From c742f9adc476523983c9534c1f598bf7326ea5d4 Mon Sep 17 00:00:00 2001
From: autonomic-bot <autonomic-bot@git.autonomic.zone>
Date: Thu, 18 Jun 2026 01:51:54 +0000
Subject: [PATCH] journal(redfix): cc-ci-side verification mechanism
 (temp-checkout run) + M2 progress snapshot

---
 machine-docs/JOURNAL-redfix.md | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/machine-docs/JOURNAL-redfix.md b/machine-docs/JOURNAL-redfix.md
index c77eaa1..ca4bd17 100644
--- a/machine-docs/JOURNAL-redfix.md
+++ b/machine-docs/JOURNAL-redfix.md
@@ -334,3 +334,25 @@ the promote path (custom exec tests not involved); cold !testme-green needs the
 
 Need to determine how cc-ci-side code reaches a !testme run (also required for keycloak + mumble
 harness fixes) — investigating CCCI_REPO/Drone checkout next.
+
+## 2026-06-18T02:15Z — cc-ci-side change verification mechanism (for bluesky-rename/keycloak/mumble)
+
+The Drone !testme build clones cc-ci at main HEAD; the manual runner runs from CCCI_REPO (default
+/etc/cc-ci). To verify a cc-ci-side change WITHOUT pushing main or disturbing /etc/cc-ci (shared with
+Adversary): push the change to a cc-ci BRANCH, clone/checkout that branch to a temp dir on cc-ci, and
+run `cd <tmp> && CCCI_REPO=<tmp> cc-ci-run runner/run_recipe_ci.py RECIPE=... CCCI_SKIP_FETCH=1`
+(cc-ci-run is the deployed nix env; runner/ + tests/ come from my branch checkout). Restores cleanly.
+
+bluesky-rename coupling: the warm-promote only fires on a FULLY-GREEN cold run, and bluesky's custom
+tier exec_in_app defaults to service="app". So renaming app→pds REQUIRES the cc-ci exec-ref update
+(service="pds") deployed via the temp-checkout for the cold run to go green and the promote to fire.
+So: (1) recipe rename PR, (2) cc-ci branch with exec-ref update, (3) verify via temp-checkout run ->
+cold green -> promote -> warm-bluesky-pds 200.
+
+## M2 progress snapshot (2026-06-18T02:15Z)
+- mattermost-lts: DONE (PR #1 ci/pg-restore, !testme run #901 all-green incl restore). 
+- discourse: DONE (PR #4 discourse-official-image, !testme run #849 green; re-verify fresh for claim).
+- bluesky-pds: PR #4 (alias) -> superseding with service RENAME app->pds + cc-ci exec-ref update; verify on promote path.
+- gitea: fix READY locally (/tmp/redfix-gitea: app.ini->staging + docker-setup seed-once + DOCKER_SETUP_SH_VERSION v2); needs PR push + warm-advance verify.
+- keycloak: harness fix (canonical_domain collision-free for WARM_DOMAINS recipes + enroll) NOT STARTED.
+- mumble: harness fix (handshake readiness/retry stabilization) NOT STARTED.