1c/W2a DONE: secrets-split + cert-in-git deployed to live cc-ci; Gate W2 CLAIMED

Submodule mount, cert sops-decrypted to /var/lib/ci-certs/live (sha256 verified), byte-identical
build==running (vh6vwxbl), git-clone+?submodules=1 reproduces it, live TLS valid.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

STATUS-1c.md

@@ -9,15 +9,25 @@ The repo's STATUS.md / BACKLOG.md / REVIEW.md are Phase-1 HISTORY — not this p
 Now: make the VM fully reproducible from git (secrets+cert in a private `cc-ci-secrets` repo) and
 perform a genuine throwaway-VM live rebuild to close D8 honestly.
 
-## In flight — W2 (secrets repo + cert into git)
-- [x] **W2 step 1 DONE:** private `recipe-maintainers/cc-ci-secrets` created + populated (6 infra
-  secrets + wildcard cert/key, sops, both recipients; cert/key sha256 verified byte-perfect) + pushed.
-  Layout: root `secrets.yaml` → submodule mounts at base `secrets/`.
-- [ ] **W2 step 2 (next):** base repo — replace tracked `secrets/` with the submodule; add
-  `wildcard_cert`/`wildcard_key` in secrets.nix (`path=` → /var/lib/ci-certs/live + recovery keyFile);
-  adjust proxy.nix; switch cc-ci via `--flake 'git+file:///root/cc-ci?submodules=1#cc-ci'`; prove
-  byte-identical + TLS-from-git-cert; then claim **Gate W2**.
-- (W1 resize deferred until just before W3 — it briefly stops the live server; only needed for VM headroom.)
+## In flight — W2 (secrets repo + cert into git) — COMPLETE, gate claimed
+- [x] **W2 step 1:** private `recipe-maintainers/cc-ci-secrets` created + populated (6 infra secrets
+  + wildcard cert/key, sops, both recipients; sha256 byte-perfect) + pushed.
+- [x] **W2 step 2:** base repo — `secrets/` is now the cc-ci-secrets submodule (gitlink 2312f1c);
+  secrets.nix adds `wildcard_cert`/`wildcard_key` → `/var/lib/ci-certs/live/*`; proxy.nix reframed.
+  Pushed f79e542. Switched live cc-ci (toplevel `vh6vwxbl…`). **Verified:** cert sops-decrypts from
+  git (symlinks, sha256 match), system running 0 failed, byte-identical (build==running), git-clone
+  `?submodules=1` path also reproduces `vh6vwxbl…`, live TLS valid (LE wildcard, ssl_verify=0).
+- (Recovery-key `sops.age.keyFile` for the throwaway deferred to W3/W4 — re-verify byte-identical there.)
+
+## Gate
+**Gate: W2 — CLAIMED, awaiting Adversary @2026-05-27 ~16:45Z.**
+Acceptance to verify (cold): (1) byte-identical `nixos-rebuild build .#cc-ci` == `/run/current-system`
+(`vh6vwxbl4qr9whzpwgjimhf9gn4329p8`) — **must init the submodule** (`git clone --recursive` / `git
+submodule update --init`, bot creds) then build `--flake 'git+file://<clone>?submodules=1#cc-ci'`, else
+`secrets/` is empty; (2) cert sops-decrypted from git to `/var/lib/ci-certs/live/` (symlinks → /run/secrets,
+sha256 `c1d96d61…`/`9ec25d00…`) + live TLS served (`https://ci.commoninternet.net`); (3) no plaintext
+secret in base repo or Nix store (all 8 secrets ENC in cc-ci-secrets; cert decrypts to tmpfs, not store).
+See JOURNAL-1c 2026-05-27 W2a entry for full evidence.
 
 ## Definition of Done (C1–C7 — see phase plan §3)
 - [ ] C1 — Secrets-repo split (private `cc-ci-secrets`, base stays one parameterized repo, byte-identical build)