review(2): F2-11 CLOSED — deploy-free cold proof (35 unit + real conftest skip-report stitched to predicate); consume inbox

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

machine-docs/ADVERSARY-INBOX.md

@@ -1,28 +0,0 @@
-# Adversary inbox (from Builder) — non-gate heads-up
-
-## @2026-05-28 ~21:20Z — F2-11 FIXED (deploy-free verify) + deploy work paused on Docker Hub rate limit
-
-Consumed your BUILDER-INBOX (DONE-gate warnings + F2-11). Two things:
-
-**1. F2-11 — FIXED, ready for your re-verify (commit `5b34496`).** SSO-dep "deps-not-ready" SKIP no
-longer yields a GREEN run. Full WHAT/HOW/EXPECTED/WHERE in STATUS-2 "## Adversary findings — Builder
-response". Both verifications are **deploy-free** (rate-limit-independent), so you can re-verify now:
-  - `cc-ci-run -m pytest tests/unit -q` → 35 passed (28 prior + 7 new in test_f211_sso_skip.py).
-  - `CCCI_DEPS_READY=0 CCCI_DEPS_SKIP_REPORT=/tmp/f211-skip.txt cc-ci-run -m pytest \
-     tests/lasuite-docs/functional/test_oidc_with_keycloak.py -rs; cat /tmp/f211-skip.txt`
-     → `1 skipped` + exit 0 (the hazard) but skip-report==`1`; lasuite-docs declares DEPS=[keycloak]
-     so `sso_dep_unverified(["keycloak"],False,1)=True` → orchestrator `overall=1`.
-  Design note: generic-tier failure-isolation is preserved; only the green SIGNAL is corrected. The
-  full live-deploy e2e (forced setup_custom_tests failure → overall=1) is deferred until the rate
-  limit below lifts — flagged honestly in STATUS-2, not hidden.
-
-**2. Deploy-dependent work is PAUSED on a Docker Hub pull rate limit (NOT abandoned).** See STATUS-2
-"## Blocked". cc-ci's IP hit `toomanyrequests` (today's many deploys + a `docker image prune` that
-forced a full cold re-pull while clearing a disk-full on the Q3.2 lasuite-drive deploy). Only ~1 pull
-trickles through per window-roll, so I can't complete any new recipe deploy. Operator notified
-@~19:45Z to provide registry pull creds (plan §1.5). This gates everything you flagged that needs a
-deploy: ghost create-post §4.3 floor, F2-7 authentik, F2-9 cryptpad create-pad, Q3.2 drive specifics.
-cc-ci is CLEAN (drive stack torn down, 0 residue). Gitea outage (~19:40–21:08Z) is RESOLVED + git
-reconciled. I'll resume deploy work the moment pulls flow.
-
-(Delete this file once read — deletion is the consumed signal.)

machine-docs/BACKLOG-2.md

@@ -115,8 +115,36 @@ Phase plan: `/srv/cc-ci/cc-ci-plan/plan-phase2-recipe-tests.md`
 
 ## Adversary findings
 
-- [ ] **F2-11 [adversary] — SSO-dep "deps-not-ready" SKIP yields a GREEN `!testme` while the
-      core OIDC test never ran (gate-integrity / P7, medium)** — Filed by Adversary @2026-05-28
+- [x] **F2-11 [adversary] — CLOSED @2026-05-28** by Builder commit `5b34496`. The deps-not-ready
+      SKIP no longer yields a GREEN run; generic-tier failure-isolation is preserved (only the green
+      SIGNAL is corrected). The fix: `conftest.pytest_collection_modifyitems` counts skipped
+      `requires_deps` tests and appends the count to `$CCCI_DEPS_SKIP_REPORT`; `run_recipe_ci`
+      sums it (`run_recipe_ci.py:582-585`), surfaces `(N requires_deps SKIPPED … SSO UNVERIFIED)`
+      in the RUN SUMMARY, and the pure predicate `sso_dep_unverified(declared, deps_ready, skipped)`
+      (`:48`) flips `overall=1` (`:633`) when a DEPS-declaring recipe skipped ≥1 SSO test.
+      **Adversary cold re-verify @2026-05-28 on `/root/adv-verify` HEAD `0d6cd05` (deploy-free,
+      rate-limit-independent):**
+      - `cc-ci-run -m pytest tests/unit -q` → **35 passed** (28 prior + 7 new `test_f211_sso_skip.py`;
+        read the bodies — non-vacuous: predicate true + 3 false cases, conftest skip/record/append/
+        no-op with fakes).
+      - **Real signal proof:** the actual `tests/lasuite-docs/functional/test_oidc_with_keycloak.py`
+        (lasuite-docs declares `DEPS=["keycloak"]`) run with `CCCI_DEPS_READY=0` →
+        `1 skipped`, **pytest-exit=0** (the original hazard — a skip-only file still exits 0) BUT
+        `$CCCI_DEPS_SKIP_REPORT` content == `1`.
+      - **Stitched to the real orchestrator predicate:** `sso_dep_unverified(["keycloak"], False, 1)
+        = True` → `overall=1` (RED). Negatives correct: `deps_ready=True → False`, `no-deps → False`.
+      - Runtime wiring verified by code-read: `main()` sets `CCCI_DEPS_SKIP_REPORT` (`:445`) before
+        the custom tier; `_tier_env` returns `dict(os.environ, …)` so the pytest subprocess inherits
+        `CCCI_DEPS_READY` + the report path; orchestrator reads the same `skipfile`.
+      - **Residual (non-blocking):** the Builder honestly deferred the full live-deploy e2e (forced
+        `setup_custom_tests` failure on a real deployed recipe → observe `overall=1` end-to-end)
+        behind the Docker Hub pull rate limit. The decision logic + conftest→orchestrator signal it
+        would exercise are already proven above; I will confirm the live path on the next SSO-dep
+        deploy once pulls flow (belt-and-suspenders, not a re-open condition).
+      Original FAIL detail retained below for audit.
+
+- [ ] ~~**F2-11 [adversary] — SSO-dep "deps-not-ready" SKIP yields a GREEN `!testme` while the
+      core OIDC test never ran (gate-integrity / P7, medium)**~~ — Filed by Adversary @2026-05-28
       as an independent break-it probe during the git.autonomic.zone outage (no gate claimed).
 
       **The hazard chain (cold-proven, end-to-end):**

machine-docs/REVIEW-2.md

@@ -601,3 +601,30 @@ hazard. Filed **F2-11** in BACKLOG-2 (full detail there). Summary:
 
 **No VETO.** No gate claimed. Returning to self-paced idle; will retry the git host and re-orient
 on Builder activity on next wake.
+
+## F2-11 re-verify @2026-05-28 — FIXED (deploy-free cold proof); inbox consumed
+
+Builder commit `5b34496` fixes F2-11 (SSO-dep deps-not-ready SKIP no longer yields a GREEN run).
+Consumed `ADVERSARY-INBOX.md` (F2-11 fixed + deploy work paused on Docker Hub rate limit) — deleted
+to mark consumed. Read the fix code + the 7 new unit-test bodies (not just pass/fail).
+
+**Cold re-verify on `/root/adv-verify` HEAD `0d6cd05` (deploy-free — rate-limit-independent):**
+- `cc-ci-run -m pytest tests/unit -q` → **35 passed** (28 prior + 7 new `test_f211_sso_skip.py`).
+- Real signal: `tests/lasuite-docs/functional/test_oidc_with_keycloak.py` (DEPS=["keycloak"]) with
+  `CCCI_DEPS_READY=0` → `1 skipped`, **pytest-exit=0** (hazard) BUT `$CCCI_DEPS_SKIP_REPORT` == `1`.
+- Stitched to the real predicate: `sso_dep_unverified(["keycloak"], False, 1) = True` → `overall=1`
+  (RED). Negatives: `deps_ready=True → False`, `no-deps → False`. Generic-tier isolation preserved
+  (predicate only flips `overall`; tier results untouched), no false-fail.
+- Runtime wiring confirmed by code-read (`main():445` sets the report path before the custom tier;
+  `_tier_env` = `dict(os.environ,…)` propagates to the pytest subprocess; orchestrator sums the
+  same `skipfile` at `:582-585` and applies the predicate at `:633`).
+
+**Verdict: F2-11 CLOSED** (BACKLOG-2 marked `[x]`). NO VETO. F2-11 was a finding, not a gate — no
+gate is CLAIMED. **Residual (non-blocking):** the live-deploy e2e (forced `setup_custom_tests`
+failure on a real recipe → `overall=1` end-to-end) is Builder-deferred behind the Docker Hub pull
+rate limit; the logic + signal it exercises are proven here. I'll confirm the live path on the next
+SSO-dep deploy once pulls flow.
+
+Standing DONE-gate conditions unchanged (F2-7 authentik, F2-9 cryptpad create-pad, ghost §4.3 floor,
+P1 coverage of remaining §5 recipes, full P1–P8 Q5 cold re-verify) — all deploy-gated, awaiting the
+rate-limit unblock. Returning to self-paced idle; watchdog edge-pings on the next gate claim.