review(2): F2-11 CLOSED — deploy-free cold proof (35 unit + real conftest skip-report stitched to predicate); consume inbox

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

machine-docs/REVIEW-2.md

@@ -601,3 +601,30 @@ hazard. Filed **F2-11** in BACKLOG-2 (full detail there). Summary:
 
 **No VETO.** No gate claimed. Returning to self-paced idle; will retry the git host and re-orient
 on Builder activity on next wake.
+
+## F2-11 re-verify @2026-05-28 — FIXED (deploy-free cold proof); inbox consumed
+
+Builder commit `5b34496` fixes F2-11 (SSO-dep deps-not-ready SKIP no longer yields a GREEN run).
+Consumed `ADVERSARY-INBOX.md` (F2-11 fixed + deploy work paused on Docker Hub rate limit) — deleted
+to mark consumed. Read the fix code + the 7 new unit-test bodies (not just pass/fail).
+
+**Cold re-verify on `/root/adv-verify` HEAD `0d6cd05` (deploy-free — rate-limit-independent):**
+- `cc-ci-run -m pytest tests/unit -q` → **35 passed** (28 prior + 7 new `test_f211_sso_skip.py`).
+- Real signal: `tests/lasuite-docs/functional/test_oidc_with_keycloak.py` (DEPS=["keycloak"]) with
+  `CCCI_DEPS_READY=0` → `1 skipped`, **pytest-exit=0** (hazard) BUT `$CCCI_DEPS_SKIP_REPORT` == `1`.
+- Stitched to the real predicate: `sso_dep_unverified(["keycloak"], False, 1) = True` → `overall=1`
+  (RED). Negatives: `deps_ready=True → False`, `no-deps → False`. Generic-tier isolation preserved
+  (predicate only flips `overall`; tier results untouched), no false-fail.
+- Runtime wiring confirmed by code-read (`main():445` sets the report path before the custom tier;
+  `_tier_env` = `dict(os.environ,…)` propagates to the pytest subprocess; orchestrator sums the
+  same `skipfile` at `:582-585` and applies the predicate at `:633`).
+
+**Verdict: F2-11 CLOSED** (BACKLOG-2 marked `[x]`). NO VETO. F2-11 was a finding, not a gate — no
+gate is CLAIMED. **Residual (non-blocking):** the live-deploy e2e (forced `setup_custom_tests`
+failure on a real recipe → `overall=1` end-to-end) is Builder-deferred behind the Docker Hub pull
+rate limit; the logic + signal it exercises are proven here. I'll confirm the live path on the next
+SSO-dep deploy once pulls flow.
+
+Standing DONE-gate conditions unchanged (F2-7 authentik, F2-9 cryptpad create-pad, ghost §4.3 floor,
+P1 coverage of remaining §5 recipes, full P1–P8 Q5 cold re-verify) — all deploy-gated, awaiting the
+rate-limit unblock. Returning to self-paced idle; watchdog edge-pings on the next gate claim.