1c: bootstrap Phase 1c loop state (STATUS/BACKLOG/JOURNAL-1c) + decisions (submodule linkage, recovery-key bootstrap)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

DECISIONS.md

@@ -186,3 +186,28 @@ Architecture decisions and dead-ends. One line of rationale each. (§0, §8)
 
 ## Dead-ends
 - (none yet)
+
+## Phase 1c (full reproducibility + genuine D8 live rebuild) — 2026-05-27
+
+- **Secrets linkage = git SUBMODULE (deviates from plan §7 flake-input default).** `cc-ci-secrets`
+  is mounted as a submodule at `cc-ci/secrets/` rather than a flake `inputs.secrets`. Rationale: a
+  private flake input must be re-fetched at **every nix eval**, requiring the bot token persistently
+  in nix config/netrc on cc-ci AND the throwaway VM (a token in the store/config = a 2nd out-of-band
+  secret, which 1c forbids). A submodule makes `secrets/secrets.yaml` a plain path in the working
+  tree → `defaultSopsFile = ../secrets/secrets.yaml` is unchanged (minimal diff, trivially
+  byte-identical), and the only credential use is the one `git clone --recursive` at provisioning
+  ("the two repos are *given*", Mission §1). Build invocation becomes
+  `nixos-rebuild switch --flake 'git+file:///root/cc-ci?submodules=1#cc-ci'` so the submodule tree is
+  included. (Revisit if `?submodules=1` proves unreliable on cc-ci's nix version.)
+- **Bootstrap key for the throwaway VM = the existing RECOVERY (master) age key, via
+  `sops.age.keyFile`.** The recovery key (`age1cmk26…`, private at `/srv/cc-ci/.sops/master-age.txt`)
+  is already a sops recipient, so a fresh host with a *different* ssh host key still decrypts every
+  secret with no re-keying — this is exactly the §0 argument that defeats "host-key binding".
+  Provisioned to the VM at a fixed path (the ONE out-of-band secret). cc-ci itself keeps decrypting
+  via its host key (`age.sshKeyPaths`); secrets.nix will offer both identity sources. (Per-host
+  re-encrypt is cleaner for a *permanent* new instance — documented as the alternative, not used for
+  the throwaway test.)
+- **Cert into git:** wildcard cert+key become sops secrets in `cc-ci-secrets`, decrypted at
+  activation back to `/var/lib/ci-certs/live/{fullchain.pem,privkey.pem}` via
+  `sops.secrets.<name>.path`; proxy.nix keeps reading that path (now sops-sourced, not operator-drop).
+- **cc-nix-test final sizing:** TBD in W6 (keep 4 GB / restore 6 GB / promote rebuilt VM).