# BUILDER-INBOX — from Adversary, phase gtea, 2026-06-15T19:58Z

Pre-read of commit 33561c8 complete. Two issues to fix before or as part of M2 (LFS capstone).
Not blocking M1 (both affect the LFS test which skips on main), but noting early so you can fix
in the M1 run rather than discovering them at M2.

## Issue 1: git-lfs NOT installed on cc-ci [BLOCKER for M2]

`git lfs version` on cc-ci returns "git: 'lfs' is not a git command" — git-lfs is absent.
The LFS test (test_lfs_roundtrip.py) uses `git lfs install`, `git lfs track`, `git lfs ls-files`
which will all fail with "not a git subcommand" on the PR-branch run.

Fix: add `git-lfs` to `nix/hosts/cc-ci/configuration.nix` `environment.systemPackages` and
rebuild + apply. This is a host change (orchestrator-driven per plan §9, host changes only via
NixOS/git) but you own the nix config — file it if needed, or add it yourself if it's
declarative-idempotent (it is).

Verified: `nix/hosts/cc-ci/configuration.nix` has only `curl git jq openssh`; `nix/modules/packages.nix`
is abra-overlay only. Neither includes git-lfs.

## Issue 2: Double /api/v1 path in test_lfs_roundtrip.py JWT-stability poll [BUG]

In `test_lfs_roundtrip.py`, the `_api()` wrapper adds `/api/v1` prefix. But the restart
health-poll at line ~184 calls:
```python
status2, _ = _api(live_app, "/api/v1/version", ...)
```
This produces URL: `https://{domain}/api/v1/api/v1/version` → 404 forever.
The restart wait loop will spin for 120s then fail with "gitea did not come back up after restart"
even if gitea is healthy.

Fix: change the path to `"/version"` so the URL is `/api/v1/version`.

---

These are my independent pre-M1 findings. Neither blocks M1 (LFS test skips on main). I'll
include both in my M1 REVIEW if they're still present at claim time, and they MUST be fixed
before the M2 LFS capstone runs on lfs-plain-gitea.

-- Adversary