review(redfix): F-redfix-2 CLOSED — gitignore remedy cold-verified (fresh-clone + add -A replay, origin/main, no HTTP exposure); full 51-char key never committed (my prefix-grep was self-contaminated); Builder's symlink correction confirmed — one repo, fix fully applied; rotation left to operator; DONE stands, no VETO; consumed ADVERSARY-INBOX

machine-docs/BACKLOG-redfix.md

@@ -108,7 +108,42 @@ ABRA_DIR=$LA script -qec "abra recipe lint -n discourse" /dev/null   # -> R011 X
 its `DISCOURSE_SMTP_PASSWORD_FILE` env + `smtp_password` secret into the `app` service, since sidekiq is now
 internal). Re-run discourse cold -> EXPECT R011 OK, level=5. Only the Adversary closes this, after re-test.
 
-### [adversary] F-redfix-2 — live API key sits untracked **and un-gitignored** at the repo root of both Builder clones (`config.json`) — one `git add -A` from being pushed to origin — **OPEN, NON-BLOCKING**
+### [adversary] F-redfix-2 — live API key sat untracked **and un-gitignored** at the Builder clone's repo root (`config.json`) — one `git add -A` from being pushed to origin — **CLOSED @2026-07-08T23:26Z**
+
+**CLOSED by Adversary cold re-test.** Builder remedied @`8cf08fd`: `config.json` added to the "local secrets /
+env — never commit" block in `.gitignore` (line 7, with a comment naming the finding). My independent
+verification, none of it taking the Builder's word:
+1. **Attack replay from cold** — `git add -A` into a scratch `GIT_INDEX_FILE` seeded from HEAD: staged paths
+   are `main.go` only; `config.json` **not staged**. `git check-ignore -v config.json` → `.gitignore:7`.
+2. **Fix is on origin, not just local** — `git show origin/main:.gitignore` contains `config.json`. A *fresh
+   clone from origin* + dropping the real `config.json` in → ignored ✅, `git add -A` does not stage it ✅.
+   This matters: a local-only .gitignore edit would not protect the next clone.
+3. **Full key never committed** — my original evidence used the 6-char prefix and is now **contaminated**: our
+   own finding/inbox/journal text contains `tk_bhg`, so `-S'tk_bhg'` yields false positives. Re-tested against
+   the *full 51-char value*: `git log --all -S"$KEY"` → **0 commits** in BOTH `cc-ci` and `cc-ci-adv`. Binary
+   search on prefix length: the longest prefix ever committed anywhere is **6 of 51 chars**, in our own
+   documentation — not a usable disclosure. No leak, past or latent.
+4. **No non-git exposure** — dashboard is live (`https://ci.commoninternet.net/` → 200) but
+   `/config.json` → **404** (also 404 on `dashboard.ci.…`); no tracked source reads it (the other
+   `config.json` hits are `/root/.docker/config.json`, unrelated). Perms `-rw-r--r-- loops:users`.
+
+**CORRECTION to my own finding (Builder was right, I was wrong).** I wrote "BOTH Builder clones". There is
+only **one** repo: `/srv/cc-ci` is a symlink → `/srv/cc-ci-orch` (`ls -ld`), so `/srv/cc-ci/cc-ci` and
+`/srv/cc-ci-orch/cc-ci` share `rev-parse --show-toplevel`, the same `.git` inode (3206558) and the same
+`.gitignore` inode (3252849). My `cc-ci-adv` "pair" is the same illusion. A filesystem-wide sweep found
+exactly one `config.json` inside any git repo, and it is now IGNORED. One fix, fully applied — not half.
+
+**Residual, explicitly NOT closed by this:** the key is still on disk **unrotated** (`len=51`, `tk_bhg…`).
+Gitignoring prevents a future commit; it cannot un-expose a value that leaked by another channel. Since the
+full key provably never entered git and is not HTTP-reachable, git is not a reason to rotate. The Builder
+correctly **escalated rotation to the operator rather than deciding it** — that judgement was right, and the
+call remains the operator's.
+
+---
+
+<details><summary>Original report (as filed 2026-07-08T23:12Z)</summary>
+
+### [adversary] F-redfix-2 — original text — **OPEN, NON-BLOCKING**
 
 **Severity:** does NOT block phase `redfix` (out of scope of its Definition of Done — no VETO, DONE stands).
 Latent secret-leak risk in the working environment; worth fixing before any future phase does a broad `git add`.
@@ -143,3 +178,5 @@ credential and is not mine to modify.
 standing mandate, run after the phase closed. The Builder's journal @418ec57 independently noticed the same
 file; I verified the exposure surface (gitignore miss + never-committed) from a cold start rather than
 taking that note at face value. Only the Adversary closes this, after re-test.
+
+</details>