read drill (ls-remote): OK
read drill API: 200
write drill (create a file via API): 403
push drill (git, dry-run against the server's receive-pack): 403
read other private admin/cc-secrets: 404 / git REFUSED
read other private admin/homelab-manifests: 404 / git REFUSED
read other private admin/jarr: 404 / git REFUSED
read other private admin/jarr-social: 404 / git REFUSED
read the public live catalog with the token: 13f9c9cb
drill HEAD: 256d65f6

# 9202 pointed at the drill catalog the 09 §6.5 way (2026-10-22 ~15:57 CEST): controller.yaml saved as
# controller.yaml.pre-d6-1022; git.repo_url = admin/app-catalog-drill, git.username = drill-reader, git.token = sec
# DRILL_CATALOG_TOKEN (written on the guest from stdin, never on a command line); catalog-cache removed; restart.
# The controller log 13:57:44 UTC: "Cloning https://gitea.dooplex.hu/admin/app-catalog-drill.git → …/catalog-cache"
# (no error); the cache HEAD 256d65f (the drill main); remote.origin.url is the PLAIN URL (R-616: no token stored).
