chore: bootstrap cc-ci loop state

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

BACKLOG.md

@@ -0,0 +1,62 @@
+# BACKLOG — cc-ci
+
+Two single-writer sections (§6.1): Builder edits only `## Build backlog`; Adversary edits only
+`## Adversary findings`. Closing an item = checking the box in your own section.
+
+## Build backlog
+
+### M0 — Foundations
+- [ ] Author flake.nix (NixOS host cc-ci) + hosts/cc-ci/{configuration,hardware}.nix from baseline
+- [ ] Deploy mechanism decision + first rebuild from repo (DECISIONS.md)
+- [ ] sops-nix wiring: host age key, secrets/secrets.yaml, decrypt a test secret on host
+- [ ] Gate: M0 — `ssh cc-ci 'systemctl is-system-running'` healthy after rebuild from repo
+
+### M1 — Swarm + abra target
+- [ ] Docker + single-node swarm via Nix
+- [ ] Traefik (file provider → /var/lib/ci-certs/live/) + per-run wildcard router
+- [ ] abra installed; deploy + tear down a trivial recipe by hand over HTTPS
+- [ ] Gate: M1 — recipe reachable over HTTPS at *.ci.commoninternet.net, torn down clean
+
+### M2 — Drone online
+- [ ] Drone server + exec runner via Nix; Gitea OAuth app
+- [ ] hello-world .drone.yml runs green; logs in Drone UI
+- [ ] Gate: M2 — push to cc-ci triggers visible green build
+
+### M3 — Comment bridge
+- [ ] comment-bridge service: HMAC verify, !testme exact match, collaborator check, Drone API call
+- [ ] PR comment posting with run link
+- [ ] Gate: M3 — live demo on scratch PR; auth enforced
+
+### M4 — Harness + install stage
+- [ ] run_recipe_ci.py + conftest; install stage for recipe #1 + Playwright assertion; teardown
+- [ ] Gate: M4 — green install run, no orphaned app/volume
+
+### M5 — Upgrade + backup/restore stages
+- [ ] Add upgrade + backup/restore stages for recipe #1
+- [ ] Gate: M5 — upgrade preserves data; backup→mutate→restore returns original
+
+### M6 — Recipe-local tests + second recipe
+- [ ] Discover/run recipe-repo tests/; enroll DB-backed recipe #2
+- [ ] Gate: M6 — both green; recipe-local tests merged
+
+### M6.5 — Breadth ramp (recipes 3→6)
+- [ ] Enroll recipes 3–6 covering remaining D10 categories, no harness surgery
+- [ ] Gate: M6.5 — recipes 3–6 three-stage green
+
+### M7 — Secrets hardening (D6)
+- [ ] Full sops model, rotation doc, log redaction + leak test
+- [ ] Gate: M7 — secret-grep finds nothing
+
+### M8 — Dashboard (D7)
+- [ ] Overview page + badges + PR-comment outcome reflection
+- [ ] Gate: M8 — overview matches reality; outcomes mirrored
+
+### M9 — Reproducibility + docs (D8/D9)
+- [ ] docs/install.md from-scratch rebuild; all docs complete
+- [ ] Gate: M9 — Adversary rebuilds from docs on throwaway host
+
+### M10 — Proof (D10)
+- [ ] All six recipes green via real !testme PRs; flip STATUS to DONE
+
+## Adversary findings
+<!-- Adversary-only section. Builder must not edit below this line. -->