ci(review): drop panel to Haiku-only per QA A/B decision 2026-06-12

A/B analysis across 13 PRs (convo/cto/threads/2026-06-qa-ab-review/02-analyst-findings.md):
- DeepSeek: high false-positive rate (absint()="code exec", PLUGIN_DIR="dir traversal")
- Kimi: ~60% model failure rate, 1 unique-real finding in 13 PRs
- Neurometric: summarizer only, 0 unique-real findings, unreliable heuristic verdict label
- Haiku: 0 failures, lowest noise, equivalent real-signal catch vs 4-voice panel

Removes DeepSeek, Kimi, and Neurometric voices. Haiku is now sole reviewer.
Also removes NEUROMETRIC_API_KEY env var (no longer needed).
No plugin version bump -- CI-only change (precedent: prautoblogger #150).

Agent-Session: engineer-panel-haiku-20260612

.github/workflows/cto-review.yml

@@ -1,20 +1,17 @@
 name: CTO Review
 
-# Automated PR review powered by Claude + DeepSeek + Kimi (via OpenRouter)
+# Automated PR review powered by Claude Haiku (via OpenRouter).
-# plus Neurometric PR-Summarizer (a Qwen3-4B task-specialist SLM).
 #
-# During the A/B window (until further notice), every PR gets reviewed by FOUR models
+# A/B panel decision 2026-06-12: panel dropped to Haiku-only.
-# in parallel. The PR comment shows each model's verdict side-by-side so we can compare
+# Evidence: convo/cto/threads/2026-06-qa-ab-review/02-analyst-findings.md
-# quality/cost on real PRs before picking a permanent default.
+# DeepSeek: high false-positive rate (absint()="code exec", PLUGIN_DIR="dir traversal").
+# Kimi: ~60% model failure rate across 13 PRs sampled.
+# Neurometric: summarizer only, zero unique-real findings, unreliable heuristic verdict.
+# Haiku: 0 failures, lowest noise, equivalent real-signal catch rate vs 4-voice panel.
 #
-# Neurometric is a "prose voice": it does not support OpenAI tool-calling, so its
+# Does NOT merge. Posts formal APPROVE/REQUEST_CHANGES/COMMENT reviews.
-# contribution is raw markdown + a heuristic verdict. It is never the primary voice.
 #
-# Does NOT merge. Does NOT post formal APPROVE/REQUEST_CHANGES reviews — always COMMENT
+# Requires repo secret: OPENROUTER_API_KEY
-# (GITHUB_TOKEN can't formally approve PRs without repo-setting toggle).
-#
-# Requires repo secrets: OPENROUTER_API_KEY, NEUROMETRIC_API_KEY (optional; the
-# Neurometric voice self-skips with an inline error note if the key is missing).
 #
 # Cost cap: tracked in Repository Variables (CTO_REVIEW_SPEND_CENTS, CTO_REVIEW_CAP_CENTS).
 # Default cap is 1000 cents ($10/month). Auto-resets on the 1st of each month.
@@ -123,17 +120,18 @@ jobs:
           git fetch origin ${{ github.event.pull_request.base.ref }} --depth=50
           BASE_SHA="${{ github.event.pull_request.base.sha }}"
           HEAD_SHA="${{ github.event.pull_request.head.sha }}"
-          DIFF=$(git diff --no-color "$BASE_SHA" "$HEAD_SHA" | head -c 400000)
+          # Write the diff to a file, not a step output / env var. Passing a
+          # ~400KB diff through the process env (execve argv+envp) exceeds the
+          # runner ARG_MAX and fails the next step with "Argument list too long".
+          # File transport also sidesteps the ~1MB step-output cap.
+          git diff --no-color "$BASE_SHA" "$HEAD_SHA" | head -c 400000 > /tmp/cto-review-diff.txt
           FILES=$(git diff --name-only "$BASE_SHA" "$HEAD_SHA")
-          SIZE=$(echo -n "$DIFF" | wc -c)
+          SIZE=$(wc -c < /tmp/cto-review-diff.txt)
           {
             echo "size=$SIZE"
             echo "files<<EOF_FILES"
             echo "$FILES"
             echo "EOF_FILES"
-            echo "diff<<EOF_DIFF"
-            echo "$DIFF"
-            echo "EOF_DIFF"
           } >> "$GITHUB_OUTPUT"
 
       - name: Load repo conventions
@@ -150,18 +148,17 @@ jobs:
             echo "EOF_CONV"
           } >> "$GITHUB_OUTPUT"
 
-      - name: Call 4 models in parallel (OpenRouter + Neurometric)
+      - name: Call Haiku via OpenRouter
         if: steps.budget.outputs.skip != 'true'
         id: review
         env:
           OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
-          NEUROMETRIC_API_KEY: ${{ secrets.NEUROMETRIC_API_KEY }}
           PR_TITLE: ${{ github.event.pull_request.title }}
           PR_BODY: ${{ github.event.pull_request.body }}
           PR_AUTHOR: ${{ github.event.pull_request.user.login }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
           REPO_NAME: ${{ github.event.repository.name }}
-          DIFF: ${{ steps.diff.outputs.diff }}
+          DIFF_PATH: /tmp/cto-review-diff.txt
           DIFF_SIZE: ${{ steps.diff.outputs.size }}
           CHANGED_FILES: ${{ steps.diff.outputs.files }}
           CONVENTIONS: ${{ steps.conventions.outputs.content }}
@@ -183,24 +180,17 @@ jobs:
           fi
 
           python3 - <<'PY'
-          import json, os, sys, urllib.request, concurrent.futures
+          import json, os, sys, urllib.request
 
           api_key = os.environ["OPENROUTER_API_KEY"]
 
-          # A/B harness: four models. Each gets the same prompt.
+          # Haiku-only reviewer. A/B panel dropped 2026-06-12 per QA data:
-          # Primary model's verdict drives the heading. Others are labeled.
+          # DeepSeek high false-positive rate, Kimi ~60% failure rate,
-          # Edit this list to change the roster (or drop to 1 after A/B window closes).
+          # Neurometric zero unique-real findings. Haiku retained as sole voice.
-          #
+          MODEL_SLUG = "anthropic/claude-haiku-4.5"
-          # provider_type semantics:
+          MODEL_DISPLAY = "Claude Haiku 4.5"
-          #   - "openrouter_tools": OpenAI tool-calling via OpenRouter; structured verdict.
+          INPUT_PER_M_USD = 1.00
-          #   - "neurometric_prose": Neurometric marketplace SLM; prose output + heuristic verdict.
+          OUTPUT_PER_M_USD = 5.00
-          MODELS = [
-              # (slug, display name, input_per_M_USD, output_per_M_USD, is_primary, provider_type)
-              ("anthropic/claude-haiku-4.5",       "Claude Haiku 4.5",                     1.00, 5.00, True,  "openrouter_tools"),
-              ("deepseek/deepseek-chat-v3.1",      "DeepSeek V3.1",                        0.15, 0.75, False, "openrouter_tools"),
-              ("moonshotai/kimi-k2-thinking",      "Kimi K2 Thinking",                     0.60, 2.50, False, "openrouter_tools"),
-              ("neurometric/pr-summarizer",        "Neurometric PR-Summarizer (Qwen3-4B)", 0.00, 0.00, False, "neurometric_prose"),
-          ]
 
           system = """You are the CTO and lead reviewer for the peptiderepo project. You are reviewing a pull request opened by an autonomous agent or human contributor.
 
@@ -229,7 +219,9 @@ jobs:
           user_blocks.append(f"**Changed files:**\n```\n{os.environ['CHANGED_FILES']}\n```\n")
           if os.environ.get("CONVENTIONS", "").strip():
               user_blocks.append(f"# Repo CONVENTIONS.md\n{os.environ['CONVENTIONS']}\n")
-          user_blocks.append(f"# Diff\n```diff\n{os.environ['DIFF']}\n```\n")
+          with open(os.environ["DIFF_PATH"], encoding="utf-8", errors="replace") as _df:
+              _diff_text = _df.read()
+          user_blocks.append(f"# Diff\n```diff\n{_diff_text}\n```\n")
           user_message = "\n\n".join(user_blocks)
 
           tools = [{
@@ -261,32 +253,8 @@ jobs:
               }
           }]
 
-          PER_MODEL_TIMEOUT = 60  # seconds; one hung model should not block siblings
-
-          # Heuristic verdict inference for prose-voice models that can't do tool-calling.
-          # Keyword order matters: block markers beat approve markers.
-          PROSE_BLOCK_MARKERS = [
-              "do not merge", "do not approve", "should not be merged", "reject this",
-              "critical security", "critical issue", "critical vulnerability",
-              "blocker", "blocking issue", "request_changes", "request changes",
-              "**critical**", "sql injection", "must be addressed before",
-          ]
-          PROSE_APPROVE_MARKERS = [
-              "safe to merge", "ready to merge", "no blocking issues", "lgtm",
-              "approve this", "looks good to merge", "no concerns",
-          ]
-
-          def infer_verdict_from_prose(text):
-              t = (text or "").lower()
-              if any(m in t for m in PROSE_BLOCK_MARKERS):
-                  return "REQUEST_CHANGES"
-              if any(m in t for m in PROSE_APPROVE_MARKERS):
-                  return "APPROVE"
-              return "COMMENT"
-
-          def call_openrouter_tools(slug, display, in_rate, out_rate, is_primary):
           body = {
-                  "model": slug,
+              "model": MODEL_SLUG,
               "max_tokens": 2048,
               "messages": [
                   {"role": "system", "content": system},
@@ -302,177 +270,83 @@ jobs:
                   "Authorization": f"Bearer {api_key}",
                   "content-type": "application/json",
                   "HTTP-Referer": "https://github.com/peptiderepo",
-                      "X-Title": f"peptiderepo CTO reviewer ({display})"
+                  "X-Title": f"peptiderepo CTO reviewer ({MODEL_DISPLAY})"
               },
               method="POST"
           )
+
+          error = None
+          review = None
+          cost_cents = 0.0
+          ptok = 0
+          ctok = 0
+
           try:
-                  with urllib.request.urlopen(req, timeout=PER_MODEL_TIMEOUT) as resp:
+              with urllib.request.urlopen(req, timeout=60) as resp:
                   data = json.loads(resp.read())
           except Exception as e:
-                  return {
+              error = str(e)[:300]
-                      "slug": slug, "display": display, "is_primary": is_primary,
+              data = {}
-                      "provider_type": "openrouter_tools",
-                      "error": str(e)[:300],
-                      "cost_cents": 0,
-                  }
 
+          if not error:
               choice = data.get("choices", [{}])[0].get("message", {})
               tool_calls = choice.get("tool_calls", [])
               if not tool_calls:
-                  return {
+                  error = f"No tool_call in response. Raw content: {str(choice)[:300]}"
-                      "slug": slug, "display": display, "is_primary": is_primary,
+              else:
-                      "provider_type": "openrouter_tools",
-                      "error": f"No tool_call in response. Raw content: {str(choice)[:300]}",
-                      "cost_cents": 0,
-                  }
-
                   try:
                       review = json.loads(tool_calls[0]["function"]["arguments"])
                   except Exception as e:
-                  return {
+                      error = f"Malformed tool args: {e}"
-                      "slug": slug, "display": display, "is_primary": is_primary,
-                      "provider_type": "openrouter_tools",
-                      "error": f"Malformed tool args: {e}",
-                      "cost_cents": 0,
-                  }
 
+              if not error:
                   usage = data.get("usage", {})
                   ptok = usage.get("prompt_tokens", 0)
                   ctok = usage.get("completion_tokens", 0)
-              cost_usd = (ptok * in_rate / 1_000_000) + (ctok * out_rate / 1_000_000)
+                  cost_usd = (ptok * INPUT_PER_M_USD / 1_000_000) + (ctok * OUTPUT_PER_M_USD / 1_000_000)
                   cost_cents = cost_usd * 100
-              return {
-                  "slug": slug, "display": display, "is_primary": is_primary,
-                  "provider_type": "openrouter_tools",
-                  "review": review, "prompt_tokens": ptok, "completion_tokens": ctok,
-                  "cost_cents": cost_cents,
-              }
-
-          def call_neurometric_prose(slug, display, is_primary):
-              nm_key = os.environ.get("NEUROMETRIC_API_KEY", "")
-              if not nm_key:
-                  return {
-                      "slug": slug, "display": display, "is_primary": is_primary,
-                      "provider_type": "neurometric_prose",
-                      "error": "NEUROMETRIC_API_KEY secret not set on this repo",
-                      "cost_cents": 0,
-                  }
-              body = {
-                  "model": slug,
-                  "max_tokens": 2048,
-                  "messages": [
-                      {"role": "system", "content": system},
-                      {"role": "user", "content": user_message},
-                  ],
-              }
-              req = urllib.request.Request(
-                  "https://api.neurometric.ai/v1/chat/completions",
-                  data=json.dumps(body).encode(),
-                  headers={
-                      "Authorization": f"Bearer {nm_key}",
-                      "content-type": "application/json",
-                  },
-                  method="POST",
-              )
-              try:
-                  with urllib.request.urlopen(req, timeout=PER_MODEL_TIMEOUT) as resp:
-                      data = json.loads(resp.read())
-              except Exception as e:
-                  return {
-                      "slug": slug, "display": display, "is_primary": is_primary,
-                      "provider_type": "neurometric_prose",
-                      "error": str(e)[:300],
-                      "cost_cents": 0,
-                  }
-              prose = data.get("choices", [{}])[0].get("message", {}).get("content") or ""
-              verdict = infer_verdict_from_prose(prose)
-              return {
-                  "slug": slug, "display": display, "is_primary": is_primary,
-                  "provider_type": "neurometric_prose",
-                  "review": {"verdict": verdict, "prose": prose},
-                  "prompt_tokens": 0, "completion_tokens": 0,
-                  "cost_cents": 0,
-              }
-
-          def call_model(slug, display, in_rate, out_rate, is_primary, provider_type="openrouter_tools"):
-              if provider_type == "neurometric_prose":
-                  return call_neurometric_prose(slug, display, is_primary)
-              return call_openrouter_tools(slug, display, in_rate, out_rate, is_primary)
-
-          results = []
-          with concurrent.futures.ThreadPoolExecutor(max_workers=len(MODELS)) as pool:
-              futures = [pool.submit(call_model, *m) for m in MODELS]
-              for f in concurrent.futures.as_completed(futures):
-                  results.append(f.result())
-
-          # Order: primary first, then alphabetical for stable comparison
-          results.sort(key=lambda r: (not r.get("is_primary"), r["display"]))
-
-          # Build combined comment
-          primary = next((r for r in results if r.get("is_primary") and "review" in r), None)
-          heading_verdict = primary["review"]["verdict"] if primary else "MIXED"
 
+          # Build comment
+          if error:
+              heading_verdict = "ERROR"
               lines = [f"## CTO Review — {heading_verdict}", ""]
-          lines.append(f"_A/B harness active: {len(results)} models reviewing in parallel. Primary verdict drives heading; others are advisory._")
+              lines.append(f"Model failed: `{error}`")
               lines.append("")
-
+              lines.append(f"_reviewer: {MODEL_DISPLAY}_")
-          total_cents = 0.0
+          else:
-          for r in results:
+              heading_verdict = review.get("verdict", "COMMENT")
-              lines.append(f"---")
+              lines = [f"## CTO Review — {heading_verdict}", ""]
-              primary_tag = " (primary)" if r.get("is_primary") else ""
+              lines.append(f"**Verdict:** {heading_verdict}")
-              lines.append(f"### {r['display']}{primary_tag}")
-              if "error" in r:
               lines.append("")
-                  lines.append(f"⚠️ Model failed: `{r['error']}`")
+              lines.append(review.get("summary") or "_(model returned no summary)_")
               lines.append("")
-                  continue
+              if review.get("concerns"):
-              rev = r["review"]
-              lines.append("")
-              if r.get("provider_type") == "neurometric_prose":
-                  lines.append(f"**Verdict:** {rev['verdict']} _(heuristic, inferred from prose)_")
-                  lines.append("")
-                  # Cap at 6KB to keep PR comments readable; 4B model output is rarely over this
-                  prose = rev.get("prose", "")
-                  if len(prose) > 6000:
-                      prose = prose[:6000] + "\n\n_…output truncated for comment length…_"
-                  lines.append(prose)
-                  lines.append("")
-                  lines.append("_free tier; per-call token usage not tracked_")
-                  lines.append("")
-                  continue
-              lines.append(f"**Verdict:** {rev.get('verdict', 'COMMENT')}")
-              lines.append("")
-              lines.append(rev.get("summary") or "_(model returned no summary)_")
-              lines.append("")
-              if rev.get("concerns"):
                   lines.append("**Concerns:**")
-                  for c in rev["concerns"]:
+                  for c in review["concerns"]:
-                      sev = c["severity"].upper()
+                      sev = c.get("severity", "UNKNOWN").upper()
                       f = f"`{c['file']}`" if c.get("file") else ""
                       lines.append(f"- **{sev}** {f} — {c['issue']}")
                   lines.append("")
-              if rev.get("positives"):
+              if review.get("positives"):
-                  lines.append("**Positives:** " + "; ".join(rev["positives"]))
+                  lines.append("**Positives:** " + "; ".join(review["positives"]))
                   lines.append("")
-              lines.append(f"_tokens in/out: {r['prompt_tokens']}/{r['completion_tokens']} · cost: ${r['cost_cents']/100:.4f}_")
+              lines.append(f"_tokens in/out: {ptok}/{ctok} · cost: ${cost_cents/100:.4f}_")
-              total_cents += r["cost_cents"]
               lines.append("")
 
           lines.append("---")
-          lines.append(f"_Total review cost: **${total_cents/100:.4f}**. A/B roster configured in `.github/workflows/cto-review.yml`._")
+          lines.append(f"_Total review cost: **${cost_cents/100:.4f}**. Reviewer: {MODEL_DISPLAY}. Roster configured in `.github/workflows/cto-review.yml`._")
 
           with open("/tmp/review-body.md", "w") as f:
               f.write("\n".join(lines))
           with open(os.environ["GITHUB_OUTPUT"], "a") as f:
-              f.write(f"added_cents={int(round(total_cents))}\n")
+              f.write(f"added_cents={int(round(cost_cents))}\n")
               f.write(f"skipped=0\n")
               f.write(f"primary_verdict={heading_verdict}\n")
           PY
 
       - name: Post PR review (formal APPROVE / REQUEST_CHANGES / COMMENT)
-        # Uses primary model's verdict as the formal event. Falls back to COMMENT
+        # Uses Haiku's verdict as the formal event. Falls back to COMMENT
-        # if the primary model failed or returned something unexpected.
+        # if the model failed or returned something unexpected.
         if: steps.budget.outputs.skip != 'true' && steps.review.outputs.skipped != '1'
         uses: actions/github-script@v7
         env:

.github/workflows/deploy.yml

@@ -16,88 +16,10 @@ jobs:
     name: Pre-deploy CI
     uses: ./.github/workflows/ci.yml
 
-  deploy-staging:
+  deploy:
-    name: Deploy to Staging
+    name: Deploy (shared pipeline)
     needs: ci
-    runs-on: ubuntu-latest
+    uses: peptiderepo/peptide-e2e/.github/workflows/deploy-app.yml@main
-    environment: staging
+    with:
-    steps:
+      target_path: wp-content/plugins/peptide-repo-core
-      - uses: actions/checkout@v4
+    secrets: inherit
-      - name: Setup SSH key
-        run: |
-          mkdir -p ~/.ssh
-          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
-          chmod 600 ~/.ssh/deploy_key
-          ssh-keyscan -p ${{ secrets.SSH_PORT }} ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
-      - name: Deploy via rsync → staging
-        run: |
-          rsync -avz --delete \
-            --exclude '.git' --exclude '.github' \
-            --exclude 'tests' --exclude 'phpunit.xml.dist' \
-            --exclude 'composer.json' --exclude 'composer.lock' \
-            --exclude 'vendor' --exclude 'phpcs.xml.dist' \
-            --exclude 'ARCHITECTURE.md' --exclude 'CONVENTIONS.md' --exclude 'CHANGELOG.md' \
-            -e "ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }}" \
-            ./ ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:~/domains/peptiderepo.com/public_html/staging/wp-content/plugins/peptide-repo-core/
-      - name: Staging health check
-        run: |
-          sleep 5
-          STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://staging.peptiderepo.com/ || echo "000")
-          echo "Staging responded: HTTP $STATUS"
-      - name: Cleanup
-        if: always()
-        run: rm -f ~/.ssh/deploy_key
-
-  smoke:
-    name: Smoke tests (staging)
-    needs: deploy-staging
-    uses: peptiderepo/peptide-e2e/.github/workflows/smoke.yml@main
-    secrets:
-      STAGING_WP_ADMIN_USER: ${{ secrets.STAGING_WP_ADMIN_USER }}
-      STAGING_WP_ADMIN_PASSWORD: ${{ secrets.STAGING_WP_ADMIN_PASSWORD }}
-
-  deploy-production:
-    name: Deploy to Production
-    needs: [ci, deploy-staging, smoke]
-    runs-on: ubuntu-latest
-    environment: production
-    steps:
-      - uses: actions/checkout@v4
-      - name: Setup SSH key
-        run: |
-          mkdir -p ~/.ssh
-          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
-          chmod 600 ~/.ssh/deploy_key
-          ssh-keyscan -p ${{ secrets.SSH_PORT }} ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
-      - name: Deploy via rsync → production
-        run: |
-          rsync -avz --delete \
-            --exclude '.git' --exclude '.github' \
-            --exclude 'tests' --exclude 'phpunit.xml.dist' \
-            --exclude 'composer.json' --exclude 'composer.lock' \
-            --exclude 'vendor' --exclude 'phpcs.xml.dist' \
-            --exclude 'ARCHITECTURE.md' --exclude 'CONVENTIONS.md' --exclude 'CHANGELOG.md' \
-            -e "ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }}" \
-            ./ ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:~/domains/peptiderepo.com/public_html/wp-content/plugins/peptide-repo-core/
-      - name: Purge LiteSpeed Cache
-        run: |
-          ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} \
-            ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }} \
-            "cd ~/domains/peptiderepo.com/public_html && find wp-content/litespeed/ -type f -delete 2>/dev/null; touch .lscache_purge 2>/dev/null || true"
-      - name: Production health check
-        run: |
-          sleep 5
-          STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://peptiderepo.com)
-          if [ "$STATUS" != "200" ] && [ "$STATUS" != "403" ]; then
-            echo "ERROR: Site returned HTTP $STATUS"
-            exit 1
-          fi
-          echo "Production healthy (HTTP $STATUS)"
-      - name: Cleanup
-        if: always()
-        run: rm -f ~/.ssh/deploy_key
-      - name: Deploy summary
-        run: |
-          echo "## Deployment Complete" >> $GITHUB_STEP_SUMMARY
-          echo "- **Commit:** \`${GITHUB_SHA::7}\`" >> $GITHUB_STEP_SUMMARY
-          echo "- **Deployed to:** peptiderepo.com" >> $GITHUB_STEP_SUMMARY

.github/workflows/main-push-audit.yml

@@ -29,12 +29,22 @@ jobs:
         with:
           script: |
             const sha = context.sha;
+            // Squash-merge -> PR association is eventually-consistent; poll briefly
+            // before concluding this was a direct push (avoids false positives on merges).
+            async function findMergedPR() {
+              for (let attempt = 1; attempt <= 5; attempt++) {
                 const { data: prs } = await github.rest.repos.listPullRequestsAssociatedWithCommit({
                   owner: context.repo.owner,
                   repo: context.repo.repo,
                   commit_sha: sha,
                 });
-            const merged = prs.find(p => p.merged_at);
+                const m = prs.find(p => p.merged_at);
+                if (m) return m;
+                if (attempt < 5) await new Promise(r => setTimeout(r, 10000));
+              }
+              return null;
+            }
+            const merged = await findMergedPR();
             if (merged) {
               core.info(`OK: commit ${sha.substring(0,7)} came from PR #${merged.number}`);
               return;

ARCHITECTURE.md

@@ -69,7 +69,11 @@ peptide-repo-core/
 │   ├── class-pr-core-seed-data.php    # Dev fixture: 3 peptides, 10 dosing rows, 5 legal cells
 │   │
 │   ├── cpt/
-│   │   └── class-pr-core-peptide-cpt.php  # CPT + peptide_category registration (guarded), meta fields, sanitizers
+│   │   ├── class-pr-core-peptide-cpt.php       # CPT + peptide_category registration (guarded), meta fields, sanitizers
+│   │   └── class-pr-core-repo-daily-cpt.php    # Repo Daily CPT registration for editorial content
+│   │
+│   ├── taxonomies/
+│   │   └── class-pr-core-repo-daily-taxonomy.php  # repo_daily_category taxonomy + term seeding
 │   │
 │   ├── migrations/
 │   │   ├── class-pr-core-migration-runner.php           # Sequential migration engine
@@ -92,6 +96,7 @@ peptide-repo-core/
 │   ├── admin/
 │   │   ├── class-pr-core-admin.php                    # Admin initialization, menu, styles
 │   │   ├── class-pr-core-peptide-metaboxes.php        # Identifiers, dosing, legal meta boxes
+│   │   ├── class-pr-core-repo-daily-metaboxes.php     # Author byline and clinical review flag meta boxes
 │   │   ├── class-pr-core-admin-columns.php            # Evidence, editorial, dosing count columns
 │   │   └── class-pr-core-candidate-queue-page.php     # AI candidate review admin screen
 │   │
@@ -110,6 +115,17 @@ peptide-repo-core/
 
 ---
 
+## Content Types
+
+| CPT | Slug | Taxonomy | Purpose | Registrant |
+|-----|------|----------|---------|-----------|
+| `peptide` | `/peptides/[slug]/` | `peptide_category` | Canonical peptide monographs with dosing, legal, evidence metadata | PR Core v0.2.0 (consolidated from PSA) |
+| `repo_daily` | `/daily/[slug]/` | `repo_daily_category` | Editorial publications (articles, guides, comparisons, news) generated by PRAutoBlogger, published under Boo Sheeran byline | PR Core v0.5.0 |
+
+**Verification scanner scope:** The verification scanner (class-pr-core-verification-scanner.php) queries `post_type=peptide` only. `repo_daily` posts are excluded automatically by CPT separation and do not appear in the overdue queue.
+
+---
+
 ## Custom Tables
 
 ### `{prefix}pr_dosing_rows`

CHANGELOG.md

@@ -3,6 +3,29 @@
 All notable changes to Peptide Repo Core are documented here.
 Format: [Semantic Versioning](https://semver.org/).
 
+## [0.5.0] — 2026-04-27
+
+### Added
+- **Repo Daily CPT**: New `repo_daily` custom post type at `/daily/[slug]/` for editorial publications (articles, guides, comparisons, news) generated by PRAutoBlogger and published under the Boo Sheeran byline.
+- **Repo Daily Category Taxonomy**: Non-hierarchical `repo_daily_category` taxonomy with four seeded terms (article, guide, comparison, news) for editorial classification.
+- **Repo Daily Meta Fields**:
+  - `_repo_daily_author` (string, default "Boo Sheeran") — byline displayed in theme templates. Never hardcoded; always read from meta.
+  - `_repo_daily_clinical_review_required` (bool, stored as '1'/'') — editorial flag marking posts that require PR Clinical Review before publication.
+- **Repo Daily Admin Meta Box**: "Article Settings" meta box on repo_daily edit screen with author byline field and clinical review flag checkbox.
+- **Bulk Author Migration**: On activation, sets `_repo_daily_author = 'Boo Sheeran'` on all post_type=post posts bearing the psa_source meta key (autoblogged articles). Idempotent; existing meta values preserved. Posts remain post_type=post; forward-only migration for byline retroactivity.
+
+### Changed
+- `PR_Core_Admin::register_hooks()` now registers repo_daily metaboxes alongside peptide metaboxes.
+
+### Technical
+- New classes: `PR_Core_Repo_Daily_CPT`, `PR_Core_Repo_Daily_Taxonomy`, `PR_Core_Repo_Daily_Metaboxes`.
+- New method: `PR_Core_Activator::migrate_autoblogged_author_meta()` — idempotent bulk meta setter.
+- Taxonomy seeding: `PR_Core_Repo_Daily_Taxonomy::seed_terms()` called on activation.
+
+### Documentation
+- ARCHITECTURE.md: Added repo_daily CPT to content-type table; documented scanner exclusion by CPT separation.
+- CONVENTIONS.md: Added "How to add a new post meta field to repo_daily posts" extension pattern.
+
 ## [0.4.0] — 2026-04-27
 
 ### Added

CONVENTIONS.md

@@ -14,7 +14,7 @@
 Autoloader convention: `PR_Core_Foo_Bar` maps to `class-pr-core-foo-bar.php`.
 Files live in `includes/` or one level of subdirectory under `includes/`.
 
-## How To: Add a New Post-Meta Field
+## How To: Add a New Post-Meta Field to Peptide Posts
 
 1. Add the field to `PR_Core_Peptide_CPT::get_meta_fields()` in `cpt/class-pr-core-peptide-cpt.php`.
 2. Add the field to `PR_Core_Peptide_DTO` constructor and `to_array()` in `dto/class-pr-core-peptide-dto.php`.
@@ -22,6 +22,13 @@ Files live in `includes/` or one level of subdirectory under `includes/`.
 4. Add a form input in `PR_Core_Peptide_Metaboxes::render_identifiers_box()` in `admin/class-pr-core-peptide-metaboxes.php`.
 5. The `save_meta()` method reads from the same field list — no changes needed unless custom save logic applies.
 
+## How To: Add a New Post-Meta Field to Repo Daily Posts
+
+1. Define the meta key (start with `_repo_daily_`) and sanitization logic (use `sanitize_text_field()` for strings, cast to bool for checkboxes).
+2. Create a new metabox or extend `PR_Core_Repo_Daily_Metaboxes::render_meta_box()` in `admin/class-pr-core-repo-daily-metaboxes.php`.
+3. In `PR_Core_Repo_Daily_Metaboxes::save_meta()`, handle the field: read from `$_POST`, sanitize, and call `update_post_meta()`.
+4. Example: The `_repo_daily_clinical_review_required` checkbox checks for `isset( $_POST['key'] )` and stores `'1'` or `''`; `get_post_meta()` is type-safe because the value is always one of two strings, never a bool.
+
 ## How To: Add a New Migration
 
 1. Create `includes/migrations/class-pr-core-migration-NNNN-description.php`.

includes/admin/class-pr-core-admin.php

@@ -34,6 +34,11 @@ class PR_Core_Admin {
 		add_filter( 'manage_' . PR_Core_Peptide_CPT::POST_TYPE . '_posts_columns', [ $columns, 'add_columns' ] );
 		add_action( 'manage_' . PR_Core_Peptide_CPT::POST_TYPE . '_posts_custom_column', [ $columns, 'render_column' ], 10, 2 );
 
+		// Repo Daily meta boxes.
+		$repo_daily_metaboxes = new PR_Core_Repo_Daily_Metaboxes();
+		add_action( 'add_meta_boxes', [ $repo_daily_metaboxes, 'add_meta_boxes' ] );
+		add_action( 'save_post_' . PR_Core_Repo_Daily_CPT::POST_TYPE, [ $repo_daily_metaboxes, 'save_meta' ], 10, 2 );
+
 		add_action( 'admin_menu', [ $this, 'add_admin_pages' ] );
 		add_action( 'admin_enqueue_scripts', [ $this, 'enqueue_admin_styles' ] );
 	}

includes/admin/class-pr-core-repo-daily-metaboxes.php

@@ -0,0 +1,113 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Meta boxes for Repo Daily edit screen: author and clinical review flag.
+ *
+ * What: Renders and saves two meta fields on the repo_daily edit screen.
+ * Who calls it: PR_Core_Admin via add_meta_boxes and save_post hooks.
+ * Dependencies: None.
+ *
+ * Meta fields:
+ * - `_repo_daily_author` (string, default "Boo Sheeran") — byline displayed in templates.
+ * - `_repo_daily_clinical_review_required` (bool, stored as '1'/'') — editorial flag.
+ *
+ * @see admin/class-pr-core-admin.php — Registers these hooks.
+ * @see cpt/class-pr-core-repo-daily-cpt.php — CPT definition.
+ */
+class PR_Core_Repo_Daily_Metaboxes {
+
+	/** @var string Default author byline for Repo Daily articles. */
+	private const DEFAULT_AUTHOR = 'Boo Sheeran';
+
+	/**
+	 * Register meta box on the repo_daily edit screen.
+	 *
+	 * @return void
+	 */
+	public function add_meta_boxes(): void {
+		add_meta_box(
+			'pr-core-repo-daily-meta',
+			__( 'Article Settings', 'peptide-repo-core' ),
+			[ $this, 'render_meta_box' ],
+			PR_Core_Repo_Daily_CPT::POST_TYPE,
+			'normal',
+			'default'
+		);
+	}
+
+	/**
+	 * Render the Article Settings meta box.
+	 *
+	 * @param \WP_Post $post Current post.
+	 * @return void
+	 */
+	public function render_meta_box( \WP_Post $post ): void {
+		wp_nonce_field( 'pr_core_repo_daily_meta', 'pr_core_repo_daily_nonce' );
+
+		$author = sanitize_text_field(
+			get_post_meta( $post->ID, '_repo_daily_author', true ) ?: self::DEFAULT_AUTHOR
+		);
+		$requires_review = get_post_meta( $post->ID, '_repo_daily_clinical_review_required', true );
+
+		echo '<table class="form-table pr-core-meta-table">';
+
+		// Author field.
+		printf(
+			'<tr><th><label for="pr_core_repo_daily_author">%s</label></th><td><input type="text" id="pr_core_repo_daily_author" name="pr_core_repo_daily_author" value="%s" class="regular-text" /></td></tr>',
+			esc_html__( 'Author / Byline', 'peptide-repo-core' ),
+			esc_attr( $author )
+		);
+
+		// Clinical review flag.
+		printf(
+			'<tr><th><label for="pr_core_repo_daily_clinical_review_required">%s</label></th><td><input type="checkbox" id="pr_core_repo_daily_clinical_review_required" name="pr_core_repo_daily_clinical_review_required" value="1" %s /> <span class="description">%s</span></td></tr>',
+			esc_html__( 'Clinical Review Required', 'peptide-repo-core' ),
+			checked( $requires_review, '1', false ),
+			esc_html__( 'Flag for PR Clinical Review before publish', 'peptide-repo-core' )
+		);
+
+		echo '</table>';
+	}
+
+	/**
+	 * Save repo_daily meta fields on post save.
+	 *
+	 * Side effects: updates post meta.
+	 *
+	 * @param int      $post_id Post ID.
+	 * @param \WP_Post $post    Post object.
+	 * @return void
+	 */
+	public function save_meta( int $post_id, \WP_Post $post ): void {
+		if ( ! isset( $_POST['pr_core_repo_daily_nonce'] ) ) {
+			return;
+		}
+
+		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['pr_core_repo_daily_nonce'] ) ), 'pr_core_repo_daily_meta' ) ) {
+			return;
+		}
+
+		if ( ! current_user_can( 'edit_posts' ) ) {
+			return;
+		}
+
+		if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) {
+			return;
+		}
+
+		// Save author field.
+		if ( isset( $_POST['pr_core_repo_daily_author'] ) ) {
+			$author = sanitize_text_field( wp_unslash( $_POST['pr_core_repo_daily_author'] ) );
+			// Use default if empty.
+			if ( empty( $author ) ) {
+				$author = self::DEFAULT_AUTHOR;
+			}
+			update_post_meta( $post_id, '_repo_daily_author', $author );
+		}
+
+		// Save clinical review flag.
+		$requires_review = isset( $_POST['pr_core_repo_daily_clinical_review_required'] ) ? '1' : '';
+		update_post_meta( $post_id, '_repo_daily_clinical_review_required', $requires_review );
+	}
+}

includes/class-pr-core-activator.php

@@ -37,9 +37,17 @@ class PR_Core_Activator {
 		PR_Core_Peptide_CPT::register_peptide_post_type();
 		PR_Core_Peptide_CPT::register_taxonomies();
 
+		// Register repo_daily CPT and taxonomy + seed terms.
+		PR_Core_Repo_Daily_CPT::register_post_type();
+		PR_Core_Repo_Daily_Taxonomy::register_taxonomy();
+		PR_Core_Repo_Daily_Taxonomy::seed_terms();
+
 		// Grant manage_peptide_content to administrators and editors.
 		self::add_capabilities();
 
+		// Bulk-set _repo_daily_author on existing posts with psa_source meta.
+		self::migrate_autoblogged_author_meta();
+
 		// Flush rewrite rules for the new CPT.
 		flush_rewrite_rules( false );
 
@@ -94,4 +102,58 @@ class PR_Core_Activator {
 			}
 		}
 	}
+
+	/**
+	 * Bulk-set _repo_daily_author on autoblogged posts.
+	 *
+	 * Sets `_repo_daily_author = 'Boo Sheeran'` on all post_type=post posts
+	 * that have the psa_source meta key present (identifying them as autoblogged).
+	 * Idempotent: skips posts that already have the meta set.
+	 *
+	 * Side effects: updates post meta in database.
+	 *
+	 * @return void
+	 */
+	private static function migrate_autoblogged_author_meta(): void {
+		global $wpdb;
+
+		// Query all posts of type 'post' that have the psa_source meta key.
+		// phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery
+		// phpcs:disable WordPress.DB.DirectDatabaseQuery.NoCaching
+		$post_ids = $wpdb->get_col(
+			$wpdb->prepare(
+				"SELECT DISTINCT pm.post_id
+				 FROM {$wpdb->postmeta} pm
+				 WHERE pm.meta_key = %s
+				 AND pm.post_id IN (
+					SELECT ID FROM {$wpdb->posts}
+					WHERE post_type = %s
+				 )",
+				'psa_source',
+				'post'
+			)
+		);
+		// phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery
+		// phpcs:enable WordPress.DB.DirectDatabaseQuery.NoCaching
+
+		if ( empty( $post_ids ) ) {
+			return;
 		}
+
+		$author_value = 'Boo Sheeran';
+
+		foreach ( $post_ids as $post_id ) {
+			$post_id = (int) $post_id;
+
+			// Skip if already set (idempotent).
+			$existing = get_post_meta( $post_id, '_repo_daily_author', true );
+			if ( ! empty( $existing ) ) {
+				continue;
+			}
+
+			// Set the author meta.
+			update_post_meta( $post_id, '_repo_daily_author', $author_value );
+		}
+	}
+}
+

includes/class-pr-core.php

@@ -35,6 +35,14 @@ class PR_Core {
 		$topic_tax = new PR_Core_Topic_Taxonomy();
 		$topic_tax->register_hooks();
 
+		// Register repo_daily CPT (fires on init).
+		$repo_daily_cpt = new PR_Core_Repo_Daily_CPT();
+		$repo_daily_cpt->register_hooks();
+
+		// Register repo_daily_category taxonomy (fires on init).
+		$repo_daily_tax = new PR_Core_Repo_Daily_Taxonomy();
+		$repo_daily_tax->register_hooks();
+
 		// One-shot rewrite flush on in-place version bumps. Runs at the very
 		// end of init (priority 999) so all CPTs/taxonomies — ours and
 		// anyone else's — are registered first. Handles updates deployed

includes/cpt/class-pr-core-repo-daily-cpt.php

@@ -0,0 +1,80 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Registers the repo_daily custom post type for editorial publications.
+ *
+ * What: Defines the `repo_daily` CPT for articles, guides, comparisons, and news
+ *       generated by PRAutoBlogger and published under the Boo Sheeran byline.
+ * Who calls it: PR_Core::init() on plugins_loaded.
+ * Dependencies: None.
+ *
+ * Posts register at /daily/[slug]/ with title, editor, excerpt, thumbnail,
+ * and custom-fields support. REST-enabled for programmatic access by
+ * PRAutoBlogger and other integrations.
+ *
+ * @see ARCHITECTURE.md — Repo Daily type specification.
+ * @see CONVENTIONS.md — CPT ownership and extension patterns.
+ */
+class PR_Core_Repo_Daily_CPT {
+
+	/** @var string Post type slug (repo_daily). */
+	public const POST_TYPE = 'repo_daily';
+
+	/**
+	 * Register WordPress hooks for CPT registration.
+	 *
+	 * @return void
+	 */
+	public function register_hooks(): void {
+		add_action( 'init', [ __CLASS__, 'register_post_type' ] );
+	}
+
+	/**
+	 * Register the `repo_daily` custom post type.
+	 *
+	 * Side effects: registers CPT with WordPress.
+	 *
+	 * @return void
+	 */
+	public static function register_post_type(): void {
+		if ( post_type_exists( self::POST_TYPE ) ) {
+			return;
+		}
+
+		$labels = [
+			'name'               => __( 'Repo Daily', 'peptide-repo-core' ),
+			'singular_name'      => __( 'Repo Daily', 'peptide-repo-core' ),
+			'add_new_item'       => __( 'Add New Article', 'peptide-repo-core' ),
+			'edit_item'          => __( 'Edit Article', 'peptide-repo-core' ),
+			'new_item'           => __( 'New Article', 'peptide-repo-core' ),
+			'view_item'          => __( 'View Article', 'peptide-repo-core' ),
+			'search_items'       => __( 'Search Articles', 'peptide-repo-core' ),
+			'not_found'          => __( 'No articles found', 'peptide-repo-core' ),
+			'not_found_in_trash' => __( 'No articles found in trash', 'peptide-repo-core' ),
+			'all_items'          => __( 'All Articles', 'peptide-repo-core' ),
+			'menu_name'          => __( 'Repo Daily', 'peptide-repo-core' ),
+		];
+
+		$args = [
+			'labels'             => $labels,
+			'public'             => true,
+			'publicly_queryable' => true,
+			'show_ui'            => true,
+			'show_in_menu'       => true,
+			'show_in_nav_menus'  => true,
+			'show_in_rest'       => true,
+			'rest_base'          => 'repo_daily',
+			'menu_position'      => 6,
+			'menu_icon'          => 'dashicons-edit-page',
+			'capability_type'    => 'post',
+			'map_meta_cap'       => true,
+			'hierarchical'       => false,
+			'has_archive'        => true,
+			'rewrite'            => [ 'slug' => 'daily', 'with_front' => false ],
+			'supports'           => [ 'title', 'editor', 'excerpt', 'thumbnail', 'custom-fields' ],
+		];
+
+		register_post_type( self::POST_TYPE, $args );
+	}
+}

includes/taxonomies/class-pr-core-repo-daily-taxonomy.php

@@ -0,0 +1,78 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Registers the repo_daily_category taxonomy for Repo Daily articles.
+ *
+ * What: Defines the `repo_daily_category` taxonomy attached to repo_daily CPT.
+ *       Seeds four content categories on activation: article, guide, comparison, news.
+ * Who calls it: PR_Core::init() on plugins_loaded; activation hook seeding.
+ * Dependencies: None.
+ *
+ * Non-hierarchical taxonomy with REST support. Used by editorial and publishing
+ * workflows to categorize Repo Daily content.
+ *
+ * @see ARCHITECTURE.md — Content type taxonomy specification.
+ * @see CONVENTIONS.md — Taxonomy ownership pattern.
+ */
+class PR_Core_Repo_Daily_Taxonomy {
+
+	/** @var string Taxonomy: repo_daily_category. */
+	public const TAX_CATEGORY = 'repo_daily_category';
+
+	/**
+	 * Register WordPress hooks for taxonomy and seeding.
+	 *
+	 * @return void
+	 */
+	public function register_hooks(): void {
+		add_action( 'init', [ __CLASS__, 'register_taxonomy' ] );
+	}
+
+	/**
+	 * Register the `repo_daily_category` taxonomy.
+	 *
+	 * Side effects: registers taxonomy with WordPress.
+	 *
+	 * @return void
+	 */
+	public static function register_taxonomy(): void {
+		if ( taxonomy_exists( self::TAX_CATEGORY ) ) {
+			return;
+		}
+
+		register_taxonomy( self::TAX_CATEGORY, PR_Core_Repo_Daily_CPT::POST_TYPE, [
+			'labels'             => [
+				'name'          => __( 'Category', 'peptide-repo-core' ),
+				'singular_name' => __( 'Category', 'peptide-repo-core' ),
+			],
+			'public'             => true,
+			'publicly_queryable' => true,
+			'show_in_rest'       => true,
+			'show_ui'            => true,
+			'show_admin_column'  => true,
+			'hierarchical'       => false,
+			'rewrite'            => [ 'slug' => 'daily/category', 'with_front' => false ],
+		] );
+	}
+
+	/**
+	 * Seed default category terms on activation.
+	 *
+	 * Idempotent: checks for existence of each term before inserting.
+	 * Called by PR_Core_Activator during plugin activation.
+	 *
+	 * Side effects: may insert terms into wp_terms and wp_term_taxonomy.
+	 *
+	 * @return void
+	 */
+	public static function seed_terms(): void {
+		$terms = [ 'article', 'guide', 'comparison', 'news' ];
+
+		foreach ( $terms as $term ) {
+			if ( ! term_exists( $term, self::TAX_CATEGORY ) ) {
+				wp_insert_term( $term, self::TAX_CATEGORY );
+			}
+		}
+	}
+}

peptide-repo-core.php

@@ -3,7 +3,7 @@
  * Plugin Name: Peptide Repo Core
  * Plugin URI:  https://peptiderepo.com
  * Description: Canonical peptide schema — shared data layer for the peptiderepo.com ecosystem. Provides the peptide CPT, dosing rows, legal status cells, AI candidate queue, disclaimer component, and JSON-LD output.
- * Version:     0.4.0
+ * Version:     0.5.0
  * Author:      peptiderepo
  * Author URI:  https://peptiderepo.com
  * License:     GPL-2.0-or-later
@@ -22,7 +22,7 @@ if ( ! defined( 'ABSPATH' ) ) {
 
 /* ── Constants ────────────────────────────────────────────────────────── */
 
-define( 'PR_CORE_VERSION', '0.4.0' );
+define( 'PR_CORE_VERSION', '0.5.0' );
 define( 'PR_CORE_PLUGIN_FILE', __FILE__ );
 define( 'PR_CORE_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
 define( 'PR_CORE_PLUGIN_URL', plugin_dir_url( __FILE__ ) );