status(2): Q2 RE-CLAIMED — F2-5 dep-teardown-verify fix cold-verified clean

Per REVIEW-2 ## Q2 FAIL @2026-05-28 (F2-5 dep teardown leak + F2-6 cold install flake + F2-7
SSO setup keycloak-hardcoded):

F2-5 closed by commit c6e94af: teardown_deps now uses verify=True so residuals raise; failures
propagate to orchestrator exit code + run summary. Cold-verified: lasuite-docs+keycloak e2e
PASS, dep teardown clean, post-run docker stack/volume/secret with 'keyc' filter all empty.

This also explained my Q3.1 flake — the leaked Q2.4 dep keycloak (deterministic dep domain) had
collided with my next dep deploy. With F2-5 fixed, that class of cross-run collision is
impossible (teardown now raises if it leaks, so the run fails BEFORE the next one starts).

F2-7 acknowledged: setup_keycloak_realm is keycloak-specific; authentik would need parallel
backend. Logged for Q2.2/Q5.

F2-6 (cold keycloak install 502) — real but secondary; will checkpoint in Q4 sweep.

Side-effect: Q3.1 partial also landed (PARITY.md + test_health_check parity port +
test_auth_required + the prior test_oidc_with_keycloak.py as Q3.1 third specific test).

Cold evidence: ssh cc-ci 'RECIPE=lasuite-docs STAGES=install,custom cc-ci-run runner/run_recipe_ci.py'
  deploy-count=2 (expect 2), all 5 assertions PASS, dep teardown clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

machine-docs/STATUS-2.md

@@ -57,10 +57,18 @@ Q2 PASS as it's lower-priority (the SSO harness is provider-pluggable and Q2.4 a
 already proven via keycloak).
 
 ## Gate
-**Gate: Q2 — CLAIMED, awaiting Adversary @2026-05-28** (commits `d5f5e86` Q2.1 keycloak; `4d6b040`
-Q2.3 dep resolver + SSO harness primitives; `47f7cb4` harness.browser hardening across all install
-overlays; `9e88741` Q2.4 acceptance). Acceptance per plan §6 Q2: "a dependent recipe deploys its
-provider + runs an OIDC login test in one run." Proven cold:
+**Gate: Q2 — RE-CLAIMED, awaiting Adversary @2026-05-28** (commit `c6e94af` F2-5 fix on top of
+the prior Q2 changeset). Adversary FAIL on F2-5 (dep teardown silent suppress) + F2-6 (cold
+keycloak install flake, secondary) + F2-7 (SSO setup keycloak-hardcoded, transparency). F2-5
+fixed: `teardown_deps` now uses `verify=True`, errors propagate to the orchestrator's exit code,
+the run summary surfaces leaks. Cold-verified: dep keycloak deployed → tests PASS → DEPS
+teardown ran clean → `docker stack ls | grep keyc` → empty. F2-7 ack as a real scope gap (when
+Q2.2 authentik enrolls, `setup_authentik_realm` will need a parallel backend in `harness.sso`).
+F2-6 cold-flake on keycloak install is real but unrelated to Q2 acceptance (a flake-handling
+finding for the install layer; will checkpoint when Q4 reaches keycloak again).
+
+Acceptance per plan §6 Q2: "a dependent recipe deploys its provider + runs an OIDC login test
+in one run." Proven cold:
 
 **Objective evidence pointers (Q2):**
 - **Q2.1 keycloak parity + 2 NEW specific tests** — commit `d5f5e86`:
@@ -84,6 +92,17 @@ provider + runs an OIDC login test in one run." Proven cold:
   - `tests/conftest.py` — `deps_apps` fixture exposes dep domains to dependent tests.
   - 7 new unit tests in `tests/unit/test_deps.py`; **28/28 unit tests PASS** cold.
 
+- **F2-5 fix — dep teardown verify=True** — commit `c6e94af`, log `/root/ccci-f25-verify.log`:
+  - `runner/harness/deps.py::teardown_deps` now uses `lifecycle.teardown_app(..., verify=True)`
+    so residuals raise `TeardownError`. Errors are logged per-dep but we continue to other deps;
+    a combined `TeardownError` is raised after all attempts.
+  - `runner/run_recipe_ci.py` catches the dep `TeardownError` in finally, surfaces via
+    `dep_teardown_error` in the run summary + non-zero exit code.
+  - Cold-verified: lasuite-docs+keycloak dep e2e PASSED clean (3 custom + 2 lifecycle install =
+    5 PASS); post-run cc-ci state has NO leftover keycloak (`docker stack ls | grep keyc` →
+    empty; `docker volume ls | grep keyc` → empty; `docker secret ls | grep keyc` → empty).
+  - deploy-count=2, expected 2.
+
 - **Q2.4 acceptance (the gate)** — commit `9e88741`, log `/root/ccci-q24-lasuite-keycloak.log`:
   - `tests/lasuite-docs/recipe_meta.py` declares `DEPS = ["keycloak"]`.
   - `tests/lasuite-docs/functional/test_oidc_with_keycloak.py`: