README + journal: the /secrets layout, and the weekly run's flash models

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

cc-ci-plan/JOURNAL.md

@@ -1171,3 +1171,34 @@ Lesson for future sweeps: scanning `/secrets` is not enough, agent logs are a se
 **Legitimately outside `/secrets`** (documented in its README so a later sweep does not "clean"
 them): `/run/secrets/*`, `/root/.docker/config.json`, `/etc/nginx/oc-htpasswd`,
 `/var/lib/ci-certs/live/*.pem`, `/var/lib/sops-nix/key.txt`, `/etc/ssh/ssh_host_*`.
+
+## 2026-09-08 17:30 UTC — /secrets made authoritative (incl. ssh host keys); weekly-run models
+
+**Operator rule:** every secret lives in `/secrets`; consumers read from there or symlink to it.
+Implemented declaratively in `nix/hosts/cc-ci/configuration.nix` (cc-ci-orchestrator e7aa055):
+`/secrets` `0711` with `files/` (loops), `host/` (root: ssh host keys + sops age identity) and
+`nginx/` (root:nginx: the UI htpasswd). `find / -type f` for key material now returns **only**
+`/secrets`; `/etc/ssh/ssh_host_*`, `~loops/.ssh/*`, `~loops/.local/share/opencode/auth.json` and
+`/srv/cc-ci/.testenv` are all symlinks into it.
+
+**The risky part, done safely.** The ed25519 host key is a sops recipient (`age1tmvg…`), so a
+regenerated key would make every cc-ci secret undecryptable. Therefore: keys **copied** (never
+moved-then-regenerated), the age identity verified identical before activation, `services.openssh.
+hostKeys` and `sops.age.{sshKeyPaths,keyFile}` pointed at `/secrets/host` **directly** rather than
+through the `/etc/ssh` symlinks (a dangling link would let sshd write a NEW key), `test` before
+`switch`, and the proof was a fresh `StrictHostKeyChecking=yes` connection plus 8/8 sops secrets.
+Fingerprint unchanged: `SHA256:r1H85Ybif…`. Then the duplicates outside `/secrets` were deleted
+(`/var/lib/sops-nix/key.txt`, `/etc/nginx/oc-htpasswd`) and the unused ecdsa host key removed.
+
+**Logs cleared** (operator: "we don't need them anymore"): 30 agent transcripts + 1 archived gz,
+558 MB → 2 MB. Kept `upgrades/` (233 weekly records), `state/`, the `*-update-*.md` records and the
+launcher dotfiles.
+
+**Weekly-run models** — operator enabled China-hosted models on the workspace, so both verified on
+the host: `opencode-go/deepseek-v4-flash` and `opencode-go/glm-5.3-flash` answer.
+- **subagents** (per-recipe workers): `opencode-go/deepseek-v4-flash` — cc-ci PR #37, pulled into
+  both loops clones and `/etc/cc-ci`.
+- **main agents** (weekly parent, report, hourly supervisor): `opencode-go/glm-5.3-flash` —
+  `upgrader.env` (`LOOP_TIER=go` maps to the `opencode-go` auth entry; `LOOP_MODEL` overrides the
+  tier default). Next fire Fri 2026-09-11 02:00 UTC.
+- The steering orchestrator agent stays on `opencode-go/glm-5.2` (not asked to change).