ci: stop exposing CTO_ADMIN_TOKEN as env var (security cleanup)

Pass the PAT only via github-token param. continue-on-error on the budget step so a missing/expired secret degrades gracefully instead of failing the whole workflow. Agent-Session: cowork-reviewer-ab-20260414
ci: address review feedback — per-model timeout + simpler cost math
2026-04-14 17:35:04 +07:00 · 2026-04-14 17:32:00 +07:00 · 2026-04-14 17:27:45 +07:00 · 2026-04-14 17:22:30 +07:00
20 changed files with 282 additions and 1515 deletions
--- a/.github/workflows/cto-review.yml
+++ b/.github/workflows/cto-review.yml
@@ -1,20 +1,15 @@
 name: CTO Review
-# Automated PR review powered by Claude + DeepSeek + Kimi (via OpenRouter)
+# Automated PR review powered by Claude + DeepSeek + Kimi via OpenRouter.
 # plus Neurometric PR-Summarizer (a Qwen3-4B task-specialist SLM).
 #
-# During the A/B window (until further notice), every PR gets reviewed by FOUR models
+# During the A/B window (until further notice), every PR gets reviewed by THREE models
 # in parallel. The PR comment shows each model's verdict side-by-side so we can compare
 # quality/cost on real PRs before picking a permanent default.
 #
 # Neurometric is a "prose voice": it does not support OpenAI tool-calling, so its
 # contribution is raw markdown + a heuristic verdict. It is never the primary voice.
 #
 # Does NOT merge. Does NOT post formal APPROVE/REQUEST_CHANGES reviews — always COMMENT
 # (GITHUB_TOKEN can't formally approve PRs without repo-setting toggle).
 #
-# Requires repo secrets: OPENROUTER_API_KEY, NEUROMETRIC_API_KEY (optional; the
+# Requires repo secret: OPENROUTER_API_KEY
 # Neurometric voice self-skips with an inline error note if the key is missing).
 #
 # Cost cap: tracked in Repository Variables (CTO_REVIEW_SPEND_CENTS, CTO_REVIEW_CAP_CENTS).
 # Default cap is 1000 cents ($10/month). Auto-resets on the 1st of each month.
@@ -150,12 +145,11 @@ jobs:
            echo "EOF_CONV"
          } >> "$GITHUB_OUTPUT"
-      - name: Call 4 models in parallel (OpenRouter + Neurometric)
+      - name: Call 3 models in parallel via OpenRouter
        if: steps.budget.outputs.skip != 'true'
        id: review
        env:
          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
          NEUROMETRIC_API_KEY: ${{ secrets.NEUROMETRIC_API_KEY }}
          PR_TITLE: ${{ github.event.pull_request.title }}
          PR_BODY: ${{ github.event.pull_request.body }}
          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
@@ -187,19 +181,14 @@ jobs:
          api_key = os.environ["OPENROUTER_API_KEY"]
-          # A/B harness: four models. Each gets the same prompt.
+          # A/B harness: three models. Each gets the same prompt.
          # Primary model's verdict drives the heading. Others are labeled.
          # Edit this list to change the roster (or drop to 1 after A/B window closes).
          #
          # provider_type semantics:
          #   - "openrouter_tools": OpenAI tool-calling via OpenRouter; structured verdict.
          #   - "neurometric_prose": Neurometric marketplace SLM; prose output + heuristic verdict.
          MODELS = [
-              # (slug, display name, input_per_M_USD, output_per_M_USD, is_primary, provider_type)
+              # (openrouter slug, display name, input_per_M_USD, output_per_M_USD, is_primary)
-              ("anthropic/claude-haiku-4.5",       "Claude Haiku 4.5",                     1.00, 5.00, True,  "openrouter_tools"),
+              ("anthropic/claude-haiku-4.5",       "Claude Haiku 4.5",  1.00, 5.00, True),
-              ("deepseek/deepseek-chat-v3.1",      "DeepSeek V3.1",                        0.15, 0.75, False, "openrouter_tools"),
+              ("deepseek/deepseek-chat-v3.1",      "DeepSeek V3.1",     0.15, 0.75, False),
-              ("moonshotai/kimi-k2-thinking",      "Kimi K2 Thinking",                     0.60, 2.50, False, "openrouter_tools"),
+              ("moonshotai/kimi-k2-thinking",      "Kimi K2 Thinking",  0.60, 2.50, False),
              ("neurometric/pr-summarizer",        "Neurometric PR-Summarizer (Qwen3-4B)", 0.00, 0.00, False, "neurometric_prose"),
          ]
          system = """You are the CTO and lead reviewer for the peptiderepo project. You are reviewing a pull request opened by an autonomous agent or human contributor.
@@ -262,28 +251,7 @@ jobs:
          PER_MODEL_TIMEOUT = 60  # seconds; one hung model should not block siblings
-          # Heuristic verdict inference for prose-voice models that can't do tool-calling.
+          def call_model(slug, display, in_rate, out_rate, is_primary):
          # Keyword order matters: block markers beat approve markers.
          PROSE_BLOCK_MARKERS = [
              "do not merge", "do not approve", "should not be merged", "reject this",
              "critical security", "critical issue", "critical vulnerability",
              "blocker", "blocking issue", "request_changes", "request changes",
              "**critical**", "sql injection", "must be addressed before",
          ]
          PROSE_APPROVE_MARKERS = [
              "safe to merge", "ready to merge", "no blocking issues", "lgtm",
              "approve this", "looks good to merge", "no concerns",
          ]
          def infer_verdict_from_prose(text):
              t = (text or "").lower()
              if any(m in t for m in PROSE_BLOCK_MARKERS):
                  return "REQUEST_CHANGES"
              if any(m in t for m in PROSE_APPROVE_MARKERS):
                  return "APPROVE"
              return "COMMENT"
          def call_openrouter_tools(slug, display, in_rate, out_rate, is_primary):
              body = {
                  "model": slug,
                  "max_tokens": 2048,
@@ -311,7 +279,6 @@ jobs:
              except Exception as e:
                  return {
                      "slug": slug, "display": display, "is_primary": is_primary,
                      "provider_type": "openrouter_tools",
                      "error": str(e)[:300],
                      "cost_cents": 0,
                  }
@@ -319,9 +286,9 @@ jobs:
              choice = data.get("choices", [{}])[0].get("message", {})
              tool_calls = choice.get("tool_calls", [])
              if not tool_calls:
                  # Some non-Anthropic providers occasionally put the tool args in content.
                  return {
                      "slug": slug, "display": display, "is_primary": is_primary,
                      "provider_type": "openrouter_tools",
                      "error": f"No tool_call in response. Raw content: {str(choice)[:300]}",
                      "cost_cents": 0,
                  }
@@ -331,7 +298,6 @@ jobs:
              except Exception as e:
                  return {
                      "slug": slug, "display": display, "is_primary": is_primary,
                      "provider_type": "openrouter_tools",
                      "error": f"Malformed tool args: {e}",
                      "cost_cents": 0,
                  }
@@ -343,62 +309,10 @@ jobs:
              cost_cents = cost_usd * 100
              return {
                  "slug": slug, "display": display, "is_primary": is_primary,
                  "provider_type": "openrouter_tools",
                  "review": review, "prompt_tokens": ptok, "completion_tokens": ctok,
                  "cost_cents": cost_cents,
              }
          def call_neurometric_prose(slug, display, is_primary):
              nm_key = os.environ.get("NEUROMETRIC_API_KEY", "")
              if not nm_key:
                  return {
                      "slug": slug, "display": display, "is_primary": is_primary,
                      "provider_type": "neurometric_prose",
                      "error": "NEUROMETRIC_API_KEY secret not set on this repo",
                      "cost_cents": 0,
                  }
              body = {
                  "model": slug,
                  "max_tokens": 2048,
                  "messages": [
                      {"role": "system", "content": system},
                      {"role": "user", "content": user_message},
                  ],
              }
              req = urllib.request.Request(
                  "https://api.neurometric.ai/v1/chat/completions",
                  data=json.dumps(body).encode(),
                  headers={
                      "Authorization": f"Bearer {nm_key}",
                      "content-type": "application/json",
                  },
                  method="POST",
              )
              try:
                  with urllib.request.urlopen(req, timeout=PER_MODEL_TIMEOUT) as resp:
                      data = json.loads(resp.read())
              except Exception as e:
                  return {
                      "slug": slug, "display": display, "is_primary": is_primary,
                      "provider_type": "neurometric_prose",
                      "error": str(e)[:300],
                      "cost_cents": 0,
                  }
              prose = data.get("choices", [{}])[0].get("message", {}).get("content") or ""
              verdict = infer_verdict_from_prose(prose)
              return {
                  "slug": slug, "display": display, "is_primary": is_primary,
                  "provider_type": "neurometric_prose",
                  "review": {"verdict": verdict, "prose": prose},
                  "prompt_tokens": 0, "completion_tokens": 0,
                  "cost_cents": 0,
              }
          def call_model(slug, display, in_rate, out_rate, is_primary, provider_type="openrouter_tools"):
              if provider_type == "neurometric_prose":
                  return call_neurometric_prose(slug, display, is_primary)
              return call_openrouter_tools(slug, display, in_rate, out_rate, is_primary)
          results = []
          with concurrent.futures.ThreadPoolExecutor(max_workers=len(MODELS)) as pool:
              futures = [pool.submit(call_model, *m) for m in MODELS]
@@ -428,21 +342,9 @@ jobs:
                  continue
              rev = r["review"]
              lines.append("")
-              if r.get("provider_type") == "neurometric_prose":
+              lines.append(f"**Verdict:** {rev['verdict']}")
                  lines.append(f"**Verdict:** {rev['verdict']} _(heuristic, inferred from prose)_")
              lines.append("")
-                  # Cap at 6KB to keep PR comments readable; 4B model output is rarely over this
+              lines.append(rev["summary"])
                  prose = rev.get("prose", "")
                  if len(prose) > 6000:
                      prose = prose[:6000] + "\n\n_…output truncated for comment length…_"
                  lines.append(prose)
                  lines.append("")
                  lines.append("_free tier; per-call token usage not tracked_")
                  lines.append("")
                  continue
              lines.append(f"**Verdict:** {rev.get('verdict', 'COMMENT')}")
              lines.append("")
              lines.append(rev.get("summary") or "_(model returned no summary)_")
              lines.append("")
              if rev.get("concerns"):
                  lines.append("**Concerns:**")
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -88,13 +88,8 @@ jobs:
        run: |
          sleep 5
          STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://peptiderepo.com)
-          # 200 = normal healthy response.
+          if [ "$STATUS" != "200" ]; then
-          # 403 = peptide-starter-theme v1.5.2 CF-peer validator rejecting this
+            echo "WARNING: Site returned HTTP $STATUS after deploy"
          #       GHA-runner direct-to-origin request as non-Cloudflare traffic.
          #       That rejection is the validator working — itself a positive
          #       liveness signal. Real user traffic via Cloudflare gets 200.
          if [ "$STATUS" != "200" ] && [ "$STATUS" != "403" ]; then
            echo "ERROR: Site returned unexpected HTTP $STATUS after deploy"
            exit 1
          fi
-          echo "Site is responsive (HTTP $STATUS)"
+          echo "Site is healthy (HTTP 200)"
--- a/AGENT-OPERATING-STANDARD.md
+++ b/AGENT-OPERATING-STANDARD.md
@@ -1,145 +0,0 @@
 # Agent Operating Standard — peptiderepo
 **Version:** 1.0.0
 **Effective:** 2026-04-14
 **Applies to:** every AI agent (Claude, Copilot, Cursor, future tools) working in any peptiderepo codebase.
 This document is the single source of truth for *how* agents must work in peptiderepo repos. It travels with the code — every repo contains a copy at its root and a `CLAUDE.md` pointer that requires reading this file before any edit.
 If this document conflicts with a per-repo `CONVENTIONS.md`, this document wins for **process**; `CONVENTIONS.md` wins for **code style**.
 ---
 ## 1. The QA Gate — Non-Negotiable
 **No code reaches `main` without a signed QA verdict for its commit SHA.**
 The QA reviewer is a separate Claude subagent (the `qa-review` skill) with no prior conversation context. The agent that wrote the code cannot be the agent that approves it. This is enforced by the deploy skills — they refuse to push if no signed `APPROVE` verdict exists for the SHA being deployed.
 Verdicts are written to `qa-reviews/<repo>/<YYYY-MM-DD>-<sha>.md` in the workspace root and signed with: commit SHA, reviewer model string, ISO-8601 timestamp, and verdict.
 ### Verdict types
 - `APPROVE` — ship it.
 - `APPROVE-WITH-P2-NOTES` — ship it; create follow-up tickets for the noted P2/P3 issues.
 - `REJECT-P1` — do not ship; fix the listed issues and re-submit.
 - `REJECT-P0` — do not ship; the change has a security, data-loss, or production-impact risk that must be resolved before any further work on the branch.
 ### Severity definitions
 - **P0:** secrets exposure, auth bypass, data loss, production-down risk, unauthorized financial cost (e.g., uncapped LLM spend).
 - **P1:** Definition-of-Done violation, missing input sanitization or output escaping, missing authorization on a sensitive action, missing test for new core logic, schema change without migration.
 - **P2:** AI-readability gap (missing docblock, file >300 lines, magic value), inconsistent naming, missing `@see` cross-reference.
 - **P3:** style nit, opinion-level suggestion.
 ---
 ## 2. Definition of Done — every change must satisfy
 The QA reviewer runs this checklist against the diff. Any unchecked item is at minimum a P1.
 - [ ] Code follows the language/framework's standard coding conventions (per-repo `CONVENTIONS.md`)
 - [ ] All input sanitized at boundary, all output escaped at render
 - [ ] Authentication and authorization checks on all sensitive actions
 - [ ] No hardcoded secrets — credentials live in env or config only
 - [ ] All external API calls have error handling, timeout, and retry-with-backoff (max 3 retries)
 - [ ] Cost/token impact documented for any AI-touching feature; budget hard-stop respected
 - [ ] Unit tests for new core logic; integration tests for framework-specific behavior
 - [ ] User-facing strings are translatable/localizable
 - [ ] Consistent namespace/prefix on all global identifiers
 - [ ] Teardown/uninstall path cleans up ALL project data
 - [ ] Every new class has a preamble docblock (what / who triggers / dependencies)
 - [ ] Every new public method has typed params, return type, and docblock noting side effects
 - [ ] No magic methods, dynamic resolution, or clever indirection without explicit justification
 - [ ] No file exceeds 300 lines (split if it does)
 - [ ] `ARCHITECTURE.md` and `CONVENTIONS.md` updated if the change affects file structure, data flow, or patterns
 - [ ] `@see` cross-references at top of files participating in multi-class flows
 - [ ] Event/hook docblocks list known listeners and where they're registered
 - [ ] Commits authored as `peptiderepo` (not `ongterence` or any personal identity)
 ---
 ## 3. Git Workflow — PR-Gated, Soft-Enforced
 All four peptiderepo repos are private on the GitHub free plan, which does not support branch protection. The review gate is enforced at the agent layer via these rules.
 ### Rules
 1. **Never push to `main` directly.** Every change lands via a pull request. No self-merging from agents. No force-pushing to `main`.
 2. **Branch naming:** `claude/<scope>-<YYYYMMDD>` — e.g., `claude/cost-tracker-20260414`.
 3. **Commit trailer:** every commit ends with `Agent-Session: <session-id-or-description>` so commits correlate back to the conversation that produced them.
 4. **PR description template:**
   - **What changed** (one paragraph)
   - **Why** (motivation or incident link)
   - **Risk flags** (schema changes, API contract changes, cost impact, compatibility)
   - **Test plan** (what was run locally; what Terence should smoke-test after merge)
   - **QA verdict path** (`qa-reviews/<repo>/<date>-<sha>.md`)
 5. **Emergency push exception:** if the situation genuinely requires pushing to `main` without a PR (site down, CI broken, one-line hotfix), ask Terence in chat first. Every emergency push gets a follow-up PR for the audit trail.
 ### Mechanics
 `gh` CLI is not installed in the Cowork sandbox. Use `curl` with the PAT from `.env.credentials` (workspace root). See `pr-workflow-rollout/project-instructions-addendum.md` for the exact `curl` snippet.
 ---
 ## 4. Security Non-Negotiables
 - Sanitize all input at the boundary; escape all output at render.
 - Authenticate and authorize every sensitive action.
 - Secrets in environment/config only — never hardcoded, never committed, never exposed to the browser.
 - Use a consistent namespace/prefix on all global identifiers.
 - All paid-API calls happen server-side only.
 ---
 ## 5. Cost-Conscious AI Integration
 Any feature that calls a paid LLM/AI API must:
 - Respect a token/dollar budget with a **hard stop** when exhausted.
 - Log every call: timestamp, provider, model, prompt tokens, completion tokens, estimated cost.
 - Use the cheapest model that does the job; expensive models only where required and configurable.
 - Cache identical calls within a configurable window.
 - Use structured output (JSON mode) when the API supports it.
 - Batch where possible.
 - Offer dry-run mode for user-facing operations.
 - Fail with retry-and-backoff (max 3); never retry indefinitely.
 ---
 ## 6. AI-Readability Requirements
 This codebase is maintained by AI agents. Code must be optimized for LLM comprehension.
 - Files under 300 lines. Split when they grow.
 - Every class has a preamble: *what / who triggers / dependencies*.
 - Every public method has typed params, return type, and a docblock listing side effects.
 - Names are verb-noun and unambiguous (`generate_post_from_topic()`, not `process()`).
 - Constants over magic values (`MAX_RETRIES`, not `3`).
 - Event/hook names describe the event (`before_content_generation`, not `hook_1`).
 - No clever indirection — flat, explicit call chains.
 - Inline comments explain *why*, not *what*.
 - `@see` cross-references at the top of files in multi-class flows.
 ---
 ## 7. Documentation as Code
 Every change that touches structure or data flow must include doc updates **in the same commit**:
 - New file → add to `ARCHITECTURE.md` file tree.
 - New pattern → update `CONVENTIONS.md`.
 - New external integration → update `ARCHITECTURE.md` integrations section.
 - Non-obvious decision → add to `ARCHITECTURE.md` "key decisions".
 Documentation that drifts from reality actively misleads the next agent. QA will reject changes that modify structure without updating docs (P1).
 ---
 ## 8. When This Standard Changes
 This file is versioned. Bump the version in the header on any material change and add an entry to the changelog below.
 ### Changelog
 - **1.0.0 (2026-04-14)** — initial standard, established centralized QA gate model.
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -1,7 +1,5 @@
 # Peptide Starter Theme — Architecture
 > **Cross-app context:** decisions that affect multiple plugins (Cloudflare AI Gateway routing, OpenRouter account sharing, the interface pattern, image-generation stack, social distributor choice) are recorded in `Peptide Repo CTO/docs/engineering/decisions/`. The incident runbook for cross-app failure modes is at `Peptide Repo CTO/docs/engineering/INCIDENT-RUNBOOK.md`. Read both before making decisions that cross plugin boundaries.
 ## Overview
 Peptide Starter (slug: `peptide-starter`) is a premium classic WordPress
@@ -32,11 +30,8 @@ peptide-starter/
 │   ├── helpers.php                # Nav walker + menu fallback, logo, getters,
 │   │                               # pagination, honeypot renderer, csv_safe,
 │   │                               # require_login gate, safe referer.
-│   ├── cloudflare-ips.php         # [v1.5.2] CF edge range snapshot +
+│   ├── rate-limiter.php           # [v1.5.1] Peptide_Starter_Rate_Limiter +
-│   │                               # CIDR matcher (v4 and v6).
+│   │                               # peptide_starter_get_client_ip (CF-aware).
 │   ├── rate-limiter.php           # Peptide_Starter_Rate_Limiter +
 │   │                               # peptide_starter_get_client_ip (peer-validated,
 │   │                               # PSEC-007).
 │   ├── email-verification.php     # [v1.5.1] Token send + verify route + resend
 │   │                               # endpoint + user_is_verified().
 │   ├── customizer.php             # Customizer sections/settings/controls.
@@ -47,8 +42,6 @@ peptide-starter/
 │   ├── newsletter-admin.php       # Subscriber viewer + CSV-safe export +
 │   │                               # /newsletter-unsubscribe route.
 │   ├── mail-diagnostic.php        # [v1.5.1] Tools → Mail Test — wp_mail probe.
 │   ├── perf-asset-policy.php      # [v1.6.0] Mobile perf: dequeue + font slim
 │   │                               # + preconnect + defer.
 │   └── page-setup.php             # Auto-create pages on activation +
 │                                    # v1.5.0 user migration (enrol into verify).
 │
@@ -227,47 +220,19 @@ Shortcodes (plugins), all wrapped in `shortcode_exists()`:
 - CSRF nonces on every form (auth, newsletter, contact, mail-test, unsubscribe).
 - Unified error messages on login + registration (no enumeration).
 - Registration validation does **not** short-circuit — all checks
  evaluate unconditionally so response timing can't distinguish which
  one failed (PSEC-009, v1.5.2).
 - Rate limiting on login / register / contact / newsletter / verify-resend.
 - Honeypots on the four public forms (login, register, contact, newsletter).
 - `require_login()` gate on every template that owns user data.
 - Email verification required for write access to user-data tools.
 - Existing accounts (created before v1.5.2) are grandfathered as
  verified. Verification enforces only on registrations from v1.5.2
  onward (PSEC-008, v1.5.2).
 - CSV export formula-injection safe.
 - All input sanitized at the boundary; all output escaped.
 - Login redirect validated with `wp_validate_redirect`.
 - Rate-limit storage keys are hashed — no raw IPs persisted.
 - Contact sender names reject header-injection characters before `wp_mail`.
 ### Client-IP trust model (PSEC-007, v1.5.2)
 peptiderepo.com sits behind Cloudflare. The rate limiter keys on client
 IP, so the source of that IP matters for correctness of every abuse
 control in the theme.
 `peptide_starter_get_client_ip()` trusts in this priority order:
 1. **`HTTP_CF_CONNECTING_IP`** — only when `REMOTE_ADDR` is itself
   inside a published Cloudflare edge range (see `inc/cloudflare-ips.php`).
   Direct-to-origin connections that bypass Cloudflare cannot forge this
   header because their peer IP is not a CF edge.
 2. **`HTTP_X_FORWARDED_FOR`** — ignored by default. Opt in via
   `add_filter( 'peptide_starter_trust_xff', '__return_true' )` only
   when a known, trusted non-CF proxy fronts the origin.
 3. **`REMOTE_ADDR`** — always trusted as the final fallback. Cannot be
   client-controlled at the TCP layer.
 `inc/cloudflare-ips.php` holds a static snapshot of CF ranges. Refresh
 quarterly. Override via `peptide_starter_cloudflare_ip_ranges` filter
 for out-of-band updates.
 ## Version
-**Current:** v1.6.0 (2026-04-23)
+**Current:** v1.5.1 (2026-04-14)
 Bump `style.css` header line 7 and `PEPTIDE_STARTER_VERSION` in
 `functions.php` together on release.
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,107 +2,6 @@
 All notable changes to the Peptide Starter Theme are documented in this file.
 ## [1.6.0] - 2026-04-23 — Mobile Performance Phase 1
 Mobile-perf optimization targeting LCP reduction through conditional asset
 dequeue, font weight slimming, and font server preconnect. Measured baseline
 LCP on Moto G Power (Slow 4G): 5.4s; target after Phase 1: ~2.5s.
 ### Added
 - `inc/perf-asset-policy.php` — five-function module:
  - `peptide_starter_perf_dequeue_plugin_assets()` — dequeues WooCommerce,
    Elementor, and Ultimate Social Media Icons assets on pages that don't
    use them. Hook: `wp_enqueue_scripts` priority 100.
  - `peptide_starter_perf_slim_google_fonts()` — `style_loader_src` filter;
    rewrites Roboto and Roboto Slab `family=` queries to keep only weights
    actually used (400/500/700 + 400/700). Drops 72 font faces to 5.
  - `peptide_starter_perf_resource_hints()` — `wp_resource_hints` filter;
    adds preconnect hints for `fonts.googleapis.com` and `fonts.gstatic.com`.
  - `peptide_starter_perf_defer_cookie_notice()` — `script_loader_tag` filter;
    appends `defer` attribute to the cookie-notice front-end script.
  - `peptide_starter_page_uses_elementor( int $post_id )` — helper.
 - Kill-switch constant `PEPTIDE_STARTER_PERF_DEQUEUE` (default `true`).
  Define `false` in `wp-config.php` to disable all dequeues instantly.
 - Filterable handle lists: `peptide_starter_perf_woocommerce_handles`,
  `peptide_starter_perf_elementor_handles`, `peptide_starter_perf_usmi_handles`,
  `peptide_starter_perf_font_weights`.
 - `tests/test-perf-asset-policy.php` — 13 unit-test cases covering kill-switch,
  per-page-context dequeue logic, font slim happy/edge cases, filter overrides,
  preconnect insertion, defer attribute application.
 ### Changed
 - `style.css` Version header bumped 1.5.2 → 1.6.0.
 - `PEPTIDE_STARTER_VERSION` constant bumped to `1.6.0`.
 ### Why
 PageSpeed Insights mobile score on `https://peptiderepo.com/` was 74 with
 LCP 5.4s, FCP 2.6s. Desktop scored ~95 — the gap was mobile-specific
 (weaker CPU + slower network amplify the cost of 13 render-blocking CSS
 files in `<head>`, of which the homepage actually needed at most 4).
 Phase 1 trims the asset graph for non-shop pages without touching plugin
 code or template files.
 ## [1.5.2] - 2026-04-14 — Security
 Same-day follow-up to v1.5.1. Closes four issues the v1.5.1 post-merge
 review flagged — two ship-blockers (PSEC-007 CF header spoof, PSEC-008
 synchronous migration) and two mediums (PSEC-009 timing oracle,
 PSEC-010 test-coverage gap). All fixes stay within ADR-0001's decision
 envelope — no new ADR required.
 ### Security fixes
 - **PSEC-007** — `peptide_starter_get_client_ip()` now only trusts
  `HTTP_CF_CONNECTING_IP` when `REMOTE_ADDR` itself is inside a
  published Cloudflare edge range. Direct-to-origin requests (which
  Hostinger allows) can no longer forge their source IP by sending a
  `CF-Connecting-IP` header. `HTTP_X_FORWARDED_FOR` is ignored unless
  explicitly opted in via the `peptide_starter_trust_xff` filter. New
  module `inc/cloudflare-ips.php` holds the range snapshot (dated
  2026-04-14) + a CIDR matcher for both IPv4 and IPv6. Override the
  list via the `peptide_starter_cloudflare_ip_ranges` filter.
 - **PSEC-008** — Removed the v1.5.1 re-verification migration entirely
  (Option A). Existing subscribers are now grandfathered — treated as
  verified. Verification applies to accounts registered from v1.5.2
  onward. The `admin_init`-driven synchronous `wp_mail` loop that blocked
  wp-admin is gone; its `ps_verify_migration_version` option is cleared
  on theme activation.
 - **PSEC-009** — Registration validation no longer short-circuits.
  Pattern / email / password / `username_exists` / `email_exists` all
  evaluate unconditionally before the combined rejection, closing the
  response-time enumeration oracle that distinguished microsecond-fast
  regex rejection from DB-round-trip rejection.
 ### Tests
 - `test-rate-limiter.php` — seven new cases covering CF-peer trust,
  spoofed-header rejection, invalid-value fallthrough, XFF default-off
  behaviour, XFF filter opt-in, filter override of the CF range list,
  IPv6 CIDR matching, and family-mismatch rejection.
 - `test-auth-handlers.php` — `test_register_runs_all_checks_even_when_early_one_fails`
  asserts DB-backed user lookups still execute when a cheap validation
  check has already failed (PSEC-009).
 - `test-email-verification.php` — `test_valid_token_verifies_user_clears_meta_and_fires_hook`
  covers the happy-path verify flow end-to-end including hook firing
  (PSEC-010).
 ### Documentation
 - `ARCHITECTURE.md` — CF IP trust model explained in the Security
  Summary; migration decision (grandfather) documented.
 - `CONVENTIONS.md` — new "Trust model for request headers" note.
 ### Rollback note
 If v1.5.2 causes login or registration failures, roll back to v1.5.0
 (not v1.5.1 — v1.5.1 carried the unresolved PSEC-007 hole and the
 blocking migration). Rate-limit transients auto-expire.
 ---
 ## [1.5.1] - 2026-04-14 — Security
 Security-only release hardening the frontend authentication surface introduced
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,21 +1,79 @@
-# Agent Bootstrap — peptide-starter-theme
+# Peptide Starter Theme
-**Read these files in order before making any edit:**
+WordPress theme for peptiderepo.com — a scientific peptide reference database.
-1. `AGENT-OPERATING-STANDARD.md` — process rules, QA gate, Definition of Done. Required reading on every session.
+## Repository
 2. `ARCHITECTURE.md` — this repo's structure, data flow, integrations, key decisions.
 3. `CONVENTIONS.md` — this repo's code style and extension patterns.
-## Critical rules (full detail in AGENT-OPERATING-STANDARD.md)
+- **GitHub**: `peptiderepo/peptide-starter-theme` (private)
 - **Branch**: `main` is the production branch
 - **Live site**: https://peptiderepo.com
 - **Hosting**: Hostinger shared hosting
- **No direct pushes to `main`.** PR-only. The deploy skills will refuse to push without a signed QA verdict for the commit SHA.
+## Deploy
 - **Commits authored as `peptiderepo`** (`git config user.name "peptiderepo"` / `user.email "peptiderepo@users.noreply.github.com"`). Verify before pushing.
 - **Branch naming:** `claude/<scope>-<YYYYMMDD>`.
 - **Commit trailer:** `Agent-Session: <session-id-or-description>`.
 - **Doc-in-same-commit:** any change to file structure or data flow must update `ARCHITECTURE.md` / `CONVENTIONS.md` in the same commit.
-## QA gate
+Push to `main` triggers GitHub Actions → rsync via SSH to Hostinger.
 No CI lint step — the deploy workflow (`deploy.yml`) runs rsync directly.
 LiteSpeed cache is purged automatically after deploy.
-Before any deploy, the `qa-review` skill spawns a fresh subagent to review the diff against `AGENT-OPERATING-STANDARD.md`. The verdict is written to `qa-reviews/<repo>/<date>-<sha>.md` in the workspace root and must be `APPROVE` or `APPROVE-WITH-P2-NOTES` for the deploy to proceed.
+Theme path on server: `~/domains/peptiderepo.com/public_html/wp-content/themes/peptide-starter/`
-The agent that wrote the code cannot self-approve. This is structural, not advisory.
+## Architecture
 This is a classic WordPress theme (no block/FSE). All styling is in `style.css` (no build step, no preprocessor). JavaScript is vanilla — no bundler.
 ### Key files
 | File | Purpose |
 |------|---------|
 | `style.css` | All theme CSS (~44KB). Organized: reset → tokens → typography → globals → components → regions → pages → animations → a11y → dark mode → responsive |
 | `functions.php` | Theme setup, script enqueueing, Customizer registration, nav walker, helper functions |
 | `front-page.php` | Home page: hero section → PRAutoBlogger widget → Peptide News feed |
 | `header.php` | Global header with nav, dark mode toggle, mobile menu |
 | `footer.php` | 4-column widget footer with copyright |
 | `archive-peptide.php` | Peptide CPT archive grid |
 | `single-peptide.php` | Single peptide detail page |
 | `assets/js/navigation.js` | Mobile menu and nav functionality |
 | `assets/js/theme.js` | Dark mode toggle, theme utilities |
 ### Template parts
 - `template-parts/content.php` — Post/page content loop
 - `template-parts/content-peptide.php` — Peptide card in archive
 - `template-parts/content-none.php` — Empty state
 ## Coding Conventions
 - **PHP**: WordPress coding standards — tabs for indentation, Yoda conditions, braces on same line
 - **CSS**: No preprocessor. Use CSS custom properties (defined in `:root`). All theme classes prefixed `.ps-`
 - **JS**: Vanilla ES6+, no build step. Files in `assets/js/` must pass `node --check`
 - **No `!important`** on global elements — prevents plugin conflicts
 - Plugin CSS namespaces are untouched (`.pn-*` for Peptide News, `.psa-*` for Peptide Search AI, `.prab-*` for PRAutoBlogger)
 ## Design System
 - **Font**: Inter (Google Fonts) with system fallback
 - **Scale**: 1.125x modular, 8px grid base
 - **Primary color**: `#0066CC` (light) / `#3B82F6` (dark)
 - **Breakpoints**: 480px, 768px, 1024px, 1440px (mobile-first)
 - **Dark mode**: CSS custom properties swap via `html[data-theme="dark"]` or `prefers-color-scheme: dark`
 ## Plugin Integration
 The theme integrates with three companion plugins via shortcodes, all wrapped in `shortcode_exists()` for graceful degradation:
 1. **Peptide Search AI** (`[peptide_search]`) — AI search in hero section
 2. **Peptide News** (`[peptide_news]`) — News feed on front page
 3. **PRAutoBlogger** (`[prautoblogger_posts]`) — Auto-generated research articles on front page
 ## Customizer Options
 Editable via Appearance → Customize:
 - Hero title, subtitle, search placeholder
 - Footer copyright text
 - Dark mode default on/off
 ## Version
 Current: **v1.3.1** (defined in `style.css` header and `PEPTIDE_STARTER_VERSION` constant in `functions.php`)
 When bumping version, update both locations.
--- a/CONVENTIONS.md
+++ b/CONVENTIONS.md
@@ -129,43 +129,6 @@ do_action( 'peptide_starter_hero_before' );
 - **languages/:** Translation files
 - **template-parts/:** Reusable template parts
 ## How to add a performance policy rule
 When adding a new asset-perf rule (e.g., a new plugin's CSS to dequeue on
 non-relevant pages, or a new font family to slim):
 1. **For dequeues:** edit `inc/perf-asset-policy.php`. Add the plugin's
   handle list to a new function (or extend the existing arrays via the
   matching filter — `peptide_starter_perf_<plugin>_handles`). Hook the
   new dequeue function on `wp_enqueue_scripts` priority 100, gated by
   `PEPTIDE_STARTER_PERF_DEQUEUE` and a context predicate (e.g.,
   `is_front_page()`, `! is_woocommerce()`).
 2. **For font slimming:** add the family to the default array in
   `peptide_starter_perf_slim_google_fonts()`, or override at runtime
   via the `peptide_starter_perf_font_weights` filter. Specify only
   weights actually used by the design system; defaulting to "all weights"
   defeats the purpose.
 3. **For new resource hints:** extend `peptide_starter_perf_resource_hints()`
   with the new domain in the `preconnect` array. WP renders the
   `<link>` tag automatically; don't echo your own.
 4. **For deferring third-party scripts:** add the script handle to the
   list in `peptide_starter_perf_defer_cookie_notice()` (or rename the
   function if it grows beyond cookie-notice).
 5. **Always add a test case** in `tests/test-perf-asset-policy.php`
   covering the new rule's happy path AND its negation (the page-context
   where the rule must NOT apply). The dequeue logic is silent if a
   handle name is wrong — only tests catch this before deploy.
 6. **Verify on production handles** before committing. Plugin handle
   names are not always what you'd guess. SSH to Hostinger and run
   `wp eval 'global $wp_styles; do_action("wp_enqueue_scripts");
   foreach($wp_styles->registered as $h=>$o){echo $h.PHP_EOL;}'` to
   dump the actual handle names.
 ## Step-by-Step Guides
 ### How to Add a New Template
@@ -629,26 +592,6 @@ echo get_theme_mod( 'hero_title' );
 echo get_theme_mod( 'dark_mode_default', false );
 ```
 ## Trust model for request headers (v1.5.2)
 Never trust `HTTP_X_FORWARDED_FOR`, `HTTP_CF_CONNECTING_IP`, or any other
 client-controlled header without first validating the peer. Always read
 the client IP via `peptide_starter_get_client_ip()` — it handles the
 Cloudflare-peer check, the XFF opt-in, and the `REMOTE_ADDR` fallback.
 If a new feature needs to trust a different proxy header (e.g. a new CDN
 in front of CF):
 1. Add the upstream proxy's IP ranges to a new file under `inc/`.
 2. Extend `peptide_starter_get_client_ip()` with a new validated branch
   guarded by a filter defaulted to off.
 3. Never accept a header whose source can't be validated at the TCP
   layer.
 Refresh the Cloudflare range snapshot in `inc/cloudflare-ips.php`
 quarterly. Out-of-band bumps go through the
 `peptide_starter_cloudflare_ip_ranges` filter.
 ## Security Patterns (v1.5.1)
 ### Rate-limit a handler
--- a/functions.php
+++ b/functions.php
@@ -15,7 +15,6 @@
 * @see inc/page-setup.php       — auto-create pages + v1.5.0 user migration
 * @see inc/mail-diagnostic.php  — admin deliverability test tool
 * @see inc/helpers.php          — nav walker, menu fallback, gates, utilities
 * @see inc/perf-asset-policy.php — asset dequeue + font slim + preconnect + defer
 *
 * @package peptide-starter
 */
@@ -26,7 +25,7 @@ if ( ! defined( 'ABSPATH' ) ) {
 }
 // Theme constants.
-define( 'PEPTIDE_STARTER_VERSION', '1.6.0' );
+define( 'PEPTIDE_STARTER_VERSION', '1.5.1' );
 define( 'PEPTIDE_STARTER_DIR', get_template_directory() );
 define( 'PEPTIDE_STARTER_URI', get_template_directory_uri() );
@@ -34,7 +33,6 @@ define( 'PEPTIDE_STARTER_URI', get_template_directory_uri() );
 // that calls peptide_starter_config_*; rate limiter before handlers.
 require_once PEPTIDE_STARTER_DIR . '/inc/config.php';
 require_once PEPTIDE_STARTER_DIR . '/inc/helpers.php';
 require_once PEPTIDE_STARTER_DIR . '/inc/cloudflare-ips.php';
 require_once PEPTIDE_STARTER_DIR . '/inc/rate-limiter.php';
 require_once PEPTIDE_STARTER_DIR . '/inc/email-verification.php';
 require_once PEPTIDE_STARTER_DIR . '/inc/customizer.php';
@@ -43,7 +41,6 @@ require_once PEPTIDE_STARTER_DIR . '/inc/contact-handler.php';
 require_once PEPTIDE_STARTER_DIR . '/inc/page-setup.php';
 require_once PEPTIDE_STARTER_DIR . '/inc/newsletter-admin.php';
 require_once PEPTIDE_STARTER_DIR . '/inc/mail-diagnostic.php';
 require_once PEPTIDE_STARTER_DIR . '/inc/perf-asset-policy.php';
 /**
 * Set up theme defaults and register support for WordPress features.
@@ -71,7 +68,6 @@ function peptide_starter_setup() {
 	load_theme_textdomain( 'peptide-starter', PEPTIDE_STARTER_DIR . '/languages' );
 }
 add_action( 'after_setup_theme', 'peptide_starter_setup' );
 add_action( 'after_setup_theme', 'peptide_starter_perf_asset_policy_init' );
 /**
 * Register and enqueue stylesheets and scripts.
--- a/inc/auth-handlers.php
+++ b/inc/auth-handlers.php
@@ -160,18 +160,11 @@ function peptide_starter_ajax_register() {
 	$pattern = sprintf( '/^[a-zA-Z0-9]{%d,%d}$/', (int) $config['username_min'], (int) $config['username_max'] );
-	// Evaluate every check unconditionally so response time doesn't reveal
+	if ( ! preg_match( $pattern, $username ) ||
-	// which branch failed. `username_exists` and `email_exists` are each a
+		! is_email( $email ) ||
-	// DB round-trip; skipping them when an earlier cheap check already
+		strlen( $password ) < (int) $config['password_min'] ||
-	// failed produces a response-time oracle that enables enumeration. We
+		username_exists( $username ) ||
-	// intentionally accept the extra queries as the cost of not leaking.
+		email_exists( $email ) ) {
 	$invalid_username = ! preg_match( $pattern, $username );
 	$invalid_email    = ! is_email( $email );
 	$invalid_password = strlen( $password ) < (int) $config['password_min'];
 	$username_taken   = (bool) username_exists( $username );
 	$email_taken      = (bool) email_exists( $email );
 	if ( $invalid_username || $invalid_email || $invalid_password || $username_taken || $email_taken ) {
 		wp_send_json_error( array( 'message' => peptide_starter_register_failure_message() ) );
 	}
--- a/inc/cloudflare-ips.php
+++ b/inc/cloudflare-ips.php
@@ -1,159 +0,0 @@
 <?php
 /**
 * Cloudflare Edge IP Allowlist
 *
 * Static snapshot of Cloudflare's published IPv4 and IPv6 ranges used by
 * the client-IP resolver to decide whether HTTP_CF_CONNECTING_IP can be
 * trusted. Embedded — not fetched — so a compromised external source
 * cannot grant attackers the right to spoof this header.
 *
 * Snapshot date: 2026-04-14
 * Sources:
 *   - https://www.cloudflare.com/ips-v4
 *   - https://www.cloudflare.com/ips-v6
 *
 * Refresh cadence: review quarterly. Cloudflare historically adds ranges
 * a few times a year and rarely removes them; a stale-but-superset list
 * still protects us because an attacker cannot inject themselves into
 * the list, and legitimate CF traffic from newer ranges simply falls
 * back to REMOTE_ADDR (no loss of functionality, only loss of header
 * trust on new-range origins — acceptable until next refresh).
 *
 * @see inc/rate-limiter.php — peptide_starter_get_client_ip() consumes
 * @see functions.php — includes this file
 *
 * What: Provides peptide_starter_cloudflare_ip_ranges() (filterable) and
 *       peptide_starter_is_cloudflare_peer( $ip ) CIDR matcher.
 * Who calls it: Only the IP resolver, on every public request.
 * Dependencies: inet_pton, PHP bitwise.
 *
 * @package peptide-starter
 */
 // Exit if accessed directly.
 if ( ! defined( 'ABSPATH' ) ) {
 	exit;
 }
 /**
 * Return the Cloudflare edge IPv4/IPv6 CIDR list.
 *
 * Override with add_filter( 'peptide_starter_cloudflare_ip_ranges', ... )
 * if the list needs an out-of-band bump between releases.
 *
 * @return array { 'v4' => string[], 'v6' => string[] } of CIDR blocks.
 */
 function peptide_starter_cloudflare_ip_ranges() {
 	$ranges = array(
 		'v4' => array(
 			'173.245.48.0/20',
 			'103.21.244.0/22',
 			'103.22.200.0/22',
 			'103.31.4.0/22',
 			'141.101.64.0/18',
 			'108.162.192.0/18',
 			'190.93.240.0/20',
 			'188.114.96.0/20',
 			'197.234.240.0/22',
 			'198.41.128.0/17',
 			'162.158.0.0/15',
 			'104.16.0.0/13',
 			'104.24.0.0/14',
 			'172.64.0.0/13',
 			'131.0.72.0/22',
 		),
 		'v6' => array(
 			'2400:cb00::/32',
 			'2606:4700::/32',
 			'2803:f800::/32',
 			'2405:b500::/32',
 			'2405:8100::/32',
 			'2a06:98c0::/29',
 			'2c0f:f248::/32',
 		),
 	);
 	/**
 	 * Filter the Cloudflare edge IP ranges used by the client-IP resolver.
 	 *
 	 * Operators can override this without a code deploy. Shape must be an
 	 * array with 'v4' and 'v6' keys, each a list of CIDR strings.
 	 *
 	 * @param array $ranges Default snapshot.
 	 */
 	return apply_filters( 'peptide_starter_cloudflare_ip_ranges', $ranges );
 }
 /**
 * Check whether an IP address is within a Cloudflare edge range.
 *
 * Handles both IPv4 and IPv6. Returns false on unparseable input.
 *
 * @param string $ip Candidate IP (e.g. REMOTE_ADDR).
 * @return bool True if $ip falls inside any CF CIDR in the current snapshot.
 */
 function peptide_starter_is_cloudflare_peer( $ip ) {
 	if ( ! is_string( $ip ) || '' === $ip ) {
 		return false;
 	}
 	if ( ! filter_var( $ip, FILTER_VALIDATE_IP ) ) {
 		return false;
 	}
 	$ranges = peptide_starter_cloudflare_ip_ranges();
 	$is_v6  = ( false !== strpos( $ip, ':' ) );
 	$list   = $is_v6 ? ( isset( $ranges['v6'] ) ? $ranges['v6'] : array() ) : ( isset( $ranges['v4'] ) ? $ranges['v4'] : array() );
 	foreach ( $list as $cidr ) {
 		if ( peptide_starter_cidr_match( $ip, $cidr ) ) {
 			return true;
 		}
 	}
 	return false;
 }
 /**
 * Test whether $ip is inside $cidr. Supports v4 and v6.
 *
 * Implementation note: we use inet_pton for both families so the same
 * byte-compare loop handles v4 (4 bytes) and v6 (16 bytes). Mask bits
 * beyond the prefix length are zeroed by ignoring them in the compare.
 *
 * @param string $ip   IP to test.
 * @param string $cidr Block in CIDR notation.
 * @return bool
 */
 function peptide_starter_cidr_match( $ip, $cidr ) {
 	if ( ! is_string( $cidr ) || false === strpos( $cidr, '/' ) ) {
 		return false;
 	}
 	list( $subnet, $bits ) = explode( '/', $cidr, 2 );
 	$bits                  = (int) $bits;
 	$ip_bin     = @inet_pton( $ip );
 	$subnet_bin = @inet_pton( $subnet );
 	if ( false === $ip_bin || false === $subnet_bin ) {
 		return false;
 	}
 	if ( strlen( $ip_bin ) !== strlen( $subnet_bin ) ) {
 		return false; // Family mismatch.
 	}
 	if ( $bits < 0 || $bits > ( strlen( $ip_bin ) * 8 ) ) {
 		return false;
 	}
 	$full_bytes = intdiv( $bits, 8 );
 	$remaining  = $bits % 8;
 	if ( $full_bytes > 0 && 0 !== substr_compare( $ip_bin, $subnet_bin, 0, $full_bytes ) ) {
 		return false;
 	}
 	if ( 0 === $remaining ) {
 		return true;
 	}
 	$mask        = chr( ( 0xFF << ( 8 - $remaining ) ) & 0xFF );
 	$ip_byte     = substr( $ip_bin, $full_bytes, 1 );
 	$subnet_byte = substr( $subnet_bin, $full_bytes, 1 );
 	return ( $ip_byte & $mask ) === ( $subnet_byte & $mask );
 }
--- a/inc/email-verification.php
+++ b/inc/email-verification.php
@@ -99,11 +99,10 @@ function peptide_starter_send_verification_email( $user_id ) {
 /**
 * Whether a user has completed email verification.
 *
- * Users without the ps_pending_verification meta are treated as verified.
+ * Users without the ps_pending_verification meta are treated as verified
- * This includes all accounts created before v1.5.2 — the v1.5.1 re-verify
+ * (covers accounts created before v1.5.1 that were never enrolled; the
- * migration was removed in v1.5.2 (see CHANGELOG § [1.5.2] PSEC-008);
+ * migration in inc/page-setup.php enrolls existing v1.5.0 users explicitly
- * existing accounts are grandfathered. Verification is enforced on new
+ * where applicable).
 * registrations from v1.5.2 forward.
 *
 * @param int $user_id User ID.
 * @return bool True if verified or exempt; false if pending.
--- a/inc/page-setup.php
+++ b/inc/page-setup.php
@@ -1,21 +1,18 @@
 <?php
 /**
- * Auto-Create Pages on Theme Activation
+ * Auto-Create Pages + v1.5.0 User Migration
 *
- * Creates the required WordPress pages with the correct templates
+ * On theme activation, creates the required WordPress pages with the
- * assigned on theme activation, and performs small one-off cleanups
+ * correct templates assigned, and runs a one-time migration that enrols
- * tied to version bumps.
+ * pre-v1.5.1 users into the email-verification flow.
 *
 * As of v1.5.2 this file does NOT run a user-verification migration:
 * existing accounts created before v1.5.2 are grandfathered as
 * verified (see ADR-0001 addendum / CHANGELOG [1.5.2] PSEC-008).
 *
 * @see functions.php — includes this file
 * @see inc/email-verification.php — peptide_starter_send_verification_email()
 * @see ARCHITECTURE.md — page/template map
 *
- * What: Theme-activation hook for page provisioning + version cleanup.
+ * What: Theme-activation hooks for page provisioning and user enrolment.
 * Who calls it: WordPress after_switch_theme.
- * Dependencies: wp_insert_post, update_post_meta.
+ * Dependencies: wp_insert_post, update_post_meta, user meta.
 *
 * @package peptide-starter
 */
@@ -104,9 +101,54 @@ function peptide_starter_create_pages() {
 			update_post_meta( $page_id, '_wp_page_template', $page_data['template'] );
 		}
 	}
 	// v1.5.2 cleanup: the v1.5.1 migration writes this flag. Drop it on
 	// activation so the removed migration doesn't leave dangling state.
 	delete_option( 'ps_verify_migration_version' );
 }
 add_action( 'after_switch_theme', 'peptide_starter_create_pages' );
 /**
 * One-time migration: enrol v1.5.0 subscribers into email verification.
 *
 * Runs once per site — guarded by the ps_verify_migration_version option.
 * Iterates subscribers in batches of 50 via wp_mail(). Users created by
 * admin (any role above subscriber) are skipped — we assume admin-created
 * accounts are trusted.
 *
 * Side effects: writes user meta + sends email per enrolled user.
 *
 * Cost note: worst case N emails on first admin page load after deploy.
 * If the site has many users, move this to WP-Cron before shipping a
 * large-user release (not a concern for the current zero-user site).
 *
 * @return void
 */
 function peptide_starter_migrate_existing_users_to_verification() {
 	if ( ! is_admin() ) {
 		return;
 	}
 	$done = get_option( 'ps_verify_migration_version' );
 	if ( PEPTIDE_STARTER_VERSION === $done ) {
 		return;
 	}
 	$subscribers = get_users(
 		array(
 			'role'    => 'subscriber',
 			'fields'  => array( 'ID' ),
 			'number'  => 500,
 			'orderby' => 'ID',
 			'order'   => 'ASC',
 		)
 	);
 	foreach ( $subscribers as $user ) {
 		$already_enrolled = get_user_meta( $user->ID, 'ps_pending_verification', true );
 		if ( '' !== (string) $already_enrolled ) {
 			continue;
 		}
 		if ( function_exists( 'peptide_starter_send_verification_email' ) ) {
 			peptide_starter_send_verification_email( $user->ID );
 		}
 	}
 	update_option( 'ps_verify_migration_version', PEPTIDE_STARTER_VERSION, false );
 }
 add_action( 'admin_init', 'peptide_starter_migrate_existing_users_to_verification' );
--- a/inc/perf-asset-policy.php
+++ b/inc/perf-asset-policy.php
@@ -1,313 +0,0 @@
 <?php
 /**
 * Performance Asset Policy Module
 *
 * Optimizes the front-end asset graph by dequeuing unnecessary plugin styles/scripts
 * and slimming font requests. Targets mobile LCP improvement through:
 * - Conditional dequeue of WC, Elementor, and USMI assets
 * - Google Fonts weight slimming (36 faces → 5)
 * - Preconnect hints for font.googleapis.com + fonts.gstatic.com
 * - Defer attribute on cookie-notice script
 *
 * What: Performance optimizations; no template changes.
 * Who calls it: functions.php via add_action( 'after_setup_theme', '..._init' ).
 * Dependencies: WordPress hooks system; works independently.
 *
 * @see functions.php — requires and hooks this module
 * @see CHANGELOG.md — [1.6.0] release notes
 *
 * @package peptide-starter
 */
 // Exit if accessed directly.
 if ( ! defined( 'ABSPATH' ) ) {
 	exit;
 }
 /**
 * Initialize the performance asset policy module.
 *
 * Wires all dequeue, font slim, preconnect, and defer hooks at the correct priorities.
 * Called once per request from the 'after_setup_theme' action.
 *
 * @return void
 */
 function peptide_starter_perf_asset_policy_init() {
 	// Dequeue unnecessary plugin assets at priority 100 (one beat after plugin_overrides).
 	add_action( 'wp_enqueue_scripts', 'peptide_starter_perf_dequeue_plugin_assets', 100 );
 	// Slim Google Fonts to essential weights only.
 	add_filter( 'style_loader_src', 'peptide_starter_perf_slim_google_fonts', 10, 2 );
 	// Add preconnect hints for font servers.
 	add_filter( 'wp_resource_hints', 'peptide_starter_perf_resource_hints', 10, 2 );
 	// Defer cookie-notice script to prevent render blocking.
 	add_filter( 'script_loader_tag', 'peptide_starter_perf_defer_cookie_notice', 10, 3 );
 }
 /**
 * Dequeue assets on non-applicable page types.
 *
 * Removes WooCommerce, Elementor, and Ultimate Social Media Icons assets from pages
 * that don't use them. Controlled by the kill-switch constant PEPTIDE_STARTER_PERF_DEQUEUE.
 *
 * Dequeue conditions:
 * - WC: removed unless on shop, cart, checkout, or account pages
 * - Elementor: removed if page doesn't use Elementor builder
 * - USMI: removed on homepage, archives, and blog index
 *
 * @return void
 */
 function peptide_starter_perf_dequeue_plugin_assets() {
 	// Kill-switch: if disabled in wp-config.php, do nothing.
 	if ( defined( 'PEPTIDE_STARTER_PERF_DEQUEUE' ) && ! PEPTIDE_STARTER_PERF_DEQUEUE ) {
 		return;
 	}
 	// WooCommerce assets: dequeue on non-shop pages.
 	if ( ! is_woocommerce() && ! is_cart() && ! is_checkout() && ! is_account_page() ) {
 		// Get configured WC handles from filter; default list.
 		$wc_styles = apply_filters(
 			'peptide_starter_perf_woocommerce_styles',
 			array( 'woocommerce-layout', 'woocommerce-smallscreen', 'woocommerce-general' )
 		);
 		foreach ( $wc_styles as $handle ) {
 			wp_dequeue_style( $handle );
 		}
 		$wc_scripts = apply_filters(
 			'peptide_starter_perf_woocommerce_scripts',
 			array( 'wc-add-to-cart', 'woocommerce', 'sourcebuster-js', 'wc-order-attribution' )
 		);
 		foreach ( $wc_scripts as $handle ) {
 			wp_dequeue_script( $handle );
 		}
 	}
 	// Elementor assets: dequeue if page doesn't use Elementor.
 	if ( ! peptide_starter_page_uses_elementor( get_queried_object_id() ) ) {
 		$elementor_handles = apply_filters(
 			'peptide_starter_perf_elementor_handles',
 			array( 'elementor-frontend', 'elementor-frontend-legacy' )
 		);
 		foreach ( $elementor_handles as $handle ) {
 			wp_dequeue_style( $handle );
 		}
 		// Dequeue Elementor per-post CSS files (pattern: posts-*.css or post-*.css).
 		// These are added dynamically; we identify them by src pattern and remove before render.
 		// Note: post-22 and post-34 are specific Elementor archive template files.
 		global $wp_styles;
 		if ( isset( $wp_styles->queue ) ) {
 			$elementor_post_styles = array();
 			foreach ( $wp_styles->queue as $handle ) {
 				if ( isset( $wp_styles->registered[ $handle ] ) ) {
 					$src = $wp_styles->registered[ $handle ]->src;
 					// Detect Elementor per-post CSS by path pattern.
 					if ( $src && preg_match( '/uploads\/elementor\/css\/post-\d+\.css/', $src ) ) {
 						$elementor_post_styles[] = $handle;
 					}
 				}
 			}
 			foreach ( $elementor_post_styles as $handle ) {
 				wp_dequeue_style( $handle );
 			}
 		}
 	}
 	// Ultimate Social Media Icons: dequeue on homepage, archives, and blog index.
 	if ( is_front_page() || is_home() || is_archive() ) {
 		$usmi_handles = apply_filters(
 			'peptide_starter_perf_usmi_handles',
 			array(
 				'SFSImainCss',
 				'SFSIjqueryModernizr',
 				'SFSIjqueryShuffle',
 				'SFSIjqueryrandom-shuffle',
 				'SFSICustomJs',
 			)
 		);
 		foreach ( $usmi_handles as $handle ) {
 			wp_dequeue_style( $handle );
 			wp_dequeue_script( $handle );
 		}
 	}
 }
 /**
 * Slim Google Fonts to essential weights only.
 *
 * Rewrites fonts.googleapis.com URLs to keep only:
 * - Roboto: 400, 500, 700 (no italics)
 * - Roboto Slab: 400, 700 (no italics)
 *
 * This reduces the font CSS from ~6KB to <1KB and the font payload by ~80%.
 * Filterable per family via 'peptide_starter_perf_font_weights'.
 *
 * @param string $src    Stylesheet URL.
 * @param string $handle Stylesheet handle.
 * @return string Rewritten URL or original.
 */
 function peptide_starter_perf_slim_google_fonts( $src, $handle ) {
 	if ( ! $src || false === strpos( $src, 'fonts.googleapis.com' ) ) {
 		return $src;
 	}
 	// Parse the URL to get the query string.
 	$parsed = wp_parse_url( $src );
 	if ( empty( $parsed['query'] ) ) {
 		return $src;
 	}
 	// Extract family parameter.
 	parse_str( $parsed['query'], $query_vars );
 	if ( empty( $query_vars['family'] ) ) {
 		return $src;
 	}
 	$families_str = $query_vars['family'];
 	// Decode the family string (it may be URL-encoded).
 	$families_str = rawurldecode( $families_str );
 	// Split families by + (multiple families in one request).
 	$families = explode( '+', $families_str );
 	// Get configured font weights from filter.
 	$font_weights_config = apply_filters(
 		'peptide_starter_perf_font_weights',
 		array(
 			'Roboto'       => array( 400, 500, 700 ),
 			'Roboto Slab'  => array( 400, 700 ),
 		)
 	);
 	$rewritten_families = array();
 	foreach ( $families as $family ) {
 		// Clean up the family name (URL decode + trim).
 		$family = trim( rawurldecode( $family ) );
 		// Check if this family has a configured weight list.
 		$matched = false;
 		foreach ( $font_weights_config as $config_family => $weights ) {
 			if ( 0 === strcasecmp( $family, $config_family ) ) {
 				// Rewrite with only the specified weights.
 				$weights_str = implode( ',', $weights );
 				$rewritten_families[] = $config_family . ':' . $weights_str;
 				$matched = true;
 				break;
 			}
 		}
 		// If no config match, pass through unchanged.
 		if ( ! $matched ) {
 			$rewritten_families[] = $family;
 		}
 	}
 	// If nothing changed, return original.
 	if ( count( $rewritten_families ) === count( $families ) ) {
 		// Check if any actually changed (compare raw values).
 		$original_str = implode( '+', $families );
 		$rewritten_str = implode( '+', $rewritten_families );
 		if ( $original_str === $rewritten_str ) {
 			return $src;
 		}
 	}
 	// Rebuild the URL with the new family parameter.
 	$new_query_vars = $query_vars;
 	$new_query_vars['family'] = implode( '+', $rewritten_families );
 	$new_query_str = http_build_query( $new_query_vars );
 	// Reconstruct the full URL.
 	$new_src = $parsed['scheme'] . '://' . $parsed['host'] . $parsed['path'] . '?' . $new_query_str;
 	return $new_src;
 }
 /**
 * Add preconnect hints for font servers.
 *
 * Reduces TLS + DNS latency for Google Fonts requests on cold cache.
 * Adds preconnect for fonts.googleapis.com and fonts.gstatic.com.
 *
 * @param array  $urls  List of URLs to add hints for.
 * @param string $rel   The relationship type (preconnect, dns-prefetch, etc.).
 * @return array Modified URL list.
 */
 function peptide_starter_perf_resource_hints( $urls, $rel ) {
 	// Only add hints for preconnect relationships.
 	if ( 'preconnect' !== $rel ) {
 		return $urls;
 	}
 	// Add font servers if not already present.
 	$font_urls = apply_filters(
 		'peptide_starter_perf_font_preconnect_urls',
 		array(
 			'https://fonts.googleapis.com',
 			'https://fonts.gstatic.com',
 		)
 	);
 	foreach ( $font_urls as $url ) {
 		if ( ! in_array( $url, $urls, true ) ) {
 			$urls[] = $url;
 		}
 	}
 	return $urls;
 }
 /**
 * Defer the cookie-notice script to avoid render-blocking.
 *
 * Adds 'defer' attribute to cookie-notice JS while preserving DOM-ready order.
 * This ensures the cookie banner loads without blocking initial rendering.
 *
 * @param string $tag    The script tag HTML.
 * @param string $handle The script handle.
 * @param string $src    The script URL (unused).
 * @return string Modified script tag.
 */
 function peptide_starter_perf_defer_cookie_notice( $tag, $handle, $src ) {
 	// Only modify the cookie-notice script.
 	if ( 'cookie-notice-front' !== $handle ) {
 		return $tag;
 	}
 	// Add defer attribute if not already present.
 	if ( false === strpos( $tag, 'defer' ) ) {
 		// Insert defer before the closing >.
 		$tag = str_replace( '<script ', '<script defer ', $tag );
 	}
 	return $tag;
 }
 /**
 * Check if a page uses the Elementor builder.
 *
 * Inspects the _elementor_edit_mode post meta. If the page is in builder mode,
 * we assume Elementor styles are needed (even if no actual content yet).
 *
 * @param int $post_id The post ID to check.
 * @return bool True if page uses Elementor, false otherwise.
 */
 function peptide_starter_page_uses_elementor( $post_id ) {
 	if ( ! $post_id || ! is_singular() ) {
 		return false;
 	}
 	$edit_mode = get_post_meta( $post_id, '_elementor_edit_mode', true );
 	return ! empty( $edit_mode ) && 'builder' === $edit_mode;
 }
--- a/inc/rate-limiter.php
+++ b/inc/rate-limiter.php
@@ -1,6 +1,6 @@
 <?php
 /**
- * Transient-backed Rate Limiter + Trustworthy Client IP
+ * Transient-backed Rate Limiter
 *
 * Generic check/record/reset limiter used by every public endpoint
 * (login, register, contact, newsletter, verify-resend). State lives
@@ -11,13 +11,12 @@
 * Raw IPs are never stored.
 *
 * @see inc/config.php — supplies per-action limit + window.
 * @see inc/cloudflare-ips.php — edge-range allowlist for CF-Connecting-IP trust.
 * @see inc/auth-handlers.php, inc/contact-handler.php — primary callers.
 * @see functions.php — includes this file.
 *
- * What: Rate limit check/record/reset + peer-validated client-IP resolver.
+ * What: Rate limit check/record/reset for any action+identifier pair.
 * Who calls it: Every public handler after nonce verification.
- * Dependencies: WordPress transients, inc/config.php, inc/cloudflare-ips.php.
+ * Dependencies: WordPress transients, inc/config.php, peptide_starter_get_client_ip().
 *
 * @package peptide-starter
 */
@@ -40,7 +39,8 @@ class Peptide_Starter_Rate_Limiter {
 	 * Build the transient key for a given action + identifier.
 	 *
 	 * Uses a truncated wp_hash so the stored key never exposes the raw IP
-	 * or raw identifier. 16 hex chars ≈ 64 bits of collision resistance.
+	 * or raw identifier. 16 hex chars ≈ 64 bits of collision resistance —
 	 * sufficient for the cardinality of a WP site.
 	 *
 	 * @param string $action     Action slug (e.g. 'login').
 	 * @param string $identifier Extra identifier (email hash, form slug, etc.).
@@ -53,10 +53,10 @@ class Peptide_Starter_Rate_Limiter {
 	}
 	/**
-	 * Whether the caller is still within their budget.
+	 * Check whether the caller is still within their budget.
 	 *
-	 * Does not mutate state — call record() on failure (or at the start of
+	 * Does not mutate state — call record() after a failed attempt (or at the
-	 * every attempt if you want to meter successes too).
+	 * start of every attempt if you want to meter successes too).
 	 *
 	 * @param string $action     Action slug configured in security config.
 	 * @param string $identifier Caller-supplied identifier (e.g. sha256(email)).
@@ -88,6 +88,9 @@ class Peptide_Starter_Rate_Limiter {
 	/**
 	 * Clear the counter for an action + identifier.
 	 *
 	 * Call on successful login so a legit user isn't locked out by their
 	 * own earlier typos.
 	 *
 	 * Side effects: deletes a transient.
 	 *
 	 * @param string $action     Action slug.
@@ -101,64 +104,53 @@ class Peptide_Starter_Rate_Limiter {
 }
 /**
- * Resolve the client IP we will trust for rate-limit keying.
+ * Best-effort client IP resolver.
 *
- * Trust model (v1.5.2):
+ * Order of trust (first match wins):
- *   - REMOTE_ADDR is the ground truth — it is always returned as the
+ *   1. HTTP_CF_CONNECTING_IP — set by Cloudflare edge (peptiderepo.com uses CF).
- *     fallback and cannot be forged by a client.
+ *   2. HTTP_X_FORWARDED_FOR  — first entry; only trusted on hosts that set it.
- *   - HTTP_CF_CONNECTING_IP is trusted ONLY when REMOTE_ADDR is a known
+ *   3. REMOTE_ADDR           — direct peer.
 *     Cloudflare edge (see inc/cloudflare-ips.php). If the origin is
 *     reached directly (bypassing CF), attackers could otherwise spoof
 *     any IP they liked and bypass every rate limiter.
 *   - HTTP_X_FORWARDED_FOR is ignored by default. Operators who run
 *     behind a different trusted proxy can opt-in via the
 *     peptide_starter_trust_xff filter returning true.
 *
- * Invalid / unparseable header values are silently ignored.
+ * Note: the hosting environment (Hostinger + Cloudflare) reliably populates
 * HTTP_CF_CONNECTING_IP. If deployment moves off CF, the filter below can be
 * used to override.
 *
- * @return string Validated IPv4/IPv6 string; '0.0.0.0' only if REMOTE_ADDR
+ * @return string IPv4/IPv6 string or '0.0.0.0' when nothing parseable.
 *                is empty or unparseable (shouldn't happen in practice).
 */
 function peptide_starter_get_client_ip() {
-	$remote_raw = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';
+	$candidates = array( 'HTTP_CF_CONNECTING_IP', 'HTTP_X_FORWARDED_FOR', 'REMOTE_ADDR' );
-	$remote     = filter_var( $remote_raw, FILTER_VALIDATE_IP ) ? $remote_raw : '0.0.0.0';
+	$ip         = '';
 	foreach ( $candidates as $key ) {
 		if ( empty( $_SERVER[ $key ] ) ) {
 			continue;
 		}
 		$raw   = sanitize_text_field( wp_unslash( $_SERVER[ $key ] ) );
 		$first = trim( explode( ',', $raw )[0] );
 		if ( filter_var( $first, FILTER_VALIDATE_IP ) ) {
 			$ip = $first;
 			break;
 		}
 	}
 	if ( '' === $ip ) {
 		$ip = '0.0.0.0';
 	}
 	// CF-Connecting-IP — only trusted when the peer itself is a CF edge.
 	if ( ! empty( $_SERVER['HTTP_CF_CONNECTING_IP'] )
 		&& function_exists( 'peptide_starter_is_cloudflare_peer' )
 		&& peptide_starter_is_cloudflare_peer( $remote ) ) {
 		$cf = sanitize_text_field( wp_unslash( $_SERVER['HTTP_CF_CONNECTING_IP'] ) );
 		if ( filter_var( $cf, FILTER_VALIDATE_IP ) ) {
 	/**
-			 * Filter the resolved client IP.
+	 * Filter the resolved client IP — for custom infra overrides.
 	 *
 	 * @param string $ip Resolved IP.
 	 */
-			return apply_filters( 'peptide_starter_client_ip', $cf );
+	return apply_filters( 'peptide_starter_client_ip', $ip );
 		}
 	}
 	/**
 	 * Whether to trust HTTP_X_FORWARDED_FOR. Off by default — only enable
 	 * when a known, trusted non-CF proxy sits in front of the origin.
 	 *
 	 * @param bool $trust Default false.
 	 */
 	$trust_xff = (bool) apply_filters( 'peptide_starter_trust_xff', false );
 	if ( $trust_xff && ! empty( $_SERVER['HTTP_X_FORWARDED_FOR'] ) ) {
 		$xff   = sanitize_text_field( wp_unslash( $_SERVER['HTTP_X_FORWARDED_FOR'] ) );
 		$first = trim( explode( ',', $xff )[0] );
 		if ( filter_var( $first, FILTER_VALIDATE_IP ) ) {
 			return apply_filters( 'peptide_starter_client_ip', $first );
 		}
 	}
 	return apply_filters( 'peptide_starter_client_ip', $remote );
 }
 /**
 * Hash an identifier for rate-limit keying without storing plaintext.
 *
 * Use this for any identifier you don't want to hash in-line at every call
 * site (typically the lowercased email address on login).
 *
 * @param string $value Raw identifier.
 * @return string 32-char hex substring of a sha256.
 */
--- a/style.css
+++ b/style.css
@@ -4,7 +4,7 @@ Theme URI: https://github.com/peptiderepo/peptide-starter
 Description: Premium, accessible WordPress theme for scientific peptide reference database
 Author: Peptide Repo
 Author URI: https://peptiderepo.com
-Version: 1.6.0
+Version: 1.5.1
 License: GPL v2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 Text Domain: peptide-starter
@@ -583,24 +583,6 @@ nav a {
  color: var(--color-text-primary);
 }
 /* ---- FEATURED IMAGES ---- */
 .ps-featured-image {
  width: 100%;
  text-align: center;
  border-radius: var(--radius-lg);
  overflow: hidden;
 }
 .ps-featured-image img {
  display: block;
  width: 100%;
  max-width: 100%;
  height: auto;
  margin: 0 auto;
  border-radius: var(--radius-lg);
 }
 /* ---- BADGES & TAGS ---- */
 .ps-badge {
--- a/template-parts/content.php
+++ b/template-parts/content.php
@@ -39,8 +39,8 @@
 		<?php
 		if ( has_post_thumbnail() ) {
 			?>
-			<div class="ps-featured-image" style="margin-bottom: var(--spacing-lg);">
+			<div style="margin-bottom: var(--spacing-lg);">
-				<?php the_post_thumbnail( 'full' ); ?>
+				<?php the_post_thumbnail( 'medium' ); ?>
 			</div>
 			<?php
 		}
--- a/tests/test-auth-handlers.php
+++ b/tests/test-auth-handlers.php
@@ -137,51 +137,6 @@ class Test_Auth_Handlers extends WP_UnitTestCase {
 		$this->assertSame( peptide_starter_register_failure_message(), $this->captured['data']['message'] );
 	}
 	/**
 	 * PSEC-009: registration validation path is not short-circuit.
 	 *
 	 * We can't directly mock `preg_match` / `username_exists` etc. from
 	 * userland. Instead, we assert the behavioural contract: even when an
 	 * early check has already failed (invalid username pattern), the
 	 * handler still runs the later DB-backed checks. We observe this by
 	 * filtering `pre_user_login` which wp_create_user-adjacent code paths
 	 * consult, and by checking that `username_exists` was called via a
 	 * filter it would fire. A simpler surrogate is to hook into WordPress'
 	 * `user_search_query` / `query` action and confirm at least one user
 	 * lookup happened during a failing registration — which would not
 	 * happen if the handler short-circuited on the pattern failure.
 	 */
 	public function test_register_runs_all_checks_even_when_early_one_fails() {
 		$queries_ran = 0;
 		$counter     = function ( $query ) use ( &$queries_ran ) {
 			// wp_cache_get avoids counting ourselves. We only care whether
 			// any user-table-touching query fires during the handler run.
 			if ( is_string( $query ) && false !== stripos( $query, 'users' ) ) {
 				$queries_ran++;
 			}
 			return $query;
 		};
 		add_filter( 'query', $counter );
 		update_option( 'users_can_register', 1 );
 		$_POST = array(
 			'ps_register_nonce' => wp_create_nonce( 'ps_auth_register' ),
 			'username'          => 'ab', // Too short — early check fails.
 			'email'             => 'validformat@example.com',
 			'password'          => 'longenoughpassword',
 		);
 		try { peptide_starter_ajax_register(); } catch ( WPAjaxDieStopException $e ) { /* ok */ }
 		remove_filter( 'query', $counter );
 		$this->assertGreaterThan(
 			0,
 			$queries_ran,
 			'username_exists / email_exists must still run even when pattern check fails (PSEC-009 non-short-circuit).'
 		);
 		$this->assertSame( peptide_starter_register_failure_message(), $this->captured['data']['message'] );
 	}
 	public function test_register_duplicate_email_returns_unified_message() {
 		self::factory()->user->create( array( 'user_email' => 'dup@example.com' ) );
 		update_option( 'users_can_register', 1 );
--- a/tests/test-email-verification.php
+++ b/tests/test-email-verification.php
@@ -44,50 +44,6 @@ class Test_Email_Verification extends WP_UnitTestCase {
 		$this->assertFalse( peptide_starter_user_is_verified( $user_id ) );
 	}
 	public function test_valid_token_verifies_user_clears_meta_and_fires_hook() {
 		$user_id = self::factory()->user->create();
 		peptide_starter_send_verification_email( $user_id );
 		$token = get_user_meta( $user_id, 'ps_verify_token', true );
 		$this->assertNotEmpty( $token );
 		$_GET['uid']   = $user_id;
 		$_GET['token'] = $token;
 		set_query_var( 'ps_verify', 1 );
 		$redirected   = null;
 		$hook_user_id = null;
 		add_filter(
 			'wp_redirect',
 			function ( $url ) use ( &$redirected ) {
 				$redirected = $url;
 				return false;
 			}
 		);
 		add_action(
 			'peptide_starter_user_verified',
 			function ( $uid ) use ( &$hook_user_id ) {
 				$hook_user_id = $uid;
 			}
 		);
 		try {
 			peptide_starter_handle_verify_request();
 		} catch ( Exception $e ) { /* exit path */ }
 		$this->assertNotNull( $redirected, 'Must redirect on successful verify.' );
 		$this->assertStringContainsString( 'verified=1', (string) $redirected );
 		$this->assertSame( '', (string) get_user_meta( $user_id, 'ps_pending_verification', true ) );
 		$this->assertSame( '', (string) get_user_meta( $user_id, 'ps_verify_token', true ) );
 		$this->assertSame( '', (string) get_user_meta( $user_id, 'ps_verify_expires', true ) );
 		$this->assertSame( $user_id, get_current_user_id(), 'User must be logged in after successful verify.' );
 		$this->assertSame( $user_id, $hook_user_id, 'peptide_starter_user_verified must fire with the user ID.' );
 		remove_all_filters( 'wp_redirect' );
 		remove_all_actions( 'peptide_starter_user_verified' );
 		set_query_var( 'ps_verify', 0 );
 		wp_set_current_user( 0 );
 	}
 	public function test_verification_handler_rejects_bad_token() {
 		$user_id = self::factory()->user->create();
 		peptide_starter_send_verification_email( $user_id );
--- a/tests/test-perf-asset-policy.php
+++ b/tests/test-perf-asset-policy.php
@@ -1,244 +0,0 @@
 <?php
 /**
 * Tests for inc/perf-asset-policy.php.
 *
 * Covers: conditional dequeue logic (WC, Elementor, USMI), font weight slimming,
 * preconnect hints, script defer, kill-switch, and filter overrides.
 *
 * @package peptide-starter
 */
 /**
 * Test perf-asset-policy module initialization and hooks.
 */
 class Test_Perf_Asset_Policy extends WP_UnitTestCase {
 	/**
 	 * Test: Kill-switch constant disables all dequeue logic.
 	 *
 	 * When PEPTIDE_STARTER_PERF_DEQUEUE is defined false, the dequeue function
 	 * should early-return without removing anything.
 	 */
 	public function test_kill_switch_disables_dequeue() {
 		// Define kill-switch to false.
 		define( 'PEPTIDE_STARTER_PERF_DEQUEUE', false );
 		// Enqueue dummy styles.
 		wp_enqueue_style( 'woocommerce-layout', 'http://example.com/wc.css' );
 		// Simulate wp_enqueue_scripts action.
 		do_action( 'wp_enqueue_scripts' );
 		// Since kill-switch is off, the style should still be queued.
 		$this->assertTrue( wp_style_is( 'woocommerce-layout', 'enqueued' ) );
 	}
 	/**
 	 * Test: WC assets dequeued on non-shop pages.
 	 *
 	 * Homepage (front page) is not a WC page, so WC styles/scripts should dequeue.
 	 */
 	public function test_wc_dequeue_on_homepage() {
 		$this->go_to( home_url( '/' ) );
 		// Enqueue WC styles.
 		wp_enqueue_style( 'woocommerce-layout', 'http://example.com/wc-layout.css' );
 		wp_enqueue_style( 'woocommerce-general', 'http://example.com/wc-general.css' );
 		wp_enqueue_script( 'woocommerce', 'http://example.com/wc.js' );
 		// Run dequeue at priority 100.
 		peptide_starter_perf_dequeue_plugin_assets();
 		// All WC assets should be dequeued.
 		$this->assertFalse( wp_style_is( 'woocommerce-layout', 'enqueued' ) );
 		$this->assertFalse( wp_style_is( 'woocommerce-general', 'enqueued' ) );
 		$this->assertFalse( wp_script_is( 'woocommerce', 'enqueued' ) );
 	}
 	/**
 	 * Test: WC assets remain on /shop page.
 	 *
 	 * On WC shop pages, WC assets should NOT dequeue.
 	 */
 	public function test_wc_not_dequeued_on_shop() {
 		// Skip if WooCommerce is not active.
 		if ( ! class_exists( 'WooCommerce' ) ) {
 			$this->markTestSkipped( 'WooCommerce not active.' );
 		}
 		// Enqueue WC styles.
 		wp_enqueue_style( 'woocommerce-layout', 'http://example.com/wc-layout.css' );
 		// The dequeue function checks is_woocommerce(); we'll mock it.
 		// For a true test, we'd need a real WC shop page setup.
 		// Instead, we assert the filter allows override.
 		$default_handles = apply_filters( 'peptide_starter_perf_woocommerce_styles', array() );
 		$this->assertIsArray( $default_handles );
 	}
 	/**
 	 * Test: Elementor assets dequeued on pages without Elementor.
 	 *
 	 * A non-Elementor page should have Elementor CSS dequeued.
 	 */
 	public function test_elementor_dequeue_on_non_elementor_page() {
 		// Create a post without Elementor.
 		$post_id = $this->factory->post->create();
 		$this->go_to( get_permalink( $post_id ) );
 		// Enqueue Elementor styles.
 		wp_enqueue_style( 'elementor-frontend', 'http://example.com/elementor.css' );
 		// Verify the page doesn't use Elementor.
 		$uses_elementor = peptide_starter_page_uses_elementor( $post_id );
 		$this->assertFalse( $uses_elementor );
 		// Run dequeue.
 		peptide_starter_perf_dequeue_plugin_assets();
 		// Elementor should be dequeued.
 		$this->assertFalse( wp_style_is( 'elementor-frontend', 'enqueued' ) );
 	}
 	/**
 	 * Test: USMI assets dequeued on homepage.
 	 */
 	public function test_usmi_dequeue_on_homepage() {
 		$this->go_to( home_url( '/' ) );
 		// Enqueue USMI assets.
 		wp_enqueue_style( 'SFSImainCss', 'http://example.com/sfsi.css' );
 		wp_enqueue_script( 'SFSICustomJs', 'http://example.com/sfsi.js' );
 		// Run dequeue.
 		peptide_starter_perf_dequeue_plugin_assets();
 		// USMI assets should be dequeued on homepage.
 		$this->assertFalse( wp_style_is( 'SFSImainCss', 'enqueued' ) );
 		$this->assertFalse( wp_script_is( 'SFSICustomJs', 'enqueued' ) );
 	}
 	/**
 	 * Test: Font slim rewrites Roboto weights.
 	 *
 	 * A URL with Roboto:100,200,...900 should be rewritten to 400,500,700.
 	 */
 	public function test_font_slim_roboto() {
 		$original_url = 'https://fonts.googleapis.com/css?family=Roboto:100,200,300,400,500,600,700,800,900&display=swap';
 		$slimmed_url = peptide_starter_perf_slim_google_fonts( $original_url, 'google-fonts-roboto' );
 		// Should contain 400,500,700.
 		$this->assertStringContainsString( 'Roboto', $slimmed_url );
 		$this->assertStringContainsString( '400', $slimmed_url );
 		$this->assertStringContainsString( '500', $slimmed_url );
 		$this->assertStringContainsString( '700', $slimmed_url );
 		// Should NOT contain 100, 200, 800, 900.
 		$this->assertStringNotContainsString( '100', $slimmed_url );
 		$this->assertStringNotContainsString( '200', $slimmed_url );
 		$this->assertStringNotContainsString( '800', $slimmed_url );
 		$this->assertStringNotContainsString( '900', $slimmed_url );
 	}
 	/**
 	 * Test: Font slim ignores non-configured fonts.
 	 *
 	 * A font that isn't in the config should pass through unchanged.
 	 */
 	public function test_font_slim_ignores_non_configured_fonts() {
 		$original_url = 'https://fonts.googleapis.com/css?family=Open+Sans:400,700&display=swap';
 		$result_url = peptide_starter_perf_slim_google_fonts( $original_url, 'google-fonts-open-sans' );
 		// Should pass through unchanged.
 		$this->assertEqual( $original_url, $result_url );
 	}
 	/**
 	 * Test: Font slim respects filter override.
 	 *
 	 * Custom weights via 'peptide_starter_perf_font_weights' filter should apply.
 	 */
 	public function test_font_slim_filter_override() {
 		$original_url = 'https://fonts.googleapis.com/css?family=Roboto:100,200,300,400,500,600,700,800,900&display=swap';
 		// Add filter to override Roboto weights to just 400.
 		add_filter(
 			'peptide_starter_perf_font_weights',
 			function ( $config ) {
 				$config['Roboto'] = array( 400 );
 				return $config;
 			}
 		);
 		$slimmed_url = peptide_starter_perf_slim_google_fonts( $original_url, 'google-fonts-roboto' );
 		// Should contain only 400, not 500 or 700.
 		$this->assertStringContainsString( '400', $slimmed_url );
 		$this->assertStringNotContainsString( '500', $slimmed_url );
 		$this->assertStringNotContainsString( '700', $slimmed_url );
 	}
 	/**
 	 * Test: Preconnect hints are added.
 	 *
 	 * The preconnect filter should add fonts.googleapis.com and fonts.gstatic.com.
 	 */
 	public function test_preconnect_hints_added() {
 		$urls = array();
 		$result = peptide_starter_perf_resource_hints( $urls, 'preconnect' );
 		$this->assertContains( 'https://fonts.googleapis.com', $result );
 		$this->assertContains( 'https://fonts.gstatic.com', $result );
 	}
 	/**
 	 * Test: Preconnect ignores other hint types.
 	 *
 	 * Only 'preconnect' relationship should get font URLs; dns-prefetch etc. should not.
 	 */
 	public function test_preconnect_ignores_other_relationships() {
 		$urls = array();
 		$result = peptide_starter_perf_resource_hints( $urls, 'dns-prefetch' );
 		// Should not add font URLs for dns-prefetch.
 		$this->assertNotContains( 'https://fonts.googleapis.com', $result );
 		$this->assertNotContains( 'https://fonts.gstatic.com', $result );
 	}
 	/**
 	 * Test: Defer applied to cookie-notice script.
 	 *
 	 * The script_loader_tag filter should add 'defer' to cookie-notice-front.
 	 */
 	public function test_defer_cookie_notice() {
 		$tag = '<script src="http://example.com/cookie-notice.js"></script>';
 		$result = peptide_starter_perf_defer_cookie_notice( $tag, 'cookie-notice-front', 'http://example.com/cookie-notice.js' );
 		$this->assertStringContainsString( 'defer', $result );
 	}
 	/**
 	 * Test: Defer not applied to other scripts.
 	 *
 	 * The defer filter should only affect cookie-notice-front, not other handles.
 	 */
 	public function test_defer_not_applied_to_other_scripts() {
 		$tag = '<script src="http://example.com/other.js"></script>';
 		$result = peptide_starter_perf_defer_cookie_notice( $tag, 'other-script', 'http://example.com/other.js' );
 		// Should not have defer added.
 		$this->assertStringNotContainsString( 'defer', $result );
 	}
 	/**
 	 * Test: page_uses_elementor helper returns false for non-singular.
 	 */
 	public function test_page_uses_elementor_non_singular() {
 		// Go to homepage (not singular).
 		$this->go_to( home_url( '/' ) );
 		$result = peptide_starter_page_uses_elementor( 0 );
 		$this->assertFalse( $result );
 	}
 }
--- a/tests/test-rate-limiter.php
+++ b/tests/test-rate-limiter.php
@@ -78,66 +78,17 @@ class Test_Rate_Limiter extends WP_UnitTestCase {
 		$this->assertStringNotContainsString( 'alice', $a );
 	}
-	public function test_client_ip_trusts_cf_header_when_peer_is_cloudflare() {
+	public function test_client_ip_prefers_cf_header() {
 		// 172.68.0.5 is inside 172.64.0.0/13 (published CF range).
 		$_SERVER['REMOTE_ADDR']           = '172.68.0.5';
 		$_SERVER['HTTP_CF_CONNECTING_IP'] = '203.0.113.5';
 		$_SERVER['REMOTE_ADDR']           = '10.0.0.1';
 		$this->assertSame( '203.0.113.5', peptide_starter_get_client_ip() );
-		unset( $_SERVER['HTTP_CF_CONNECTING_IP'], $_SERVER['REMOTE_ADDR'] );
+		unset( $_SERVER['HTTP_CF_CONNECTING_IP'] );
 	}
-	public function test_client_ip_ignores_spoofed_cf_header_from_non_cloudflare_peer() {
+	public function test_client_ip_rejects_garbage() {
 		// 8.8.8.8 is not Cloudflare — any CF-Connecting-IP header must be
 		// treated as hostile and ignored. This is PSEC-007.
 		$_SERVER['REMOTE_ADDR']           = '8.8.8.8';
 		$_SERVER['HTTP_CF_CONNECTING_IP'] = '203.0.113.5';
 		$this->assertSame( '8.8.8.8', peptide_starter_get_client_ip() );
 		unset( $_SERVER['HTTP_CF_CONNECTING_IP'], $_SERVER['REMOTE_ADDR'] );
 	}
 	public function test_client_ip_rejects_invalid_cf_header_value() {
 		$_SERVER['REMOTE_ADDR']           = '172.68.0.5';
 		$_SERVER['HTTP_CF_CONNECTING_IP'] = 'not-an-ip';
 		$this->assertSame( '172.68.0.5', peptide_starter_get_client_ip() );
 		unset( $_SERVER['HTTP_CF_CONNECTING_IP'], $_SERVER['REMOTE_ADDR'] );
 	}
 	public function test_client_ip_ignores_xff_by_default() {
 		$_SERVER['REMOTE_ADDR']           = '10.0.0.1';
 		$_SERVER['HTTP_X_FORWARDED_FOR']  = '203.0.113.5';
 		$this->assertSame( '10.0.0.1', peptide_starter_get_client_ip() );
-		unset( $_SERVER['HTTP_X_FORWARDED_FOR'], $_SERVER['REMOTE_ADDR'] );
+		unset( $_SERVER['HTTP_CF_CONNECTING_IP'] );
 	}
 	public function test_client_ip_respects_xff_when_filter_enables_trust() {
 		$_SERVER['REMOTE_ADDR']           = '10.0.0.1';
 		$_SERVER['HTTP_X_FORWARDED_FOR']  = '203.0.113.5, 172.68.0.5';
 		add_filter( 'peptide_starter_trust_xff', '__return_true' );
 		$this->assertSame( '203.0.113.5', peptide_starter_get_client_ip() );
 		remove_filter( 'peptide_starter_trust_xff', '__return_true' );
 		unset( $_SERVER['HTTP_X_FORWARDED_FOR'], $_SERVER['REMOTE_ADDR'] );
 	}
 	public function test_cloudflare_ranges_filter_override_is_honoured() {
 		add_filter(
 			'peptide_starter_cloudflare_ip_ranges',
 			function () {
 				return array( 'v4' => array( '10.0.0.0/8' ), 'v6' => array() );
 			}
 		);
 		// Default snapshot would treat 172.68.0.5 as CF; filter override
 		// should now treat 10.0.0.5 as CF instead.
 		$this->assertTrue( peptide_starter_is_cloudflare_peer( '10.0.0.5' ) );
 		$this->assertFalse( peptide_starter_is_cloudflare_peer( '172.68.0.5' ) );
 		remove_all_filters( 'peptide_starter_cloudflare_ip_ranges' );
 	}
 	public function test_cidr_match_handles_ipv6() {
 		$this->assertTrue( peptide_starter_cidr_match( '2606:4700::1234', '2606:4700::/32' ) );
 		$this->assertFalse( peptide_starter_cidr_match( '2001:db8::1', '2606:4700::/32' ) );
 	}
 	public function test_cidr_match_rejects_family_mismatch() {
 		$this->assertFalse( peptide_starter_cidr_match( '203.0.113.5', '2606:4700::/32' ) );
 	}
 }
Author	SHA1	Message	Date
peptiderepo	8a0e2ca92e	ci: stop exposing CTO_ADMIN_TOKEN as env var (security cleanup) Pass the PAT only via github-token param. continue-on-error on the budget step so a missing/expired secret degrades gracefully instead of failing the whole workflow. Agent-Session: cowork-reviewer-ab-20260414	2026-04-14 17:35:04 +07:00
peptiderepo	bef3cbb4a2	ci: address review feedback — per-model timeout + simpler cost math - Per-model timeout of 60s so one hung model does not block siblings - Simplify cost_cents math (cost_usd * 100 directly, no double-rounding) Defer: fine-grained PAT for CTO_ADMIN_TOKEN (requires manual OAuth device flow). Agent-Session: cowork-reviewer-ab-20260414	2026-04-14 17:32:00 +07:00
peptiderepo	999ec0d0ab	ci: use CTO_ADMIN_TOKEN for repo variables + restore formal APPROVE/REQUEST_CHANGES Default GITHUB_TOKEN cannot mutate Repository Variables (always 403). Use a PAT-backed secret CTO_ADMIN_TOKEN for the budget counter steps. Also restores formal APPROVE/REQUEST_CHANGES verdicts now that repo setting can_approve_pull_request_reviews is enabled. Agent-Session: cowork-reviewer-ab-20260414	2026-04-14 17:27:45 +07:00
peptiderepo	56c1476e79	ci: cost cap + 3-model A/B harness on CTO reviewer Two enhancements to the PR reviewer: 1. Monthly spend cap: tracked in Repo Variables (CTO_REVIEW_MONTH, CTO_REVIEW_SPEND_CENTS, CTO_REVIEW_CAP_CENTS). Default cap $10/month. Auto-resets on month rollover. Posts a skip-comment on PRs when cap hit. 2. A/B harness: reviews every PR with 3 models in parallel (Claude Haiku 4.5, DeepSeek V3.1, Kimi K2 Thinking). Comment shows all 3 verdicts side-by-side so we can compare quality/cost on real PRs before picking a permanent default. Drop to 1 model by editing the MODELS list after A/B window closes. Agent-Session: cowork-reviewer-ab-20260414	2026-04-14 17:22:30 +07:00