security(redfix): escalate B-redfix-8 LOW->HIGH — leaked bot password is served to the PUBLIC internet; consume BUILDER-INBOX

Independently verified (bare python urllib GET, no creds): the mirror is public and commit 14c7dee
serves the cleartext autonomic-bot password at HTTP 200 to unauthenticated clients. HEAD/main and the
redaction commit e99e2b3 fetch clean publicly — only the historical commit still serves it. Mount-ns
containment (the old LOW rationale) is moot once the same secret is on the open web.

Redaction at HEAD stops propagation but cannot un-publish a public value; a --force history rewrite is
both forbidden here and insufficient. ROTATION of autonomic-bot's Gitea password by the operator is
now URGENT and the only real remediation (Class-A1 external input, §4.4).

Consumed the Adversary's BUILDER-INBOX (git rm = ack). No verdict change: leak is orthogonal to the
canon-sweep DoD, clearable only externally, so no VETO. M1/M2 PASS, DONE stands.

machine-docs/JOURNAL-redfix.md

@@ -1249,3 +1249,35 @@ rotation, not history surgery, is the right lever.
 Scope: no DoD item is touched. **The phase is not reopened; DONE stands.** But this is the first thing in
 several wakes that genuinely needed a human, and it would have gone unnoticed had the guard not fired — and
 nearly did anyway, because the guard was toothless.
+
+### Wake #20 — consumed review(redfix)@cf65019 (re-confirmation #18) + BUILDER-INBOX (Adversary wake #20): the leaked credential is PUBLIC. Escalated B-redfix-8 LOW→HIGH.
+
+The Adversary acked my wake-#19 redaction and handed me one material new fact: the `git.autonomic.zone`
+mirror is **public**, so `14c7dee` serves the cleartext password to the unauthenticated internet. A fact
+this consequential I do not relay on trust — I reproduced it myself, and deliberately with a probe that
+CANNOT smuggle in credentials:
+
+    python3 urllib.request.urlopen(.../raw/commit/14c7dee/machine-docs/BACKLOG-redfix.md)
+      → HTTP 200, 33080 bytes, body starts "# BACKLOG", contains the A-redfix-1 "Repro" block,
+        and the cleartext password IS in the body.
+    (no auth handler, no netrc, no git cred helper — a bare urllib GET, so the 200 is truly anonymous)
+    HEAD /raw/branch/main and /raw/commit/e99e2b3  → 200, password ABSENT (my redaction is live publicly).
+
+First attempt used `curl`, absent on this host — it printed "no match", a **false negative from a broken
+probe**. That is the exact failure mode both loops have now logged three times over (curl-missing here; the
+Adversary's host-ns `setpriv`; its bad-path `git -C`). Caught the same way every time: not by re-reading the
+conclusion but by re-running with a probe that actually measures the thing (`python3` urllib, with sanity
+assertions that I fetched the real file and not an error page). Naming it again because the lesson keeps
+paying out: **verify the instrument, not just the answer.**
+
+Consequence: A-redfix-1/B-redfix-8 goes **LOW → HIGH**. The LOW rating rested on mount-namespace containment
+— which is simply irrelevant once the identical secret is on the open web, no host access required. Updated
+B-redfix-8 accordingly and made rotation URGENT. Redaction at HEAD stops propagation but **cannot
+un-publish**: a value served publicly must be presumed captured/crawled, so even the forbidden `--force`
+rewrite would not close it. Only **rotation** does, and only the operator can (Class-A1, §4.4).
+
+Consumed the BUILDER-INBOX by `git rm` (deletion = ack). No verdict change: the leak is orthogonal to the
+canon-sweep DoD and clearable only by an external action, so neither of us vetoes — a VETO would wedge the
+phase without helping. **M1/M2 PASS, DONE stands, no VETO.** This is the one item in this whole tail of
+re-confirmations that genuinely needs the human, so I am surfacing it to the operator plainly and not
+burying it in the loop files.