review(2w): Adversary online — phase start, cold access verified, awaiting WC gate claims

machine-docs/REVIEW-2w.md

@@ -0,0 +1,35 @@
+# REVIEW-2w — Adversary verdicts for Phase 2w (warm canonical + `--quick`)
+
+Adversary-owned ledger. Append-only. Formal verdicts live here; gate claims live in STATUS-2w.md,
+findings in BACKLOG-2w.md `## Adversary findings`.
+
+**Definition of Done verified here:** WC1–WC9 (see `plan-phase2w-warm-canonical-quick.md` §1).
+Each needs an independent COLD verdict before `## DONE` is permitted. The marquee proof is **WC9**:
+deliberately fail a PR under `--quick` and confirm the canonical's last-known-good is restored intact
+(data preserved) AND a `--quick` pass did not move the known-good.
+
+## Verification map (what I will re-run cold per gate)
+- **WC1** live-warm keycloak: dependent recipe's SSO custom tests pass against warm keycloak;
+  concurrent dependents use distinct namespaced realms (no collision); leftover realms reaped.
+- **WC2** data-warm canonical: canonical at a stable domain (≠ cold `<recipe>-<6hex>`); declarative
+  registry tracks recipe→commit; re-warmable from scratch.
+- **WC3** snapshots: raw volume copy taken while UNDEPLOYED under stable path; one last-known-good per
+  app, atomic replace; restore brings app back healthy with data.
+- **WC4** `--quick`: reattach canonical → upgrade to PR head → generic UPGRADE+serving+custom;
+  PASS→undeploy keep volume, known-good unchanged; FAIL→restore snapshot then undeploy; never promotes.
+- **WC5** cold-only advancement: green full-cold on latest re-snapshots+re-tags; only cold advances.
+- **WC6** nightly full-cold sweep: scheduled, declarative, MAX_TESTS-bounded.
+- **WC7** trigger/authority/labeling: default `!testme`=cold; `--quick` opt-in, never gates merge;
+  results carry mode; no-canonical fallback clean.
+- **WC8** resource safety: warm runs serialize per app; warm keycloak shared via per-run realms; disk
+  monitored+pruned; cold teardown still deletes per-run volumes; warm data excluded from D8 closure.
+- **WC9** docs + cold verify incl. rollback proof; no softened tests.
+
+---
+
+## @2026-05-28 — Phase 2w start (Adversary online)
+- Phase 2w interjected by operator (2026-05-28); Phase 2 paused. No 2w gates CLAIMED yet — Builder
+  has not bootstrapped STATUS-2w.md. Phase-2 Docker Hub rate-limit fix was the last completed work.
+- COLD access re-verified: `cc-ci-tailscaled` active; `ssh cc-ci` → NixOS 24.11 (50ab793);
+  wildcard `*.ci.commoninternet.net` → gateway 143.244.213.108. Verification path is live.
+- IDLE until the Builder claims a WC gate (watchdog will ping on claim). Standing veto power retained.