[codex] Use routed WP helper for E2E post creation

[adamziel]

What it does

Replaces create_branch_post's admin-editor nonce scrape with a test-only mu-plugin endpoint that creates real published posts via wp_insert_post() on the routed branch host.

Rationale

The merge E2E needs real WordPress content on branch hosts, but the old helper depended on /wp-admin/post-new.php returning an authenticated editor shell. CI was getting an unauthenticated page for a UI-created branch, so the test failed before it could exercise the branch merge behavior.

Implementation

Adds forkpress-e2e-post.php during the COW E2E setup. create_branch_post now calls /?forkpress_e2e_post=create&title=... with the target branch Host header and validates the JSON response.

The WP UI create/merge path still uses the real admin actions and nonces; this only removes cookie/nonce bootstrapping from test post creation.

Testing instructions

bash -n tests/cow/e2e.sh
git diff --check
umask 022; make test-cow

make test-cow passed locally. A first run without umask 022 failed because PHP could not create temporary /tmp lock directories, then passed with the expected umask.

[adamziel]

Follow-up from the failed mac-cow-e2e aarch64-apple-darwin run:

• The 302 was WordPress redirecting ui-created to /wp-admin/install.php, meaning the newly published branch was not using its final branch database path at runtime.
• Root cause: create_cow_branch_from_tree() bootstrapped wp-config.php while the branch still lived under the branch-create-stage-* directory, then renamed the tree to its final branch path.
• Fix: after publishing the staged tree, rerun the lightweight COW bootstrap against the public/final branch root before writing the branch list.
• Added E2E assertions that UI-created and CLI-created branch wp-config.php files point at /<branch>/wp-content/database/.ht.sqlite and do not retain branch-create-stage paths.

Local verification run after the fix:

bash -n tests/cow/e2e.sh
git diff --check
cargo test -p forkpress-storage
FORKPRESS_RUNTIME_BUNDLE=/dev/null cargo test -p forkpress-cli
make test-cow

[adamziel]

Updated this PR with two E2E hardening changes after the macOS aarch64 failure:

• added a test-only mu-plugin that makes WordPress admin update checks deterministic and blocks WordPress.org update probes during the COW E2E UI branch flow
• added a ui-merge-metadata.json failure dump so a future UI merge status failure prints the latest merge run and first conflict rows

Focused verification run locally:

• bash -n tests/cow/e2e.sh
• git diff --check

CI has restarted on f9284a0.

[adamziel]

Additional focused local verification after the deterministic-admin E2E patch:\n\n- make test-cow passed\n\nThis covers the PHP COW merge suite, Git server tests, WordPress branch UI action tests, router path tests, and router lock tests.

[adamziel]

CI status note: the restarted COW E2E jobs have not reached the COW steps yet.

Current PR #60 run metadata shows these jobs still in Build production dist bundle:

• linux-cow-e2e
• mac-cow-e2e aarch64-apple-darwin
• mac-cow-e2e x86_64-apple-darwin

The release workflow's standalone build aarch64-apple-darwin job has passed, along with both Linux release builds and Windows. So the prior UI-merge metadata-status failure has not yet been re-exercised by the macOS COW E2E job on this commit.

[adamziel]

Updated again after the CI jobs remained in Build production dist bundle without reaching the COW E2E steps.

This adds two release-gate diagnostics:

• scripts/build-dist.sh now prints phase markers around static-php-cli doctor/download/build work.
• CI/release build-dist steps now have explicit timeouts, so a stuck PHP runtime build fails boundedly instead of consuming the job indefinitely.

Focused verification:

• bash -n scripts/build-dist.sh
• make test-release
• git diff --check

New PR #60 head: b2c38fe.

[adamziel]

Updated PR #60 with a targeted merge-policy fix for the macOS COW E2E failure seen at b2c38fe:

• wp_usermeta.session_tokens is now treated as target-local WordPress auth/session state. Source-side token updates, deletes, and source-only token rows are kept out of the target branch instead of producing review conflicts or importing branch-local login state.
• Added a regression that merges real wp_posts content while both branches mutate session_tokens, verifies the target token stays local, verifies source-only tokens are not imported, and verifies no wp_usermeta conflicts are recorded.

Local verification on the restored worktree:

umask 022; php -l scripts/cow/merge.php
umask 022; php -l tests/cow/merge.php
umask 022; git diff --check
umask 022; php tests/cow/merge.php

php tests/cow/merge.php passed with 2919 assertions. CI has restarted on 34fd959.

[adamziel]

Additional local verification completed on 34fd959:

umask 022; make test-cow

Passed locally. This covers:

• COW Git server: 252 passed
• COW merge suite: 2919 assertions
• branch UI, router path, and router lock checks

Latest PR status check: CI is still running; Windows checks have already passed, macOS and Linux COW jobs are still in progress.

[adamziel]

Follow-up hardening pushed at a48d3f0: the real WordPress semantic E2E merge now requires status: completed and checks that the semantic-source -> semantic-target merge run recorded zero merge_conflicts.

This removes the previous tolerance for completed_with_conflicts, so volatile/runtime-state conflicts like the wp_usermeta.session_tokens issue can no longer hide behind successful object-graph assertions.

Focused checks for the E2E script update:

umask 022; bash -n tests/cow/e2e.sh
umask 022; git diff --check

[adamziel]

Documented the new clean semantic merge gate in docs/merge-reliability.md at 6f81833. The objective audit now records that the real WordPress semantic E2E must complete with zero merge conflicts, so the evidence matrix matches the stricter test gate.

Check run for the doc update:

umask 022; git diff --check