Initial commit: cc-ci autonomous orchestrator

Planning + launch + setup material for the cc-ci Co-op Cloud recipe CI server:
plan.md (single source of truth), kickoff/launch supervision, and the
Builder/Adversary loop prompts. Secrets (.testenv) and runtime dirs are gitignored.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cc-ci-plan/README.md

@@ -0,0 +1,34 @@
+# cc-ci-plan
+
+Self-contained handoff package for building the **cc-ci** Co-op Cloud recipe CI server with two
+autonomous Claude loops (a Builder and an adversarial Reviewer) running over days.
+
+## Start here
+
+1. Read **`plan.md`** — the full plan and single source of truth (mission, Definition of Done,
+   architecture, milestones, the two-agent coordination protocol, loop discipline).
+2. Read **`kickoff.md`** — how to launch and supervise the loops.
+3. Run **`./launch.sh start`** to bring up both loops + the watchdog.
+
+## Files
+
+| File | Purpose |
+|---|---|
+| `plan.md` | The plan. Agents treat it as their single source of truth. |
+| `brief.md` | The original one-page brief (context only; `plan.md` supersedes it). |
+| `kickoff.md` | Launch & supervision guide. |
+| `launch.sh` | Starts both loops + a watchdog; restarts dead loops; stops on `## DONE`. |
+| `prompts/builder.md` | Builder loop prompt (fed to `claude` by the script). |
+| `prompts/adversary.md` | Adversary loop prompt. |
+
+## Before launching
+
+- Set the org in `plan.md` (`git.autonomic.zone/recipe-maintainers/cc-ci`) and lock the six proof recipes (§8).
+- Ensure the launching shell has: SSH+sudo to `cc-ci`, the Gitea token, `git.autonomic.zone` access.
+- Preconfigure test-app DNS + TLS (plan §4.0): point a wildcard `*.ci.commoninternet.net` record at a gateway that TLS-passthroughs to cc-ci, and **pre-issue the wildcard cert** (`*.ci.commoninternet.net` + `ci.commoninternet.net`, via Gandi DNS-01) into `/var/lib/ci-certs/live/` on cc-ci. The agent handles everything else on cc-ci (Traefik file provider → that cert, swarm, routing) and does **no ACME**; renewal (~90 days) is an out-of-band operator task, so the DNS token never goes to the agent.
+- `export CC_CI_REPO=https://git.autonomic.zone/recipe-maintainers/cc-ci.git` so the watchdog can detect `## DONE`.
+
+## What "done" means
+
+The loops stop only when all of `plan.md` §2 (D1–D10) hold **and** the Adversary has independently
+re-verified each within 24h. The watchdog then tears the loops down automatically.