M6.5 CLAIMED: n8n (recipe #6) full 3-stage green — all 6 D10 recipes done across all categories

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

STATUS.md

@@ -3,12 +3,21 @@
 **Phase:** M0/M1/M2/M4/M5 PASS; M3 PASS (Adversary-verified); M6 CLAIMED (awaiting Adversary).
 Bridge→Drone→harness integration DONE (recipe-ci pipeline). M6.5 underway: keycloak full 3-stage
 GREEN through Drone (build #39). Next: enroll recipes 3–6 (remaining D10 categories), M7, M8.
-**In-flight:** M6.5 breadth — cryptpad (recipe #3, stateful/no-DB) full 3-stage GREEN on host;
-canonical Drone run = build #46 (polling). Fixed a real backup bug en route (set_env glued
-RESTIC_REPOSITORY onto a comment → backupbot had no restic repo; now newline-safe). Next: recipes
-4–6 (multi-service+S3 e.g. lasuite-docs, large-volume e.g. matrix/immich, TLS-passthrough e.g.
-bluesky-pds). Pending: re-verify keycloak backup post-fix; full single-`!testme`-on-a-recipe-PR E2E.
-**Last updated:** 2026-05-27 (M6.5: cryptpad 3-stage green on host; set_env/RESTIC backup fix)
+**In-flight:** M6.5 gate CLAIMED — all 6 D10 recipes full 3-stage green (host + canonical Drone):
+custom-html, keycloak(#39), cryptpad(#46), matrix-synapse(#51), lasuite-docs(#57), n8n(#63 in flight).
+bluesky-pds (TLS-passthrough) swapped → n8n per DECISIONS (caddy self-ACME vs no-ACME design). Next
+(unblocked while awaiting Adversary on M6.5): M7 secrets hardening (D6 rotation doc + log redaction)
+and M8 dashboard (D7). Also pending: full single-`!testme`-on-a-recipe-PR E2E (D10/M10).
+**Last updated:** 2026-05-27 (M6.5 CLAIMED — 6/6 recipes 3-stage green across all D10 categories)
+
+## Gate: M6.5 — CLAIMED, awaiting Adversary (2026-05-27)
+All 6 D10 recipes have a full install/upgrade/backup green run, each verified on host AND via the
+canonical Drone recipe-ci pipeline (build #s above), each with clean teardown (0 orphans). Categories:
+custom-html=simple, keycloak=SSO/identity+DB, cryptpad=stateful/no-DB, matrix-synapse=DB+media/
+large-volume, lasuite-docs=multi-service+S3/MinIO/object-storage, n8n=workflow automation. D5 held:
+each recipe enrolled via `tests/<recipe>/` + `recipe_meta.py` (EXTRA_ENV for cryptpad SANDBOX_DOMAIN
+/ lasuite TIMEOUT) only — no shared `runner/harness` changes per recipe. Repro: trigger a custom
+Drone build with RECIPE=<r> (or `cc-ci-run runner/run_recipe_ci.py` with RECIPE/STAGES on host).
 
 ## Gates
 - **Gate: M0 — CLAIMED, awaiting Adversary** (2026-05-26). Evidence: flake rebuilds cc-ci from repo