review(drone): M2 PASS @2026-06-11T22:30Z — build #506 L5; bridge !testme verified; §7.1 signed

Adversary M2 verdict: PASS. Evidence independently verified:

- results.json build #506: level=5, install+upgrade+custom+lint PASS, backup intentional skip,
  clean_teardown=True, no_secret_leak=True, no unintentional skips
- Drone API: event=custom, status=success, params={PR:1,RECIPE:drone,REF:049438e1cb47},
  sender=autonomic-bot — genuine bridge !testme trigger, not manual
- POLL_REPOS: recipe-maintainers/drone confirmed in bridge.nix
- Screenshot: real drone landing page ("Hello, Welcome to Drone") visually verified
- Gitea dep gite-4c9694 provisioned per-run; SCM test used dep client_id (not production)

DEFERRED build-creation gap §7.1 sign-off: drone OAuth + .drone.yml build-creation API
accepted as a proportionate deferral (harness capability gap, not recipe gap). Maximal
subset (install+upgrade+SCM-configured+lint) proven in build #506. Remaining DEFERRED:
build-creation API automation only.

Phase drone DONE. PR open for operator merge.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

machine-docs/REVIEW-drone.md

@@ -52,6 +52,48 @@
 
 ---
 
+### M2 PASS @2026-06-11T22:30Z
+
+**Build:** #506 on `drone.ci.commoninternet.net`, event=custom (bridge-triggered !testme)  
+**PR:** recipe-maintainers/drone #1 (`testme-1.9.0-cc-ci` @ `049438e1cb47`)  
+**Timestamp:** 2026-06-11T22:21Z–22:23Z
+
+**Adversary verification steps (all PASS):**
+
+1. **Results JSON independently read from `/var/lib/cc-ci-runs/506/results.json`:**
+   `level=5`, `install:pass`, `upgrade:pass`, `backup:skip`, `restore:skip`, `custom:pass`,
+   `lint:pass`, `backup_restore:skip` intentional ("not backup-capable"), `clean_teardown:True`,
+   `no_secret_leak:True`, `skips.unintentional:[]`, `pr:1`, `ref:049438e1cb47` ✅
+
+2. **Bridge-triggered independently confirmed via Drone API:**
+   `event:custom`, `status:success`, `params:{PR:'1', RECIPE:'drone',
+   REF:'049438e1cb473626f23f7b076ca9d880b50a69f1', SRC:'recipe-maintainers/drone'}`,
+   `sender:autonomic-bot`. Not a push event; not a manual run — genuine bridge !testme trigger. ✅
+
+3. **POLL_REPOS verified in `nix/modules/bridge.nix`:**
+   `recipe-maintainers/drone` present in the POLL_REPOS csv list. ✅
+
+4. **Screenshot (`drone-m2-build506.png`) visually inspected:**
+   Real drone landing page — "Hello, Welcome to Drone. You will be redirected to your source
+   control management system to authenticate." + CONTINUE button. Not blank/placeholder. ✅
+
+5. **Gitea dep provisioned per-run (not production):** STATUS-drone.md confirms gitea dep at
+   `gite-4c9694.ci.commoninternet.net`, OAuth2 app `client_id=d144083e-5ba5-4d1e-aed2-5e8f8331923a`
+   created per-run. Not `git.autonomic.zone`. ✅
+
+6. **DEFERRED build-creation gap — §7.1 sign-off:**
+   Per DEFERRED.md (2026-05-29 Q4.10), the drone scope was always "MAXIMAL SUBSET (drone boots
+   with gitea SCM: install+upgrade+health+SCM-configured) + Adversary §7.1 sign-off on the
+   build-creation gap." M2 proves the maximal subset (build #506, L5, all mandatory tiers). The
+   build-creation API gap (creating/running actual CI pipelines via drone's own API — needs a drone
+   OAuth token + `.drone.yml` + webhook trigger) is accepted as a genuine deferral: disproportionate
+   to the current scope, requires infrastructure not yet in place, and is not a recipe gap.
+   **§7.1 SIGNED OFF. DEFERRED item updated.** ✅
+
+**M2 PASS. Phase drone DONE. PR open for operator merge.**
+
+---
+
 ## Pre-verification probes (Adversary-initiated, before any Builder claim)
 
 ### P0 verification — /etc/timezone on cc-ci host