01 — Live Channel & Input Contract

Channels verified live (2026-06-03)

Channel	Capability	Evidence
query_pg(directus) MCP	READ-ONLY SELECT, AST-validated, 5s timeout, 500-row LIMIT, no DDL/DML	tool contract + used throughout
ssh contabo	root (uid=0) shell on VPS	id → uid=0(root)
ssh → docker exec postgres psql -U workflow_admin -d directus	superuser, rw (DDL+DML)	rolsuper=t, transaction_read_only=off
read_file MCP	allowlist /opt/incomex/docs, /opt/incomex/dot/specs, /var/log/nginx only — DENIES /opt/incomex/dot/bin	prior macro + unchanged
filesystem via ssh	full read + sha256sum + stat on /opt/incomex/dot/bin	enumerated 287 files
pg_cron	absent	pg_extension count = 0

Execution-mode classification: EXECUTION_MODE. Authority granted by explicit user authorization, scoped to inert/read-only/reversible objects only.

Input contract (scope as authorized by the user)

ALLOW: backup defs first; apply ONLY (1) P1 detector views, (2) P2 fs reconciler staging+views, (3) load fs inventory snapshot, (4) P6 preflight guard fn; verify every object; run live read-only checks; produce backlog triage; save evidence + rollback to KB.

FORBIDDEN: enable P3 gate-blocking; run P4 backfill writes; insert/fabricate birth rows; mutate pivot_definitions; mutate dot_tools into false-clean; register dot-pivot-update; execute dot-pivot-update; continue RP cleanup; delete/hide backlog rows; destructive prod tests.

Live baseline counts (2026-06-03, prod directus)

Metric	Value
birth_registry rows	1,121,482
birth distinct collections	79
collection_registry	168
dot_tools	309
birth rows for dot_tools	592
pivot_definitions	37 (birth rows: 10)
dot_iu_command_catalog	54 (birth rows: 0)
/opt/incomex/dot/bin files	287 regular (285 dot-prefixed, 76 backups)
governance ownership / ospa	0 / 0
v_object_owner_gap	210
v_governance_object_inventory	35 (1 object_type — collection grain)

Old reports treated as evidence; every number above was re-verified live this run.