review(2): file F2-11 — SSO deps-not-ready SKIP yields GREEN !testme (cold-proven); note git host outage

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

machine-docs/REVIEW-2.md

@@ -571,3 +571,33 @@ DEFERRED.md:
 **No VETO** (no DONE claim to block yet). No new blocking finding filed on unclaimed WIP. Returning
 to self-paced idle; will verify promptly when a gate is claimed (watchdog edge-ping) or re-verify a
 stale D-gate >24h.
+
+## Idle break-it probe @2026-05-28 — F2-11 filed (SSO-skip-goes-green); git host outage noted
+
+**Git coordination host down.** `git.autonomic.zone` returns a bare Go `404 page not found`
+(text/plain, 19 bytes) on EVERY path incl. root `/` — the Gitea app is down behind its proxy
+(not a deleted repo: my local clone still tracks `origin/main` and is ahead 1 with my prior
+review checkpoint). `git fetch/push` both fail. External, transient infra. **Test infra is up**
+(`ssh cc-ci` OK, dashboard 200 via SOCKS, load avg ~8 → a run likely in flight). No gate is
+CLAIMED. Verdicts/commits accumulate locally and push when the host recovers.
+
+**Independent probe (no git needed):** read the SSO-dep skip path end-to-end and cold-proved the
+hazard. Filed **F2-11** in BACKLOG-2 (full detail there). Summary:
+- `setup_custom_tests` failure → `CCCI_DEPS_READY=0` (`run_recipe_ci.py:528`) →
+  `conftest.py:98` skips every `@pytest.mark.requires_deps` test → a skip-only pytest file exits
+  **0** (cold-proven on cc-ci: `1 skipped`, `PYTEST_EXIT=0`) → `run_custom` returns `"pass"`
+  (`run_recipe_ci.py:372`) → `overall=0` → **`!testme` reports GREEN while the only SSO test for
+  that recipe never ran.** Counter-signal is one conditional `deps-not-ready:` line; no skip count
+  in the summary, no effect on the green/exit signal.
+- **Does NOT compromise Q2 PASS** — Q2.4's `test_oidc_password_grant_against_dep_keycloak`
+  actually PASSED (deps were ready), per the recorded evidence. Latent hazard for future Q3
+  SSO-dep gates + the standing `!testme` signal.
+- **Binding on my future verdicts:** no SSO-dep recipe gate accepted on a green exit alone — I
+  will grep the run log for `SKIPPED`/`deps-not-ready` on `requires_deps` tests and require the
+  OIDC/SSO test to have actually PASSED.
+- Recommended (not a VETO): surface skipped `requires_deps` tests in RUN SUMMARY + make an
+  unexpected deps-not-ready skip gate-blocking for the declaring recipe, while preserving
+  generic-tier failure-isolation.
+
+**No VETO.** No gate claimed. Returning to self-paced idle; will retry the git host and re-orient
+on Builder activity on next wake.