Addresses the three P1 findings from QA baseline review of a8a0ce2:
1. uninstall.php: delete psa_db_version option on plugin removal so no
orphaned data is left behind — satisfies AGENT-OPERATING-STANDARD
teardown/uninstall DoD.
2. Extract psa_upgrade_needed( $stored, $current ) as a pure function and
add tests/unit/UpgradeTest.php covering fresh-install, same-version,
future-version, and older-version scenarios. The impure wrapper
psa_maybe_run_upgrades() now delegates the decision to the pure helper.
3. Document the psa_db_version option and the admin_init-triggered
upgrade mechanism in ARCHITECTURE.md (Options section), including
why admin_init, downgrade behavior, cleanup, and testability.
No behavioral change for end users — same upgrade semantics, just
testable and documented, with proper teardown.
Agent-Session: cowork-qa-p1-fixes-20260414
Adds [peptide_directory] shortcode with card grid, category taxonomy (8 terms),
search, pagination, detail modal, and /v1/compounds REST endpoint. Includes 9
new meta fields (half-life, stability, solubility, etc.), admin data tools for
migration/re-enrichment, integration hooks for cross-plugin extensibility,
dark mode support, and full uninstall cleanup. Refactors AI generator into
PSA_OpenRouter + PSA_KB_Builder classes. Adds PHPUnit tests for PostType and
Directory classes. Fixes QA findings: dead JS selector, renderError loading
state, numeric meta validation, prepared SQL in uninstall.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Create PSA_Cost_Tracker class with database table for API call logging
- Log prompt/completion tokens and estimated cost for every OpenRouter API call
- Implement monthly budget system with hard stop (budget of 0 = unlimited)
- Add budget checks in validate_peptide_name() and generate_peptide_content()
- Add dry_run() method to estimate costs before making API calls
- Display monthly usage summary and recent API logs in admin settings
- Add monthly_budget setting to admin interface with number input field
- Update uninstall.php to drop psa_api_logs table on plugin removal
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
SEC-001 CRITICAL: Remove spoofable X-Forwarded-For/X-Real-IP from IP detection; trust only CF-Connecting-IP + REMOTE_ADDR
SEC-004 HIGH: Add peptide name input validation with character whitelist and prompt injection blocking
SEC-006 HIGH: Add missing return after wp_send_json_success in handle_pending_retry max-retries block
SEC-007 MEDIUM: KB articles now respect auto_publish setting instead of always publishing
SEC-009 MEDIUM: Replace hardcoded page ID 73 with configurable kb_page_id setting
SEC-010 MEDIUM: Fix cache invalidation — add underscore prefix to transient name pattern
SEC-011 MEDIUM: Skip sleep() during WP-Cron to avoid blocking PHP workers on rate limit retry
SEC-012 MEDIUM: Add global daily generation cap (50/day) to prevent cost overruns
SEC-013 LOW: Add @deprecated notice to unused PSA_Error class
SEC-015 LOW: Convert uninstall.php from space to tab indentation (WPCS)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
