STATUS/JOURNAL/BACKLOG: recipe-ci integration green (build #33), bridge→Drone→harness wired

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

JOURNAL.md

@@ -487,3 +487,32 @@ build runs the self-test, NOT `runner/run_recipe_ci.py`. M4/M5 ran the orchestra
 
 **M3 CLAIMED** (gate). Trigger + auth + comment-back demoed live; the webhook-delivery blocker is
 moot now that polling is primary.
+
+---
+## 2026-05-27 — Bridge→Drone→harness integration (recipe-ci pipeline) wired & green
+
+Closed the gap where a bridge-triggered build ran only the self-test. Split `.drone.yml` into two
+event-filtered exec pipelines (commits 9d51cb6, bc8baae, 7aa0346):
+- `self-test` — `trigger.event: [push]` (M2 sanity on pushes).
+- `recipe-ci` — `trigger.event: [custom]` (bridge fires event=custom builds): runs
+  `cc-ci-run runner/run_recipe_ci.py` with STAGES=install,upgrade,backup, `CCCI_JANITOR_MAX_AGE=0`
+  (safe at capacity=1), `concurrency:{limit:1}`, and `HOME=/root` (the exec runner otherwise points
+  HOME at an empty per-build workspace → abra `FATA directory is empty: .../.abra/servers`).
+
+Verified by triggering a `custom` build (RECIPE=custom-html, as the bridge does) via the Drone API:
+- **Build #31** got past `abra app new` (HOME fix) but failed at backup:
+  `abra app backup create … FATA … authentication required: Unauthorized` — backup/restore weren't
+  passing `-C -o`, so abra fetched recipe tags from the (private) remote. Also `recipe versions`
+  found no tags (contaminated recipe dir: private-mirror origin, no tags) → upgrade stage SKIPPED.
+- Fixes: `abra.py` backup_create/restore now pass `-C -o`; `fetch_recipe` catalogue path rm's the
+  recipe dir first so a leftover private-mirror clone can't poison version resolution.
+- **Build #33 → SUCCESS (124s)**, all three stages green through Drone:
+  install `2 passed` (real deploy + Playwright), upgrade `1 passed` (real — tags restored by the
+  clean re-clone, no longer skipped), backup `1 passed` (the -C -o fix). Post-run on host:
+  0 run-app services, 0 run-app volumes; traefik/drone/bridge infra intact. Event filtering works
+  (only recipe-ci ran, not self-test).
+
+So the full D1→D2 path is wired and proven in two verified halves: poll-trigger→Drone (build #26,
+RECIPE param correct) and Drone→harness 3-stage CI (build #33, green + clean teardown). Remaining for
+full single-comment E2E on a *recipe* PR: enroll the recipe in the bridge POLL_REPOS + open a recipe
+PR (M6.5/M10 breadth work).