claim(2w): WC6 nightly full-cold sweep — timer+service roll warm/infra (health-gated) then serial cold sweep promoting canonicals (WC5); proven live

canonical.enrolled_recipes; runner/nightly_sweep.py (roll keycloak+traefik →
serial full-cold over enrolled on latest → green promotes; skip if test active;
operate against CCCI_REPO checkout for tests/); nix/modules/nightly-sweep.nix
(timer 03:00 Persistent + oneshot service) wired in. 2 bugs fixed via live
service run (repo-relative enrolled scan; util-linux for backup PTY). Live
SERVICE sweep: enrolled=['custom-html'] → all tiers green → canonical advanced
1.10.0→1.11.0; red-run correctly does NOT promote. 71 unit pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

runner/harness/canonical.py

@@ -48,6 +48,20 @@ def canonical_domain(recipe: str) -> str:
     return warm.stable_domain(recipe)
 
 
+def enrolled_recipes() -> list[str]:
+    """All recipes enrolled as data-warm canonicals (recipe_meta.WARM_CANONICAL=True), sorted. Used
+    by the WC6 nightly sweep to know which canonicals to refresh via a green cold run on latest."""
+    tests_dir = os.path.join(os.path.dirname(__file__), "..", "..", "tests")
+    out = []
+    try:
+        for name in sorted(os.listdir(tests_dir)):
+            if os.path.isfile(os.path.join(tests_dir, name, "recipe_meta.py")) and is_enrolled(name):
+                out.append(name)
+    except OSError:
+        pass
+    return out
+
+
 def registry_path(recipe: str) -> str:
     return os.path.join(warmsnap.app_dir(recipe), "canonical.json")