M3: bridge deployed + verified publicly reachable; webhook delivery blocked at Gitea (ALLOWED_HOST_LIST)

Bridge healthz 200 over public DNS; HMAC verified. Gitea sends no deliveries
(suspect webhook host allowlist). Recorded in STATUS Blocked + operator options.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

STATUS.md

@@ -24,7 +24,20 @@
   `scripts/bootstrap-drone-oauth.sh`. Starting M3 as independent work; won't flip M3 gate until M2 PASS.
 
 ## Blocked
-- (none)
+- **M3 gate — Gitea→bridge webhook delivery not arriving (suspect Gitea `ALLOWED_HOST_LIST`).**
+  The comment-bridge is built, deployed (swarm service behind traefik), and **publicly reachable**:
+  `https://ci.commoninternet.net/hook/healthz` → 200 from the sandbox over *real public DNS*
+  (ci.commoninternet.net → gateway 143.244.213.108). HMAC logic verified (a manually openssl-signed
+  POST is accepted; bad sig → 401). BUT Gitea never delivers: commenting `!testme` on PR #1 and even
+  Gitea's "Test Delivery" (UI returns 200/queued) produce **zero** requests at the bridge container
+  (and traefik accessLog is off, so unobservable there). Bridge is reachable from a 3rd network, gateway
+  accepts public sources, public DNS is correct → Gitea is not *sending* the HTTP request. Most likely
+  git.autonomic.zone's `[webhook] ALLOWED_HOST_LIST` excludes `ci.commoninternet.net` (bot is not Gitea
+  admin, can't inspect/change). **Operator options:** (a) add `ci.commoninternet.net` to Gitea's webhook
+  allowed-host list; or (b) tell me to pivot the bridge to **poll** the Gitea API for `!testme` comments
+  (self-service, satisfies D1's 60s; recorded as the fallback). **Not globally blocking** — M4 (harness +
+  install stage) is independent of the trigger path (dev builds triggerable via the Drone API), so I
+  proceed there meanwhile.
 
 ## Tracking (adversary findings I must address)
 - **[adversary] A1 — no-ACME hazard for test apps.** Acknowledged (valid). The harness (M4) MUST