journal(redfix): wake #18 — consumed review(redfix)@6997c29 (re-confirmation #16, B-redfix-6 confirmed + deferral endorsed); corrected an Adversary fact via inbox (/etc/cc-ci HEAD is main@d11f8f56, redfix-m2-harness@b96b8a4c is a stale LOCAL BRANCH not HEAD — its conclusion stands); filed B-redfix-7: /etc/cc-ci/.git/config is mode 644 with the Gitea bot password in cleartext (severity LOW — no non-root login users; orphaned non-Nix clone, no systemd unit uses it); NOT actioned (Class-A1 external cred + not my dir), operator call, does not reopen the phase; no verdict change, DONE stands, loop remains stopped

machine-docs/BACKLOG-redfix.md

@@ -81,6 +81,25 @@ hold). Concrete fix designs from M1 evidence:
       the M2 PASS was granted against and that every drift sweep pins. Fold into the next commit that moves
       the branch for a substantive reason (e.g. B-redfix-5), rewording to the structural form.
       Corrected in STATUS-redfix.md prose (which is not sha-pinned) as of wake #17.
+- [ ] **B-redfix-7 — orphaned non-Nix clone at `/etc/cc-ci` on the node stores the Gitea bot password in
+      plaintext in a world-readable `.git/config`** (OPERATOR CALL; out of redfix scope; found wake #18 while
+      checking a claim in re-confirmation #16). Facts, all read-only-verified on cc-ci:
+      - `/etc/cc-ci/.git/config` is mode **644** `root:root` and its `origin` URL embeds
+        `https://autonomic-bot:<password>@git.autonomic.zone/...` — the bot's Gitea credential at rest in
+        cleartext. (Value deliberately not reproduced here.)
+      - **Severity is LOW, not nil:** `awk` over `/etc/passwd` shows **no non-root login users** (no uid>=1000
+        with a real shell), so today only root can read it. It is defence-in-depth that is missing, not a live
+        compromise. It would become real the moment any unprivileged user or a container bind-mounting `/etc`
+        exists.
+      - `/etc/cc-ci` is a **real directory, not a `/nix/store` symlink**, and **no systemd unit references
+        it** — i.e. undeclared, unmanaged server state that nothing runs from. It violates the standing
+        "keep server state Nix-declared and reversible" rule.
+      **NOT actioned by me, deliberately.** The Gitea bot credential is a Class-A1 EXTERNAL infra input
+      (plan §4.4) — not mine to rotate or invent. And I did not create `/etc/cc-ci`, so it is not mine to
+      delete. Remedies for the operator, cheapest first: (a) `chmod 600` the config; (b) move the credential
+      to a `credential.helper` / netrc outside the repo; (c) if the clone is genuinely orphaned, remove it and
+      let Nix own any needed checkout. Rotating the bot password is worth considering regardless, since it has
+      sat in cleartext on disk.
 
 ## Adversary findings