02 - Source Artifact Manifest & SHA

O6B · doc 2 of 8 · 2026-05-21 · Gate G2 — clean source artifact creation.

1. Artifact creation method

method:   git archive   (tracked-files-only — guarantees no untracked junk)
command:  git archive --format=tar.gz --prefix=iu-cutter-v0.6/ \
                      -o iu-cutter-v0.6-6625f76.tar.gz 6625f76
source_commit: 6625f768841dd80a9d524fb722889731edc53c07
why_git_archive: |
  git archive emits EXACTLY the tree tracked at the commit. Untracked
  artifacts (.git, __pycache__, .pytest_cache, *.pyc, scratch, tmp,
  any .env) are structurally impossible to include — they are not
  tracked, so they cannot appear in the archive.

2. Artifact identity

file:          iu-cutter-v0.6-6625f76.tar.gz
local_path:    /Users/nmhuyen/iu-cutter-build/o6b-artifact/iu-cutter-v0.6-6625f76.tar.gz
size_bytes:    176544
sha256:        b2c11e505fa2a28500317911da38dbeb93c8ccbda381ac8ff734222ce3557b6b
tar_entries:   88  (80 files + 8 directory entries)
prefix:        iu-cutter-v0.6/  (extracts directly to the deploy dir name)

3. Forbidden-file scan (inside the artifact)

scan_patterns:  .git/ .git .env *.pyc __pycache__ .pytest_cache
                /tmp/ scratch id_rsa *.pem *.key secret
result:         CLEAN — ZERO matches

4. Full manifest (80 files)

top-level:   .gitignore  README.md  cli.py
             constitution-normalized-17660443e0f23e99.md

cutter_agent/        __init__.py canonicalization.py cutplan.py cutprod.py
  (v0.4+v0.5 core)   cutprod_canonical.py cutwrite.py db_adapter.py dryrun.py
                     idempotency.py ledger.py ledger_v2_canonical_cut.py
                     ledger_v2_canonical_verify.py phases.py
                     prod_iu_adapter.py prod_iu_adapter_canonical.py
                     signal.py signing.py state_machine.py

cutter_agent/orchestrator/   __init__.py approval.py batch.py discover.py
  (v0.6 — 15 modules)        enums.py errors.py gates.py kb_reporter.py
                             policy.py run_context.py runner.py state_store.py

cutter_agent/orchestrator/phases/   __init__.py backup.py closeout.py
  (12 phase modules)                cut_leg_a.py cutplan.py grant_probe.py
                                    leg_b_record.py lifecycle_enact.py mark.py
                                    source_pin.py structural_verify.py
                                    write_verify.py

sql/lifecycle/   README.md bundle_a..e (5 bundles) fingerprints.yaml
  (11 files)     rollback_runbook.sql verify_preflight.sql
                 verify_postapply.sql verify_behavioral_probes.sql

tests/   _orchestrator_o2_harness.py + fixtures/constitution-normalized*.md
  (24)   + 21 test_*.py files (all unittest.TestCase based)

5. Result

G2_verdict:  PASS
artifact:    iu-cutter-v0.6-6625f76.tar.gz
sha256:      b2c11e505fa2a28500317911da38dbeb93c8ccbda381ac8ff734222ce3557b6b
forbidden_files: NONE
contents:    code + tests + sql/lifecycle + README/runbooks  (complete)
proceed_to:  G3 Contabo preflight