reports.nix: pin non-browser UA on /pr/ proxy — Gitea's Anubis 307-challenges browser UAs, turning every report STATUS cell into '?'

subagent model: opencode-go/deepseek-v4-flash (#37)

machine-docs/JOURNAL-ghost.md

@@ -114,3 +114,20 @@ The artifact also reports the `lint` stage as pass. Gitea comment `15815` was up
 result with links to build #1332. A post-run host probe produced no matching `ghos-*` or `dev-ghost`
 stack, service, or volume. `REVIEW-ghost.md` records fresh M1 and M2 PASS verdicts at
 `2026-09-07T21:29:58Z` after independent current-state verification.
+
+## 2026-09-08T16:53Z — Bootstrap and current-state recheck
+
+Bootstrap checks passed: `ssh cc-ci 'hostname && whoami && nixos-version'` returned `cc-ci`,
+`root`, and `26.05.20260906.c257840`; the authenticated Gitea API returned version `1.27.3`; and
+the wildcard probe resolved to `195.201.88.249`. `git pull --rebase` reported an up-to-date clone.
+
+Current Ghost inventory remains exactly one open PR: #7, head
+`14575de6209ab2c4fb29d95fe454b761070cd351`, branch `upgrade-808ac05`. Closed PR inventory contains
+PRs #1–#6, with PR#4 merged and PR#5/PR#6 closed. Gitea comments #15814 and #15815 contain the
+fresh `!testme` and passed result for build #1332.
+
+The authoritative host artifact `/var/lib/cc-ci-runs/1332/results.json` reports level 5 and
+`install`, `upgrade`, `backup`, `restore`, `custom`, and `lint` all `pass`. The host probe reports
+proxy subnet `10.10.0.0/16` and no matching Ghost stacks, services, volumes, or networks. The
+unauthenticated Drone API endpoint returned HTTP 401, so no claim is based on that endpoint; the
+host artifact and Gitea result comment remain the verification sources.

nix/modules/reports.nix

@@ -33,6 +33,10 @@ let
             proxy_ssl_server_name on;
             proxy_set_header Host git.autonomic.zone;
             proxy_set_header Accept "application/json";
+            # Pin a non-browser UA: Gitea sits behind Anubis, which 307-challenges browser-like
+            # UAs to an un-CORS-able counter-domain — which would turn every STATUS cell into "?".
+            # A stable non-browser UA passes through (verified: curl 200, browser UA 307).
+            proxy_set_header User-Agent "ccci-reports-proxy/1.0";
             proxy_pass https://git.autonomic.zone/api/v1/repos/recipe-maintainers/$1/pulls/$2;
             proxy_intercept_errors off;
             proxy_connect_timeout 5s;

opencode.json

@@ -2,7 +2,7 @@
   "$schema": "https://opencode.ai/config.json",
   "agent": {
     "general": {
-      "model": "opencode-go/glm-5.2"
+      "model": "opencode-go/deepseek-v4-flash"
     }
   }
 }