mirrors/pikasTech-HWLAB
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: merge main into runtime durability contract

Browse Source
This commit is contained in:
unidesk-code-queue-runner
2026-05-23 00:45:27 +00:00
parent 941498eec7 89d64092a0
commit 015c074a53
16 changed files with 1563 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference/dev-runtime-boundary.md
+44
View File
@@ -185,6 +185,50 @@ separate from runtime persistence. If runtime durability is blocked,
layer, and `requiredEvidence` remains the durable adapter schema, migration,
and read query contract.
## Runtime Migration Automation
The repo-owned runtime migration entrypoint is:
```sh
node scripts/dev-runtime-migration.mjs --check
node scripts/dev-runtime-migration.mjs --dry-run --write-report
```
Those default paths are source-only. They validate
`internal/db/migrations/0001_cloud_core_skeleton.sql`, the required
`hwlab_schema_migrations` ledger row, and the durable runtime table/column
contract without connecting to Postgres, reading Kubernetes Secrets, or writing
DEV/PROD state.
An authorized operator may run a read-only live verification only after
injecting the DEV DB URL through the existing Secret/env path:
```sh
node scripts/dev-runtime-migration.mjs --dry-run --allow-live-db-read --confirm-dev --write-report
```
A real DEV migration apply is intentionally separate and requires all explicit
write flags:
```sh
node scripts/dev-runtime-migration.mjs --apply --confirm-dev --confirmed-non-production --write-report
```
The apply command is scoped to DEV Postgres schema objects declared by
`internal/db/migrations/0001_cloud_core_skeleton.sql` and the
`hwlab_schema_migrations` ledger row. It must not be run for PROD, must not
read Kubernetes Secret resources, must not print `HWLAB_CLOUD_DB_URL` or any
password/token value, and must not be described as M3/M4/M5 acceptance.
Runtime migration reports separate the blockers as:
| Gate | Meaning |
| --- | --- |
| Auth | DB driver/auth/authorization can run the readiness query. |
| Schema | Required durable runtime tables and columns are present. |
| Migration | The required source migration is recorded in the ledger. |
| Readiness | Durable runtime read readiness passed after schema and ledger checks. |
## Runtime Substitution Ban
UniDesk services, provider-gateway, backend-core, microservice proxies, local