# REVIEW — phase `settings` (Adversary)

SSOT: /srv/cc-ci/cc-ci-plan/plan-phase-settings-ci-server-config.md
Gates: M1 (loader + flag + release-tag-first fallback, unit-tested) · M2 (verified live on server)

Status: **awaiting Builder bootstrap.** No `STATUS-settings.md` / claim yet as of 2026-06-17T16:45Z.
`dash` phase is DONE (M1+M2 PASS, commit 7507cf4) — this is the next phase.

## Baseline captured (pre-change, for the "false = byte-for-byte unchanged" guardrail)

Cold-read of the code I'll be verifying against (no anchoring — code + plan only):

- `resolve_upgrade_base` is in `runner/run_recipe_ci.py:112`. Current no-canonical chain:
  `canonical(version, w/ samever step-back) → main-tip (recipe_branch_commit "main") → skip`.
  The plan (§2.C) inserts **newest release tag < head** BEFORE main-tip on every no-canonical path.
- The samever helper to reuse: `warm_reconcile.newest_older_version(tags, version)`
  (`runner/warm_reconcile.py:161`) — newest version-tag strictly older than `version`, keyed on
  `version_key`. The fallback MUST reuse this (no divergent version ordering) per §2.C / M1.
- `recipe_tags(recipe)` = `git -C <recipe_dir> tag` (`warm_reconcile.py:267`) — tag source.
- NO existing TOML config module today: CI-server config is scattered `os.environ.get(...)`
  (`CCCI_*`, `ABRA_DIR`, `MAX_TESTS`, etc.). No `settings.toml` tracked. So a NEW minimal loader is
  justified (verify: minimal, extensible, stdlib `tomllib` only, defaults baked in, graceful on
  absent/malformed file/unknown key).

## Verification checklist I will run when M1 is CLAIMED
- [ ] Default is `false` → this server's upgrade-base resolution byte-for-byte unchanged.
- [ ] flag false + canonical present → canonical (unchanged).
- [ ] flag false + NO canonical → **newest release tag < head** (NOT main-tip).
- [ ] no canonical AND no older release tag → main-tip.
- [ ] none → skip.
- [ ] flag true → canonical lookup BYPASSED → same release-tag-first fallback.
- [ ] absent file / absent key → default false; malformed file → no crash, clear handling.
- [ ] fallback REUSES `samever`'s helper (no parallel version-ordering impl).
- [ ] scope narrow: promotion + `--quick` warm-reattach UNTOUCHED by the flag.
- [ ] loader cannot crash the harness on a bad/absent file.

## Verdicts
(none yet)