review(redfix): wake #53 — cold re-verify on closed phase; DONE + no-VETO reaffirmed; A-redfix-1 'sole copy' FALSIFIED (78 world-readable cred copies, root-caused to /root/.gitconfig insteadOf; dashboard invariant HOLDS, operator-scope widened, no gate impact)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0123qkYW7yhbqntjcjVvTUQ2

machine-docs/REVIEW-redfix.md

@@ -1565,3 +1565,30 @@ are the operator's to perform.** If the operator later merges `b5f2b10` or a new
 loop should re-verify from a cold start against the then-current tree.
 
 Did not read JOURNAL-redfix.md.
+
+---
+
+## Wake #53 (2026-07-09T10:15Z) — cold re-verify on closed phase; DONE + no-VETO REAFFIRMED; A-redfix-1 "sole copy" claim FALSIFIED (operator-scope widened, no gate impact)
+
+Reboot on a closed phase. Re-ran the terminal invariants cold, no cached state:
+
+- **Merge target invariant HOLDS.** `origin/redfix-m2-harness` tip == `b5f2b10`; `07fc6d4` is an *ancestor*
+  of `b5f2b10` (dev history), and **neither** is an ancestor of `origin/main` — i.e. nothing was merged; the
+  branch waits for the operator. Correct per DoD ("merge `b5f2b10`, NEVER deploy `07fc6d4`").
+- **Dashboard "no secrets" invariant HOLDS (live).** `ci.commoninternet.net` (not `dashboard.*`) is the live
+  host. `/runs/985/results.json` → 200 `has_cred=False` (positive control); `/runs/<rid>/abra/recipes/<r>/.git/config`
+  → **404** (blocked by `len(parts)==2` + `_RUN_FILES` allow-list in `dashboard/dashboard.py:467-490`). The
+  0644 credential copies are **not** reachable over HTTP.
+- **B-redfix-8 sentinel still unrotated** — `sha256(pw)[:16] = 3fcea78925015fc9` across every checked copy
+  (empty-input control `e3b0c44298fc1c14`). Operator-only, as recorded.
+
+**Break-it finding — A-redfix-1's "sole copy" universal is FALSE (see BACKLOG A-redfix-1 ADDENDUM wake #53).**
+I disbelieved the claim that `/etc/cc-ci/.git/config` is the only world-readable cred copy. Cold enumeration
+found **78** world-readable cred-bearing `.git/config` files (68 in `/var/lib/cc-ci-runs/*/abra/recipes/*/`, 8
+in `/nix/store`, `/tmp/v`, `/etc/cc-ci`), all the same live credential. Root-caused to the
+`url.…:<pw>@….insteadOf` rewrite in `/root/.gitconfig`: `run_recipe_ci.py:360` clones a clean URL but git
+rewrites userinfo in, at 0644, **regenerated on every CI run**. This means the recorded remedy (chmod/delete
+the single file) is insufficient and rotation alone re-exposes the new value. It **widens the operator remedy**
+(remove userinfo from git's URL layer; use a 0600 credential helper) but touches **no gate / no DoD item** —
+the dashboard invariant holds and this is host-local FS exposure inside existing operator-only A-redfix-1/
+B-redfix-8 scope. **No VETO; `## DONE` stands.**