01 — Shell & SSH Proof

Macro: T2 SHELL MACRO — C1 W7 REAL EXEC CHANNEL PREFLIGHT Date: 2026-06-23 Scope: Read-only capability proof. NO production write. NO apply/propose/execute/register/dry-run.

Result: REAL OPERATOR SHELL + VPS SSH CONFIRMED

Local terminal (this environment)

Check	Value
whoami	nmhuyen
hostname	Nguyens-MacBook-Air.local
pwd	/Users/nmhuyen
uname	Darwin 25.5.0 ... arm64 (Apple Silicon, macOS)
ssh client	/usr/bin/ssh (present)
SSH key	/Users/nmhuyen/.ssh/contabo_vps — present, -rw------- (0600), 399 bytes

This is the operator's real laptop with a real shell (Bash tool), NOT a read-only MCP-only context. This is the decisive distinction vs. prior HOLD runs, which operated through MCP read-only tools (read_file allowlist) and therefore could not see /opt/incomex/dot/bin and concluded "no exec channel."

SSH connectivity to VPS

Command (read-only, BatchMode=yes ConnectTimeout=12): ssh -i ~/.ssh/contabo_vps root@38.242.240.89 'hostname; whoami; pwd; ls -ld /opt/incomex /opt/incomex/dot /opt/incomex/dot/bin' Output:

• REMOTE_OK
• vmi3080463 (remote hostname, matches SSOT VPS in prior memory)
• root (remote user)
• /root
• drwxr-xr-x 26 root root 4096 May 26 12:27 /opt/incomex
• drwxr-xr-x 23 root root 4096 Jun 4 12:10 /opt/incomex/dot
• drwxr-xr-x 4 incomex incomex 16384 Jun 6 08:04 /opt/incomex/dot/bin
• SSH_EXIT_CODE=0

Confirmed: This terminal can SSH to the VPS as root@vmi3080463 and read /opt/incomex, /opt/incomex/dot, /opt/incomex/dot/bin.

Criteria status (this file)

• SSH to VPS: YES
• read /opt/incomex/dot/bin: YES