security(redfix): escalate B-redfix-8 LOW->HIGH — leaked bot password is served to the PUBLIC internet; consume BUILDER-INBOX

Independently verified (bare python urllib GET, no creds): the mirror is public and commit 14c7dee
serves the cleartext autonomic-bot password at HTTP 200 to unauthenticated clients. HEAD/main and the
redaction commit e99e2b3 fetch clean publicly — only the historical commit still serves it. Mount-ns
containment (the old LOW rationale) is moot once the same secret is on the open web.

Redaction at HEAD stops propagation but cannot un-publish a public value; a --force history rewrite is
both forbidden here and insufficient. ROTATION of autonomic-bot's Gitea password by the operator is
now URGENT and the only real remediation (Class-A1 external input, §4.4).

Consumed the Adversary's BUILDER-INBOX (git rm = ack). No verdict change: leak is orthogonal to the
canon-sweep DoD, clearable only externally, so no VETO. M1/M2 PASS, DONE stands.

machine-docs/BACKLOG-redfix.md

@@ -109,8 +109,19 @@ hold). Concrete fix designs from M1 evidence:
       to a `credential.helper` / netrc outside the repo; (c) if the clone is genuinely orphaned, remove it and
       let Nix own any needed checkout. Rotating the bot password is worth considering regardless, since it has
       sat in cleartext on disk.
-- [ ] **B-redfix-8 — the live Gitea bot password was committed to this repo and pushed to `origin/main`**
-      (**OPERATOR ACTION NEEDED — rotation is now the only real remediation**; found + redacted wake #19).
+- [ ] **B-redfix-8 — the live Gitea bot password was committed to this repo, pushed to `origin/main`, and is
+      served to the UNAUTHENTICATED PUBLIC INTERNET** (**SEVERITY HIGH — URGENT operator rotation, not
+      deferrable**; found + redacted wake #19; public-exposure confirmed wake #20).
+      **Public exposure — independently verified wake #20 (not taken from the Adversary's report):** a plain
+      `urllib.request.urlopen` (no auth handler, no netrc, no git credential helper) of
+      `…/recipe-maintainers/cc-ci/raw/commit/14c7dee/machine-docs/BACKLOG-redfix.md` returns **HTTP 200, 33080
+      bytes, with the cleartext password in the body** (sanity-checked: body starts `# BACKLOG`, contains the
+      A-redfix-1 `Repro` block — a real fetch, not an error page). The mirror is public. So the leaked
+      credential is now **world-readable to anyone on the internet, with no account**, permanent in history,
+      replicated to every clone, AND push-capable to `recipe-maintainers/*`. HEAD (`main`) and the redaction
+      commit `e99e2b3` were re-fetched publicly and are **clean** — only the historical commit `14c7dee`
+      serves it. This lifts A-redfix-1/B-redfix-8 from LOW (host-local, mount-ns-contained) to **HIGH**:
+      mount-namespace isolation is irrelevant once the same secret is on the open web.
       While documenting A-redfix-1, `machine-docs/BACKLOG-redfix.md` gained a "repro" line that inlined the
       **actual bot password** as a `grep` pattern. Introduced by commit **`14c7dee`**, which is **on
       `origin/main`** — i.e. pushed to `git.autonomic.zone/recipe-maintainers/cc-ci`.
@@ -124,10 +135,13 @@ hold). Concrete fix designs from M1 evidence:
       **NOT done, and cannot be by me:** the secret remains in **history at `14c7dee` forever**. Excising it
       needs a history rewrite + `--force`, which the standing rules forbid ("Never `--force`"), and which
       would break both loops' clones. Redaction at HEAD stops propagation; it does **not** undo disclosure.
-      **⇒ Rotate the `autonomic-bot` Gitea password.** It was already advisable under A-redfix-1; it is now
-      mandatory, and it is a Class-A1 external input, so only the operator can do it. Once rotated, `14c7dee`
-      becomes inert and no rewrite is needed. The re-issued credential must NOT go back into a remote URL —
-      see A-redfix-1's remedy ladder (`credential.helper` / netrc outside the repo).
+      **⇒ Rotate the `autonomic-bot` Gitea password — URGENT.** It is a live, world-readable, push-capable
+      credential; every hour it stays valid it can be used by anyone who has fetched that public URL. It is a
+      Class-A1 external input, so only the operator can rotate it. **Rotation is the ONLY remediation that
+      actually closes this** — a history rewrite is both forbidden here (`--force`) and insufficient anyway,
+      because a value already served publicly must be presumed captured/cached/crawled and cannot be
+      un-published. Once rotated, `14c7dee` becomes inert. The re-issued credential must NOT go back into a
+      remote URL — see A-redfix-1's remedy ladder (`credential.helper` / netrc outside the repo).
       **Process lesson (mine):** my pre-commit guard did catch this, but I had chained it with `;` instead of
       `&&`, so the commit proceeded anyway and I pushed on top of the leak. A guard whose failure does not
       halt the pipeline is decoration. Fixed by making the check `&&`-gated before `git commit` in wake #19+.