O8 Report 06 — First-run command package

• macro: v0.6-o8-production-run-readiness-command-package
• date_utc: 2026-05-21 · host: vmi3080463 (Contabo)
• gate covered: G6 first-run command package

STATUS: TEMPLATE — NOT EXECUTABLE. This documents the command package shape so the sovereign/GPT can see exactly what a first production run would require. It cannot be run until GAP-3, GAP-5, GAP-6, GAP-8, GAP-9 are closed and a GAP-7 ruling exists.

1. Runner — what would invoke the run

There is no cutter orchestrate CLI (design doc 06 §2.10 specified it; never built). O7 used a read-only sidecar runner. A first live run would need an analogous live sidecar runner that:

• constructs OrchestratorRunner(store, kb, discoverer, db_provider) with a live-write discoverer / execution adapter (does not exist — GAP-9), and
• calls runner.cut(document_id=<target>, mode=Mode.LIVE, actor=<sovereign>) then runner.resume(run_id=…, approval_kb_id=<SG_1 doc>) and again with the <SG_2 doc>.

2. Required env / config (all OPEN — see Reports 02 / 05)

secrets (names only, GSM-absent → env-file model):
  DOT_CUTTER_EXEC_DB_USER/_PASSWORD     # cutter_exec lane
  DOT_CUTTER_VERIFY_DB_USER/_PASSWORD   # cutter_verify lane
  DOT_CUTTER_DB_HOST/PORT/NAME/SSLMODE
  AGENT_DATA_API_KEY                    # KB upload
  BACKUP_GPG_FPR                        # ❌ GAP-3 — missing
config / dirs:
  orchestrator.sidecar_root, batch_dir, global_locks_dir   # ❌ GAP-5
  /var/lib/cutter/{runs,batches,locks}                     # ❌ GAP-5
  orchestrator.expected_grant_matrix_sha
      = 45d25e38ac2dd440d0e7fdbdd6a5a20df11afbaef715002db4e46ea60bd2d600

3. Required approval KB ids (all OPEN — see Report 07)

GAP-7 standalone GPT/sovereign ruling authorizing the execution flip   # ❌
SG_1_cut_authz   approval doc — binds (gate, run_id, payload_sha),
                 allowance: explicit, signed_utc ≤ 24h                 # ❌
SG_2_lifecycle_authz approval doc — fresh review_decision_id UUID,
                 allowance: explicit, signed_utc ≤ 12h                 # ❌

4. Prechecks (must all PASS immediately before the run)

- hostname == vmi3080463; v0.6 path present; v0.4 intact
- tests baseline PASS (366/366 or current)
- live drift re-survey: ICX-CONST / target counts vs pinned
- grant-matrix sha == 45d25e38…
- GPG public key present; narrow pg_dump backup taken + restore-proven
- execution authorization artifact valid, run-id-scoped, in-TTL
- no hardcoded secret / runtime id in any diff

5. Expected outputs

- per-run sidecar state.json under orchestrator.sidecar_root
- 11 phase KB docs + SG_1/SG_2 request docs + closeout doc
- production rows for the target document (draft → enacted)
- exactly 2 new cutter_governance.review_decision rows
- closeout summary sha; runs-index appended

6. Post-run verification

- all 11 phases result == passed; final_state == closeout_reported
- target IU/UV counts == candidate_count; lifecycle log rows == N
- immutability triggers enabled 'O'
- row counts of NON-target documents unchanged (ICX-CONST 60/60 etc.)
- __execution_enabled__ re-disabled to False immediately after

7. STOP conditions (any → halt, do not self-advance)

- any precheck fails
- STOP_DRIFT / STOP_INVARIANT_FAILED / STOP_APPROVAL_* from a phase
- KB upload fails after retries
- partial/torn write  → SG_3 escalation + compensation macro (Report 05)

8. Why this package cannot be executed now

blocking:
  GAP-9  no live-execution code path (5 mutating phases simulator-only;
         no live-write discoverer)  ← DECISIVE
  GAP-3  no GPG key → no real pre-write backup
  GAP-5  no orchestrator.* config / /var/lib/cutter dirs
  GAP-6  no tested per-document cut-revert
  GAP-7  no sovereign approval / execution-flip ruling
  GAP-8  no safe registered target document
also: no `cutter orchestrate` CLI; a live sidecar runner would have to
      be authored — but it has nothing live to call until GAP-9 closes.

G6 = COMMAND PACKAGE TEMPLATE DELIVERED; NOT EXECUTABLE.