fix: add auth gate to test-delays fixture and harden performance-audit recipe

- tools/qm-bridge/ai-ddtk-test-delays.php: add current_user_can('manage_options')
  gate to both template_redirect action and shortcode handler so anonymous
  visitors cannot trigger slow queries or CPU-bound loops via query param
- recipes/performance-audit.md: add mu-plugins path confirmation step before
  writing any instrumentation files; add Phase 5 Cleanup with security warning
  about test-delays fixture; renumber Phase 5 Report to Phase 6; update
  WP Performance Timer link to Hypercart-Dev-Tools org; prefer MCP tool for
  WPCC scan in agent summary; add cleanup step to agent workflow

Author: noelsaw1

recipes/performance-audit.md

@@ -57,6 +57,8 @@ Focus on:
 
 ### Phase 3: Runtime Profiling
 
+> **Before writing any mu-plugin or instrumentation file**, confirm the target site's mu-plugins path with the user. For Local by Flywheel, this is typically `~/Local Sites/<site-name>/app/public/wp-content/mu-plugins/`. Do not assume the path — show it and get confirmation first.
+
 For each confirmed issue, add performance timers:
 
 ```php
@@ -98,7 +100,18 @@ if (isset($timer) && function_exists('perf_timer_stop')) {
    - NeoLog session files
    - Admin → Tools → Performance Logs
 
-### Phase 5: Report
+### Phase 5: Cleanup
+
+After profiling is complete, remove all instrumentation before merging or deploying:
+
+1. **Remove `perf_timer_start()` / `perf_timer_stop()` wrappers** from the code under test
+2. **Remove `ai-ddtk-test-delays.php`** from `mu-plugins/` if it was installed (see security warning below)
+3. **Remove `PERF_LOG_ALL`** from `wp-config.php` if it was added
+4. **Verify** the site loads cleanly without debug artifacts
+
+> **Security warning:** `ai-ddtk-test-delays.php` has no auth gate — any visitor can trigger `?aiddtk_test_delays=1` to force slow queries, external HTTP calls, and CPU-bound loops. **Never leave it installed on a public-facing site.** It is a fixture for local profiling only.
+
+### Phase 6: Report
 
 Document findings in this format:
 
@@ -159,17 +172,19 @@ tail -100 /path/to/wordpress/wp-content/debug.log | grep PERF
 
 - [WPCC Features](../bin/wpcc) - Run `wpcc --features` for all options
 - [AGENTS.md](../AGENTS.md) - Performance Profiling section
-- [WP Performance Timer](https://github.com/yourusername/wp-performance-timer) - Plugin documentation
+- [Hypercart WP Performance Timer](https://github.com/Hypercart-Dev-Tools/wp-performance-timer) - Plugin documentation
 
 ---
 
 ## AI Agent Instructions
 
 When user asks for a performance audit:
 
-1. Run WPCC scan on the target path
+1. Run WPCC scan on the target path (prefer `wpcc_run_scan` MCP tool if available; fall back to `wpcc --paths <path> --format json` via shell if MCP is not connected)
 2. Triage findings for performance-related issues
-3. Guide user to add timers around flagged code
-4. Help interpret the runtime metrics
-5. Provide optimization recommendations based on confirmed bottlenecks
+3. **Confirm the target site's mu-plugins path** with the user before writing any files
+4. Guide user to add timers around flagged code
+5. Help interpret the runtime metrics
+6. Provide optimization recommendations based on confirmed bottlenecks
+7. **Run cleanup** — remove all instrumentation, test fixtures, and debug config before finishing
 

tools/qm-bridge/ai-ddtk-test-delays.php

@@ -30,6 +30,12 @@
 		return;
 	}
 
+	// Auth gate — only administrators can trigger test delays.
+	// Without this, any visitor could cause slow queries and CPU load via the query param.
+	if ( ! current_user_can( 'manage_options' ) ) {
+		return;
+	}
+
 	// Run the delays early in the page lifecycle so QM captures everything.
 	aiddtk_run_test_delays();
 }, 5 );
@@ -38,6 +44,9 @@
  * Also register as a shortcode for non-BB pages.
  */
 add_shortcode( 'aiddtk_test_delays', function () {
+	if ( ! current_user_can( 'manage_options' ) ) {
+		return '';
+	}
 	aiddtk_run_test_delays();
 	return '<p style="font-family:monospace;color:#666;">AI-DDTK test delays executed. Check QM for profiling data.</p>';
 } );