From ad085efbc4c0e48cb230eb63812781c2f0a5a41a Mon Sep 17 00:00:00 2001
From: autonomic-bot <64+autonomic-bot@noreply.git.autonomic.zone>
Date: Mon, 21 Sep 2026 17:23:14 +0000
Subject: [PATCH] deploy lock: cc-ci input -> 2f6787f (cutover final state) +
 journal session 2026-09-21

---
 cc-ci-plan/JOURNAL.md | 49 +++++++++++++++++++++++++++++++++++++++++++
 flake.lock            |  8 +++----
 2 files changed, 53 insertions(+), 4 deletions(-)

diff --git a/cc-ci-plan/JOURNAL.md b/cc-ci-plan/JOURNAL.md
index b5d7f74..7fd0eb5 100644
--- a/cc-ci-plan/JOURNAL.md
+++ b/cc-ci-plan/JOURNAL.md
@@ -1238,3 +1238,52 @@ the host: `opencode-go/deepseek-v4-flash` and `opencode-go/glm-5.3-flash` answer
   `upgrader.env` (`LOOP_TIER=go` maps to the `opencode-go` auth entry; `LOOP_MODEL` overrides the
   tier default). Next fire Fri 2026-09-11 02:00 UTC.
 - The steering orchestrator agent stays on `opencode-go/glm-5.2` (not asked to change).
+
+## Session 2026-09-21 — domain cutover to ci.autonomic.zone (orchestrator)
+
+**What happened.** Morning: hourly supervisor resumed the stalled 09-18 weekly run on the GO tier
+(ZEN endpoint dead server-side — `UnknownError`; run completed 13 green PRs, 0 failed). Published
+the missing week-2026-09-18 report (PR-finding #4; launcher defaults flipped to `go` in
+cc-ci-orchestrator PR #23). Then executed the full domain cutover per
+`cc-ci-plan/plan-domain-migration-ci-autonomic-zone.md` (PR #25).
+
+**Plan deviation (simplification).** No dual-cert SNI: ONE Let's Encrypt cert carries SANs for
+BOTH zones (`ci` + `*.ci` of autonomic.zone AND commoninternet.net) — the unchanged single-pair
+`ssl_cert/ssl_key` traefik reconciler keeps working; Phase 4 reissues without the legacy SANs.
+The new zone's DNS-01 challenge reuses the SAME acme-dns account: storage re-keyed by
+`cc-ci-acme-storage-seed.service` (jq clone of the legacy entry under `ci.autonomic.zone`),
+CNAME already delegated. Proven by a hand lego **staging** run before any production change.
+
+**Merged:** cc-ci #39 (front doors dual Host rules, bridge/dashboard env URLs, drone abra rename,
+runner RPC, naming.py → `*.ci.autonomic.zone`, dual-zone name regexes in lifecycle/warm/prune,
+recipe-report URLs) · cc-ci #40 (seed-unit nesting fix) · cc-ci #41 (have_secret stack-scope —
+caught live: the old stack's `*_rpc_secret_v1` satisfied the check post-rename) · cc-ci #42 (nix
+interpolation escape) · orchestrator #27 (oc.ci host + `opencodeUiExtraHosts`, host self-pins,
+flake bump).
+
+**Deployed** via `nixos-rebuild test` → verify → `switch` (generation `nn1vwiv7v1k…`, running ==
+boot). Cert SANs confirmed 4-name; all 5 front doors answer on BOTH zones
+(200/200/303/401 + traefik 200), TLS verify=0 from outside; zero failed units; disk dropped
+88%→45% after prune.
+
+**Drone migration.** New abra app `drone.ci.autonomic.zone`, FRESH DB (module's
+`DRONE_USER_CREATE` re-injected the sops bridge token). The Gitea OAuth app redirect now has both
+URIs; the client secret was rotated (each Gitea PATCH regenerates it) and synced through
+sops → `sops-install-secrets` → swarm secret v1 → drone. Bootstrapped OAuth
+(`drone login ok (admin=true)`), re-enabled cc-ci + discourse repos, build timeout 60m.
+Webhooks: ghost + discourse repointed (secrets preserved); cc-ci repo's bridge webhook →
+`ci.autonomic.zone/hook`, stale drone hook deleted, Drone's auto-created new-zone hook active.
+Old stack removed + orphaned secrets reaped.
+
+**E2E proof.** `!testme` on keycloak PR #9 → bridge → drone build #1 (new DB numbering) → runner →
+harness → `results.json` + PR card `✅ passed` linking `ci.autonomic.zone/runs/1/summary.png`.
+
+**Deferred / open.**
+- Warm stacks + backupbot stay on the legacy zone (data-warm volumes / restic password tied to
+  abra app names) — post-bake migration; harness regexes accept both zones meanwhile.
+- Docs sweep (~60 references: AGENTS.md, README, skills incl. cc-ci-status front-door list,
+  launcher printed URLs).
+- Phase 4 (after ≥7 clean days): drop legacy SANs (reissue), remove legacy Host arms + host
+  self-pins + Gandi records (`ci`, `*.ci`, `_acme-challenge.ci`), TTLs back to 3600.
+- Host auto-update was `failed` 2026-09-15 (health check) — `/cc-ci-orchestrator-update` still
+  pending; next auto-attempt Tue 09-22.
diff --git a/flake.lock b/flake.lock
index 76515ba..0d4e490 100644
--- a/flake.lock
+++ b/flake.lock
@@ -10,11 +10,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1790009762,
-        "narHash": "sha256-pg5aOho9rJZmHtuGwiQgaW/uQ01vFb0f6lKsH+BB62o=",
+        "lastModified": 1790010051,
+        "narHash": "sha256-0dz8fg4zqg54tk+1A7CHZAw+lK9vWxre6Tioi5B0ocU=",
         "ref": "refs/heads/main",
-        "rev": "c5106bc1eb3bcb1b8056b1f1bd2ed8ae7b652503",
-        "revCount": 1554,
+        "rev": "2f6787f0433e7ff3053116039f10c00cde34128f",
+        "revCount": 1558,
         "type": "git",
         "url": "https://git.autonomic.zone/recipe-maintainers/cc-ci.git"
       },
-- 
2.54.0