05 - Post-Deploy Checks

O6B · doc 5 of 8 · 2026-05-21 · Gate G5 — Contabo post-deploy checks. All checks run on the deployed copy at /opt/incomex/dot/iu-cutter-v0.6 under Contabo's system Python 3.12.3.

1. Files present

file_count:        80  (excl DEPLOY-MANIFEST.txt)   ✓ == artifact manifest
cutter_agent/orchestrator/:  PRESENT
sql/lifecycle/:              PRESENT
tests/:                      PRESENT

2. Forbidden-file / secret scan (on deployed tree)

file_scan:    .env* / *.pyc / __pycache__ / .git / *.pem / *.key / id_rsa*
              -> ZERO hits
literal_scan: grep for  postgres(ql)://user:pass@  and  PGPASSWORD="..."
              -> 2 hits, both verified BENIGN:
   tests/test_orchestrator_o1_run_context.py:41  "postgres://x:y@z/db"
   tests/test_orchestrator_o1_runner.py:125      "postgres://x:y@z/db"
   -> dummy x/y/z placeholders inside secret-REFUSAL unit tests
      (they assert the orchestrator rejects secret-shaped pins).
      NOT real credentials. Artifact carries no live secret.

3. Kill-switch (deployed copy)

file:   cutter_agent/orchestrator/__init__.py
line36: __execution_enabled__ = False   # flipped to True only by later sovereign ruling
verdict: kill-switch OFF  ✓

4. Static + import smoke (Python 3.12.3)

py_compile:   python3 -m compileall -q cutter_agent cli.py
              -> OK (every module compiles under Python 3.12;
                     no 3.11->3.12 syntax regression)
import:       import cutter_agent, cutter_agent.orchestrator     -> OK
              import runner, run_context, state_store, gates,
                     discover, enums                              -> OK
runtime_values:
  cutter_agent.__version__            : "0.4.0-dryrun-skeleton"
  orchestrator.__execution_enabled__  : False
  Mode members                        : ['DRYRUN', 'LIVE']

5. Full test suite — 366/366 on Contabo

runner:   python3 -m unittest discover -s tests -p 'test_*.py'
          (pytest absent on host -> stdlib unittest; all 21 files are
           unittest.TestCase based, so the full suite is covered)
result:   Ran 366 tests in 3.560s
          OK
verdict:  366/366 PASS on Contabo Python 3.12.3   ✓ == dev-Mac baseline

6. Mode.LIVE structural refusal

check:    runner.py source contains the Mode.LIVE + __execution_enabled__
          refusal guard (mode == Mode.LIVE and not __execution_enabled__
          -> raises). Confirmed present.
effect:   while __execution_enabled__ is False, no phase can run live.
verdict:  Mode.LIVE refused  ✓

7. CLI surface note (not a defect)

cli.py:   `python3 cli.py --help` -> "dot-iu-cutter v0.4 - local / dry-run
          CLI entrypoint ONLY"; subcommands: demo, run, selftest.
          There is NO `orchestrate` subcommand at HEAD 6625f76.
meaning:  the v0.6 orchestrator is a LIBRARY subpackage
          (cutter_agent.orchestrator) — it is invoked programmatically
          via OrchestratorRunner, not via the CLI. The O6 deploy plan
          assumed `cli.py orchestrate inspect`; that command does not
          exist in the real source. This is a SOURCE REALITY at 6625f76,
          NOT a deploy defect. O6B did not fake an `orchestrate` PASS and
          did not mutate cli.py. CLI wiring is a future (O7+) decision.

8. Dependency-gap report (per G5 mandate)

missing_dependency:  pytest  (Contabo system python)
fallback_used:       python3 -m unittest discover  -> 366/366 OK
                     (no functional loss — full suite still ran)
host_mutation_avoided: pytest was deliberately NOT installed
                       (would mutate the host outside the deploy dir)

9. Result

G5_verdict:  PASS
  files present .......... PASS (80 + manifest)
  no forbidden files .... PASS
  execution_enabled ..... False
  py_compile ............ PASS (Python 3.12.3)
  import ................ PASS
  tests ................. PASS 366/366 (unittest; pytest absent, documented)
  Mode.LIVE refusal ..... PASS
proceed_to:  G6 read-only live dry-run smoke