null | wc -l; find wp-content/litespeed/ -type f -delete 2>/dev/null; touch .lscache_purge 2>/dev/null || true" 2>/dev/null | head -1 || echo 0)
+          echo "Post-deploy active plugins (best-effort): $POST"
+          if [ "${PRE:-0}" -gt 0 ] && [ "${POST:-0}" -gt 0 ] && [ "${POST:-0}" -lt "${PRE:-0}" ]; then
+            echo "::error::active plugin count dropped ${PRE} -> ${POST} after deploy"; exit 1
+          fi
+        fi
+
+        # Stamp the commit that was actually rsynced (the checked-out tree), not
+        # GITHUB_SHA, so a rollback of an older commit is recorded truthfully.
+        DEPLOYED=$(git rev-parse HEAD 2>/dev/null || echo "$GITHUB_SHA")
+        SLUG=$(printf '%s' "$TARGET_PATH" | tr '/' '_')
+        ssh -n $SSHOPT "$R" "mkdir -p ~/.peptide-deploys/$STAGE && printf '%s %s %s\n' '$DEPLOYED' '$GITHUB_REPOSITORY' \"\$(date -u +%FT%TZ)\" > ~/.peptide-deploys/$STAGE/$SLUG" \
+          || echo "::warning::could not record deployed commit for deploy-health"
+        echo "Deployed ${DEPLOYED:0:7} to $STAGE:$TARGET_PATH"
+
+    - name: Health check (${{ inputs.stage }})
+      shell: bash
+      env:
+        STAGE: ${{ inputs.stage }}
+      run: |
+        sleep 5
+        if [ "$STAGE" = staging ]; then
+          echo "Staging responded: HTTP $(curl -s -o /dev/null -w '%{http_code}' https://staging.peptiderepo.com/ || echo 000)"
+          exit 0
+        fi
+        S=$(curl -s -o /dev/null -w '%{http_code}' https://peptiderepo.com)
+        if [ "$S" != "200" ] && [ "$S" != "403" ]; then echo "::error::site returned HTTP $S"; exit 1; fi
+        echo "Production healthy (HTTP $S)"

.gitea/actions/smoke/action.yml

@@ -0,0 +1,70 @@
+name: Smoke tests (staging)
+description: >-
+  Playwright smoke suite from peptide-e2e against staging. Gitea port of
+  smoke.yml. Checks peptide-e2e out into .peptide-e2e so it never clobbers the
+  caller's checkout. Uses upload-artifact@v3 (Gitea does not support v4).
+
+inputs:
+  base_url:
+    required: false
+    default: https://staging.peptiderepo.com
+  wp_admin_user:
+    required: true
+  wp_admin_password:
+    required: true
+  e2e_ref:
+    required: false
+    default: main
+
+runs:
+  using: composite
+  steps:
+    - name: Checkout peptide-e2e
+      uses: actions/checkout@v4
+      with:
+        repository: peptide-repo/peptide-e2e
+        ref: ${{ inputs.e2e_ref }}
+        path: .peptide-e2e
+
+    - name: Set up Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: '22'
+        cache: npm
+        cache-dependency-path: .peptide-e2e/package-lock.json
+
+    - name: Install dependencies
+      shell: bash
+      working-directory: .peptide-e2e
+      run: npm ci
+
+    - name: Install Playwright browsers
+      # OS deps are pre-installed on the runner host; --with-deps needs sudo.
+      shell: bash
+      working-directory: .peptide-e2e
+      run: npx playwright install chromium
+
+    - name: Run smoke tests
+      shell: bash
+      working-directory: .peptide-e2e
+      env:
+        BASE_URL: ${{ inputs.base_url }}
+        WP_ADMIN_USER: ${{ inputs.wp_admin_user }}
+        WP_ADMIN_PASSWORD: ${{ inputs.wp_admin_password }}
+      run: npx playwright test
+
+    - name: Upload test report
+      if: always()
+      uses: actions/upload-artifact@v3
+      with:
+        name: playwright-report
+        path: .peptide-e2e/playwright-report/
+        retention-days: 14
+
+    - name: Upload failure screenshots/videos
+      if: failure()
+      uses: actions/upload-artifact@v3
+      with:
+        name: playwright-failures
+        path: .peptide-e2e/test-results/
+        retention-days: 7

.gitea/workflows/deploy-health.yml

@@ -0,0 +1,62 @@
+name: Deploy health (daily drift check)
+
+# Gitea rewrite of .github/workflows/deploy-health.yml. GitHub's version read
+# GitHub Deployment objects, which Gitea does not have. This one compares what is
+# ACTUALLY on the server: the deploy composite action stamps
+# ~/.peptide-deploys/production/<target> with the deployed commit, and this job
+# compares that stamp with each repo's main HEAD. Drift (or a missing stamp after
+# cutover) opens one issue in peptide-e2e; it never opens duplicates.
+on:
+  schedule:
+    - cron: '0 13 * * *'   # 21:00 SGT, same slot as the GitHub job
+  workflow_dispatch: {}
+
+jobs:
+  drift:
+    name: Compare deployed commit with main
+    runs-on: peptide-vps
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check every deployable repo
+        shell: bash
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+          SSH_HOST: ${{ secrets.SSH_HOST }}
+          SSH_PORT: ${{ secrets.SSH_PORT }}
+          SSH_USERNAME: ${{ secrets.SSH_USERNAME }}
+          PROD_ENABLED: ${{ vars.PROD_DEPLOY_ENABLED }}
+        run: |
+          set -euo pipefail
+          WORK=$(mktemp -d); trap 'rm -rf "$WORK"' EXIT
+          printf '%s\n' "$SSH_PRIVATE_KEY" > "$WORK/key"; chmod 600 "$WORK/key"
+          ssh-keyscan -p "$SSH_PORT" "$SSH_HOST" > "$WORK/kh" 2>/dev/null || true
+          SSHOPT="-n -i $WORK/key -p $SSH_PORT -o UserKnownHostsFile=$WORK/kh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=30 -o BatchMode=yes"
+          API="$GITHUB_SERVER_URL/api/v1"; H="Authorization: token $TOKEN"
+          problems=""
+          for row in $(python3 -c 'import json; d=json.load(open("tools/gitea-pipeline/repos.json")); [print(k+"="+v["target_path"]) for k,v in d.items() if not k.startswith("_") and v.get("target_path")]'); do
+            repo=${row%%=*}; tp=${row#*=}; slug=$(printf '%s' "$tp" | tr '/' '_')
+            # The job token is scoped to peptide-e2e; the repos are public, so read
+            # their branches anonymously. Unreadable main = a problem, not a crash.
+            head=$(curl -s "$API/repos/peptide-repo/$repo/branches/main" | python3 -c 'import json,sys
+          try: print(json.load(sys.stdin)["commit"]["id"])
+          except Exception: print("")')
+            if [ -z "$head" ]; then problems="$problems\n- $repo: could not read main from Gitea"; continue; fi
+            stamp=$(ssh $SSHOPT "$SSH_USERNAME@$SSH_HOST" "cat ~/.peptide-deploys/production/$slug 2>/dev/null" || true)
+            dep=${stamp%% *}
+            if [ -z "$dep" ]; then
+              msg="$repo: no Gitea production deploy recorded"
+              if [ "$PROD_ENABLED" = "true" ]; then problems="$problems\n- $msg (main is ${head:0:7})"; else echo "::notice::$msg (expected before cutover)"; fi
+            elif [ "$dep" != "$head" ]; then
+              problems="$problems\n- $repo: production has ${dep:0:7}, main is ${head:0:7}"
+            else
+              echo "OK $repo ${head:0:7}"
+            fi
+          done
+          [ -z "$problems" ] && { echo "No drift."; exit 0; }
+          printf "Drift found:%b\n" "$problems"
+          open=$(curl -s -H "$H" "$API/repos/$GITHUB_REPOSITORY/issues?state=open&type=issues&limit=50" | python3 -c 'import json,sys;print(sum(1 for i in json.load(sys.stdin) if i["title"]=="Deploy drift detected"))')
+          if [ "$open" -gt 0 ]; then echo "An open drift issue already exists; not opening another."; exit 1; fi
+          python3 -c 'import json,sys; print(json.dumps({"title": "Deploy drift detected", "body": "Daily deploy-health found production out of step with main:\n" + sys.argv[1].replace("\\n","\n") + "\n\nRe-run the repo pipeline on main (workflow_dispatch) or investigate the failed deploy. Opened by deploy-health.yml."}))' "$problems" > issue.json
+          curl -s -o /dev/null -w "issue HTTP %{http_code}\n" -H "$H" -H 'Content-Type: application/json' -X POST "$API/repos/$GITHUB_REPOSITORY/issues" --data-binary @issue.json
+          exit 1

.gitea/workflows/pipeline.yml

@@ -0,0 +1,41 @@
+# GENERATED by peptide-e2e/tools/gitea-pipeline/render.py from repos.json.
+# Do not edit by hand: change repos.json or the template and re-render.
+name: CI / Deploy
+
+on:
+  push:
+    branches: [main]
+  pull_request: {}
+  workflow_dispatch: {}
+
+concurrency:
+  group: pipeline-peptide-e2e-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  lint-php:
+    name: PHP Lint (${{ matrix.php }})
+    runs-on: ubuntu-latest
+    container: git.protopeer.com/peptide-repo/ci-php:2026-10
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ["8.1", "8.2", "8.3"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: https://git.protopeer.com/peptide-repo/peptide-e2e/.gitea/actions/ci-lint-php@main
+        with:
+          php: ${{ matrix.php }}
+
+  phpcs:
+    name: PHPCS (WordPress standards)
+    runs-on: ubuntu-latest
+    container: git.protopeer.com/peptide-repo/ci-php:2026-10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.head_ref || github.ref_name }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: https://git.protopeer.com/peptide-repo/peptide-e2e/.gitea/actions/ci-phpcs@main
+        with:
+          autofix: 'false'

.gitea/workflows/smoke.yml

@@ -0,0 +1,24 @@
+name: Smoke Tests (manual)
+
+# Manual run of the staging smoke suite (the deploy pipeline runs it automatically
+# via the smoke composite action). Gitea port of the workflow_dispatch half of
+# .github/workflows/smoke.yml.
+on:
+  workflow_dispatch:
+    inputs:
+      base_url:
+        description: 'Target URL (defaults to staging)'
+        required: false
+        default: 'https://staging.peptiderepo.com'
+
+jobs:
+  smoke:
+    name: Playwright smoke suite
+    runs-on: peptide-vps
+    timeout-minutes: 15
+    steps:
+      - uses: https://git.protopeer.com/peptide-repo/peptide-e2e/.gitea/actions/smoke@main
+        with:
+          base_url: ${{ inputs.base_url }}
+          wp_admin_user: ${{ secrets.STAGING_WP_ADMIN_USER }}
+          wp_admin_password: ${{ secrets.STAGING_WP_ADMIN_PASSWORD }}

.github/workflows/ci-self-test.yml

@@ -0,0 +1,27 @@
+# Self-test: exercises the reusable ci.yml on this repo itself.
+# Uses tests: none (peptide-e2e is a Playwright/Node repo, no PHP suite).
+# permissions: contents: write is required at the caller level — any caller of
+# ci.yml must declare this so the phpcs job can commit phpcbf fixes back to the
+# PR branch. Even with phpcs_autofix: false here, the permission must be declared
+# for the reusable workflow to pass GH's startup permission-escalation check.
+
+name: CI Self-Test (reusable ci.yml)
+
+on:
+  push:
+    branches: [main, 'claude/**']
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: write  # required: called ci.yml phpcs job declares job-level write for phpcbf
+
+jobs:
+  ci:
+    uses: ./.github/workflows/ci.yml
+    with:
+      tests: none
+      enforce_300: false
+      has_js: false
+      phpcs_autofix: false
+    secrets: inherit

.github/workflows/ci.yml

@@ -0,0 +1,388 @@
+##
+# Reusable CI workflow — peptiderepo estate
+#
+# Usage (in any repo's .github/workflows/ci.yml):
+#
+#   jobs:
+#     ci:
+#       uses: peptide-repo/peptide-e2e/.github/workflows/ci.yml@main
+#       with:
+#         tests: stubs       # or wp-framework | brain-monkey | none
+#         has_js: false
+#       secrets: inherit
+#
+# Inputs:
+#   php_versions      (string)  JSON array of PHP versions to matrix over.
+#                               Default: '["8.1","8.2","8.3"]'
+#   tests             (string)  PHPUnit environment. One of:
+#                                 stubs        — WP stubs only; no DB/service; fast.
+#                                 brain-monkey — Brain Monkey mocking; no DB/service.
+#                                 wp-framework — Full WordPress test framework with MySQL.
+#                                 none         — Skip phpunit entirely (temporary; remove
+#                                                at rollout when the repo gains a suite).
+#                               Default: stubs
+#   enforce_300       (boolean) Fail if any tracked *.php under line_limit_paths exceeds
+#                               300 lines (the estate hard rule). Default: true
+#   line_limit_paths  (string)  Space-separated directory/path(s) the 300-line rule
+#                               applies to. Default: 'includes'
+#   has_js            (boolean) Whether to run JS linting. Default: false
+#   phpcs_autofix     (boolean) On pull_request events: run phpcbf and commit any fixes
+#                               back to the branch before strict phpcs. On push events:
+#                               skip the commit (no loop) but still run strict phpcs.
+#                               Default: true
+#
+# Job names (fixed — callers and deploy-app.yml gate on these):
+#   lint-php    PHP syntax check across php_versions matrix.
+#   phpcs       WordPress Coding Standards; phpcbf auto-commit on PRs.
+#   file-size   300-line rule enforcement (skipped when enforce_300: false).
+#   phpunit     PHPUnit across php_versions matrix (skipped when tests: none).
+#   lint-js     JS linting (skipped when has_js: false).
+#
+# Design notes:
+#   - phpcbf auto-commit pattern is the prautoblogger gold standard (see
+#     prautoblogger/.github/workflows/ci.yml). The GITHUB_TOKEN commit does
+#     NOT trigger a new CI run per GitHub's loop-prevention rules.
+#   - WP test framework path replicates peptide-starter-theme's three gotchas:
+#     (1) install svn — ubuntu-latest no longer ships it;
+#     (2) MySQL service pre-creates the DB via MYSQL_DATABASE, so pass
+#         skip-db-create=true as the 6th arg to install-wp-tests.sh;
+#     (3) WP_CORE_DIR must have a trailing slash (bootstrapped into ABSPATH
+#         and concatenated verbatim — missing slash produces wrong path).
+#   - Every repo calls `composer test` regardless of the `tests` input; the
+#     input only controls environment provisioning, not the command.
+#   - permissions: the phpcs job declares `contents: write` at job level for
+#     phpcbf commit-back. GitHub requires the CALLING WORKFLOW to also declare
+#     `permissions: contents: write` at the caller's workflow level — GH enforces
+#     that callers cannot be escalated beyond their declared scope, even by job-level
+#     overrides in the reusable workflow. All caller repos must include this.
+##
+
+name: CI — Reusable
+
+on:
+  workflow_call:
+    inputs:
+      php_versions:
+        description: >-
+          JSON array of PHP versions to matrix over.
+          Example: '["8.1","8.2","8.3"]'
+        required: false
+        default: '["8.1","8.2","8.3"]'
+        type: string
+      tests:
+        description: >-
+          PHPUnit environment. One of: stubs | wp-framework | brain-monkey | none.
+          All environments run `composer test`; this input controls setup only.
+        required: false
+        default: stubs
+        type: string
+      enforce_300:
+        description: >-
+          Fail if any tracked *.php under line_limit_paths exceeds 300 lines.
+        required: false
+        default: true
+        type: boolean
+      line_limit_paths:
+        description: >-
+          Space-separated directory/path(s) to which the 300-line rule applies.
+        required: false
+        default: includes
+        type: string
+      has_js:
+        description: >-
+          Whether to run JS linting (node --check / npm run lint).
+        required: false
+        default: false
+        type: boolean
+      phpcs_autofix:
+        description: >-
+          On pull_request: run phpcbf and commit fixes back to the branch before
+          strict phpcs. On push: skip the commit but still run strict phpcs.
+        required: false
+        default: true
+        type: boolean
+
+jobs:
+
+  # ---------------------------------------------------------------------------
+  # lint-php: PHP syntax check — matrix over php_versions
+  # ---------------------------------------------------------------------------
+  lint-php:
+    name: PHP Lint (${{ matrix.php }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ${{ fromJson(inputs.php_versions) }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup PHP ${{ matrix.php }}
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          coverage: none
+
+      - name: Syntax check all PHP files
+        # Exclude vendor/, node_modules/, .git/, .github/ (mu-plugins may use
+        # version-specific syntax). -P4 parallelises across 4 cores.
+        run: |
+          set -e
+          find . -name '*.php' \
+            -not -path './vendor/*' \
+            -not -path './node_modules/*' \
+            -not -path './.git/*' \
+            -not -path './.github/*' \
+            -print0 | xargs -0 -n1 -P4 php -l > /dev/null
+
+  # ---------------------------------------------------------------------------
+  # phpcs: WordPress Coding Standards + phpcbf auto-fix on PRs
+  # ---------------------------------------------------------------------------
+  phpcs:
+    name: PHPCS (WordPress standards)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write  # allows phpcbf auto-fix commits back to the PR branch
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Check out the actual PR branch head so phpcbf can push fixes back.
+          # On push events github.head_ref is empty; fall back to github.ref_name.
+          ref: ${{ github.head_ref || github.ref_name }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.1'
+          coverage: none
+          tools: composer:v2, phpcs
+
+      - name: Install WordPress Coding Standards
+        run: |
+          composer global config --no-plugins \
+            allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
+          composer global require --no-interaction \
+            "dealerdirect/phpcodesniffer-composer-installer:^1.0" \
+            "wp-coding-standards/wpcs:^3.0" \
+            "phpcsstandards/phpcsutils:^1.0" \
+            "phpcsstandards/phpcsextra:^1.0"
+
+      - name: Auto-fix with phpcbf (PR only — commit back to branch if changed)
+        # Only runs on pull_request events AND when phpcs_autofix is enabled.
+        # phpcbf exits 1 when it makes fixes and 0 when nothing to fix; both are
+        # treated as success here (|| true). Commits via GITHUB_TOKEN do NOT
+        # trigger a new CI run — GitHub prevents loops on bot commits.
+        if: ${{ github.event_name == 'pull_request' && inputs.phpcs_autofix }}
+        run: |
+          # Detect which phpcs config file is present; pass it explicitly to
+          # --standard so phpcbf and phpcs always agree with the guard check.
+          PHPCS_CONFIG=""
+          if [ -f phpcs.xml ]; then PHPCS_CONFIG="phpcs.xml"
+          elif [ -f phpcs.xml.dist ]; then PHPCS_CONFIG="phpcs.xml.dist"
+          elif [ -f .phpcs.xml.dist ]; then PHPCS_CONFIG=".phpcs.xml.dist"
+          fi
+          if [ -z "$PHPCS_CONFIG" ]; then
+            echo "No phpcs.xml / phpcs.xml.dist / .phpcs.xml.dist — phpcbf skipped."
+            exit 0
+          fi
+          phpcbf --standard="$PHPCS_CONFIG" \
+            --extensions=php \
+            --ignore=vendor/*,tests/*,node_modules/* \
+            . || true
+          if ! git diff --quiet; then
+            git config user.name "peptiderepo"
+            git config user.email "peptiderepo@users.noreply.github.com"
+            git add -A
+            git commit -m "style: auto-fix PHPCS violations via phpcbf"
+            git push
+          fi
+
+      - name: Run PHPCS strict (fail on remaining violations)
+        # Runs on all events (push AND pull_request). After phpcbf has committed
+        # any auto-fixable issues on PRs, only non-auto-fixable violations land
+        # here. On push events phpcbf is skipped but phpcs is still strict.
+        # Guard: skip gracefully if no phpcs config file exists (repo not yet configured).
+        run: |
+          # Detect which phpcs config file is present (mirrors the phpcbf step above).
+          PHPCS_CONFIG=""
+          if [ -f phpcs.xml ]; then PHPCS_CONFIG="phpcs.xml"
+          elif [ -f phpcs.xml.dist ]; then PHPCS_CONFIG="phpcs.xml.dist"
+          elif [ -f .phpcs.xml.dist ]; then PHPCS_CONFIG=".phpcs.xml.dist"
+          fi
+          if [ -z "$PHPCS_CONFIG" ]; then
+            echo "No phpcs.xml / phpcs.xml.dist / .phpcs.xml.dist found — PHPCS skipped."
+            echo "Add a phpcs.xml to enable coding standards enforcement."
+            exit 0
+          fi
+          phpcs --standard="$PHPCS_CONFIG" \
+            --extensions=php \
+            --ignore=vendor/*,tests/*,node_modules/* \
+            --warning-severity=0 \
+            --report=full \
+            .
+
+  # ---------------------------------------------------------------------------
+  # file-size: 300-line rule enforcement
+  # ---------------------------------------------------------------------------
+  file-size:
+    name: 300-line rule (${{ inputs.line_limit_paths }})
+    runs-on: ubuntu-latest
+    if: ${{ inputs.enforce_300 }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check for PHP files over 300 lines
+        # Scans only tracked *.php files under line_limit_paths (not vendor etc.).
+        # Prints every offender with its line count, then fails the job so the
+        # engineer has a clear list to split.
+        env:
+          # Use env: block to avoid shell-injection from caller-controlled input.
+          PATHS: ${{ inputs.line_limit_paths }}
+        run: |
+          set -e
+          OFFENDERS=""
+          for DIR in $PATHS; do
+            if [ ! -e "$DIR" ]; then
+              echo "Warning: path '$DIR' does not exist in this repo — skipping."
+              continue
+            fi
+            while IFS= read -r FILE; do
+              if [ -z "$FILE" ]; then continue; fi
+              LINES=$(wc -l < "$FILE")
+              if [ "$LINES" -gt 300 ]; then
+                OFFENDERS="${OFFENDERS}${LINES} lines: ${FILE}\n"
+              fi
+            done < <(git ls-files -- "$DIR" | grep '\.php$')
+          done
+          if [ -n "$OFFENDERS" ]; then
+            echo "::error::Files exceeding 300-line limit (estate hard rule):"
+            printf "%b" "$OFFENDERS"
+            exit 1
+          fi
+          echo "All tracked PHP files under '$PATHS' are within the 300-line limit."
+
+  # ---------------------------------------------------------------------------
+  # phpunit: PHPUnit — matrix over php_versions
+  # Skipped entirely when tests == 'none'.
+  # ---------------------------------------------------------------------------
+  phpunit:
+    name: PHPUnit — ${{ inputs.tests }} (PHP ${{ matrix.php }})
+    runs-on: ubuntu-latest
+    if: ${{ inputs.tests != 'none' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ${{ fromJson(inputs.php_versions) }}
+
+    # MySQL service is declared for all variants but only connected when
+    # tests == 'wp-framework'. On stubs/brain-monkey the service starts but is
+    # never touched — marginal overhead, keeps the YAML unconditional.
+    services:
+      mysql:
+        image: mysql:8.0
+        env:
+          MYSQL_ROOT_PASSWORD: root
+          # The WP test bootstrap expects this DB to exist. Passing
+          # skip-db-create=true (6th arg) to install-wp-tests.sh relies on
+          # MySQL having created it already via this env var.
+          MYSQL_DATABASE: wp_tests
+        ports:
+          - 3306:3306
+        options: >-
+          --health-cmd="mysqladmin ping"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-retries=5
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install subversion (wp-framework only)
+        # ubuntu-latest no longer ships svn. The WP test-suite bootstrap script
+        # checks out develop.svn.wordpress.org via svn.
+        # Gotcha #1 of the three known WP PHPUnit CI gotchas.
+        if: ${{ inputs.tests == 'wp-framework' }}
+        run: sudo apt-get update -qq && sudo apt-get install -y --no-install-recommends subversion
+
+      - name: Setup PHP ${{ matrix.php }}
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          coverage: none
+          tools: composer:v2
+          extensions: ${{ inputs.tests == 'wp-framework' && 'mysqli' || '' }}
+
+      - name: Install Composer dependencies
+        run: composer install --no-progress --no-interaction --prefer-dist
+
+      - name: Wait for MySQL (wp-framework only)
+        if: ${{ inputs.tests == 'wp-framework' }}
+        run: |
+          for i in {1..30}; do
+            if mysqladmin ping -h 127.0.0.1 -P 3306 -u root -proot --silent; then
+              echo "MySQL is up"; break
+            fi
+            echo "Waiting for MySQL... ($i/30)"; sleep 2
+          done
+
+      - name: Install WordPress test suite (wp-framework only)
+        # Gotcha #2: pass skip-db-create=true (6th arg) — the MySQL service
+        #   already created wp_tests via MYSQL_DATABASE; re-creating it fails.
+        # Gotcha #3: WP_CORE_DIR must end with a trailing slash. The bootstrap
+        #   concatenates this verbatim as ABSPATH + 'wp-settings.php'. Without
+        #   the slash: '/tmp/wordpresswp-settings.php' -> fatal bootstrap error.
+        if: ${{ inputs.tests == 'wp-framework' }}
+        env:
+          WP_TESTS_DIR: /tmp/wordpress-tests-lib
+          WP_CORE_DIR: /tmp/wordpress/
+        run: |
+          chmod +x bin/install-wp-tests.sh
+          bin/install-wp-tests.sh wp_tests root root 127.0.0.1:3306 latest true
+
+      - name: Run PHPUnit
+        # Every repo calls `composer test` regardless of environment.
+        # The repo's composer.json `test` script points to vendor/bin/phpunit
+        # with the appropriate phpunit.xml config for that repo.
+        env:
+          WP_TESTS_DIR: /tmp/wordpress-tests-lib
+        run: composer test
+
+  # ---------------------------------------------------------------------------
+  # lint-js: JavaScript linting (only when has_js == true)
+  # ---------------------------------------------------------------------------
+  lint-js:
+    name: JS Lint
+    runs-on: ubuntu-latest
+    if: ${{ inputs.has_js }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install npm dependencies
+        run: npm ci
+
+      - name: Lint JavaScript
+        # Prefer `npm run lint` if the repo defines it (catches ESLint etc.).
+        # Fall back to `node --check` syntax-only scan on all *.js files.
+        # NOTE: `npm run lint --if-present` exits 0 even when no lint script
+        # exists (npm 10+ / ubuntu-latest Node 20 behaviour), so the fallback
+        # branch is dead code under --if-present. Instead, explicitly detect
+        # whether a lint script is declared and branch on that.
+        run: |
+          if node -e "process.exit(require('./package.json').scripts?.lint ? 0 : 1)" 2>/dev/null; then
+            echo "npm run lint script found — running it."
+            npm run lint
+          else
+            echo "No 'lint' npm script — running node --check syntax scan."
+            find . -name '*.js' \
+              -not -path './vendor/*' \
+              -not -path './node_modules/*' \
+              -not -path './.git/*' \
+              -print0 | xargs -0 -I{} node --check {}
+          fi

.github/workflows/deploy-app.yml

@@ -35,7 +35,7 @@ permissions:
 jobs:
   deploy-staging:
     name: Deploy to Staging
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, peptide-vps]
     environment: staging
     steps:
       - uses: actions/checkout@v4
@@ -72,7 +72,7 @@ jobs:
     name: Smoke tests (staging)
     needs: deploy-staging
     if: ${{ inputs.run_smoke }}
-    uses: peptiderepo/peptide-e2e/.github/workflows/smoke.yml@main
+    uses: peptide-repo/peptide-e2e/.github/workflows/smoke.yml@main
     secrets:
       STAGING_WP_ADMIN_USER: ${{ secrets.STAGING_WP_ADMIN_USER }}
       STAGING_WP_ADMIN_PASSWORD: ${{ secrets.STAGING_WP_ADMIN_PASSWORD }}
@@ -83,7 +83,7 @@ jobs:
     # skipped smoke (run_smoke: false) still allows prod via the if-condition.
     needs: [deploy-staging, smoke]
     if: ${{ !cancelled() && needs.deploy-staging.result == 'success' && needs.smoke.result != 'failure' }}
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, peptide-vps]
     environment: production
     steps:
       - uses: actions/checkout@v4

.github/workflows/deploy-health.yml

@@ -22,7 +22,7 @@ jobs:
       - uses: actions/github-script@v7
         with:
           script: |
-            const owner = 'peptiderepo';
+            const owner = 'peptide-repo';
             const repos = [
               'prautoblogger','peptide-repo-core','peptide-search-ai',
               'peptide-news-plugin','peptide-reconstitution-calculator','peptide-starter-theme'

.github/workflows/smoke.yml

@@ -32,14 +32,14 @@ on:
 jobs:
   smoke:
     name: Playwright smoke suite
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, peptide-vps]
     timeout-minutes: 15
 
     steps:
       - name: Checkout peptide-e2e (explicit — workflow_call defaults to caller repo)
         uses: actions/checkout@v4
         with:
-          repository: peptiderepo/peptide-e2e
+          repository: peptide-repo/peptide-e2e
           ref: main
 
       - name: Set up Node.js
@@ -53,7 +53,8 @@ jobs:
         run: npm ci
 
       - name: Install Playwright browsers
-        run: npx playwright install chromium --with-deps
+        # OS deps pre-installed on the self-hosted runner host; --with-deps needs sudo which the sandbox blocks
+        run: npx playwright install chromium
 
       - name: Run smoke tests
         env:

CHANGELOG.md

@@ -1,7 +1,99 @@
 # Changelog
 
+## [1.8.0] - 2026-06-23
+
+### Added
+- **`infra/vps/` PRAB generation orchestrator**: systemd timer + service + bash
+  script that SSHes from the Coolify KVM8 VPS to Hostinger and drives
+  `wp prautoblogger generate --sync` in a held-open SSH session. Sidesteps
+  Hostinger's ~10-min background-PHP-process kill that was blocking full
+  generation runs. Components:
+  - `orchestrate-generation.sh`: main script with DRY_RUN mode, structured
+    logging, reaper pre-sweep, failure email alert, and shellcheck-clean quoting.
+  - `prab-generation.service` / `prab-generation.timer`: systemd oneshot service
+    (2h timeout, no auto-restart) + daily 06:00 UTC timer with 5-min jitter.
+  - `install-orchestrator.sh`: one-time setup script; installs units but does NOT
+    enable the timer (requires explicit CEO greenlight post-QA).
+  - Security: `StrictHostKeyChecking=accept-new` with pre-seeded known_hosts for
+    the Hostinger IP; no hardcoded secrets; SSH key referenced by env-var path.
+
+## [1.7.2] - 2026-06-17
+
+### Fixed
+- **CI**: Drop `--with-deps` from `npx playwright install chromium` in `smoke.yml`.
+  The `peptide-vps` self-hosted runner has OS-level Playwright deps pre-installed by
+  root; `--with-deps` invokes `apt-get` which requires `sudo`, blocked by the runner's
+  `NoNewPrivileges=true` systemd hardening. Binary-only install works without
+  elevated privileges.## [1.7.1] - 2026-06-17
+
+### Changed
+- **CI/CD**: Switch `deploy-staging`, `deploy-production`, and `smoke` jobs from
+  `ubuntu-latest` (GitHub-hosted) to `[self-hosted, peptide-vps]` (org runner on
+  KVM8 VPS). This routes all Hostinger SSH/rsync traffic through our stable VPS IP,
+  fixing the Azure-region throttle that caused intermittent deploy failures.
+  Callers' CI/validate jobs are unaffected (remain on `ubuntu-latest`).
+
+## [1.7.0] - 2026-06-17
+
+### Added
+- **Peptide News admin smoke (07)** (`07-peptide-news-admin.spec.ts`).
+  Covers the Peptide News Plugin admin surfaces: dashboard (HTTP 200, no fatal,
+  h1 "Peptide News Analytics" heading, `.pn-summary-cards`, `.pn-date-filter`),
+  settings (form present), articles, and LLM costs sub-pages. Skip-if-absent guard
+  on all tests using the standard 05/06 merge-early binding pattern. Slugs sourced
+  from `admin/class-pn-admin-menu.php`.
+
+- **PR Vision admin smoke (08)** (`08-pr-vision-admin.spec.ts`).
+  Covers the PR Vision plugin admin surfaces: dashboard (HTTP 200, no fatal,
+  h1 "PR Vision" visible), Settings page (API-key-manager card `#prv-key-card`
+  present, status badge `#prv-key-source-badge` visible), write-only security
+  invariant (`#prv_api_key` value="" + full HTML must not contain "sk-or-"),
+  Costs sub-page (`pr-vision-costs`), and Call Log sub-page (`pr-vision-calls`).
+  Skip-if-absent at two levels: plugin absent (loud annotation + skip), and
+  `#prv-key-card` absent (Settings v0.2.0 not yet deployed on environment).
+  Selectors sourced from `class-prv-admin-page.php`, `class-prv-key-manager-renderer.php`.
+
+
 All notable changes to the peptide-e2e smoke suite will be documented here.
 
+## [1.6.0] - 2026-06-16
+
+## [1.6.1] - 2026-06-16
+
+### Fixed
+- **P2-A injection** (`ci.yml:239`): `${{ inputs.line_limit_paths }}` moved
+  from raw shell assignment into an `env:` block (`PATHS`); shell now reads
+  `$PATHS` — eliminates template-injection surface for caller-supplied input.
+- **P2-B lint-js fallback** (`ci.yml:378`): replaced `npm run lint --if-present`
+  (exits 0 when no lint script exists, killing the fallback branch) with
+  explicit `node -e "process.exit(…)"` detection; `node --check` scan now
+  actually runs when no `lint` npm script is defined.
+- **P2-C phpcs config mismatch** (`ci.yml:178-199, 206-223`): both phpcbf
+  and phpcs steps now detect which of `phpcs.xml` / `phpcs.xml.dist` /
+  `.phpcs.xml.dist` is present and pass that file to `--standard`; guard and
+  command now agree for all three variants.
+
+
+### Added
+- **Reusable CI workflow** (`.github/workflows/ci.yml`).
+  `on: workflow_call` entrypoint that every estate repo will adopt as a thin
+  caller. Inputs: `php_versions` (JSON matrix), `tests`
+  (stubs|wp-framework|brain-monkey|none), `enforce_300`, `line_limit_paths`,
+  `has_js`, `phpcs_autofix`. Fixed job names (`lint-php`, `phpcs`, `file-size`,
+  `phpunit`, `lint-js`) so deploy-app.yml can `needs:` them uniformly.
+  - **phpcbf auto-commit** (prautoblogger gold-standard pattern): on
+    `pull_request` events, phpcbf runs and pushes any fixes back to the branch
+    before strict PHPCS; on `push` events auto-commit is skipped to prevent
+    loops.
+  - **wp-framework PHPUnit path** replicates all three peptide-starter-theme
+    gotchas: (1) install svn; (2) pass skip-db-create=true so the MySQL
+    service's pre-created DB is reused; (3) WP_CORE_DIR trailing slash.
+  - **Self-test caller** (`.github/workflows/ci-self-test.yml`): exercises
+    the reusable workflow on this repo with `tests: none` so the workflow is
+    validated on this PR itself.
+  - **README.md**: adoption snippet documenting how any repo becomes a caller.
+
+
 ## [1.5.0] - 2026-06-14
 
 ### Added

README.md

@@ -0,0 +1,99 @@
+# peptide-e2e
+
+Playwright smoke tests and shared CI/CD pipelines for the [peptiderepo.com](https://peptiderepo.com) estate.
+
+## Reusable workflows
+
+This repo hosts shared GitHub Actions workflows called by all 7 app repos.
+
+### `deploy-app.yml` — shared deploy pipeline
+
+Handles staging rsync → Playwright smoke → production rsync → inventory guard →
+LiteSpeed cache purge → health check. Called by every app's `deploy.yml` via
+`uses: peptiderepo/peptide-e2e/.github/workflows/deploy-app.yml@main`.
+
+### `ci.yml` — reusable CI (PHP lint, PHPCS, 300-line, PHPUnit, JS lint)
+
+Standardised CI for every estate repo. Consistent job names so `deploy-app.yml`
+can gate on them uniformly.
+
+**Adopt in any repo** — create `.github/workflows/ci.yml` in the caller repo:
+
+```yaml
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+# Required: the called ci.yml phpcs job declares contents: write for phpcbf
+# commit-back. GitHub enforces that callers must grant at least the permission
+# level the reusable workflow's jobs request.
+permissions:
+  contents: write
+
+jobs:
+  ci:
+    uses: peptiderepo/peptide-e2e/.github/workflows/ci.yml@main
+    with:
+      tests: stubs        # stubs | wp-framework | brain-monkey | none
+      has_js: false       # set true if the repo ships JS
+    secrets: inherit
+```
+
+**Full input reference:**
+
+| Input | Type | Default | Description |
+|-------|------|---------|-------------|
+| `php_versions` | string | `'["8.1","8.2","8.3"]'` | JSON array of PHP versions to matrix over |
+| `tests` | string | `stubs` | PHPUnit environment: `stubs`, `wp-framework`, `brain-monkey`, or `none` |
+| `enforce_300` | boolean | `true` | Fail if any tracked `*.php` file under `line_limit_paths` exceeds 300 lines |
+| `line_limit_paths` | string | `includes` | Space-separated paths the 300-line rule applies to |
+| `has_js` | boolean | `false` | Whether to run JS linting (`npm run lint` or `node --check`) |
+| `phpcs_autofix` | boolean | `true` | On PRs: run phpcbf and commit fixes back before strict PHPCS |
+
+**PHPUnit `tests` values explained:**
+
+- `stubs` — WP stubs only (fast, no DB); just runs `composer test`.
+- `brain-monkey` — Brain Monkey mocking; no DB; runs `composer test`.
+- `wp-framework` — Full WordPress test framework: provisions MySQL service,
+  installs svn, runs `bin/install-wp-tests.sh`, then `composer test`. Handles
+  the three known gotchas: svn install, `--skip-db-create` with MySQL service,
+  `WP_CORE_DIR` trailing slash.
+- `none` — Skips the `phpunit` job entirely (temporary; repos without a suite
+  yet; remove at rollout).
+
+**phpcbf auto-commit:** on `pull_request` events, phpcbf runs first and commits
+any auto-fixable violations back to the PR branch via `GITHUB_TOKEN`. GitHub
+prevents loops — bot commits do not trigger a new CI run. Strict PHPCS then
+runs and fails only on non-auto-fixable violations.
+
+**Job names** (fixed — callers and `deploy-app.yml` `needs:` these):
+`lint-php`, `phpcs`, `file-size`, `phpunit`, `lint-js`.
+
+## Smoke tests
+
+The `tests/` directory contains Playwright specs that run against
+`https://staging.peptiderepo.com` (via `deploy-app.yml`) and can also target
+production. See `playwright.config.ts` for environment configuration.
+
+```
+tests/
+  00-homepage.spec.ts
+  01-reconstitution-calculator.spec.ts
+  02-peptide-search.spec.ts
+  03-admin-plugins.spec.ts
+  04-rest-api.spec.ts
+  05-dossier-edit.spec.ts
+  06-board-generate-now.spec.ts
+```
+
+## Development
+
+```bash
+npm ci
+npx playwright install --with-deps chromium
+BASE_URL=https://staging.peptiderepo.com npm test
+```

ci-image/Dockerfile

@@ -0,0 +1,15 @@
+# peptide-ci-php: Gitea runner image with PHP 8.1/8.2/8.3 + Composer preinstalled.
+# Why: shivammathur/setup-php treats the stock runner image as a bare self-hosted
+# box and apt-installs a whole compiler toolchain on every job (~5-10 min each).
+# Built into the gitea-dind daemon by ci-image/build.sh; runner label `peptide-php`.
+FROM docker.gitea.com/runner-images@sha256:fd911d7417bfbf0f454530e447da95b58001e1df41bbc5e1a8dd35d432575aae
+RUN set -eux; export DEBIAN_FRONTEND=noninteractive; \
+    apt-get update; apt-get install -y --no-install-recommends software-properties-common gnupg unzip mariadb-client; \
+    add-apt-repository -y ppa:ondrej/php; apt-get update; \
+    for v in 8.1 8.2 8.3; do \
+      apt-get install -y --no-install-recommends php$v-cli php$v-common php$v-mbstring php$v-xml php$v-curl php$v-zip php$v-mysql php$v-intl php$v-bcmath php$v-gd; \
+    done; \
+    update-alternatives --set php /usr/bin/php8.3; \
+    curl -fsSL https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer; \
+    composer --version; php8.1 -v | head -1; php8.2 -v | head -1; php8.3 -v | head -1; \
+    rm -rf /var/lib/apt/lists/*

ci-image/build.sh

@@ -0,0 +1,10 @@
+#!/bin/sh
+# Rebuild the CI image (PHP 8.1/8.2/8.3 + Composer) and publish it to the Gitea
+# registry. Run on the KVM8 as root. Pulls are anonymous (public org), but the
+# push needs `docker exec -i gitea-dind docker login git.protopeer.com` first with
+# a Gitea token that has write:package. Bump TAG and CI_IMAGE in
+# tools/gitea-pipeline/render.py together, then re-render the pipelines.
+set -e
+TAG=git.protopeer.com/peptide-repo/ci-php:2026-10
+docker exec -i gitea-dind docker build -t "$TAG" - < "$(dirname "$0")/Dockerfile"
+docker exec gitea-dind docker push "$TAG"

docs/gitea-pipeline.md

@@ -0,0 +1,68 @@
+# Gitea Actions pipeline (peptide-repo)
+
+Since 2026-10-24 every peptide-repo plugin/theme builds and deploys from
+`git.protopeer.com/peptide-repo`, not GitHub. GitHub's `.github/workflows` are
+left in the repos but Gitea ignores them (a repo with `.gitea/workflows` uses
+only that folder).
+
+## How it fits together
+
+- **Shared logic lives once**, as composite actions in this repo under
+  `.gitea/actions/`: `deploy`, `smoke`, `ci-lint-php`, `ci-phpcs`,
+  `ci-file-size`, `ci-phpunit`, `ci-lint-js`, `audit-direct-push`.
+  Gitea 1.25 cannot run reusable workflows (`workflow_call`), which is why this
+  is not a 1:1 copy of the GitHub `deploy-app.yml` / `ci.yml`.
+- **Each repo's `.gitea/workflows/pipeline.yml` is generated** by
+  `tools/gitea-pipeline/render.py` from `tools/gitea-pipeline/repos.json`.
+  Change a repo's settings in `repos.json`, re-render, commit the output. Do not
+  hand-edit the generated files.
+- **Job graph:** lint-php / phpcs / file-size / phpunit / lint-js (+ repo extras)
+  -> deploy-staging -> smoke (gate) -> deploy-production. Deploys run on pushes
+  to `main` and on manual runs of `main`.
+- **Runners:** CI jobs run on the shared docker runner (`ubuntu-latest`) inside
+  `git.protopeer.com/peptide-repo/ci-php:2026-10` (PHP 8.1/8.2/8.3 + Composer,
+  built from `ci-image/`). Deploy and smoke run on the host runner
+  `peptide-vps-gitea` (systemd `gitea-runner-peptide`, user `gtrunner`, label
+  `peptide-vps`) on the KVM8, one job at a time, like the old GitHub runner.
+- **Secrets / variables** are org-level on Gitea `peptide-repo`:
+  `SSH_PRIVATE_KEY` (deploy key `gitea-peptide-deploy-20261024` on Hostinger),
+  `SSH_HOST`, `SSH_PORT`, `SSH_USERNAME`, `STAGING_WP_ADMIN_USER` (`gitea-smoke`,
+  staging-only admin), `STAGING_WP_ADMIN_PASSWORD`; variable `PROD_DEPLOY_ENABLED`.
+
+## Switches and recovery
+
+- **Kill switch:** set org variable `PROD_DEPLOY_ENABLED` to anything but `true`
+  -> production deploys (and `peptide-news-plugin` rollback) are skipped;
+  staging + smoke still run.
+- **Redeploy / retry:** run the repo's `CI / Deploy` workflow on `main` manually.
+- **Roll back news plugin:** `peptide-news-plugin` -> `Rollback Deployment`
+  (workflow_dispatch, optional commit SHA). Same deploy action as normal.
+- **Drift:** `deploy-health.yml` (daily 13:00 UTC / 21:00 SGT) compares the
+  commit stamped in `~/.peptide-deploys/production/<target>` on Hostinger with
+  each repo's `main`, and opens one "Deploy drift detected" issue here.
+- **Back to GitHub (emergency):** `systemctl enable --now
+  actions.runner.peptide-repo.peptide-vps` on the KVM8 and set
+  `PROD_DEPLOY_ENABLED=false` here. Only works while GitHub's Hostinger deploy
+  key is still authorised.
+
+## Differences from the GitHub pipeline (deliberate)
+
+- `.gitea` is also excluded from rsync.
+- JS lint uses Node 22 (GitHub used Node 20, now end-of-life).
+- Smoke login confirms WordPress's periodic "Administration email verification"
+  screen instead of timing out on it (it had been blocking smoke since
+  2026-09-10, when staging's admin-email check expired).
+- Production stamps the deployed commit for deploy-health (replaces GitHub
+  Deployments).
+- PHP matrices are literal lists (avoids Gitea's `fromJson` matrix bug).
+
+## Known gaps
+
+- `pr-vision` `cto-review.yml` (AI PR review via OpenRouter) is **not ported**:
+  its `OPENROUTER_API_KEY` / `CTO_ADMIN_TOKEN` secrets only exist on GitHub and
+  it calls GitHub's review API.
+- The LiteSpeed purge in the production deploy runs relative to `$HOME`, so it is
+  effectively a no-op - same as on GitHub. Kept as-is, not fixed.
+- Issues / PR history of repos other than peptide-e2e stayed on GitHub (the
+  migration hit GitHub's anonymous API rate limit); GitHub repos are to be
+  archived, not deleted.

global.setup.ts

@@ -90,10 +90,24 @@ setup('authenticate as WP admin', async ({ browser }) => {
       // indicate a credential rejection or 2FA prompt) and then navigate
       // explicitly to wp-admin.
       await page.waitForURL(
-        (url) => !url.pathname.includes('/wp-login.php'),
+        (url) =>
+          !url.pathname.includes('/wp-login.php') ||
+          url.searchParams.get('action') === 'confirm_admin_email',
         { timeout: NAV_TIMEOUT }
       );
 
+      // WordPress periodically (every ~6 months) interrupts admin logins with
+      // "Administration email verification" (wp-login.php?action=confirm_admin_email).
+      // The login has already succeeded at that point; confirm and continue so the
+      // smoke gate does not time out on it.
+      if (new URL(page.url()).searchParams.get('action') === 'confirm_admin_email') {
+        console.log('[setup] Admin email verification screen - confirming and continuing');
+        await page.click('#correct-admin-email');
+        await page.waitForURL((url) => !url.pathname.includes('/wp-login.php'), {
+          timeout: NAV_TIMEOUT,
+        });
+      }
+
       // Navigate explicitly into wp-admin to capture the authenticated admin session.
       await page.goto('/wp-admin/', { timeout: NAV_TIMEOUT });
       await expect(page).toHaveURL(/\/wp-admin\//, { timeout: 20_000 });

infra/vps/install-orchestrator.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+# install-orchestrator.sh — One-time setup for the PRAB generation orchestrator on the VPS.
+#
+# Installs:
+#   1. orchestrate-generation.sh  -> /opt/prab-orchestrator/ (from this repo)
+#   2. prab-generation.service    -> /etc/systemd/system/
+#   3. prab-generation.timer      -> /etc/systemd/system/
+#
+# Does NOT enable or start the timer — that is an explicit post-QA cutover step.
+# Does NOT write secrets — the SSH key at /root/.ssh/hostinger_prod_ed25519 must
+# already be present (placed manually by the CTO from .env.credentials).
+#
+# Run as root on the KVM8 VPS (76.13.220.15):
+#   bash infra/vps/install-orchestrator.sh
+#
+# After install, validate with DRY_RUN=1 before enabling the timer:
+#   DRY_RUN=1 /opt/prab-orchestrator/orchestrate-generation.sh
+#   systemctl enable --now prab-generation.timer   # only after CEO greenlight
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+INSTALL_DIR="/opt/prab-orchestrator"
+SYSTEMD_DIR="/etc/systemd/system"
+ORCHESTRATE_SH="${SCRIPT_DIR}/orchestrate-generation.sh"
+SERVICE_FILE="${SCRIPT_DIR}/prab-generation.service"
+TIMER_FILE="${SCRIPT_DIR}/prab-generation.timer"
+
+# Must be root.
+if [[ "$(id -u)" -ne 0 ]]; then
+  echo "ERROR: install-orchestrator.sh must be run as root." >&2
+  exit 1
+fi
+
+# Validate source files exist.
+for f in "${ORCHESTRATE_SH}" "${SERVICE_FILE}" "${TIMER_FILE}"; do
+  if [[ ! -f "$f" ]]; then
+    echo "ERROR: source file not found: $f" >&2
+    exit 1
+  fi
+done
+
+echo "Installing PRAB orchestrator to ${INSTALL_DIR}..."
+mkdir -p "${INSTALL_DIR}"
+install -m 0750 "${ORCHESTRATE_SH}" "${INSTALL_DIR}/orchestrate-generation.sh"
+echo "  OK: ${INSTALL_DIR}/orchestrate-generation.sh"
+
+# Pre-seed known_hosts with Hostinger's host key so ssh(1) can verify
+# the server identity without StrictHostKeyChecking=no.
+# ssh-keyscan output is pinned here; re-run if Hostinger rotates its key.
+KNOWN_HOSTS_FILE="${INSTALL_DIR}/known_hosts"
+if [[ ! -f "${KNOWN_HOSTS_FILE}" ]]; then
+  echo "Pre-seeding known_hosts from Hostinger (${SSH_HOST:-145.223.107.228}:${SSH_PORT:-65002})..."
+  ssh-keyscan -p "${SSH_PORT:-65002}" "${SSH_HOST:-145.223.107.228}" \
+    > "${KNOWN_HOSTS_FILE}" 2>/dev/null \
+    && chmod 0600 "${KNOWN_HOSTS_FILE}" \
+    && echo "  OK: ${KNOWN_HOSTS_FILE}" \
+    || echo "  WARN: ssh-keyscan failed — known_hosts not seeded; first SSH will add key via accept-new"
+else
+  echo "  OK: ${KNOWN_HOSTS_FILE} (already exists, not overwritten)"
+fi
+
+echo "Installing systemd units..."
+install -m 0644 "${SERVICE_FILE}" "${SYSTEMD_DIR}/prab-generation.service"
+install -m 0644 "${TIMER_FILE}" "${SYSTEMD_DIR}/prab-generation.timer"
+echo "  OK: ${SYSTEMD_DIR}/prab-generation.service"
+echo "  OK: ${SYSTEMD_DIR}/prab-generation.timer"
+
+systemctl daemon-reload
+echo "  OK: systemctl daemon-reload"
+
+echo ""
+echo "Install complete. Timer is installed but NOT enabled."
+echo "Next steps (post-QA + CEO greenlight only):"
+echo "  1. Ensure SSH key exists: ls -la /root/.ssh/hostinger_prod_ed25519"
+echo "  2. Validate with dry run: DRY_RUN=1 /opt/prab-orchestrator/orchestrate-generation.sh"
+echo "  3. Run first real invocation: /opt/prab-orchestrator/orchestrate-generation.sh"
+echo "  4. Enable timer: systemctl enable --now prab-generation.timer"
+echo "  5. Confirm next run: systemctl list-timers prab-generation.timer"

infra/vps/orchestrate-generation.sh

@@ -0,0 +1,158 @@
+#!/usr/bin/env bash
+# orchestrate-generation.sh — VPS orchestrator for PRAutoBlogger article generation
+#
+# Runs as a systemd oneshot service (prab-generation.service) on the Coolify KVM8 VPS.
+# SSHes to Hostinger and drives wp prautoblogger generate --sync in a held-open SSH
+# session. SSH-attached processes survive Hostinger's ~10-min background-PHP-process kill.
+#
+# Usage:
+#   DRY_RUN=1 ./orchestrate-generation.sh   # echo commands, no generation
+#   ./orchestrate-generation.sh             # real run
+#
+# Alerting: on failure, sends email to cto@peptiderepo.com via system mail.
+# Logs:     structured log lines to stdout (captured by systemd journal).
+# Lock:     the plugin's Generation_Lock (DB mutex) prevents double-drive.
+#
+# Environment variables:
+#   DRY_RUN       Set to "1" to echo SSH/WP-CLI commands without executing. Default: 0.
+#   LOGFILE       Path for persistent log file. Default: /var/log/prab-generation.log.
+#   ALERT_EMAIL   Failure alert recipient. Default: cto@peptiderepo.com.
+#   SSH_KEY       Path to Hostinger SSH private key. Default: /root/.ssh/hostinger_prod_ed25519.
+#   SSH_HOST      Hostinger SSH host. Default: 145.223.107.228.
+#   SSH_PORT      Hostinger SSH port. Default: 65002.
+#   SSH_USER      Hostinger SSH user. Default: u117248512.
+#   WP_PATH       WordPress docroot on Hostinger. Default: /home/u117248512/domains/peptiderepo.com/public_html.
+
+set -euo pipefail
+
+# ---------------------------------------------------------------------------
+# Configuration (override via environment; no hardcoded secrets)
+# ---------------------------------------------------------------------------
+DRY_RUN="${DRY_RUN:-0}"
+LOGFILE="${LOGFILE:-/var/log/prab-generation.log}"
+ALERT_EMAIL="${ALERT_EMAIL:-cto@peptiderepo.com}"
+SSH_KEY="${SSH_KEY:-/root/.ssh/hostinger_prod_ed25519}"
+SSH_HOST="${SSH_HOST:-145.223.107.228}"
+SSH_PORT="${SSH_PORT:-65002}"
+SSH_USER="${SSH_USER:-u117248512}"
+WP_PATH="${WP_PATH:-/home/u117248512/domains/peptiderepo.com/public_html}"
+# Known-hosts file pre-seeded by install-orchestrator.sh with Hostinger's host key.
+# Pins the server identity; StrictHostKeyChecking=accept-new adds on first connect.
+KNOWN_HOSTS="${KNOWN_HOSTS:-/opt/prab-orchestrator/known_hosts}"
+
+# ---------------------------------------------------------------------------
+# Logging helpers
+# ---------------------------------------------------------------------------
+PID="$$"
+TS() { date -u '+%Y-%m-%dT%H:%M:%SZ'; }
+
+log() {
+  local msg="prab-generation[${PID}]: $*"
+  echo "$msg"
+  echo "$(TS) $msg" >> "${LOGFILE}" 2>/dev/null || true
+}
+
+die() {
+  log "FATAL: $*"
+  exit 1
+}
+
+# ---------------------------------------------------------------------------
+# Validate required key before doing anything
+# ---------------------------------------------------------------------------
+if [[ "${DRY_RUN}" != "1" ]] && [[ ! -f "${SSH_KEY}" ]]; then
+  die "SSH key not found at ${SSH_KEY}. Run install-orchestrator.sh first."
+fi
+
+# ---------------------------------------------------------------------------
+# DRY_RUN mode: echo commands and exit
+# ---------------------------------------------------------------------------
+if [[ "${DRY_RUN}" == "1" ]]; then
+  log "DRY_RUN=1 — echoing commands only, no generation"
+  log "WOULD RUN: ssh -i ${SSH_KEY} -p ${SSH_PORT} -o StrictHostKeyChecking=accept-new -o ConnectTimeout=15 ${SSH_USER}@${SSH_HOST} \\"
+  log "  'wp prautoblogger generate --sync --path=${WP_PATH} 2>&1'"
+  log "DRY_RUN complete"
+  exit 0
+fi
+
+# ---------------------------------------------------------------------------
+# Run start
+# ---------------------------------------------------------------------------
+START_TS="$(TS)"
+log "START ts=${START_TS}"
+
+# ---------------------------------------------------------------------------
+# Step 1: Reaper sweep — clear any stuck runs before starting.
+# Belt-and-suspenders: the plugin's daily reaper cron handles this too, but
+# running it explicitly here ensures a clean state before each generation.
+# ---------------------------------------------------------------------------
+log "REAPER_SWEEP: invoking Run_Reaper::reap()"
+REAP_CMD="wp eval 'echo json_encode(PRAutoBlogger_Run_Reaper::reap());' --path=${WP_PATH} 2>&1"
+
+REAP_OUT=""
+# shellcheck disable=SC2029
+REAP_OUT="$(ssh -i "${SSH_KEY}" \
+    -p "${SSH_PORT}" \
+    -o StrictHostKeyChecking=accept-new \
+    -o UserKnownHostsFile="${KNOWN_HOSTS}" \
+    -o ConnectTimeout=15 \
+    -o ServerAliveInterval=60 \
+    -o ServerAliveCountMax=30 \
+    "${SSH_USER}@${SSH_HOST}" \
+    "${REAP_CMD}" \
+    2>&1)" || true
+log "REAPER_RESULT: ${REAP_OUT}"
+
+# ---------------------------------------------------------------------------
+# Step 2: Run wp prautoblogger generate --sync
+# ---------------------------------------------------------------------------
+log "SSH_CONNECT: ${SSH_USER}@${SSH_HOST}:${SSH_PORT} key=${SSH_KEY}"
+
+WP_CMD="wp prautoblogger generate --sync --path=${WP_PATH} 2>&1"
+
+RESULT_OUTPUT=""
+EXIT_CODE=0
+
+# shellcheck disable=SC2029
+RESULT_OUTPUT="$(ssh -i "${SSH_KEY}" \
+    -p "${SSH_PORT}" \
+    -o StrictHostKeyChecking=accept-new \
+    -o UserKnownHostsFile="${KNOWN_HOSTS}" \
+    -o ConnectTimeout=15 \
+    -o ServerAliveInterval=60 \
+    -o ServerAliveCountMax=30 \
+    "${SSH_USER}@${SSH_HOST}" \
+    "${WP_CMD}" \
+    2>&1)" || EXIT_CODE=$?
+
+# Extract the last JSON summary line (the one from WP_CLI::log(json_encode(...)))
+LAST_JSON="$(echo "${RESULT_OUTPUT}" | grep -E '^\{' | tail -1 || true)"
+LAST_LINE="$(echo "${RESULT_OUTPUT}" | tail -1)"
+
+log "SSH_RESULT exit=${EXIT_CODE} json=${LAST_JSON:-none}"
+
+# ---------------------------------------------------------------------------
+# Step 3: Evaluate result
+# ---------------------------------------------------------------------------
+END_TS="$(TS)"
+
+if [[ ${EXIT_CODE} -eq 0 ]]; then
+  log "END result=success ts=${END_TS}"
+else
+  log "END result=failure exit=${EXIT_CODE} last_line=${LAST_LINE} ts=${END_TS}"
+
+  # Send failure alert via email (system mail; no external deps required).
+  # cto@peptiderepo.com forwards to peptiderepo@gmail.com via Cloudflare Email Routing.
+  ALERT_BODY="PRAutoBlogger generation FAILED on $(hostname) at ${END_TS}.
+Exit code: ${EXIT_CODE}
+Last output: ${LAST_LINE}
+Full log: ${LOGFILE}
+SSH: ${SSH_USER}@${SSH_HOST}:${SSH_PORT}
+WP path: ${WP_PATH}"
+
+  echo "${ALERT_BODY}" \
+    | mail -s "PRAB generation FAILED @ ${END_TS}" "${ALERT_EMAIL}" 2>/dev/null \
+    || log "ALERT_FAILED: could not send email to ${ALERT_EMAIL} (mail not configured?)"
+
+  exit "${EXIT_CODE}"
+fi

infra/vps/prab-generation.service

@@ -0,0 +1,22 @@
+[Unit]
+Description=PRAutoBlogger article generation (VPS orchestrator)
+Documentation=https://github.com/peptide-repo/peptide-e2e/tree/main/infra/vps/
+After=network.target
+# Do not start if the timer fires while another instance is still running.
+# Type=oneshot + TimeoutStartSec enforce this at the systemd level.
+
+[Service]
+Type=oneshot
+# root owns /root/.ssh/hostinger_prod_ed25519 and /opt/prab-orchestrator/known_hosts;
+# a dedicated service user would need its own keypair + sudo-less SSH access.
+# Acceptable on this dedicated lab VPS (not shared); revisit if VPS is multi-tenant.
+User=root
+ExecStart=/opt/prab-orchestrator/orchestrate-generation.sh
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=prab-generation
+# Allow up to 2 hours for a full generation run (orchestrate + draft LLM calls).
+# The longest observed single LLM call was 1925s (~32 min); normal runs 2-5 min.
+TimeoutStartSec=7200
+# Do not restart on failure — the timer will retry the next day.
+Restart=no

infra/vps/prab-generation.timer

@@ -0,0 +1,19 @@
+[Unit]
+Description=Daily PRAutoBlogger generation at 06:00 UTC
+Documentation=https://github.com/peptide-repo/peptide-e2e/tree/main/infra/vps/
+Requires=prab-generation.service
+
+[Timer]
+# Fire daily at 06:00 UTC — before Hostinger's daily wp-cron window.
+OnCalendar=*-*-* 06:00:00 UTC
+# Persistent=true: if the VPS was down at 06:00 UTC, fire immediately on next
+# boot so at most one day's generation is missed (not deferred indefinitely).
+Persistent=true
+# Up to 5 min random jitter to avoid thundering-herd if multiple VPS instances
+# are ever added. Harmless with a single instance.
+RandomizedDelaySec=300
+# Accuracy within 1 minute (default is 1 minute; explicit for clarity).
+AccuracySec=60
+
+[Install]
+WantedBy=timers.target

package.json

@@ -1,6 +1,6 @@
 {
   "name": "peptide-e2e",
-  "version": "1.5.0",
+  "version": "1.8.0",
   "description": "Playwright smoke tests for peptiderepo.com (staging + production)",
   "private": true,
   "scripts": {

tests/07-peptide-news-admin.spec.ts

@@ -0,0 +1,144 @@
+/**
+ * 07-peptide-news-admin.spec.ts
+ *
+ * What: Smoke tests for the Peptide News Plugin admin surfaces.
+ *       Verifies the dashboard, settings, articles, and cost sub-pages
+ *       load without PHP fatals and checks expected UI elements.
+ *       Guards against activation failures, missing menu registration, or
+ *       PHP fatals introduced by a bad deploy.
+ *
+ * Who triggers it: Playwright chromium project (post-auth setup).
+ * Dependencies: wp-admin authenticated session (from global.setup.ts).
+ *
+ * SKIP-IF-ABSENT: When the Peptide News Plugin is not installed/activated on
+ *   this environment, each test detects the absent menu page and skips with a
+ *   loud annotation — consistent with the 05/06 merge-early binding pattern.
+ *
+ * Admin menu slugs (sourced from admin/class-pn-admin-menu.php):
+ *   Dashboard  -> admin.php?page=peptide-news-dashboard
+ *   Settings   -> admin.php?page=peptide-news-settings
+ *   Articles   -> admin.php?page=peptide-news-articles
+ *   LLM Costs  -> admin.php?page=peptide-news-costs
+ *
+ * Selectors sourced from admin/partials/dashboard.php:
+ *   h1 "Peptide News Analytics"  - page heading (text match)
+ *   .pn-summary-cards            - summary card row
+ *   .pn-date-filter              - date range filter form
+ *
+ * @see peptiderepo/peptide-news-plugin admin/class-pn-admin-menu.php
+ * @see peptiderepo/peptide-news-plugin admin/partials/dashboard.php
+ */
+
+import { test, expect } from '@playwright/test';
+
+const ADMIN = '/wp-admin';
+
+/**
+ * Detect the "page not registered" condition WordPress returns when a plugin
+ * menu slug is unknown. Returns true when the plugin is absent.
+ *
+ * WordPress either:
+ * (a) Shows "You do not have sufficient permissions to access this page."
+ * (b) Shows a notice that the page cannot be found
+ * (c) Redirects back to /wp-admin/ stripping the ?page= param
+ */
+function isPluginAbsent(body: string, url: string): boolean {
+  return (
+    body.includes('Invalid plugin page') ||
+    body.includes('do not have sufficient permissions') ||
+    body.includes('The page you are looking for') ||
+    ( url.includes('/wp-admin/') && ! url.includes('page=peptide-news') )
+  );
+}
+
+/** Push a loud skip annotation and call test.skip(). */
+function skipMissing(): void {
+  test.info().annotations.push({
+    type: 'skip',
+    description:
+      '[peptide-news smoke] Peptide News Plugin is not installed or activated ' +
+      'on this environment. Skipping per the merge-early binding.',
+  });
+  test.skip();
+}
+
+test.describe('WP Admin - Peptide News Plugin dashboard', () => {
+  test('dashboard page loads (HTTP 200, no PHP fatal)', async ({ page }) => {
+    const res = await page.goto(`${ADMIN}/admin.php?page=peptide-news-dashboard`);
+    expect(res?.status()).toBe(200);
+
+    await expect(page.locator('#wpbody')).toBeVisible();
+
+    const body = (await page.textContent('body')) ?? '';
+    expect(body).not.toContain('Fatal error');
+
+    if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
+  });
+
+  test('dashboard renders analytics heading, summary cards, and date filter', async ({ page }) => {
+    await page.goto(`${ADMIN}/admin.php?page=peptide-news-dashboard`);
+
+    await expect(page.locator('#wpbody')).toBeVisible();
+    const body = (await page.textContent('body')) ?? '';
+    expect(body).not.toContain('Fatal error');
+
+    if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
+
+    // Heading from admin/partials/dashboard.php: <h1>Peptide News Analytics</h1>
+    await expect(
+      page.locator('h1').filter({ hasText: 'Peptide News Analytics' })
+    ).toBeVisible({ timeout: 10_000 });
+
+    // Summary card row: <div class="pn-summary-cards">
+    await expect(page.locator('.pn-summary-cards')).toBeVisible({ timeout: 10_000 });
+
+    // Date range filter form: <form class="pn-date-filter">
+    await expect(page.locator('.pn-date-filter')).toBeVisible({ timeout: 10_000 });
+  });
+});
+
+test.describe('WP Admin - Peptide News Plugin settings page', () => {
+  test('settings page loads (HTTP 200, no fatal, settings form present)', async ({ page }) => {
+    const res = await page.goto(`${ADMIN}/admin.php?page=peptide-news-settings`);
+    expect(res?.status()).toBe(200);
+
+    await expect(page.locator('#wpbody')).toBeVisible();
+    const body = (await page.textContent('body')) ?? '';
+    expect(body).not.toContain('Fatal error');
+
+    if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
+
+    // Every settings page rendered by class-pn-admin-settings-page.php contains a form
+    await expect(page.locator('form').first()).toBeVisible({ timeout: 10_000 });
+  });
+});
+
+test.describe('WP Admin - Peptide News Plugin articles page', () => {
+  test('articles page loads without fatal error', async ({ page }) => {
+    const res = await page.goto(`${ADMIN}/admin.php?page=peptide-news-articles`);
+    expect(res?.status()).toBe(200);
+
+    await expect(page.locator('#wpbody')).toBeVisible();
+    const body = (await page.textContent('body')) ?? '';
+    expect(body).not.toContain('Fatal error');
+
+    if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
+
+    expect(body).not.toContain('Invalid plugin page');
+  });
+});
+
+test.describe('WP Admin - Peptide News Plugin LLM costs page', () => {
+  test('costs page loads without fatal error', async ({ page }) => {
+    const res = await page.goto(`${ADMIN}/admin.php?page=peptide-news-costs`);
+    expect(res?.status()).toBe(200);
+
+    await expect(page.locator('#wpbody')).toBeVisible();
+    const body = (await page.textContent('body')) ?? '';
+    expect(body).not.toContain('Fatal error');
+
+    if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
+
+    expect(body).not.toContain('Invalid plugin page');
+  });
+});

tests/08-pr-vision-admin.spec.ts

@@ -0,0 +1,220 @@
+/**
+ * 08-pr-vision-admin.spec.ts
+ *
+ * What: Smoke tests for the PR Vision plugin admin surfaces.
+ *       Covers the dashboard, Settings (API-key-manager card + write-only
+ *       invariant), Costs, and Call Log sub-pages. Guards against PHP fatals,
+ *       missing menu registration, and key leakage regressions.
+ *
+ * Who triggers it: Playwright chromium project (post-auth setup).
+ * Dependencies: wp-admin authenticated session (from global.setup.ts).
+ *
+ * SKIP-IF-ABSENT: When PR Vision is not installed/activated on this
+ *   environment, each test detects the absent page and skips with a loud
+ *   annotation - consistent with the 05/06 merge-early binding pattern.
+ *
+ * Admin menu slugs (sourced from includes/core/class-prv-admin-page.php
+ *   and includes/core/class-prv-settings-page.php,
+ *       includes/core/class-prv-costs-page.php,
+ *       includes/core/class-prv-call-log-page.php):
+ *   Dashboard  -> admin.php?page=pr-vision           (MENU_SLUG = 'pr-vision')
+ *   Settings   -> admin.php?page=pr-vision-settings  (MENU_SLUG = 'pr-vision-settings')
+ *   Costs      -> admin.php?page=pr-vision-costs     (MENU_SLUG = 'pr-vision-costs')
+ *   Call Log   -> admin.php?page=pr-vision-calls     (MENU_SLUG = 'pr-vision-calls')
+ *
+ * Selectors sourced from includes/core/class-prv-admin-page.php:
+ *   h1 "PR Vision - AI Visibility"  - dashboard page heading
+ *
+ * Selectors sourced from includes/core/class-prv-key-manager-renderer.php:
+ *   #prv-key-card                  - the API-key-manager card container
+ *   #prv-key-source-badge          - key source status indicator span
+ *   #prv_api_key                   - password input (must render empty - write-only invariant)
+ *
+ * Write-only invariant (security):
+ *   The stored OpenRouter key must NEVER appear in page source.
+ *   #prv_api_key renders with value="" on every page load regardless of
+ *   whether a key is stored. This spec asserts the empty value and asserts
+ *   that no structurally valid key token (regex /sk-or-v1-[A-Za-z0-9]{20,}/)
+ *   appears in the full body HTML. A regex is used instead of a naive
+ *   toContain('sk-or-') to avoid a false-positive on the password input's
+ *   placeholder="sk-or-…" attribute (the ellipsis is a format hint, not a
+ *   token body, and won't match the regex).
+ *
+ * @see peptiderepo/pr-vision includes/core/class-prv-admin-page.php
+ * @see peptiderepo/pr-vision includes/core/class-prv-settings-page.php
+ * @see peptiderepo/pr-vision includes/core/class-prv-key-manager-renderer.php
+ */
+
+import { test, expect } from '@playwright/test';
+
+const ADMIN = '/wp-admin';
+
+/**
+ * Detect the "page not registered" condition WordPress returns when a plugin
+ * menu slug is unknown. Returns true when the plugin is absent.
+ */
+function isPluginAbsent(body: string, url: string): boolean {
+  return (
+    body.includes('Invalid plugin page') ||
+    body.includes('do not have sufficient permissions') ||
+    body.includes('The page you are looking for') ||
+    ( url.includes('/wp-admin/') && ! url.includes('page=pr-vision') )
+  );
+}
+
+/** Push a loud skip annotation and call test.skip(). */
+function skipMissing(): void {
+  test.info().annotations.push({
+    type: 'skip',
+    description:
+      '[pr-vision smoke] PR Vision plugin is not installed or activated ' +
+      'on this environment. Skipping per the merge-early binding.',
+  });
+  test.skip();
+}
+
+test.describe('WP Admin - PR Vision dashboard', () => {
+  test('dashboard page loads (HTTP 200, no PHP fatal)', async ({ page }) => {
+    const res = await page.goto(`${ADMIN}/admin.php?page=pr-vision`);
+    expect(res?.status()).toBe(200);
+
+    await expect(page.locator('#wpbody')).toBeVisible();
+
+    const body = (await page.textContent('body')) ?? '';
+    expect(body).not.toContain('Fatal error');
+
+    if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
+
+    // Heading from class-prv-admin-page.php render_page():
+    // echo '<h1>' . esc_html__( 'PR Vision - AI Visibility', 'pr-vision' ) . '</h1>';
+    await expect(
+      page.locator('h1').filter({ hasText: 'PR Vision' })
+    ).toBeVisible({ timeout: 10_000 });
+  });
+});
+
+test.describe('WP Admin - PR Vision Settings page (API-key-manager)', () => {
+  test('settings page loads (HTTP 200, no PHP fatal)', async ({ page }) => {
+    const res = await page.goto(`${ADMIN}/admin.php?page=pr-vision-settings`);
+    expect(res?.status()).toBe(200);
+
+    await expect(page.locator('#wpbody')).toBeVisible();
+
+    const body = (await page.textContent('body')) ?? '';
+    expect(body).not.toContain('Fatal error');
+
+    if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
+  });
+
+  test('API-key-manager card is present and status indicator visible', async ({ page }) => {
+    await page.goto(`${ADMIN}/admin.php?page=pr-vision-settings`);
+
+    await expect(page.locator('#wpbody')).toBeVisible();
+    const body = (await page.textContent('body')) ?? '';
+    expect(body).not.toContain('Fatal error');
+
+    if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
+
+    // ── SKIP-IF-ABSENT guard: Settings page may not have key-card if Settings
+    //    subpage (v0.2.0) is not yet deployed on this environment.
+    const keyCard = page.locator('#prv-key-card');
+    const cardPresent = await keyCard.count() > 0;
+
+    if ( ! cardPresent ) {
+      test.info().annotations.push({
+        type: 'skip',
+        description:
+          '[pr-vision smoke] #prv-key-card absent: PR Vision Settings page ' +
+          '(v0.2.0 admin) is not deployed on this environment. Skipping key-manager assertions.',
+      });
+      test.skip();
+      return;
+    }
+
+    // API-key-manager card container from class-prv-key-manager-renderer.php:
+    // <div class="prv-card" id="prv-key-card">
+    await expect(keyCard).toBeVisible({ timeout: 10_000 });
+
+    // Key source status indicator: <span ... id="prv-key-source-badge">
+    // Shows one of: "Set via wp-config", "Set via admin", "Not set"
+    await expect(page.locator('#prv-key-source-badge')).toBeVisible({ timeout: 10_000 });
+  });
+
+  test('password input is present and renders EMPTY (write-only invariant)', async ({ page }) => {
+    await page.goto(`${ADMIN}/admin.php?page=pr-vision-settings`);
+
+    await expect(page.locator('#wpbody')).toBeVisible();
+    const body = (await page.textContent('body')) ?? '';
+    expect(body).not.toContain('Fatal error');
+
+    if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
+
+    const keyCard = page.locator('#prv-key-card');
+    const cardPresent = await keyCard.count() > 0;
+    if ( ! cardPresent ) {
+      test.info().annotations.push({
+        type: 'skip',
+        description:
+          '[pr-vision smoke] #prv-key-card absent: skipping write-only invariant check.',
+      });
+      test.skip();
+      return;
+    }
+
+    // Password input from class-prv-key-manager-renderer.php render_key_form():
+    // <input type="password" id="prv_api_key" name="prv_api_key" ... value="" ...>
+    // The renderer explicitly passes value="" -- the stored key is NEVER output.
+    const keyInput = page.locator('#prv_api_key');
+
+    // When the key source is SOURCE_CONSTANT the input is disabled but still rendered.
+    // In all cases it must be present in the DOM.
+    await expect(keyInput).toBeAttached({ timeout: 10_000 });
+
+    // Write-only invariant: value attribute must be empty string, not the stored key.
+    const inputValue = await keyInput.getAttribute('value');
+    expect(inputValue ?? '').toBe('');
+
+    // Security check: a *real* OpenRouter key (format "sk-or-v1-<20+ alnum chars>")
+    // must not appear anywhere in the page HTML -- guards against accidental
+    // server-side leakage.
+    //
+    // NOTE: We use a regex rather than the naive toContain('sk-or-') to avoid
+    // a false-positive: the password input carries placeholder="sk-or-…"
+    // (an ellipsis format-hint, not a token body) which contains the literal
+    // string "sk-or-" but is NOT a leaked key.  A regex that requires the
+    // "v1-" segment and at least 20 alphanumeric characters only matches a
+    // structurally valid key, so the placeholder never trips it.
+    const html = await page.content();
+    expect(html).not.toMatch(/sk-or-v1-[A-Za-z0-9]{20,}/);
+  });
+});
+
+test.describe('WP Admin - PR Vision Costs page', () => {
+  test('costs page loads without fatal error', async ({ page }) => {
+    const res = await page.goto(`${ADMIN}/admin.php?page=pr-vision-costs`);
+    expect(res?.status()).toBe(200);
+
+    await expect(page.locator('#wpbody')).toBeVisible();
+    const body = (await page.textContent('body')) ?? '';
+    expect(body).not.toContain('Fatal error');
+
+    if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
+
+    expect(body).not.toContain('Invalid plugin page');
+  });
+});
+
+test.describe('WP Admin - PR Vision Call Log page', () => {
+  test('call log page loads without fatal error', async ({ page }) => {
+    const res = await page.goto(`${ADMIN}/admin.php?page=pr-vision-calls`);
+    expect(res?.status()).toBe(200);
+
+    await expect(page.locator('#wpbody')).toBeVisible();
+    const body = (await page.textContent('body')) ?? '';
+    expect(body).not.toContain('Fatal error');
+
+    if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
+
+    expect(body).not.toContain('Invalid plugin page');
+  });
+});

tools/gitea-pipeline/render.py

@@ -0,0 +1,265 @@
+#!/usr/bin/env python3
+"""Render .gitea/workflows/pipeline.yml for a peptide-repo repository.
+
+Why this exists: Gitea 1.25 cannot run reusable workflows (workflow_call), so
+the shared CI/deploy logic lives in composite actions under .gitea/actions/ in
+peptide-e2e, and each repo gets a thin generated job graph that calls them.
+Edit repos.json or this template, never the generated files.
+
+usage: render.py <repo-name> [repos.json]   -> prints the workflow to stdout
+"""
+import json
+import sys
+
+A = "https://git.protopeer.com/peptide-repo/peptide-e2e/.gitea/actions"
+# CI image with PHP 8.1/8.2/8.3 + Composer preinstalled (peptide-e2e/ci-image).
+# Without it setup-php bootstraps a compiler toolchain on every job (5-20 min).
+CI_IMAGE = "git.protopeer.com/peptide-repo/ci-php:2026-10"
+DEFAULTS = {"tests": "stubs", "has_js": False, "line_limit_paths": "includes",
+            "enforce_300": True, "phpcs_autofix": True, "audit": True,
+            "php_versions": ["8.1", "8.2", "8.3"], "extras": []}
+MAIN_PUSH = "github.event_name == 'push' && github.ref == 'refs/heads/main'"
+# Deploys also run on a manual (workflow_dispatch) run of main, so a failed or
+# drifted deploy can be redone without a dummy commit (deploy-health says so).
+MAIN_DEPLOY = ("(github.event_name == 'push' || github.event_name == 'workflow_dispatch')"
+               " && github.ref == 'refs/heads/main'")
+
+EXTRAS = {
+    "check-constants": """
+  check-constants:
+    name: Check PRAUTOBLOGGER_* constants
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Use PHP 8.1 (preinstalled in the CI image)
+        run: update-alternatives --set php /usr/bin/php8.1 && php -v | head -1
+      # Fails if any PRAUTOBLOGGER_* constant referenced in shipped PHP is neither
+      # defined in prautoblogger.php nor guarded by defined() (v0.19.0 incident class).
+      - run: php scripts/check-constants.php
+      - name: Self-test the scanner
+        run: php scripts/check-constants.php --self-test
+""",
+    "validate-psa-version": """
+  validate:
+    name: Validate PSA_VERSION constant
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: |
+          if grep -q "define( 'PSA_VERSION'" peptide-search-ai.php; then
+            version=$(grep "define( 'PSA_VERSION'" peptide-search-ai.php | sed "s/.*'\\([^']*\\)'.*/\\1/")
+            echo "PSA_VERSION: $version"
+          else
+            echo "::error::PSA_VERSION not found"; exit 1
+          fi
+""",
+    "security-audit": """
+  security-audit:
+    name: Security Audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check for common PHP security issues
+        shell: bash
+        run: |
+          echo ":: Checking for direct SQL queries without prepare..."
+          if grep -r "query\\s*(\\s*['\\"].*\\$" --include="*.php" --exclude-dir=vendor . 2>/dev/null \\
+            | grep -v "\\$wpdb->prepare" \\
+            | grep -v "uninstall\\.php" \\
+            | grep -v "class-peptide-news-activator\\.php" \\
+            | grep -v "class-peptide-news-logger\\.php" \\
+            | grep -v "DROP TABLE" \\
+            | grep -v "TRUNCATE" \\
+            && [ ${PIPESTATUS[0]} -eq 0 ]; then
+            echo "WARNING: Found potential unescaped SQL queries. Use wpdb->prepare() for all dynamic SQL."
+            exit 1
+          fi
+          echo ":: Checking for eval() usage..."
+          if grep -r "eval\\s*(" --include="*.php" --exclude-dir=vendor . 2>/dev/null; then
+            echo "ERROR: eval() found. This is a critical security risk."; exit 1
+          fi
+          echo ":: Checking for base64_decode without validation..."
+          if grep -r "base64_decode\\s*(" --include="*.php" --exclude-dir=vendor . 2>/dev/null; then
+            echo "WARNING: Found base64_decode(). Ensure the input is properly validated."
+          fi
+          echo ":: Checking for file_get_contents with user input..."
+          if grep -r "file_get_contents\\s*(\\s*\\$" --include="*.php" --exclude-dir=vendor . 2>/dev/null; then
+            echo "WARNING: Found file_get_contents with variable. Ensure input is validated and restricted."
+          fi
+          echo "All security checks passed."
+""",
+}
+EXTRA_JOB_ID = {"check-constants": "check-constants", "validate-psa-version": "validate",
+                "security-audit": "security-audit"}
+
+
+def render(name, cfg):
+    c = {**DEFAULTS, **cfg}
+    php = json.dumps(c["php_versions"])
+    out = [f"""# GENERATED by peptide-e2e/tools/gitea-pipeline/render.py from repos.json.
+# Do not edit by hand: change repos.json or the template and re-render.
+name: CI / Deploy
+
+on:
+  push:
+    branches: [main]
+  pull_request: {{}}
+  workflow_dispatch: {{}}
+
+concurrency:
+  group: pipeline-{name}-${{{{ github.ref }}}}
+  cancel-in-progress: false
+
+jobs:
+  lint-php:
+    name: PHP Lint (${{{{ matrix.php }}}})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php: {php}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: {A}/ci-lint-php@main
+        with:
+          php: ${{{{ matrix.php }}}}
+
+  phpcs:
+    name: PHPCS (WordPress standards)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{{{ github.head_ref || github.ref_name }}}}
+          token: ${{{{ secrets.GITHUB_TOKEN }}}}
+      - uses: {A}/ci-phpcs@main
+        with:
+          autofix: '{str(c["phpcs_autofix"]).lower()}'
+"""]
+    ci_jobs = ["lint-php", "phpcs"]
+    if c["enforce_300"]:
+        out.append(f"""
+  file-size:
+    name: 300-line rule ({c["line_limit_paths"]})
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: {A}/ci-file-size@main
+        with:
+          paths: {c["line_limit_paths"]}
+""")
+        ci_jobs.append("file-size")
+    if c["tests"] != "none":
+        svc = ""
+        if c["tests"] == "wp-framework":
+            svc = """    services:
+      mysql:
+        image: mysql:8.0
+        env:
+          MYSQL_ROOT_PASSWORD: root
+          MYSQL_DATABASE: wp_tests
+        # First-boot init took 3.5 min on the CPU-limited shared runner under load
+        # (GitHub's 5 x 10s window is far too short here). Data dir on tmpfs: the
+        # test DB is throwaway and disk I/O dominated the init time.
+        options: >-
+          --tmpfs /var/lib/mysql:rw
+          --health-cmd="mysqladmin ping"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-start-period=120s
+          --health-retries=30
+"""
+        out.append(f"""
+  phpunit:
+    name: PHPUnit - {c["tests"]} (PHP ${{{{ matrix.php }}}})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php: {php}
+{svc}    steps:
+      - uses: actions/checkout@v4
+      - uses: {A}/ci-phpunit@main
+        with:
+          php: ${{{{ matrix.php }}}}
+          tests: {c["tests"]}
+""")
+        ci_jobs.append("phpunit")
+    if c["has_js"]:
+        out.append(f"""
+  lint-js:
+    name: JS Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: {A}/ci-lint-js@main
+""")
+        ci_jobs.append("lint-js")
+    for x in c["extras"]:
+        out.append(EXTRAS[x])
+        ci_jobs.append(EXTRA_JOB_ID[x])
+    if c["target_path"]:
+        needs = json.dumps(ci_jobs)
+        deploy_with = f"""          target_path: {c["target_path"]}
+          ssh_private_key: ${{{{ secrets.SSH_PRIVATE_KEY }}}}
+          ssh_host: ${{{{ secrets.SSH_HOST }}}}
+          ssh_port: ${{{{ secrets.SSH_PORT }}}}
+          ssh_username: ${{{{ secrets.SSH_USERNAME }}}}"""
+        out.append(f"""
+  deploy-staging:
+    name: Deploy to staging
+    needs: {needs}
+    if: ${{{{ {MAIN_DEPLOY} }}}}
+    runs-on: peptide-vps
+    steps:
+      - uses: actions/checkout@v4
+      - uses: {A}/deploy@main
+        with:
+          stage: staging
+{deploy_with}
+
+  smoke:
+    name: Smoke tests (staging)
+    needs: deploy-staging
+    runs-on: peptide-vps
+    timeout-minutes: 15
+    steps:
+      - uses: {A}/smoke@main
+        with:
+          wp_admin_user: ${{{{ secrets.STAGING_WP_ADMIN_USER }}}}
+          wp_admin_password: ${{{{ secrets.STAGING_WP_ADMIN_PASSWORD }}}}
+
+  deploy-production:
+    name: Deploy to production
+    # Smoke is a gate: production runs only if staging deploy AND smoke succeeded.
+    # PROD_DEPLOY_ENABLED (org variable) is the cutover switch / kill switch.
+    needs: [deploy-staging, smoke]
+    if: ${{{{ vars.PROD_DEPLOY_ENABLED == 'true' && {MAIN_DEPLOY} }}}}
+    runs-on: peptide-vps
+    steps:
+      - uses: actions/checkout@v4
+      - uses: {A}/deploy@main
+        with:
+          stage: production
+{deploy_with}
+""")
+    if c["audit"]:
+        out.append(f"""
+  audit-direct-push:
+    name: Audit - commit came from a PR
+    if: ${{{{ {MAIN_PUSH} }}}}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: {A}/audit-direct-push@main
+        with:
+          token: ${{{{ secrets.GITHUB_TOKEN }}}}
+""")
+    return "".join(out).replace(
+        "    runs-on: ubuntu-latest\n",
+        f"    runs-on: ubuntu-latest\n    container: {CI_IMAGE}\n")
+
+
+if __name__ == "__main__":
+    repos = json.load(open(sys.argv[2] if len(sys.argv) > 2 else __file__.rsplit("/", 1)[0] + "/repos.json"))
+    name = sys.argv[1]
+    sys.stdout.write(render(name, repos[name]))

tools/gitea-pipeline/repos.json

@@ -0,0 +1,11 @@
+{
+  "_comment": "Per-repo pipeline settings. Edit here, then run render.py and commit the generated .gitea/workflows/pipeline.yml in each repo. Values mirror each repo's former GitHub ci.yml / deploy.yml inputs.",
+  "peptide-repo-core":                {"target_path": "wp-content/plugins/peptide-repo-core",                "tests": "stubs"},
+  "prautoblogger":                    {"target_path": "wp-content/plugins/prautoblogger",                    "tests": "brain-monkey", "extras": ["check-constants"]},
+  "peptide-search-ai":                {"target_path": "wp-content/plugins/peptide-search-ai",                "tests": "stubs", "has_js": true, "extras": ["validate-psa-version"]},
+  "peptide-starter-theme":            {"target_path": "wp-content/themes/peptide-starter",                   "tests": "wp-framework", "has_js": true, "line_limit_paths": "inc"},
+  "pr-vision":                        {"target_path": "wp-content/plugins/pr-vision",                        "tests": "stubs"},
+  "peptide-news-plugin":              {"target_path": "wp-content/plugins/peptide-news-plugin",              "tests": "stubs", "has_js": true, "extras": ["security-audit"]},
+  "peptide-reconstitution-calculator":{"target_path": "wp-content/plugins/peptide-reconstitution-calculator","tests": "stubs", "has_js": true},
+  "peptide-e2e":                      {"target_path": null, "tests": "none", "enforce_300": false, "phpcs_autofix": false, "audit": false}
+}