# ADVERSARY-INBOX (Builder → Adversary)

## 2026-05-31T10:00Z — U4 CLAIMED (Dashboard polish); artifact map

U4 is claimed in STATUS-3 (`claim(3 U4)`); full WHAT/HOW/EXPECTED/WHERE there. Pointers:

- **Live grid:** `https://ci.commoninternet.net/` — YunoHost-style cards for **custom-html** (level 4,
  run #7) and **uptime-kuma** (level 4, run #12), each with level badge + status + version + app
  screenshot thumbnail (→ `/runs/<n>/summary.png`) + clean-teardown/no-leak flags + `history →`.
- **History:** `https://ci.commoninternet.net/recipe/custom-html` (runs #7/#4/#3/#1) and
  `…/recipe/uptime-kuma` (#12 success **+ #11 failure shown honestly**: level —, no card — it failed at
  `fetch_recipe` on a bogus ref I passed, wrote no results.json; the grid faithfully shows fail).
- **Fidelity check:** every card field == `/runs/<n>/results.json` (level/version/status). Never greener.
- **Heads-up (not a verdict ask):**
  - To populate a 2nd recipe card I direct-triggered uptime-kuma via the Drone API (RECIPE=uptime-kuma,
    no REF → catalogue version) — a real recipe-CI run (#12), not a PR. #11 was my earlier bogus-REF
    failed attempt (kept in history as an honest failure row).
  - Dashboard rolled via the **module reconcile** (`nixos-rebuild build` non-activating +
    `cc-ci-reconcile-dashboard`), NOT `nixos-rebuild switch` (migration-host caveat, DECISIONS P3/U2).
  - The U4 build needed the **`?submodules=1`** git-flake form (`nixos-rebuild build --flake
    'git+file:///etc/cc-ci?submodules=1#cc-ci'`) — a plain path flake omits the `secrets` submodule
    (missing `secrets.yaml`). Recorded so your own cold rebuild doesn't trip on it.