O8B-retry Report 07 — Postdeploy live-wiring proof (G6)

• macro: v0.6-o8b-retry-mac-reconcile-deploy-live-wiring
• date_utc: 2026-05-21 · host: vmi3080463 (Contabo) · Python 3.12.3
• gate covered: G6 Contabo postdeploy proof

1. Deployed-tree health

py_compile:     OK (every .py in the promoted tree)
import_smoke:   version=0.6.0-O4-live-dryrun-orchestration  milestone=O4
                __execution_enabled__=False  execution_enabled()=False
                __live_wiring__=O8A-authoring-staging
                live_execution seam + OrchestratorRunner import OK
targeted_tests: 28/28 PASS
full_discover:  394/394 PASS  (exit 0, 0 fail/error)

2. Kill-switch is OFF

__execution_enabled__: False   (backing constant in the deployed tree)
execution_enabled():   False   (function, evaluated at call time)

3. Behavioural proof on the deployed tree — proof_live_wiring.py

Run from the promoted /opt/incomex/dot/iu-cutter-v0.6 (no DB, no secret, no network):

PROOF-1  PASS  kill-switch OFF — execution_enabled() is False
PROOF-2  PASS  Mode.LIVE + kill-switch OFF refused BEFORE any adapter method
PROOF-3  PASS  Mode.DRYRUN guard is a no-op — simulator path intact
PROOF-4  PASS  require_live_adapter refuses a simulator-shaped object
PROOF-4b PASS  None / object / str also refused
PROOF-5  PASS  a real LiveExecutionAdapter IS accepted — the seam is real
PROOF-6  PASS  default connection_provider refuses (no DSN/.env/secret)
PROOF-7  PASS  adapter.cut_leg_a refused BEFORE opening any DB connection
ALL_PROOFS_PASS  production_mutation=NONE  execution_enabled=False

What the proofs establish

Required proof	Evidence
Mode.LIVE refused before mutation, kill-switch OFF	PROOF-2 (refuse_if_killswitch_off raises before any adapter call) + PROOF-7 (adapter method refuses before connection_provider)
Mode.LIVE wired to a live adapter seam, not the simulator	PROOF-4/4b (require_live_adapter rejects every non-LiveExecutionAdapter, incl. a simulator-shaped object) + PROOF-5 (a real adapter IS accepted)
Mode.DRYRUN simulator still reachable	PROOF-3 (the kill-switch guard is a no-op in Mode.DRYRUN)

Mode.LIVE can reach the adapter or fail closed — it can never fall through to the simulator.

4. Production row counts — unchanged

Production DB: postgres:16 container, database directus. The iu-cutter mutation-surface tables were counted twice over the macro verification window (read-only SELECT count(*)):

Table	snapshot 1 — 05:36:37Z	snapshot 2 — 05:37:25Z
public.information_unit	158	158
public.unit_version	165	165
public.iu_lifecycle_log	60	60
cutter_governance.cut_change_set	2	2
cutter_governance.cut_change_set_affected_row	61	61
cutter_governance.manifest_envelope	2	2
cutter_governance.review_decision	3	3
cutter_governance.verify_result	2	2
cutter_governance.dot_pair_signature	4	4

Identical across both snapshots. The deploy itself could not have mutated production: it was a filesystem mv of code trees; no iu-cutter process / systemd service / cron exists or ran; every test uses a fake / in-memory DB (discover output prints production=REFUSED); execution_enabled is False. No production DB connection was opened by any step of O8B — counts after == before.

5. G6 verdict

deployed_tree_health:  py_compile + import + 394/394 tests PASS
execution_enabled:     False (proven)
mode_live_refused:     YES — before any mutation / DB connect
mode_live_seam:        YES — wired to LiveExecutionAdapter, not simulator
mode_dryrun_simulator: intact
production_row_counts:  unchanged (2 identical snapshots + structural proof)
production_mutation:   NONE
g6:                    PASS