diff --git a/.gitignore b/.gitignore
index 9dd03dfa7..340257d60 100644
--- a/.gitignore
+++ b/.gitignore
@@ -80,3 +80,9 @@ web/playwright-report/
 
 # Per-session worktree-ownership marker (H7, ersatztv#303) — local, never committed
 .claude-worktree-owner
+
+# Codex CLI project scaffolding — a machine-local mirror of the .claude hooks, generated by
+# `codex exec`. Deliberately NOT tracked even though `.claude/` is: its config.toml embeds a
+# plaintext Gitea credential and absolute /Users paths, so it is neither portable nor safe to
+# commit. See ersatztv#711 for the related merge-gate gap.
+.codex/
diff --git a/docs/handoffs/rest-api.md b/docs/handoffs/rest-api.md
index 700aa730b..45f4743e0 100644
--- a/docs/handoffs/rest-api.md
+++ b/docs/handoffs/rest-api.md
@@ -76,7 +76,7 @@ Only after Phase 1 sign-off. Per slice (start with #2a Channels):
 - **One branch = one PR.** PR runs `test` + `migrations` (both **required** to merge). Merge to `main` runs `test`+`migrations`+`build`+smoke/E2E. Verify green before closing each sub-issue.
 - Migrations only if the model changes — `scripts/add-migration.sh <Name>` does **both** providers.
 - Adversarial self-review of the diff before closing (see memory: adversarial-self-review-at-milestones). Then Task Completion Protocol / `/done <sub-issue>`.
-- CI poll: `curl -u timothy:ded89Lm4 …/api/v1/repos/timothy/ersatztv/actions/tasks` (jobs by name), or the runs API.
+- CI poll: `curl -u "$ETV_GITEA_BASICAUTH" …/api/v1/repos/timothy/ersatztv/actions/tasks` (jobs by name), or the runs API.
 
 ## Repo state at handoff
 - `main` is green; #1 closed (config/topology, not code — see `docs/m3u-xmltv.md`). #5 triaged as Jellyfin/infra (→ server-management).