dot-iu-cutter v0.6 O8E Pre-production Hardening PASS

Date: 2026-05-21

O8E is accepted as PASS. It ran on VPS/Contabo, kept execution_enabled false, did not write DB, did not run production CUT/VERIFY/enact, and uploaded 10 reports.

Accepted delivery:

• GAP5 runtime dirs and non-sensitive config closed.
• F4 backup readiness surveyed and operator package prepared.
• GAP6 revert and compensation runbook authored.
• F3 LegB/Verify generalization design package authored.
• GAP8 safe target discovery and intake criteria authored.
• GAP7 approval package drafted.
• F1/F2 residual matrix sharpened.
• Mac command package prepared where source patches are needed.

The only accepted mutation was filesystem-only creation of /var/lib/cutter and non-sensitive config/readme. Rollback is rm -rf /var/lib/cutter. No DB rows changed.

Macro sizing correction: O8E still completed too quickly because most work was survey/package/report, not outcome-closing implementation. The next macro must close concrete implementation outcomes, not just produce more packages.

Selected next macro: O8F_MAC_IMPLEMENT_F2_F3_GAP6_DEPLOY_AND_VPS_PROOF.

Recommended effort: high, escalate to xhigh only if architecture redesign or production mutation becomes necessary.

Required start host: MacBook/dev host, because source implementation, tests, commit, and artifact are required. VPS is used only for deploy/proof after Mac work.

Scope:

1. Precheck Mac source repo and VPS state.
2. Implement F2 live-text sourcing in discover/cutplan path.
3. Implement F3 LegB/Verify generalization off Constitution N=60 pins if localized and safe.
4. Implement GAP6 compensating writer or non-mutating compensation checker if localized and safe.
5. Run local tests and security checks.
6. Commit and create clean artifact.
7. Deploy to VPS with execution_enabled false.
8. Run VPS tests and rollback-only proof.
9. Produce final blocker matrix for F4/GAP7/GAP8.

Forbidden:

• Persistent production change.
• Enabling execution_enabled for a real run.
• Live CUT/VERIFY/enact commit.
• Logging secrets.
• Deleting v0.4 skeleton.
• Service restart unless explicitly authorized.
• Hard delete IU data.
• Fake PASS.