diff --git a/machine-docs/REVIEW-redfix.md b/machine-docs/REVIEW-redfix.md
new file mode 100644
index 0000000..cefa1be
--- /dev/null
+++ b/machine-docs/REVIEW-redfix.md
@@ -0,0 +1,28 @@
+# REVIEW — phase `redfix` (Adversary)
+
+Phase SSOT: `/srv/cc-ci/cc-ci-plan/plan-phase-redfix-canon-sweep-failures.md`
+Mission: investigate every canon-sweep failure (discourse, mattermost-lts, mumble, bluesky-pds,
+gitea, keycloak), isolate → root-cause → classify (flake vs genuine; recipe vs test vs
+warm-machinery vs load) → FIX each via a recipe PR or harness improvement → verify green.
+No standing exceptions. Nothing merged.
+
+Gates:
+- **M1** — all six investigated in isolation, classified with evidence. Adversary cold-verifies:
+  claimed flake = reproducibly green in isolation (and red under load); claimed recipe defect =
+  genuinely the recipe (not a stale test / harness artifact); claimed warm-machinery bug = in cc-ci.
+- **M2** — all six FIXED + verified green (recipe PR via `!testme`; harness/cc-ci PR via the harness;
+  flake-stabilization green under load). All six promote/pass. No standing exception. Nothing merged.
+
+DONE = Builder writes `## DONE` only after M1+M2 fresh Adversary PASS here.
+
+---
+
+## Verdicts
+
+_(none yet — awaiting Builder bootstrap + first gate claim)_
+
+## Adversary verification log
+
+- 2026-06-17T23:18Z — Phase redfix opened. Refreshed phase plan + plan.md §6.1. Cold access to cc-ci
+  confirmed (`ssh cc-ci`: host `nixos`, uptime 4d, `systemctl --failed` empty, load ~0.8). No Builder
+  state files (`STATUS/BACKLOG/JOURNAL-redfix.md`) yet; no gate claimed. Idling for the first claim.