docs(decisions): record CI runs 500/503 for gate-toolbox-container

Co-Authored-By: Claude Opus 5.5 <[email protected]>

.gitea/workflows/gate.yml

@@ -130,6 +130,13 @@ jobs:
           REF: ${{ github.ref }}
         run: |
           set -euo pipefail
+          # act runs steps with umask 0000, so without this every checked-out directory is
+          # world-writable — and Ansible then IGNORES infra/ansible/ansible.cfg as a source
+          # ("Ansible is being run in a world writable directory"), which made the L0 check
+          # prod-baremetal-not-dev-surface fail on this PR's first CI run (run 500). The
+          # toolbox has Ansible, so that check now drives it for real. 0022 = what a
+          # workstation clone gets (reproduced locally: 0000 fails the check, 0022 passes).
+          umask 0022
           git config --global --add safe.directory "$PWD"
           git init -q .
           git remote add origin "${SERVER_URL}/${REPOSITORY}"

decisions/2026-11-08-gate-toolbox-container.md

@@ -24,6 +24,12 @@ is unchanged):
   every branch to `refs/remotes/origin/*`, tags, plus the event SHA; detached for a PR,
   `-B <branch>` for a push; asserts `HEAD == github.sha`. The job token goes to that one fetch via
   `GIT_CONFIG_*` env and is **not** persisted in `.git/config` (nothing later needs network git).
+  It sets **`umask 0022`** first: the PR's first CI run (run 500) failed L0
+  `prod-baremetal-not-dev-surface` because act runs steps with umask 0000, every checked-out
+  directory was world-writable, and Ansible (present in the toolbox, absent from the catthehacker
+  image) then ignored `infra/ansible/ansible.cfg`. Reproduced locally in the pinned image: clone
+  under umask 0000 → that check fails with the same message; under 0022 → `check OK`. Side
+  effect worth knowing: the Ansible-driven parts of that check now actually execute in CI.
 - **"Install pinned CI toolchain" step removed**, replaced by **"Toolchain is the one
   ci/versions.env pins"**: every `*_VERSION` in `ci/versions.env` must equal the image's
   `/etc/dev-toolchain-versions`, else `::error::DRIFT` and the job fails. Without this, dropping
@@ -76,10 +82,23 @@ new recurring operator touch.
   the only stage not run** (no `SETTINGS_API_TOKEN` locally); L2/L3 conformance skipped as
   usual. rc 3 is not green.
 
+- **CI, this PR's own runs** (Gitea API `/actions/runs/{id}/jobs` + job logs):
+  - run 500 (`514ed5d`, cold DinD cache: `Image exists? false`, image pulled): job 151s; set-up
+    incl. pull **9s**, checkout <1s, toolchain check 1s (all 8 pins `ok`), gate 140s → BLOCKED by
+    L0 `prod-baremetal-not-dev-surface` (umask, fixed above) + approval-policy.
+  - run 503 (`27d603f`, warm: `Image exists? true`): job **140s**; set-up 1s, checkout 1s,
+    toolchain check 0s, gate 137s. Every stage passes — l0 (incl. prod-baremetal-not-dev-surface),
+    lint, decisions-log, render-golden, l1, **gitea-settings** — except **approval-policy**,
+    the expected sensitive-path block. spec-immutability skipped (expected, no spec repo in CI).
+  - baseline before (runs 494/495, push on main): job 180s/179s; set-up 1–2s, checkout 1s,
+    **install 11s**, gate 164–165s. The install step is gone; the remaining ~25s gate-step delta
+    is NOT claimed as caused by this change (different base commits, one sample each).
+- Re-gated locally on `27d603f` in the pinned image: rc 3, gitea-settings the only not-run stage.
+
 ## What I did NOT verify
 
 - Renovate actually opening a digest-bump PR for gate.yml — only the regex was tested, not a
   Renovate run.
-- The authenticated fetch with the real job token — only CI can do that; the PR's own gate run is
-  that test.
 - Push-to-main behaviour in CI (only the PR event runs before merge).
+- Whether the gate-step speedup (165s → 137s) is real or run-to-run variance.
+- That the cold-pull cost stays ~9s under a busier node or a bigger digest delta; one sample.