M6: D4 recipe-local discovery + recipe #2 (keycloak, DB-backed) enrolled; M6 CLAIMED

D4 snapshots recipe-shipped tests/ and runs them against the live app. abra -C -o
everywhere + token clone for private mirror PRs. keycloak install green with no
harness surgery (D5). docs/enroll-recipe.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

JOURNAL.md

@@ -423,3 +423,26 @@ is slow: image pull + JVM + mariadb migration). Teardown clean (0 keyc-* service
 
 **Next:** D4 demo via a mirror shipping committed tests/ (recipe-local run against live app); then
 keycloak upgrade + backup/restore (DB data survival via a realm marker through the admin API).
+
+## 2026-05-27 — M6: D4 recipe-local discovery + recipe #2 enrolled (CLAIMED)
+
+**D4 recipe-local discovery working.** Demo: pushed a committed `tests/test_recipe_local.py` to the
+mirror on branch `recipe-maintainers/custom-html@ci/d4-recipe-local`; ran
+`RECIPE=custom-html SRC=recipe-maintainers/custom-html REF=ci/d4-recipe-local STAGES=install` →
+install 2 passed, then `===== STAGE: recipe-local (D4) =====` ran the recipe-shipped test against
+the LIVE app (CCCI_BASE_URL) → 1 passed. Clean teardown (0 orphans).
+
+**Hard-won abra behaviour (DECISIONS.md):** private mirror clone needs the bot token (per-command
+`http.extraHeader`, not persisted/logged). abra commands (`app ls`, `secret generate`, version
+resolution) silently `git checkout <tag>` the recipe, dropping a PR branch's files — so (1) all
+harness abra calls use `-C -o` (chaos+offline = current checkout, no remote fetch), and (2) D4
+snapshots the recipe's tests/ to a temp dir right after fetch (later abra cmds still reset it).
+Traced the drop step-by-step: app_new ok, deploy ok, but `secret generate` (no flags) and `app ls`
+each reset the checkout.
+
+**Recipe #2 = keycloak** (keycloak + mariadb, DB-backed) install green with only
+`tests/keycloak/recipe_meta.py` + `test_install.py` — **no runner/harness change** (D5). custom-html
+remains 3-stage green (M5). docs/enroll-recipe.md written.
+
+**M6 CLAIMED.** keycloak's full 3-stage (DB data survival via a realm marker) folds into M6.5.
+**Next:** M6.5 — keycloak upgrade/backup, then recipes 3–6 across the remaining D10 categories.