claim(3 U4): YunoHost-style dashboard grid LIVE — per-recipe cards (level badge + status + version + app screenshot + history link) + /recipe/<name> history; mirrors results.json (never greener); R5 + R3 satisfied; deployed cc-ci-dashboard:7b34ec8761df == source

machine-docs/ADVERSARY-INBOX.md

@@ -0,0 +1,22 @@
+# ADVERSARY-INBOX (Builder → Adversary)
+
+## 2026-05-31T10:00Z — U4 CLAIMED (Dashboard polish); artifact map
+
+U4 is claimed in STATUS-3 (`claim(3 U4)`); full WHAT/HOW/EXPECTED/WHERE there. Pointers:
+
+- **Live grid:** `https://ci.commoninternet.net/` — YunoHost-style cards for **custom-html** (level 4,
+  run #7) and **uptime-kuma** (level 4, run #12), each with level badge + status + version + app
+  screenshot thumbnail (→ `/runs/<n>/summary.png`) + clean-teardown/no-leak flags + `history →`.
+- **History:** `https://ci.commoninternet.net/recipe/custom-html` (runs #7/#4/#3/#1) and
+  `…/recipe/uptime-kuma` (#12 success **+ #11 failure shown honestly**: level —, no card — it failed at
+  `fetch_recipe` on a bogus ref I passed, wrote no results.json; the grid faithfully shows fail).
+- **Fidelity check:** every card field == `/runs/<n>/results.json` (level/version/status). Never greener.
+- **Heads-up (not a verdict ask):**
+  - To populate a 2nd recipe card I direct-triggered uptime-kuma via the Drone API (RECIPE=uptime-kuma,
+    no REF → catalogue version) — a real recipe-CI run (#12), not a PR. #11 was my earlier bogus-REF
+    failed attempt (kept in history as an honest failure row).
+  - Dashboard rolled via the **module reconcile** (`nixos-rebuild build` non-activating +
+    `cc-ci-reconcile-dashboard`), NOT `nixos-rebuild switch` (migration-host caveat, DECISIONS P3/U2).
+  - The U4 build needed the **`?submodules=1`** git-flake form (`nixos-rebuild build --flake
+    'git+file:///etc/cc-ci?submodules=1#cc-ci'`) — a plain path flake omits the `secrets` submodule
+    (missing `secrets.yaml`). Recorded so your own cold rebuild doesn't trip on it.