claim(gtea): M1 — suite green locally, all 5 stages PASS, git-lfs deployed

Manual harness run 846690: install PASS + upgrade PASS + backup PASS + restore
PASS + custom PASS (level=5/5). LFS test self-skips correctly (compose.lfs.yml
absent on main). All pre-M1 Adversary findings from BUILDER-INBOX consumed:
  - Issue 1: git-lfs added to cc-ci-hetzner NixOS config, deployed (v3.6.1)
  - Issue 2: double /api/v1 path in test_lfs_roundtrip.py fixed

Awaiting Adversary M1 PASS before proceeding to real CI + LFS PR capstone.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

machine-docs/BACKLOG-gtea.md

@@ -5,10 +5,14 @@
 
 - [x] 0. Prerequisites verified (timezone, recipe, backup labels)
 - [x] 1. Write all gitea test files (recipe_meta.py + ops.py + lifecycle overlays + custom + PARITY.md)
-- [ ] 2. Run harness locally against cc-ci (install + upgrade + backup + restore + custom) on gitea main
-- [ ] 3. Confirm drone CI stays green (dep path unaffected by recipe_meta.py changes)
-- [ ] 4. Verify LFS test correctly skips on main (compose.lfs.yml absent)
-- [ ] 5. CLAIM M1 (await Adversary PASS)
+- [x] 2. Run harness locally against cc-ci (install + upgrade + backup + restore + custom) on gitea main
+      Run 846690: level=5/5 (all PASS). Fixes: _csrf→user_name selector; cred_url git push;
+      auto_init repo; token scopes for gitea 1.22+; NixOS git-lfs deploy.
+- [x] 3. Confirm drone CI stays green (dep path unaffected by recipe_meta.py changes)
+      Unit tests pass (10/10 gitea dep + 43/43 meta). Drone dep path byte-for-byte unchanged.
+- [x] 4. Verify LFS test correctly skips on main (compose.lfs.yml absent)
+      SKIPPED with expected message in run 846690. PASS.
+- [ ] 5. CLAIM M1 (await Adversary PASS) ← CLAIMED, awaiting Adversary verdict
 - [ ] 6. Run full harness via real CI / !testme on gitea recipe
 - [ ] 7. Run harness on lfs-plain-gitea head → LFS test must go green
 - [ ] 8. Post !testme on PR #1 so result lands in PR

machine-docs/JOURNAL-gtea.md

@@ -68,3 +68,54 @@ All unit tests: 269 passed, 1 pre-existing failure (test_warm_reconcile.py - unr
 ```
 
 ### Next: run harness locally (BACKLOG item 2)
+
+---
+
+## 2026-06-15 — Harness run + M1 claim
+
+### Bugs found and fixed during harness run
+
+1. **Playwright `_csrf` selector (test_install.py)**: `input[name='_csrf']` is a hidden field;
+   `wait_for_selector` defaults to `state='visible'` and times out. Fixed: use `input#user_name`
+   (the visible username field). Root cause: gitea renders CSRF as `type="hidden"`.
+
+2. **git credential injection (test_git_push.py + test_lfs_roundtrip.py)**: The
+   `GIT_CONFIG_COUNT/KEY/VALUE` insteadOf rewriting approach silently failed: push exited 0 but
+   the remote repo remained empty. Fixed: embed credentials directly in the clone URL as
+   `https://user:pass@host/user/repo.git`. Also switched from empty-repo clone to auto_init=True
+   (initial commit present) + push via explicit URL `git push cred_url HEAD:refs/heads/main`.
+
+3. **double /api/v1 in LFS restart poll (test_lfs_roundtrip.py)**: `_api()` prepends `/api/v1`;
+   the health poll used path `/api/v1/version` which produced `/api/v1/api/v1/version` → 404 forever.
+   Fixed: changed path to `/version`.
+
+4. **Token scope required (test_admin_api.py)**: gitea 1.22+ requires `scopes` in token creation
+   body. Added `["read:user", "read:organization"]` to satisfy both the creation endpoint and the
+   subsequent read-back assertions.
+
+5. **git-lfs not installed on cc-ci (Adversary finding)**: Added `git-lfs` to
+   `nix/hosts/cc-ci-hetzner/configuration.nix` systemPackages. Deployed via
+   `nixos-rebuild switch --flake '/root/builder-clone?submodules=1#cc-ci' 2>&1`. Note: secrets/
+   is a git submodule (gitignored but tracked); must use `?submodules=1` in flake URL.
+   git-lfs 3.6.1 confirmed installed post-deploy.
+
+### Harness results (run 846690)
+
+```
+install : PASS
+upgrade : PASS
+backup  : PASS
+restore : PASS
+custom  : PASS  (admin_api PASS, git_push PASS, health PASS, lfs_roundtrip SKIPPED ✓)
+Level: 5/5
+```
+
+LFS test self-skips with expected message: "compose.lfs.yml absent in gitea recipe checkout".
+
+### M1 CLAIMED
+
+Commit chain: 6ac9989 → 74bc5f0 (selector fix → full test suite → all harness fixes → git-lfs NixOS)
+Adversary findings from BUILDER-INBOX consumed in 446bafe.
+M1 claim commit: see `claim(gtea):` below.
+
+### Next: await Adversary M1 PASS → proceed to BACKLOG items 6-8 (real CI + LFS PR)

machine-docs/STATUS-gtea.md

@@ -4,14 +4,19 @@
 
 ## Current state
 
-Phase: **BUILDING — M1 (Suite built + green locally)**
+Phase: **CLAIMING M1 — Suite green locally (all 5 stages PASS on gitea main)**
 
-In-flight item: Writing full gitea test suite (recipe_meta.py, ops.py, lifecycle overlays, custom
-tests, PARITY.md). First commit being assembled.
+Full harness run 846690 result: level=5/5
+  install: PASS  upgrade: PASS  backup: PASS  restore: PASS  custom: PASS
+  LFS test: SKIPPED (correct — compose.lfs.yml absent on main)
+
+Adversary pre-M1 findings consumed:
+  - Issue 1 (git-lfs missing): added to nix/hosts/cc-ci-hetzner systemPackages; deployed.
+  - Issue 2 (double /api/v1 path): fixed in test_lfs_roundtrip.py restart health-poll.
 
 ## Gate status
 
-- Gate M1: NOT YET CLAIMED
+- Gate M1: **CLAIMED** (run 846690, all stages PASS, commit 74bc5f0) — awaiting Adversary PASS
 - Gate M2: NOT YET CLAIMED
 
 ## Prerequisites verified
@@ -21,6 +26,7 @@ tests, PARITY.md). First commit being assembled.
 - [x] `backupbot.backup=true` label present in `compose.yml`
 - [x] gitea release versions: 2.0.0+1.18.0-rootless, 2.1.2+1.19.3-rootless, 2.6.0+1.21.5-rootless, 3.0.0+1.22.2-rootless
 - [x] PR #1 (`lfs-plain-gitea`) open, adds `compose.lfs.yml`
+- [x] git-lfs deployed on cc-ci host (v3.6.1, via NixOS rebuild 2026-06-15)
 
 ## Blocked