O8B Report 04 — Test / security result (G3)

• macro: v0.6-o8b-reconcile-deploy-live-wiring
• date_utc: 2026-05-21 · host: vmi3080463 (Contabo) · Python 3.12.3
• gate covered: G3 — see scope note

Scope note

G3 as specified means local tests in the Mac SSOT working tree after the G2 reconciliation. G2 is BLOCKED (Report 03), so no SSOT working tree exists in this session. The results below were run on the O8A staging copy on Contabo — they are supplementary evidence that the change set itself is sound, not a substitute for the SSOT G3 run, which the next operator must perform on the Mac.

1. O8A live-wiring sandbox test

python3 -m unittest tests.test_orchestrator_o8a_live_wiring -v → 28/28 OK (0.014s). Covers: enforcement helpers; all five phases refuse when the kill-switch is OFF without touching the adapter; LIVE routes to the adapter; a live phase without an adapter fails closed; transaction commit/rollback; the runner live gate.

2. Full staging suite

python3 -m unittest discover -s tests -p 'test_*.py' → Ran 394 tests … OK (4.198s). Matches O8A Report 08's 394/394.

3. Compile

python3 -m py_compile over all 9 change-set files → OK.

4. Security / static checks

Check	Result
module-level runtime PINs (PIN_[A-Z])	none
secrets / DSNs / postgres:// / PEM / hardcoded IPs	none
execution_enabled default	False (backing constant unchanged)
Mode.DRYRUN still simulator	yes — phase else:-branch calls discoverer.simulate_*
Mode.LIVE cannot fall back to simulator	yes — require_live_adapter raises ProductionExecutionNotAuthorized; LIVE never reaches simulate_* (test test_live_phase_without_adapter_fails_closed + the five *_live_routes_to_adapter tests)
Mode.LIVE refused when kill-switch OFF	yes — refuse_if_killswitch_off runs before any adapter call (test test_all_five_phases_refuse_and_do_not_touch_adapter)

5. Verdict

change_set_soundness:  PASS (28/28 + 394/394 + compile, on the staging copy)
ssot_g3_run:           NOT POSSIBLE this session (G2 blocked)
architectural_blocker: none — the block is environmental, not a test failure

The change set is architecturally sound; the O8B block is purely the absence of the Mac SSOT repo, not a code or test defect.