02 - Contabo Live Survey

O6 · doc 2 of 8 · 2026-05-21 · Gate G1 — read-only survey, no mutation.

1. Host identity

host:        Contabo VPS (Linux 6.8.0)
root_tree:   /opt/incomex/...
disk:        /dev/sda1 ext4 96G (74% used) — single disk, no extra mounts
/mnt /media: empty
python:      3.12.3

2. iu-cutter on Contabo — current state

path:     /opt/incomex/dot/iu-cutter
version:  0.4.0-dryrun-skeleton        (cutter_agent/__init__.py __version__)
vendored_in: /opt/incomex/dot git repo (HEAD e93424b), 23 files tracked
tracked_tree_clean: YES (git status --short iu-cutter = empty)
contents:
  cli.py, README.md, .gitignore
  cutter_agent/{__init__,canonicalization,db_adapter,idempotency,ledger,
    phases,schema_binding,signal,signing,state_machine}.py
  tests/ (10 v0.4 test files)
  .dryrun-v0.4-2026-05-17/   (prior v0.4 dry-run artifact)
orchestrator/ subdir: ABSENT

The dot repo git log shows only v0.4 iu-cutter commits (latest e93424b fix(iu-cutter): v0.4 DOT-pair signature...). No v0.6 commit exists in any repo on this host. No remote on the dot repo.

3. Is v0.6 orchestrator deployed on Contabo? — NO

Exhaustive search of /opt /root /home /srv /tmp /var/lib /usr/local:

dir 'orchestrator' anywhere:            NONE
v0.6 module files (run_context.py /
  state_store.py / kb_reporter.py /
  test_orchestrator_o4_live_dryrun.py): NONE
grep 'LiveDryRunDiscoverer' /
  'OrchestratorRunner' under /opt:      NO HITS
git bundles (*.bundle):                 NONE
iu-cutter tarballs / zips:              NONE
other iu-cutter dirs:
  /tmp/iu-cutter-cut-f20c79c-*          → v0.4.0-dryrun-skeleton (no orchestrator/)
  /tmp/iu-cutter-v05-stage             → v0.4.0-dryrun-skeleton (no orchestrator/)
  /tmp/iu-cutter-canon-f20c79c-*       → v0.4.0-dryrun-skeleton (no orchestrator/)

Confirmed: zero v0.6 orchestrator code anywhere on Contabo.

4. Transfer channels into Contabo — surveyed

git_remote_to_clone_v0.6:   NONE (no repo on this host has a remote)
staged_bundle / tarball:    NONE
outbound_SSH_to_dev_Mac:    NONE
  /root/.ssh/ holds only authorized_keys (inbound) + known_hosts;
  no private key, no ssh config → cannot reach the developer host
filesystem mount of dev repo: NONE

➡️ There is no source for v0.6 and no channel to obtain it from this session. (See doc 04 for the resulting block.)

5. Runtime / deploy substrate (for when the source becomes available)

runtime_model:   manual CLI; no systemd / cron / docker-compose service for cutter
deploy_pattern:  GPT-reviewed command-review shell wrappers, e.g.
                 /opt/incomex/docker/dot-iu-cutter-v0.4-connenv-exec.sh
                 (identity guards + pre-state sha256 + abort-on-drift +
                  timestamped artifact dir; "no secret value read/printed")
prior_artifacts: /opt/incomex/docker/dieu44_v0_4_connenv_prod_*
                 /opt/incomex/docker/dieu44_v0_5_constmarker_amend_prod_*
candidate_release_roots:
  - /opt/incomex/dot/iu-cutter        (current v0.4, vendored in dot repo)
  - /opt/incomex/deploys/             (timestamped-release convention dir)

6. DB substrate (unchanged since O5 — read-only re-confirm)

postgres (directus DB):
  roles:  cutter_exec, cutter_verify, cutter_ro, context_pack_readonly  — present
  cutter_governance schema: provisioned (review_decision, verify_result,
    cut_change_set, manifest_envelope, dot_pair_signature, ...)
secrets (env-file based, names only — values never read):
  /opt/incomex/docker/.env: DOT_CUTTER_EXEC/VERIFY_DB_*, DOT_CUTTER_DB_*,
    AGENT_DATA_API_KEY present
  /opt/incomex/secrets/.env.production present
  BACKUP_GPG_FPR: not confirmed (O5 GAP-3, still open)
runtime dirs (/var/lib/cutter/{runs,batches,locks}): NOT provisioned

7. G1 result

G1_contabo_survey: PASS (survey complete, read-only, no mutation)
key_finding:       v0.6 orchestrator code ABSENT on Contabo AND no
                   transfer channel exists from this session
db_substrate:      ready
runtime_substrate: ready (manual-CLI / command-review pattern)
mutation_performed: NONE