fix(redfix): STATUS/BACKLOG — TWO exposed live credentials, sweep regenerates them WEEKLY (both corrections conceded to Adversary)

Adversary wake #55 conceded my insteadOf falsification but corrected me twice; verified both first-hand:

1. "Production CI does not regenerate / manual-* = hand-run" WRONG. run_id()=manual-<pid> for any non-Drone
   run (run_recipe_ci.py:318-319); nightly-sweep runs run_recipe_ci.py outside Drone with CCCI_SKIP_FETCH=1
   (nightly_sweep.py:88). Sweep regenerates the exposed copies WEEKLY (freshest 07-05 03:37-59 = sweep fire).

2. Census missed a 2nd credential (grep keyed on autonomic-bot: cannot see oauth2:). Full per-file census:
   78 files carry the password, 117 a live oauth2 token, 62 both, 133 distinct under /var/lib. Token is LIVE
   + PUSH-capable (api/v1/user->200 autonomic-bot/64) and is what recipe-mirror-sync.sh:39 pushes with —
   falsifies my own B-redfix-8 "small blast radius" note.

STATUS steps 3-4 rewritten (two creds, weekly regen, combined remedy + chmod 0750); B-redfix-8/9 corrected.
DONE stands; no VETO; no DoD item touched; rotation of BOTH secrets remains operator-only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y9GyBPF1EgTTh6277Xjj7k

machine-docs/JOURNAL-redfix.md

@@ -2183,3 +2183,35 @@ merged. STATUS line 40 corrected accordingly.
 
 No gate impact, no DoD item touched, no VETO standing. `## DONE` still stands. Nothing here is Builder-actionable
 beyond the doc corrections + B-redfix-9; rotation remains operator-only. Stopping the loop again.
+
+---
+
+## Wake #55 — 2026-07-09T10:4xZ — Adversary adjudication: both my corrections were themselves corrected. Conceded both.
+
+The Adversary (`40477fd`) conceded my `insteadOf` falsification but corrected ME on two points. I verified
+both first-hand and **both hold against me**:
+
+**1. "Production CI does not regenerate them" was WRONG.** I read the `manual-*` prefix as "hand-run leftover."
+It isn't: `run_id()` returns `manual-<pid>` for ANY non-Drone run (`run_recipe_ci.py:318-319`), and the
+autonomous `nightly-sweep.timer` runs `run_recipe_ci.py` outside Drone with `CCCI_SKIP_FETCH="1"`
+(`nightly_sweep.py:88`, the `run_on_tag` path). So the sweep itself regenerates the exposed copies **weekly**.
+Empirical: freshest copies 2026-07-05 03:37–03:59Z vs sweep `LastTriggerUSec` 2026-07-05 03:04:50Z. My earlier
+grep of `nightly_sweep.py` was truncated by `head -5`, which hid the `CCCI_SKIP_FETCH` line — a self-inflicted
+blind spot. The Adversary's wake-#53 "regenerates" CONCLUSION was right all along; only its mechanism (insteadOf)
+was wrong. I had the mechanism right and the conclusion wrong. Between us the truth is: sweep copytree, weekly.
+
+**2. My census missed a second credential.** I grepped `autonomic-bot:`, which cannot match an `oauth2:` token.
+Full per-file census: 78 files carry the password, 117 carry a live `oauth2` token (62 carry both), 133 distinct
+world-readable cred files under /var/lib. The token is LIVE + PUSH-CAPABLE (`/api/v1/user` → 200
+autonomic-bot/64; `ls-remote` to private mirror OK) and is the one `recipe-mirror-sync.sh:39` pushes with. That
+also falsifies my own B-redfix-8 "small blast radius" note (which leaned on mirror-sync using a token "not the
+password" — that token is itself leaked).
+
+**Lesson worth keeping:** a census predicated on one credential's literal string cannot discover a second
+credential; the right probe enumerates ALL userinfo, then buckets by hash. And `head -N` on a grep during a
+root-cause hunt can manufacture a false negative — I concluded "no CCCI_SKIP_FETCH in nightly_sweep" from a
+truncated view.
+
+Fixed: STATUS steps 3–4 (two credentials, weekly regeneration, combined remedy incl. `chmod 0750`), the
+B-redfix-8 blast-radius note, and B-redfix-9. Replied via ADVERSARY-INBOX.md. Still no gate/DoD impact, no
+VETO, `## DONE` stands. Rotation of BOTH secrets remains operator-only. Stopping the loop.