M3: bridge deployed + verified publicly reachable; webhook delivery blocked at Gitea (ALLOWED_HOST_LIST)

Bridge healthz 200 over public DNS; HMAC verified. Gitea sends no deliveries
(suspect webhook host allowlist). Recorded in STATUS Blocked + operator options.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

JOURNAL.md

@@ -285,3 +285,29 @@ posts a PR comment linking the run. Secrets read from mounted files; config via
 traefik at `ci.commoninternet.net/hook` via a reconcile oneshot (modules/bridge.nix); register a
 per-repo webhook with the HMAC; demo on a scratch PR (!testme triggers; non-!testme + non-collab
 rejected). That's the M3 gate.
+
+## 2026-05-26 — M3: bridge deployed + verified; webhook DELIVERY blocked (Gitea-side)
+
+**Deployed** the comment-bridge as a Nix-built OCI image (no Docker Hub pull) → swarm service on
+`proxy`, behind traefik at `ci.commoninternet.net/hook`, via reconcile oneshot `modules/bridge.nix`.
+Swarm secrets (webhook_hmac/drone_token/gitea_token) materialised from /run/secrets.
+
+**Verified working (bridge side):**
+- `docker service ls` → ccci-bridge_app 1/1.
+- `GET /hook/healthz` → 200 **from the sandbox over real public DNS** (ci.commoninternet.net →
+  143.244.213.108); also 200 via gateway from cc-ci.
+- HMAC logic: bad sig → 401; a manually openssl-HMAC-signed body → 204 (passes sig, ignored as
+  non-trigger); wrong event → 204. (Debug log added: `got=/want=/bodylen/seclen`.)
+- Registered per-repo `issue_comment` webhook (id 210) on recipe-maintainers/cc-ci → ci.../hook with
+  the HMAC. Created scratch PR #1.
+
+**Blocker found:** commenting `!testme` (×several) and Gitea's "Test Delivery" (UI returns 200) yield
+ZERO requests at the bridge container. Bridge is publicly reachable by hostname from a 3rd network;
+gateway accepts public sources; public DNS correct → Gitea is not *sending* the delivery. Deliveries
+panel is AJAX (uninspectable via curl); bot is not Gitea admin (can't read `ALLOWED_HOST_LIST`).
+Conclusion: git.autonomic.zone webhook policy (likely `ALLOWED_HOST_LIST`) blocks ci.commoninternet.net.
+Recorded in STATUS ## Blocked with operator options (whitelist host, or I pivot bridge to polling).
+
+**Plan:** surface to operator; meanwhile proceed to M4 (harness + install stage) which doesn't depend
+on the webhook (dev recipe-CI builds triggerable directly via the Drone API). Revisit M3 gate once the
+host is whitelisted or via the polling fallback.