review(1b): W0 PASS (RL1) — lint/format tooling verified COLD on cc-ci over pristine archive of 233939a: nix develop .#lint → lint: PASS exit 0 (8 linters clean); stage wired in .drone.yml; break-it probe confirms FAIL exit 1 on injected violations (gate has teeth). Advisory: confirm push→Drone actually fires lint stage at RL3 (webhook flaky per §4.1)

REVIEW-1b.md

@@ -47,5 +47,33 @@ Still owed in white-box pass #2 (after I read the rest): **harness DRY** (recipe
 not per-recipe copy-paste), **log redaction real** (bridge/dashboard/log pipeline), **architecture matches
 plan** (layout/§3, poll-primary trigger §4.1, traefik-is-coop-cloud-recipe §4.2; drift → DECISIONS.md).
 
-## Status: IDLE — awaiting Builder to seed Phase-1b state + claim W0 (lint/format).
-No gate CLAIMED. Will verify W0 cold the moment it's claimed (watchdog ping). RL3 deferred to last, per plan order.
+## W0 (RL1 — lint/format tooling + green) : **PASS** @2026-05-27 (Adversary cold)
+Gate claimed in STATUS-1b. Acceptance: clean checkout → `nix develop .#lint --command bash
+scripts/lint.sh` → `lint: PASS`; lint stage wired in `.drone.yml` push pipeline. **Verified cold,
+independently** (no nix on sandbox; ran on cc-ci over a *pristine* tree, not the Builder's working copy):
+
+- **Cold checkout = exact reviewed SHA.** `git archive 233939a` (= my `origin/main` HEAD) piped to
+  cc-ci → `/tmp/ccci-cold` (clean tree, no untracked/cached state, secrets submodule empty as lint
+  excludes it). Not cloned from `/root/cc-ci` (that's a non-git plain copy) — archived from my own clone.
+- **Lint PASS cold.** `HOME=/root nix develop .#lint --command bash scripts/lint.sh` → **exit 0,
+  `lint: PASS`.** All 8 linters ran clean: nixpkgs-fmt (0/14 reformat), statix, deadnix, ruff format
+  (32 files), ruff check (all passed), shfmt, shellcheck, yamllint.
+- **Stage real, not rigged.** `scripts/lint.sh` genuinely invokes each linter in check mode and
+  accumulates a `fail` flag → `exit "$fail"` (correct `set -uo pipefail`, no `-e`, so all run). The
+  `.drone.yml` `self-test` push pipeline runs the *exact* command `nix develop .#lint --command bash
+  scripts/lint.sh` and FAILs the build on non-zero. Toolchain pinned from nixpkgs in `flake.nix`
+  (`devShells.lint`), so CI == local.
+- **Gate has TEETH (break-it probe).** Injected violations into the cold tree (a `.py` with
+  `import os,sys` + `x=1+2`, and a mis-formatted `.nix`) → re-ran lint → **exit 1, `lint: FAIL`**
+  (ruff E401/I001/F401 + nixpkgs-fmt). So the stage is not vacuously green.
+
+Verdict: **W0 PASS.** Builder may proceed to W1.
+Advisory (not W0-blocking; re-confirm at RL3): Builder notes the Gitea→Drone *push* webhook is flaky
+(§4.1), so the lint stage may not auto-fire as a real Drone build on every push — RL1's intent
+("future commits stay clean") depends on that path actually firing. The stage IS wired and proven
+green via its exact command; I'll confirm a real push triggers the Drone lint build when I re-verify
+M2/D-gates at RL3 (it overlaps). Not filing a finding now — bounded phase, acceptance-as-stated is met.
+
+## Status: W0 PASS logged. Awaiting Builder's W1 (review checklist) — I'll run my own white-box §3
+pass #2 (harness DRY · log redaction · architecture-matches-plan) as independent prep / RL2 input, then
+the cold RL3 D1–D10 re-verify LAST. Cardinal rule holds: cleanup must not weaken/skip/regress any test.