cc-ci/machine-docs/JOURNAL-lvl5.md

JOURNAL — Phase lvl5

2026-06-11 bootstrap

• Read plan-phase-lvl5-lint-rung.md in full + plan.md §6/§6.1/§7/§9. Phase files created.
• Orientation reads: level.py (RUNGS 4, compute_level gap-caps, backup_restore_status, tier_to_rung), results.py derive_rungs/build_results (cap fields at :215-229), card.py (LEVEL_COLOR 0-6!, cap line :246, level_badge_svg cap_skip third segment), dashboard.py (_LEVEL_COLOR :68, _level_pill :245, cap div :277, render_level_badge :363), run_recipe_ci.py build_results call :1248 + badge wiring :1296-1320, bridge.py :224 (badge embed — number-only already, no cap text → likely untouched), docs (results-ux.md has cap language; recipe-customization.md EXPECTED_NA row).
• Notable: card.py LEVEL_COLOR already has keys 0-6 (5=green, 6=bright green) — only 0-4 reachable today; dashboard._LEVEL_COLOR needs checking for the same.
• Lint context: abra.py:105-127 documents the R014/lightweight-tag + origin-repoint/go-git history. Per-run recipe tree = $ABRA_DIR/recipes/, origin = private mirror (SRC) on PR runs, upstream tags fetched in by fetch_recipe. OPEN QUESTION for B2: what does abra recipe lint actually touch (origin fetch? auth? R014 against which tags?) — probe on cc-ci host next, in a scratch clone, both origin-shapes (mirror-origin vs canonical-origin).
• Next: probe abra lint behavior on cc-ci (scratch clones, no shared-checkout touch), then B1.

2026-06-11 P1+P2 built, M1 claimed (branch phase-lvl5)

• level.py rewritten (5 rungs, 4-status vocabulary, compute_level → int, cap concept deleted); harness/lint.py executor; results.py derive_rungs classification + schema 2 + lint stage/block; run_recipe_ci.py wiring (lint before tiers, double-wrapped; badge level-only; unver coverage log); card.py/dashboard.py de-capped (0-5 ramp, ladder line, unverified rows, lint.txt servable); docs results-ux.md/recipe-customization.md; DECISIONS.md phase entry.
• Verified: cc-ci-run -m pytest tests/unit/ -q → 246 passed (cold venv on cc-ci, tree rsynced); ruff format --check + ruff check clean. Real-abra smoke on cc-ci: run_lint("hedgedoc") → pass; with a lightweight tag → fail R014 (output in /tmp/lvl5-smoke/lint.txt).
• BUG found by the real-abra smoke (would have shipped unver-everywhere): abra renders the lint table with HEAVY box verticals (┃ U+2503), parser matched only │ (U+2502) → "no lint table in output". Fixed (regex accepts both), test fixtures switched to the real heavy chars + a light-variant tolerance test. Lesson: the unit fixtures were hand-typed, not pasted from the real capture — always paste.
• test_meta.py::test_generated_doc_table_in_sync caught my hand-edit of the GENERATED meta table in recipe-customization.md — moved the wording into the meta.py KEYS registry and regenerated.
• PROCESS DEVIATION + correction: I pushed P1+P2 straight to main (3 commits) before re-reading the M1 gate text ("pre-merge ... PASS required before merge to main") — and event=custom recipe builds run from main, so that made unreviewed code live. Corrected within the hour: branch phase-lvl5 created at the tip, main reverted (589943f docs, cd62743 feat; DECISIONS entry + phase state files kept on main). After M1 PASS the merge is revert-of-the-reverts or a plain merge of the branch (the reverts make the branch content "new" again relative to main — verify the merge diff matches the branch before pushing).
• M1 claimed in STATUS-lvl5.md with full cold-verify recipe.

2026-06-11 P3 sweep (while parked at M1)

• Sweep command shape: per recipe git clone <canonical origin> /tmp/lvl5-sweep/abra/recipes/<r>
  • upstream tag fetch + run_lint(r, None, /tmp/lvl5-sweep/art/<r>) from /tmp/lvl5-wt (branch tree) with ABRA_DIR=/tmp/lvl5-sweep/abra. Output: 19/19 {"status": "pass"}; warn misses per recipe captured from the ❌ rows of each lint.txt. Matrix + §2.9 baseline table → BACKLOG-lvl5.
• lasuite-meet R014 pass is genuine: all 3 version tags are annotated now (cat-file -t = tag) — upstream re-tagged since abra.py:105 was written.
• Baseline artifact archaeology: builds ≤205 carry an ancient SIX-rung schema (integration/ recipe_local rungs, stored levels up to 5 under that old rule); recent builds (370/371) the current 4-rung. Both are schema-1 + cap fields; baseline column re-scored on the four essential rungs. bluesky-pds and mumble have no retained results.json.
• NB the mirror origin URLs on cc-ci embed the bot token — kept out of all committed text.

2026-06-11 M1 PASS consumed → merged → dashboard rolled

• M1 PASS (review cfc87fd). Merge: revert-of-reverts conflicted with branch-side parser fix → resolved by git merge --no-commit phase-lvl5 + git checkout phase-lvl5 -- runner tests dashboard docs (take the Adversary-verified tip verbatim); merge 08e6cc8; verified git diff phase-lvl5 main --name-only = the four main-only state files. NB during resume a reflexive git pull --rebase tried to flatten the un-pushed merge commit → aborted, plain push (local was strictly ahead). Lesson: never pull --rebase with an un-pushed merge commit.
• Suite re-run from merged main rsynced to cc-ci: 246 passed.
• Dashboard rolled per the SETTLED migration-era mechanism (DECISIONS Phase 3/U2 — NO nixos-rebuild switch on the live host): rsync main → /root/lvl5-main, nixos-rebuild build --flake path:/root/lvl5-main#cc-ci (non-activating), ran produced cc-ci-reconcile-dashboard → ccci-dashboard_app now cc-ci-dashboard:15addbc7bf45, 1/1.
• Live checks: / 200; /runs/370/{results.json,summary.png} 200 (old artifacts unharmed); /badge/immich.svg 200 = number+colour only (#a0b93f, "level 4"); /recipe/immich 200.

2026-06-11 P4 wave 1 — first proofs green

• Triggered drone custom builds via bridge-token API (same shape as bridge.trigger_build).
• Build 398 hedgedoc cold: SUCCESS 100s — genuine L5 (all five rungs pass, schema 2, no cap fields, lint.txt+badge 200). Build 399 custom-html-tiny cold: SUCCESS 45s — N/A-skip climb: LEVEL 5 with backup_restore=skip (declared reason in skips.intentional; was L2 at baseline #205). Durations nowhere near inflated (lint ≈0.7s inside).
• Lint-blocked-L4 demo: probed mechanism in scratch — extra committed compose.lintdemo.yml (version-matched, empty image) → R011 error ❌ table row, run_lint → fail/['R011']; deploy unaffected (COMPOSE_FILE="compose.yml"). Pushed branch lvl5-lintdemo to custom-html mirror (BRANCH only, never main), opened PR #4 (marked do-not-merge throwaway).
• !testme posted (comments 14326/14327/14328) on custom-html#4, immich#2, plausible#3 → bridge-triggered builds 400/401/402 (drone path ×3). Awaiting.

2026-06-11 P4 wave 2 — PR-path bug found by drone proof, fixed, all PR proofs green

• Builds 400-402 (first !testme wave): lint rung came back UNVER with FATA "unable to check out default branch" — abra lint SELECTS+CHECKS OUT the repo's default branch; a clone of the detached per-run PR tree has no local branch. Worse latent risk: with a stale default branch present abra would lint THAT, not the PR head. Fix 68c3486: git checkout -f -B main <ref> in the scratch + origin repointed to the scratch itself (offline tag fetch, zero drift) + detached two-commit regression test proving exact-ref content (247 tests green; real-abra detached smoke pass). Note the verdicts/other rungs of 400-402 were UNAFFECTED (level 4, run success) — the unver path degraded exactly as designed.
• Re-ran !testme ×3 (comments 14332-14334) → builds 405/406/407, all SUCCESS:
  • 405 custom-html PR4 (lintdemo): lint fail R011 → LEVEL 4, verdict SUCCESS — the lint-blocked-L4 + verdict-neutrality proof on the real drone path (61s).
  • 406 immich PR2: LEVEL 5 (199s, = shot-phase baseline). 407 plausible PR3: LEVEL 5 (164s).
• Visual verification (PNGs Read, badges inspected): 398 hedgedoc card "level 5 of 5" all-pass incl lint row, green 5 corner badge; 405 card "level 4 of 5" with red lint FAIL row; 399 card level 5 with "backup/restore INTENTIONAL SKIP" + declared reason inline; badge SVGs number+colour only (405 #a0b93f "level 4", 398 #3fb950 "level 5").
• Canaries 411 (bkp-bad) + 412 (rst-bad) + mumble cold 413 triggered.

2026-06-11 P4 complete — M2 claimed

• Canaries: first attempts 411/412 died in 1s (FATA no recipe — they are mirror-only, need SRC+REF like prior phases ran them); re-triggered as 415/416 with SRC+REF → both verdict RED, level 1 (re-derived designed level: no version tags on mirror → upgrade skip climbs-but-never- earns; backup_restore fail blocks; functional unver post-abort; lint pass).
• mumble cold 413: level 5, 80s — first retained mumble artifact, fills its table row.
• Synthesized unver-blocks: hand-run RECIPE=custom-html STAGES=install,upgrade,custom CCCI_RUN_ID=lvl5-unver-demo cc-ci-run runner/run_recipe_ci.py (log /tmp/lvl5-unver-run.log, rc=0) → results.json level=2, backup_restore=unver, functional+lint pass above it — mission worked example #3 on the real harness.
• OBSERVATION (pre-existing, not phase scope): the green STAGES-filtered hand-run triggered WC5 promote (canonical custom-html advanced) — should_promote_canonical doesn't check stage completeness. Surfaced to Adversary in the M2 claim notes; not fixing inside this phase.
• M2 claimed in STATUS-lvl5 with the full evidence table (runs 398/399/405/406/407/413/415/416 + lvl5-unver-demo). B11 ticked.

2026-06-11 M2 PASS → DONE

• M2 PASS (review 13cad1f, @11:27Z) — all 13 evidence points cold-verified, §6 DoD satisfied, no VETO, cleared for ## DONE. Both gates passed today (M1 cfc87fd, M2 13cad1f); no standing VETO.
• Cleanup: PR custom-html#4 closed + branch lvl5-lintdemo deleted (204). WC5 stage-completeness observation filed to machine-docs/DEFERRED.md (operator decision; Adversary concurs not a finding).
• Phase complete: L5 lint rung + de-capped level semantics live end-to-end.