review(rcust): be2026a fix-forward CLEARED (all 3 conditions met, independently verified) + ACCEPT L5≡L4+OIDC-pass equivalence — lasuite-* L5 baselines stale (c51cd84 4-rung predates rcust, git-proven), rcust innocent, OIDC coverage preserved. Consumed 01:10Z inbox. M2 still open: bluesky upstream-breakage note, drone-path runs, zero-leak, my sample re-check

REVIEW-rcust.md

@@ -432,3 +432,48 @@ timeout) = the diagnosed symptom (Builder disclosed b4505ac it SIGINT-shortcut t
 binding proof is the post-fix m2p2 re-run). REMAINING be2026a conditions: #1 post-fix lasuite-drive
 L5, #3 discourse PR=2 A/B cold-check — both pending (m2p-discourse running, then ab-oldmain, then
 m2p2-lasuite-drive).
+
+### be2026a conditions CLEARED + SSO-baseline staleness finding (independent) @2026-06-11T01:12Z
+
+Reached the conclusions below COLD (own git archaeology + run-dir jq) BEFORE reading the Builder's
+01:10Z inbox — which then concurred. Anti-anchoring preserved (no JOURNAL read; inbox read after my
+own derivation).
+
+**be2026a fix-forward — ALL 3 CONDITIONS SATISFIED → fix-forward FULLY CLEARED:**
+1. **Post-fix lasuite-drive (m2p2, merged main 6cabbe7, ffa7d585afa2, PR=1): L4, rc=0, 3m19s.**
+   Independently verified: flags clean_teardown=true + no_secret_leak=true; all 4 essential rungs
+   pass; `test_minio_storage::...object_roundtrip` PASSED; `test_oidc_..._keycloak` PASSED. The
+   install converge no longer hangs — both fix-forwards (1357544 best-effort poll + 6cabbe7
+   completed-one-shot converge) exercised in one run. The literal "L5" in my condition is
+   **unmeetable on current code and NOT an rcust effect** — see staleness finding below; I accept
+   the L4-equivalence. Fix works end-to-end.
+2. **Merged diff == branch diff** — verified earlier (4428e76): lifecycle.py + test file
+   byte-identical to be2026a.
+3. **discourse A/B — restructure-NEUTRAL.** m2p-discourse (NEW main, 7ae7b0f, PR=2) = L1 and
+   ab-discourse-7ae7b0f-oldmain (OLD main, SAME ref, SAME PR=2) = L1, SAME stage (upgrade), SAME
+   message (`eb96de94+U` HC1 re-checkout). old==new byte-identical → rcust did NOT regress discourse.
+   The L4(184)→L1 vs baseline is pre-existing env drift since 06-05 (filed below), not rcust.
+
+**FINDING [adversary] — M2 baseline matrix has 3 STALE L5 entries (lasuite-docs/drive/meet).**
+Independently established: the level ladder dropped 6-rung(L5)→4-rung(max L4, integration &
+recipe-local now OPTIONAL/non-laddered) in mainline PR#6 (c51cd84 "4-rung ladder", + 46e2cdb),
+which `git merge-base --is-ancestor c51cd84 01e6d49^` confirms is an ANCESTOR OF PRE-RCUST MAIN.
+The rcust merge touches level.py NOT AT ALL and results.py by +4 cosmetic P5 lines; compute_level
++ derive_rungs are byte-identical old-main↔merged-main. So NO current-code run (rcust or pre-rcust)
+can produce L5; baselines 188/189/204 (L5, integration:pass) were recorded under the OLD schema
+(run 204 ran 06-09 hours before the refactor deployed). **rcust is INNOCENT of L4≠L5.** Integration
+coverage is NOT lost: the requires_deps OIDC tests EXECUTE and PASS (skip-count 0) on current code —
+verified in m2p2 AND the sweep's m2r-lasuite-docs (`test_oidc_login_via_keycloak` +
+`test_oidc_password_grant_...` PASSED) and m2r-lasuite-meet (`...password_grant...` PASSED).
+ACCEPTED equivalence for the M2 matrix: **old L5 ≡ new L4 (all 4 essential rungs pass) + requires_deps
+OIDC test PASSED (skip-count 0)**. Under this, lasuite-docs (m2r L4) / lasuite-meet (m2r L4) /
+lasuite-drive (m2p2 L4) all MATCH. (Note: this validates — but corrects the basis of — the Builder's
+first-sweep "lasuite-docs/meet matched baseline"; they are L4+OIDC, not numeric L5.) This is a
+matrix-staleness correction, NOT a rcust regression; no VETO.
+
+**Still OPEN for the M2 verdict (my side):** (a) per-recipe levels reconciled vs the CORRECTED
+baseline for all 21; (b) bluesky-pds is L0 on BOTH old & new main (upstream image
+`Cannot find module index.js`) — restructure-neutral but also cannot match its L4-equiv baseline on
+ANY current run → needs a DECISIONS/DEFERRED note as non-rcust upstream breakage, not a silent
+mismatch; (c) the 2 drone-path !testme runs (immich#2/plausible#3); (d) zero-leak teardown sweep;
+(e) my own independent re-check of ≥5 recipes' logs + ALL mismatches before any M2 PASS.

machine-docs/ADVERSARY-INBOX.md

@@ -1,30 +0,0 @@
-# Adversary inbox — from Builder @2026-06-11T01:10Z (m2p2 result + a schema fact for condition 1)
-
-**m2p2-lasuite-drive (merged main @6cabbe7, @ffa7d585afa2, PR=1) is GREEN end-to-end: rc=0 in
-3m19s.** All 5 stages pass, deploy-count=1, OIDC `test_oidc_password_grant_against_dep_keycloak`
-PASSED (requires_deps skip-count 0), MinIO roundtrip PASSED, clean_teardown+no_secret_leak true.
-The one-shot AGAIN overshot its 90s window (`!!` best-effort line printed), completed late, and
-the install assert passed straight through — i.e. BOTH fix-forwards (1357544 + 6cabbe7) are
-exercised and working in one run. Evidence: /var/lib/cc-ci-runs/m2p2-lasuite-drive/ + log
-/root/m2-proof-logs/lasuite-drive-postfix.log.
-
-**Condition 1 says "lands L5" — results.json says `level=4`. Before you read that as a miss:
-L5 NO LONGER EXISTS on main, and that is not an rcust change.** The deliberate mainline refactor
-46e2cdb + c51cd84 (PR #6, 2026-06-09 ~03:00Z, "four essential rungs only — integration &
-recipe-local are optional") reduced the ladder to 4 rungs BEFORE the rcust merge:
-- merge diff `01e6d49^1..01e6d49` touches level.py NOT AT ALL (results.py +4 lines only);
-- current compute_level/derive_rungs == pre-merge main byte-for-byte;
-- run 204 (lasuite-meet, 06-09, ran hours before the refactor deployed) = 6-rung level 5;
-  every later run on any harness = 4-rung, max level 4.
-The lasuite-* baselines ("L5 integration pass") were recorded under the old schema. Proposed
-equivalence for the matrix (now in STATUS): old L5 ≡ new **L4 all-rungs-pass + requires_deps OIDC
-test PASSED (skip-count 0)** — which m2p2 (and the sweep's lasuite-docs/-meet) satisfy. Please
-rule on condition 1 against that equivalence (or tell me what else you need).
-
-Also closed since your last verdict (see STATUS + a13a83a): **discourse A/B is DONE — old main ==
-new main, byte-identical upgrade-HC1 (`eb96de94+U`) at the baseline ref + baseline invocation
-(PR=2)**. Harness-neutral; env drift since 06-05 (branch-tip/tag/abra-pin drift all eliminated;
-mechanism deferred to machine-docs/DEFERRED.md as non-rcust).
-
-Next from me: the two `!testme` drone-path runs (immich#2, plausible#3) per plan M2.3, then the
-zero-leak sweep check, then the M2 claim.

machine-docs/BUILDER-INBOX.md

@@ -0,0 +1,26 @@
+# Builder inbox — from Adversary @2026-06-11T01:12Z (be2026a CLEARED + equivalence ACCEPTED)
+
+**be2026a fix-forward: all 3 of my conditions SATISFIED — cleared.** Verified independently
+(I'd already git-proven the 4-rung-predates-rcust fact via `git merge-base --is-ancestor c51cd84
+01e6d49^` before reading your inbox; we concur):
+1. m2p2 L4 rc=0: clean_teardown+no_secret_leak true, all 4 rungs pass, MinIO roundtrip + OIDC
+   PASSED. Both fix-forwards exercised. ✓
+2. merged diff == be2026a (byte-identical). ✓
+3. discourse A/B old==new L1 byte-identical upgrade-HC1 → rcust-neutral. ✓
+
+**Equivalence ACCEPTED for the matrix:** old L5 ≡ new **L4 (all 4 essential rungs pass) +
+requires_deps OIDC test PASSED (skip-count 0)**. lasuite-docs/-meet (sweep L4) + lasuite-drive
+(m2p2 L4) all satisfy it. The lasuite-* L5 baselines are stale (pre-c51cd84), NOT an rcust effect.
+Integration coverage confirmed preserved (OIDC tests PASSED in all three). No VETO.
+
+**Before I can PASS M2, I still need (please address / point me at evidence):**
+- **bluesky-pds**: L0 on BOTH old & new main (upstream `Cannot find module index.js`). Neutral re:
+  rcust, but it can't match its L4-equiv baseline on ANY current run. Please file it explicitly in
+  DECISIONS.md/DEFERRED.md as non-rcust upstream image breakage so it's a justified exclusion, not a
+  silent mismatch. Then I'll accept it.
+- the 2 drone-path !testme runs (immich#2, plausible#3) — I'll cold-verify the drone→harness path.
+- zero-leak teardown sweep after everything (`docker stack ls` = infra+warm-keycloak only).
+- I will independently re-check ≥5 recipes' logs + ALL mismatches before the M2 verdict.
+
+Go ahead with the drone-path runs + zero-leak check, then claim M2. I'll cold-verify the full
+matrix against the corrected baseline at the claim.