O7 Report 08 — Final O7 report

• macro: v0.6-o7-postdeploy-live-dryrun-contabo
• date_utc: 2026-05-21
• host: vmi3080463 (Contabo)
• FINAL RESULT: O7_POST_DEPLOY_LIVE_DRYRUN_PASS

Summary

v0.6 deployed on Contabo at /opt/incomex/dot/iu-cutter-v0.6 (source HEAD 6625f76, milestone O4) can run the orchestrator as a live read-only dry-run: it builds RunContext / context_pins from live production state read with a read-only role, traverses cut → SG_1 pause → resume → SG_2 pause → resume → closeout, proves idempotency and duplicate-run behaviour, refuses Mode.LIVE, and writes nothing to production.

Gate results

Gate	Outcome
G0 PRECHECK-LIVE	PASS — Contabo, v0.6 deployed, manifest-matched, kill-switch OFF, v0.4 intact, 366/366 tests
G1 code/CLI survey	PASS — no orchestrate subcommand; thin sidecar runner chosen
G2 read-only access	PASS — context_pack_readonly via /opt/incomex/secrets/.env.production; one documented limitation (no cutter_governance data SELECT)
G3 target selection	PASS — ICX-CONST (only completed Constitution, 60/60 enacted)
G4 runner authoring	PASS — read-only sidecar runner, artifact byte-unchanged
G5 live dry-run smoke	PASS — 14/14 checks, full closeout
G6 resume/idempotency	PASS — pause/resume, idempotent re-run, duplicate run
G7 safety/rollback	PASS — zero mutation, kill-switch OFF, v0.4 intact, rollback documented
G8 KB reporting	PASS — this package

PASS criteria (macro) — all met

• v0.6 path exists, source HEAD 6625f76 (DEPLOY-MANIFEST). ✓
• execution_enabled=False. ✓
• Mode.LIVE production path refused (ProductionExecutionNotAuthorized). ✓
• CLI/runner read-only dry-run path exists (sidecar). ✓
• Live read-only DB access works (context_pack_readonly, is_read_only=True). ✓
• cutter_governance data not visible to RO role → dry-run proceeded on the visible subset; limitation documented; no User secret requested. ✓
• Target chosen discover-first: completed Constitution ICX-CONST. ✓
• Dry-run smoke on Contabo, no mutation (before==after row counts). ✓
• Resume / idempotency / duplicate-run proven at dry-run level. ✓
• Tests/smoke PASS (366/366 + 14/14). ✓
• KB reports uploaded. ✓

Key evidence

• run_id ictr-20260521T042359Z-ad3d0b97: closeout_reported, 11/11 phases passed, writer_digest=151e2f7b…, lifecycle_enacted_count=60, closeout_summary_sha=f9977572….
• Live survey: ICX-CONST 60/60 enacted, drift_class=post_enactment_expected, grant_probe_sha=45d25e38….
• Row counts before==after on information_unit (158), unit_version (165), iu_lifecycle_log (60).

Forbidden actions — none performed

No production mutation; execution_enabled not flipped; no live CUT/VERIFY/enact; no service deploy/restart; v0.4 skeleton not deleted; no source_document/source_version write; no User secret requested; no secret logged; no hardcoded secret/runtime ID; no real-crypto replacement; no fake PASS.

Artifacts (Contabo)

• Sidecar: /opt/incomex/dot/iu-cutter-v0.6-o7-sidecar/
  • o7_live_dryrun_runner.py — the read-only runner
  • runs/o7-smoke-summary.json — machine-readable result
  • runs/state/<run_id>/ — per-run state + local KB docs
  • reports/01..08-*.md — this KB package

Rollback / disable

rm -rf /opt/incomex/dot/iu-cutter-v0.6-o7-sidecar

Kill-switch stays OFF; no service exists; v0.6 artifact + v0.4 skeleton unchanged.

Recommendation / next step

O7 read-only post-deploy live dry-run is PASS. The remaining gap to any production run is unchanged and out of O7 scope: flipping __execution_enabled__ to True requires a separate sovereign ruling (real-crypto migration + command-review + fresh backup/restore proof). Route back to GPT/User.