Adds a pointer to the cross-app engineering docs in the CTO workspace so engineers scoped to this repo can find shared reference material (Cloudflare AI Gateway routing, OpenRouter key rotation, interface pattern, image-generation stack, social distributor choice) and the incident runbook.
No code changes. Pure docs.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* ci: cost cap + 3-model A/B harness on CTO reviewer
Two enhancements to the PR reviewer:
1. Monthly spend cap: tracked in Repo Variables (CTO_REVIEW_MONTH,
CTO_REVIEW_SPEND_CENTS, CTO_REVIEW_CAP_CENTS). Default cap $10/month.
Auto-resets on month rollover. Posts a skip-comment on PRs when cap hit.
2. A/B harness: reviews every PR with 3 models in parallel
(Claude Haiku 4.5, DeepSeek V3.1, Kimi K2 Thinking). Comment shows
all 3 verdicts side-by-side so we can compare quality/cost on real
PRs before picking a permanent default. Drop to 1 model by editing
the MODELS list after A/B window closes.
Agent-Session: cowork-reviewer-ab-20260414
* ci: use CTO_ADMIN_TOKEN for repo variables + restore formal APPROVE/REQUEST_CHANGES
Default GITHUB_TOKEN cannot mutate Repository Variables (always 403).
Use a PAT-backed secret CTO_ADMIN_TOKEN for the budget counter steps.
Also restores formal APPROVE/REQUEST_CHANGES verdicts now that repo
setting can_approve_pull_request_reviews is enabled.
Agent-Session: cowork-reviewer-ab-20260414
* ci: address review feedback — per-model timeout + simpler cost math
- Per-model timeout of 60s so one hung model does not block siblings
- Simplify cost_cents math (cost_usd * 100 directly, no double-rounding)
Defer: fine-grained PAT for CTO_ADMIN_TOKEN (requires manual OAuth device flow).
Agent-Session: cowork-reviewer-ab-20260414
* ci: stop exposing CTO_ADMIN_TOKEN as env var (security cleanup)
Pass the PAT only via github-token param. continue-on-error on the
budget step so a missing/expired secret degrades gracefully instead
of failing the whole workflow.
Agent-Session: cowork-reviewer-ab-20260414
* ci: add PHPUnit workflow that runs the existing test suite
59 tests exist across 8 files but were never running in CI.
This adds a ci.yml with PHP Lint + PHPCS + PHPUnit against WP test
framework on a MySQL service.
Agent-Session: cowork-pr-theme-tests-20260414
* ci: vendor install-wp-tests.sh for the PHPUnit workflow
Standard WP-CLI scaffold script, lightly hardened. Kept in-repo
instead of curl-from-github so CI is reproducible.
Agent-Session: cowork-pr-theme-tests-20260414
* chore: retrigger CI after reviewer fix landed on main
Agent-Session: cowork-pr-theme-tests-20260414
* ci: install subversion before bootstrap (svn no longer preinstalled)
ubuntu-latest dropped svn from the default image. install-wp-tests.sh
still uses svn to fetch the WP test suite from develop.svn.wordpress.org.
Add a step to apt-install subversion before the bootstrap runs.
Agent-Session: cowork-pr-theme-tests-20260414
* ci: skip db creation in install-wp-tests.sh (MySQL service already created it)
Agent-Session: cowork-pr-theme-tests-20260414
* ci: WP_CORE_DIR needs trailing slash for ABSPATH substitution
The wp-tests-config.php substitution copies WP_CORE_DIR into ABSPATH
verbatim, then later WordPress concatenates wp-settings.php. Without
the trailing slash you get /tmp/wordpresswp-settings.php.
Agent-Session: cowork-pr-theme-tests-20260414
* ci: post CTO review as COMMENT instead of APPROVE
GITHUB_TOKEN cannot formally approve PRs without a repo setting toggle.
Verdict is still prominent in the first line of the review body, and
the human merges based on reading it — no behavior loss.
Agent-Session: cowork-reviewer-fix-20260414
* fix(ci): ssh-keyscan failure no longer fails the deploy
ssh-keyscan was being called with set -e in effect and stderr suppressed,
so a single keyscan failure killed the entire deploy with no diagnostic
output. Since rsync/ssh use StrictHostKeyChecking=no, the known_hosts
entry is not load-bearing — making the keyscan best-effort is safe.
stderr is now captured to /tmp/keyscan.err and emitted as a warning so
future failures are debuggable.
Agent-Session: cowork-deploy-fix-20260414
* ci: add main-push audit tripwire
Flags direct pushes to main that did not come from a merged PR.
Free-plan workaround since branch protection requires GitHub Pro.
* docs: add Git Workflow section to CONVENTIONS.md
Documents the PR-gated review process enforced at the agent layer.
Free-plan workaround since branch protection requires GitHub Pro.
* ci: add Claude-powered CTO PR review workflow
Auto-reviews every PR with Claude Haiku 4.5 and posts a structured
review (APPROVE / REQUEST_CHANGES / COMMENT). Does NOT auto-merge — a
human still clicks Merge. Requires ANTHROPIC_API_KEY secret on the repo.
* ci: switch CTO reviewer from Anthropic direct to OpenRouter
Reuses the OPENROUTER_API_KEY secret that already backs the other AI
plugins. Consolidates AI spend on one bill. Model: anthropic/claude-haiku-4.5.
Security-only release per ADR-0001. Closes all six ship-blockers from the
post-v1.5.0 audit: PSEC-001 (no rate limiting), PSEC-002 (account
enumeration via separate error messages), PSEC-003 (registration auto-login
with no email verification), PSEC-004 (ungated "My Data" templates),
PSEC-005 (CSV formula injection on subscriber export), PSEC-006 (no
honeypot/CAPTCHA on public forms).
Adds inc/config.php (single source of truth for all security thresholds,
filterable via peptide_starter_security_config), inc/rate-limiter.php
(Peptide_Starter_Rate_Limiter + Cloudflare-aware client IP resolver,
transient-backed, never stores raw IPs), and inc/email-verification.php
(43-char token, 24h TTL, /verify rewrite, rate-limited resend endpoint).
Auth handlers rewritten to: unify all failure messages, rate-limit before
any expensive check, drop registrations with a filled honeypot silently,
stop auto-login on register, send a verification email instead. The
require_login() helper lives in inc/helpers.php and is applied at the top
of page-tracker.php, page-subject-log.php, and page-protocol-builder.php;
page-calculator.php stays open (no PII, no writes).
Newsletter signup gains: consent checkbox, privacy link, honeypot,
autoload=false on the wp_options blob, unsubscribe token stored per row,
/newsletter-unsubscribe route, merged success+duplicate into a single "ok"
state. Admin export runs every cell through peptide_starter_csv_safe()
which prefixes leading =/+/-/@/tab/CR with a quote.
Contact handler hardens against email-header injection (rejects name
values with \r \n , < >), rate-limits, honors honeypot, tags mail
failures with a request ID for correlation without logging message
content.
Adds Tools → Mail Test (inc/mail-diagnostic.php): a permanent wp_mail
probe so we can check Hostinger outbound deliverability any time it looks
flaky. Adds a one-time admin_init migration that enrols pre-v1.5.1
subscribers into the verification flow (currently a no-op — zero users —
but guarded for the future).
Other cleanup from the audit: fallback primary menu moved out of
header.php into inc/helpers.php (redeclaration risk), placeholder footer
language links replaced with "Translations coming soon", footer copyright
now reads through the customizer getter, settings-panel gains a proper
Tab/Shift+Tab focus trap and saves/restores body overflow, documentation
heading IDs slugified from heading text with collision counters, JS files
standardized on const/let.
Six new PHPUnit suites cover rate limiter lifecycle, auth handler error
unification and rate limits, email verification token generation and
expiry, contact handler header injection + rate limit + honeypot,
newsletter signup consent + CSV safety, and require_login gate behavior.
ARCHITECTURE.md and CONVENTIONS.md updated in the same commit — new
module layout, data flows, security patterns for rate-limiting,
honeypotting, gating, and CSV-safe export.
Version bumped to 1.5.1 in style.css and functions.php.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Reformat add_setting() and add_control() calls to comply with
PEAR.Functions.FunctionCallSignature — each argument on its own line,
opening paren last on line, closing paren on its own line. Matches the
pattern already used by add_section() calls in the same file.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Major theme extension adding full-featured navigation with dropdown submenus (Tools, My Data, Resources),
9 new page templates (Calculator, Protocol Builder, Tracker, Subject Log, Documentation, Directory,
Science Feed, Profile, Sign In/Register), documentation page with sidebar ToC and scroll spy,
branded AJAX authentication forms, newsletter signup with admin export, slide-out contact/support panel,
Research Modules 6-card grid on front page, and comprehensive footer update.
Split functions.php (554→206 lines) into 6 focused inc/ modules: helpers, customizer, auth-handlers,
contact-handler, page-setup, newsletter-admin. All new components include dark mode support, CSRF
protection, input sanitization, output escaping, and graceful plugin degradation via shortcode_exists().
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Reduce hero padding from 96/80px to 64/48px, shrink subtitle and
search margins, tighten news-feed and archive section padding,
and reduce peptides grid gap for better content density.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Warm off-white light palette, decorative geometric shapes,
category-coded peptide cards with tinted borders and pill badges,
larger hero typography with accent word, header CTA button,
and redesigned single-peptide detail page with meta card grid.
Dark mode stays default per user preference. Light mode gets the
warm treatment when toggled or via prefers-color-scheme.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The CI was overriding the project PHPCS config by passing
--standard=WordPress-Core directly. Now uses the project
.phpcs.xml.dist which includes exclusions for standard WP
patterns (class in functions.php).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Convert all PHP files from CRLF to LF line endings
- Reformat multi-line function calls per WPCS standard
(opening paren last on line, closing paren on own line)
- Fix assignment-in-conditional in single-peptide.php
- Change double quotes to single quotes in content-none.php
- Exclude InvalidClassFileName sniff (standard WP functions.php pattern)
- Fix archive-peptide.php opening PHP tag placement
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Wrapped get_search_query() with esc_attr() in 404.php, front-page.php,
and searchform.php. Without this, a crafted search query can inject
arbitrary HTML attributes into the search input value field.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Renders PRAutoBlogger-generated research articles as a card grid
between the hero section and the peptide news feed. Wrapped in
shortcode_exists() so it degrades gracefully if the plugin is
deactivated.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
