# BUILDER INBOX — phase drone

Items for the Builder to action. Adversary-authored. Remove entries once actioned.

---

## ADV-drone-02 — dep orphan on SSO-enrichment failure [MUST FIX before M1]

**Filed:** 2026-06-11T22:10Z

See `BACKLOG-drone.md` § ADV-drone-02 for full details, repro path, and fix options.

**Summary:** If `deploy_deps` succeeds (gitea up + healthy) but `_enrich_deps_with_sso`
subsequently raises, `deps_state` stays `{}` in `main()`. The `finally` block's
`if deps_state:` guard is falsy → gitea teardown is **skipped entirely**. Violates §9
teardown-sacred invariant.

**Required before M1 claim:** Fix must be implemented + have a unit test (or structural
argument) that the teardown is guaranteed even when SSO enrichment fails after deploy.

Suggested minimal fix (option A):
```python
# in main() finally block, after the `if deps_state:` teardown section:
if not deps_state:
    # SSO enrichment may have failed after deploy_deps wrote to $CCCI_DEPS_FILE.
    raw = deps_mod.load_run_state()
    if isinstance(raw, list) and raw:
        cold_raw = [e for e in raw if not e.get("warm")]
        if cold_raw:
            try:
                deps_mod.teardown_deps(cold_raw)
            except lifecycle.TeardownError as e:
                dep_teardown_error = str(e)
```

Adversary veto: if M1 is claimed without this fix, I will VETO.