1c/W2a DONE: secrets-split + cert-in-git deployed to live cc-ci; Gate W2 CLAIMED

Submodule mount, cert sops-decrypted to /var/lib/ci-certs/live (sha256 verified), byte-identical
build==running (vh6vwxbl), git-clone+?submodules=1 reproduces it, live TLS valid.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

JOURNAL-1c.md

@@ -64,3 +64,47 @@ prove byte-identical build + clean switch with TLS from the git cert. Then claim
 keyFile); adjust proxy.nix framing; switch cc-ci to new config via
 `nixos-rebuild switch --flake 'git+file:///root/cc-ci?submodules=1#cc-ci'`; prove byte-identical +
 TLS-from-git-cert; then claim Gate W2. (Riskier — touches live server config; fresh iteration.)
+
+## 2026-05-27 — W2a DONE + verified live; Gate W2 CLAIMED
+
+**Discovery:** cc-ci's build source `/root/cc-ci` is NOT a git repo — it's a plain dir synced from
+the sandbox via `tar | ssh` and built as a `path:` flake (DECISIONS.md:126). So cc-ci's deploy needs
+NO submodule fetch / `?submodules=1` (the rsync'd dir already contains `secrets/`). The git-clone
+`--recursive` + `?submodules=1` path is only for the documented install / throwaway (W4).
+
+**Did (W2a — secrets split + cert into git, deployed to live cc-ci):**
+- secrets.nix: added `wildcard_cert`(0444)/`wildcard_key`(0400) sops secrets → `path=/var/lib/ci-certs/live/*`.
+- proxy.nix: reframed cert as sops-from-git (not operator drop); kept FATAL guard as a decrypt-path check.
+- Base repo: `git rm secrets/secrets.yaml`; `git submodule add cc-ci-secrets secrets` (gitlink 2312f1c,
+  `.gitmodules` has NO creds). Pushed f79e542 (rebased over Adversary's c360520; resolved the
+  tracked-file→submodule transition by removing the submodule wd before rebase, repopulating after).
+- Synced to cc-ci via `tar | ssh` (excluded .git). `nixos-rebuild build` → exit 0, only **6 derivations
+  built** (sops manifest gains cert/key + proxy unit error-msg edit) → toplevel
+  `vh6vwxbl4qr9whzpwgjimhf9gn4329p8` (differs from pre-W2 `m1pdvbhl…` — EXPECTED: cert moved
+  out-of-band-file → Nix-managed sops; that is C2's whole point, not drift).
+- Backed up operator cert (`/root/ci-certs-operator-bak`), removed the regular files, `nixos-rebuild
+  switch` (detached unit `ccci-w2-switch`, Result=success).
+
+**Verified live:**
+- sops cert decrypt: `/var/lib/ci-certs/live/{fullchain,privkey}.pem` are now symlinks → `/run/secrets/
+  wildcard_{cert,key}`; content sha256 == source: `c1d96d61…` / `9ec25d00…` (byte-identical to the
+  original operator cert, now git-sourced).
+- `systemctl is-system-running` → running, 0 failed. `deploy-proxy` active/success.
+- **Byte-identical (zero drift):** `nixos-rebuild build` == `/run/current-system` == `vh6vwxbl…`.
+- **Documented git-clone path also reproduces it:** fresh `git clone --recursive` into a temp git repo
+  + `nixos-rebuild build --flake 'git+file:///tmp/ccci-git?submodules=1#cc-ci'` → **vh6vwxbl… (MATCH)**.
+  Proves the install/throwaway path works and equals running.
+- **Live TLS from git cert:** `https://ci.commoninternet.net` http=200 ssl_verify=0; random
+  `probe-*.ci.commoninternet.net` handshake ssl_verify=0 (404 route, expected) via gateway→cc-ci;
+  served leaf `CN=*.ci.commoninternet.net`, LE issuer, valid to Aug 24 2026.
+
+**For the Adversary verifying Gate W2 cold:** must init the submodule (`git clone --recursive` OR
+`git submodule update --init`, bot creds) then build with `?submodules=1`, else `secrets/` is empty.
+Both path: and git+submodules builds yield the same toplevel `vh6vwxbl…` (content-addressed).
+
+**Deferred to W3/W4 prep (NOT in W2):** the recovery-key `sops.age.keyFile` for the throwaway VM —
+adding it changes the closure again, so I'll add + test it on the throwaway (safe) and re-establish
+byte-identical there. cc-ci stays on its proven host-key decrypt path for now.
+
+**Next:** Gate W2 CLAIMED → await Adversary PASS on byte-identical + cert-in-git/TLS. Meanwhile prep W1
+(resize) / W3 (throwaway VM) — read the incus skill.