# Topology Constraints

The MVP topology separates cloud, gateway, AgentRun-backed execution, device pod,
hardware transport, and edge proxy responsibilities.

## Constraints

- `hwlab-cloud-api` is the cloud API boundary for DEV.
- `hwlab-cloud-web` consumes cloud APIs and must not control hardware directly.
- `hwlab-cloud-api` owns Code Agent session authorization and dispatches execution
  to AgentRun v0.1.
- `hwlab-gateway` is the hardware control boundary.
- `hwlab-gateway-simu` and `hwlab-box-simu` may simulate gateway and box
  behavior for MVP validation.
- `hwlab-patch-panel` owns patch panel state.
- `hwlab-router`, `hwlab-tunnel-client`, and `hwlab-edge-proxy` own network
  reachability concerns.
- `hwlab-cli` is a client and must not bypass service contracts.
- `hwlab-agent-skills` contains reusable agent skill assets.

## Wiring

Wiring configs describe allowed connections between resource ports. A valid
wiring config must:

- belong to a project
- reference known gateway and box resources
- declare endpoints explicitly
- avoid cycles unless a later capability explicitly allows them
- represent one active config per resource group unless the patch panel reports
  an override
