cc-ci/JOURNAL-1b.md

JOURNAL — Phase 1b (review & lint pass)

Append-only Builder log: what I did + verifying command/output + next. (Adversary logs to REVIEW-1b.)

---

2026-05-27 — Phase 1b kickoff (first wake)

Read the phase plan (plan-phase1b-review-lint.md) + plan.md §6.1/§7/§9. Confirmed Phase 1c is genuinely DONE (STATUS-1c ## DONE, REVIEW-1c all C1–C7 + E2E PASS, no VETO, ADV-1c-1 closed). Phase 1b state files did not exist — seeded STATUS-1b / BACKLOG-1b / JOURNAL-1b / REVIEW-1b (stub).

Access + environment probes:

• ssh cc-ci 'hostname && systemctl is-system-running' → nixos / running.
• Lint tools are NOT in the sandbox and nix is not installed locally, so linting must run on cc-ci (NixOS, nix 2.24.14, flakes enabled). nix build github:NixOS/nixpkgs/<our-pin>#ruff resolves from cache.nixos.org (ruff 0.7.3) → building a lint devshell from the already-pinned nixpkgs is viable with no registry/network surprises. shellcheck-0.10.0 already realized in the host store.

Lint-target inventory: 14 .nix, 32 .py, 1 .sh (scripts/bootstrap-drone-oauth.sh), plus .drone.yml / .sops.yaml YAML. No prior lint/format decisions in DECISIONS.md (clean slate).

Next: W0 — add the lint devshell + entrypoint + tool configs to the flake; auto-format; fix findings; wire the .drone.yml lint stage.

2026-05-27 — W0 built: lint toolchain + format + drone stage

Added (commits 2cede01 format/fixes, 4af427c drone stage, + tooling commits):

• flake.nix: lint devshell (nix develop .#lint) = nixpkgs-fmt, statix, deadnix, ruff, shellcheck, shfmt, yamllint, built from the already-pinned nixpkgs (no registry/network surprise — nix build <pin>#ruff resolves from cache.nixos.org). Default devshell also gets them.
• scripts/lint.sh (check / --fix), ruff.toml, .yamllint.yaml.
• .drone.yml: a lint step in the event: push pipeline running nix develop .#lint --command bash scripts/lint.sh (FAILs the build on any unclean file).

Format/lint cleanup (semantics-preserving): ruff format on all 32 .py; nixpkgs-fmt drone-runner.nix; shfmt scripts; ruff SIM105/SIM115 (contextlib.suppress / with open); statix (merge sops secrets.*, empty-pattern → _); deadnix (drop unused self/lib/overlay final).

Verification (on cc-ci, clean tar'd checkout /tmp/ccci-lint):

$ nix develop .#lint --command bash scripts/lint.sh
=== Nix — nixpkgs-fmt ===  0 / 14 would have been reformatted
=== Nix — statix ===        (clean)
=== Nix — deadnix ===       (clean)
=== Python — ruff format === 32 files already formatted
=== Python — ruff check ===  All checks passed!
=== Shell — shfmt/shellcheck === (clean)
=== YAML — yamllint ===     (clean)
lint: PASS

nix eval .#nixosConfigurations.cc-ci.config.system.build.toplevel → a derivation (evals OK; the networkd/dhcp warning is pre-existing). Built toplevel 8i3jcad9… differs from running cqym8knjg7… — EXPECTED: bridge.py/dashboard.py (and runner) are cp'd into the store, so the reformat changes their hash. cc-ci will be rebuilt to the formatted closure in W2 before RL3. All Python byte-compiles (store python 3.12.8).

Drone CI note: triggered build #150 via API but that's event=custom (→ recipe-ci pipeline, not the push lint pipeline) — cancelled it. The Gitea→Drone push webhook (hook 211) shows last_status: None and Drone logs show no inbound hook deliveries → the documented flaky webhook (§4.1). Public and canonical (100.90.116.4) Drone build lists are identical, so the gateway routes to canonical cc-ci (no rebuild-VM split). Recorded the flaky-webhook as a pre-existing infra item in DECISIONS.md; the lint stage itself is wired + proven green via the identical command.

Claimed W0 gate (RL1) in STATUS-1b. Next: W1 white-box review checklist over the cleaned codebase.

2026-05-27 — W0 PASS (Adversary cold, RL1) + W1 Builder-side §3 self-review

Adversary logged W0/RL1 PASS (REVIEW-1b): cold checkout of my HEAD 233939a archived to cc-ci, nix develop .#lint --command bash scripts/lint.sh → exit 0 lint: PASS, plus a break-it probe (injected bad .py/.nix → exit 1 lint: FAIL) proving the gate has teeth. Advisory only (flaky push webhook → confirm a real push fires the Drone lint build at RL3); not a finding.

W1 — ran the §3 white-box checklist myself (Builder side), to fix anything blocking before the Adversary's RL2 confirmation. Findings over the post-W0 (cleaned) codebase:

• Tests real (blocking) — holds. (Adversary pass #1 PASS; my W0 cleanup touched only formatting + SIM/contextlib rewrites, no assertion changed.)
• Harness DRY (blocking-ish) — holds. grep for recipe-name conditionals in the SHARED harness (runner/harness/*.py, run_recipe_ci.py, conftest.py) → NONE. Per-recipe quirks are data: optional tests/<recipe>/recipe_meta.py (HEALTH_PATH/HEALTH_OK/DEPLOY_TIMEOUT/HTTP_TIMEOUT) + per-recipe test files (e.g. keycloak kc_admin.py). Enrolling needs no shared-harness edit (D5).
• Nix idempotent (blocking) — holds (no .bootstrapped sentinels; reconcile oneshots; Adversary pass #1 confirmed).
• No footguns (blocking) — holds. Every time.sleep() (lifecycle.py 160/170/226/252, bridge.py 304) sits inside a while time.time() < deadline: poll/retry loop (verified each), not a bare readiness wait. --chaos appears ONLY in "never pass it" comments (abra.py). No shell=True.
• No secrets in code (blocking) — holds (Adversary pass #1 grep clean; full leak re-verify is RL3).
• Log redaction real (blocking) — holds. run_recipe_ci.py run_stage_redacted() masks any

  =8-char /run/secrets/* value from streamed stage output; no secret-named value is print/logged in bridge.py/dashboard.py (grep clean).

• Architecture matches plan (advisory→blocking on drift) — holds; settled in Phase 1/1c (poll is primary in bridge.py's loop; /hook optional; traefik is the coop-cloud recipe via proxy.nix). No drift; not reopening settled design (guardrail §5).
• Readability / docs (advisory) — fine; nothing worth churning in a bounded pass.

No blocking finding; nothing to fix; no advisory item to file. The Adversary owns the RL2 confirmation and is running its own §3 pass #2 (harness-DRY / redaction / architecture). Awaiting that; W2 (rebuild cc-ci to the formatted closure + request cold RL3 D1–D10) follows once RL2 is confirmed.