O8B-retry Report 04 — Local test / security result (G3)

• macro: v0.6-o8b-retry-mac-reconcile-deploy-live-wiring
• date_utc: 2026-05-21 · host: developer Mac · Python 3.11.6
• gate covered: G3 local test / static / security

1. Test suites (Mac SSOT repo, post-reconciliation)

$ python3 -m unittest tests.test_orchestrator_o8a_live_wiring
Ran 28 tests in 0.006s — OK

$ python3 -m unittest discover -s tests -p 'test_*.py'
Ran 394 tests in 0.280s — OK   (exit 0)

targeted_o8a_live_wiring:  28/28 PASS
full_discover:             394/394 PASS  (0 fail, 0 error, exit 0)
regressions:               NONE

2. Import smoke

import cutter_agent.orchestrator      → OK
  milestone           = O4
  __execution_enabled__ = False
  execution_enabled()  = False
  __live_wiring__      = O8A-authoring-staging
live_execution: LiveExecutionAdapter, ProductionLiveExecutionAdapter,
                refuse_if_killswitch_off, require_live_adapter → import OK
runner: OrchestratorRunner → import OK

3. Static checks over the 8 new/edited orchestrator files

Check	Result
module-level PIN_*	NONE (grep '^…PIN_[A-Z]' → no hit)
secret-shaped assignments (password/secret/api_key/token/dsn = '…')	NONE
postgres:// URIs / -----BEGIN PEM / dotted-quad IPs	NONE
hardcoded runtime IDs (digests / change_set_id / DSN)	NONE — per-run values flow through RunContext / injected collaborators

live_execution.py exposes only role-name constants (PRINCIPAL_EXEC="cutter_exec", PRINCIPAL_VERIFY="cutter_verify") — identifiers, not secrets, not PIN_-prefixed.

4. Behavioural proof — proof_live_wiring.py (no DB, no secret, no network)

A standalone proof script exercised the live-wiring invariants directly:

PROOF-1  PASS  kill-switch OFF — execution_enabled() is False
PROOF-2  PASS  Mode.LIVE + kill-switch OFF refused before any adapter method
PROOF-3  PASS  Mode.DRYRUN guard is a no-op — simulator path intact
PROOF-4  PASS  require_live_adapter refuses a simulator-shaped object
PROOF-4b PASS  None / object / str also refused (no fallback)
PROOF-5  PASS  a real LiveExecutionAdapter IS accepted (seam is real)
PROOF-6  PASS  default connection_provider refuses (no DSN/.env/secret)
PROOF-7  PASS  adapter.cut_leg_a refused BEFORE opening any DB connection
ALL_PROOFS_PASS  production_mutation=NONE  execution_enabled=False

5. Required confirmations

mode_dryrun_simulator_remains:   YES (PROOF-3 + TestDryRunUnchanged)
mode_live_no_simulator_fallback: YES (PROOF-4/4b + TripwireDiscoverer tests)
killswitch_off_blocks_live:      YES (PROOF-2/7 + TestLiveRefusedWhenKillSwitchOff)
no_module_level_runtime_pins:    YES
no_secret_or_dsn:                YES

6. G3 verdict

tests:    422 checks PASS (28 targeted + 394 discover; 28 are a subset)
static:   no module-level PIN_, no secret literal, no hardcoded runtime id
behaviour: 8/8 live-wiring proofs PASS
g3:       PASS