feat: add dev durable runtime provisioning gates

docs/reference/dev-runtime-boundary.md

@@ -196,6 +196,39 @@ runtime durability blocker, not a DB connectivity blocker, and must keep M3,
 M4, and M5 full acceptance blocked until the durable runtime postconditions
 below are true.
 
+## DEV DB Provisioning Automation
+
+The repo-owned DEV DB provisioning entrypoint is:
+
+```sh
+node scripts/dev-runtime-provisioning.mjs --check
+node scripts/dev-runtime-provisioning.mjs --dry-run --allow-live-db-read --confirm-dev --write-report
+```
+
+The default `--check` path validates the redacted target DB URL contract only:
+the application role name, target database name, password presence, SecretRef
+names, and endpoint authority are represented as booleans or redacted endpoint
+class. It never connects to Postgres, never reads Kubernetes Secret data, and
+never prints the target role, database name, host, password, token, DSN, or
+kubeconfig material.
+
+An authorized DEV provisioning apply is:
+
+```sh
+node scripts/dev-runtime-provisioning.mjs --apply --confirm-dev --confirmed-non-production --write-report
+```
+
+The apply path uses `HWLAB_CLOUD_DB_URL` from
+`hwlab-cloud-api-dev-db/database-url` as the redacted target contract and
+`HWLAB_CLOUD_DB_ADMIN_URL` from
+`hwlab-cloud-api-dev-db-admin/admin-url` as the admin SecretRef env. It may
+create or update only the DEV target role, target database, database `CONNECT`
+grant, and `public` schema `USAGE, CREATE` grants needed by the cloud-api
+durable runtime. It must report `created` or `existed` booleans and structured
+blockers such as role missing, database missing, SSL, auth, schema, migration,
+or durability readiness. It must not read Secret objects, print Secret values,
+run PROD changes, use manual `psql`, or perform schema migration.
+
 ## Runtime Migration Automation
 
 The repo-owned runtime migration entrypoint is:
@@ -240,6 +273,24 @@ Runtime migration reports separate the blockers as:
 | Migration | The required source migration is recorded in the ledger. |
 | Readiness | Durable runtime read readiness passed after schema and ledger checks. |
 
+## Durable Runtime Postflight
+
+The repo-owned postflight entrypoint is:
+
+```sh
+node scripts/dev-runtime-postflight.mjs --check
+node scripts/dev-runtime-postflight.mjs --live --confirm-dev --confirmed-non-production --target api --write-report
+```
+
+Default `--check` is source-only. Live mode first reads
+`http://74.48.78.17:16667/health/live` and
+`http://74.48.78.17:16667/v1`. It only performs the M3
+`DO1=true -> DI1=true -> DO1=false -> DI1=false` postflight when both
+endpoints prove `runtime.adapter="postgres"`, `runtime.durable=true`,
+`runtime.ready=true`, and `runtime.liveRuntimeEvidence=true`. The M3 portion
+must then prove operation, trace, audit, and evidence identifiers with durable
+green evidence; otherwise the report remains blocked.
+
 ## Durable Runtime Unblock Runbook
 
 This runbook is a reusable checklist for a future authorized live
@@ -252,8 +303,10 @@ authorizes the DEV apply command and the preconditions below are already true.
 | Source migration contract | Yes | `node scripts/dev-runtime-migration.mjs --check` and `node scripts/dev-runtime-migration.mjs --dry-run --write-report` | DB connection, Secret read, DEV/PROD write |
 | Static runtime boundary contract | Yes | `node scripts/validate-runtime-boundary.mjs`, source docs, manifests, and redacted Secret refs | Live mutation, service restart, Secret value output |
 | Public health observation | Yes, when command scope is read-only | `/health/live` fields such as `db.liveDbEvidence`, `runtime.adapter`, `runtime.durable`, `runtime.blocker`, `readiness.durability.blockedLayer`, `requiredEvidence`, and redaction/safety flags | Printing DB URLs, passwords, tokens, kubeconfig material, or Secret data |
+| Live provisioning apply | No, unless explicitly authorized by commander/operator | `node scripts/dev-runtime-provisioning.mjs --apply --confirm-dev --confirmed-non-production --write-report` with role/database created/existed booleans and no secret output | PROD apply, Secret value output, manual DB shell, schema migration, service restart, M3 acceptance promotion |
 | Live DB read verification | Only with explicit DEV read authorization | `--dry-run --allow-live-db-read --confirm-dev --write-report` output with redacted endpoint and `secretValuesPrinted=false` | Kubernetes Secret reads, writes, migration apply, PROD target |
 | Live migration/repair apply | No, unless explicitly authorized by commander/operator | `--apply --confirm-dev --confirmed-non-production --write-report` plus post-apply health evidence | PROD apply, Secret value output, service restart, Code Agent POST, hardware write, or acceptance promotion |
+| Durable runtime postflight | Only after durable runtime readiness is already green | `node scripts/dev-runtime-postflight.mjs --live --confirm-dev --confirmed-non-production --target api --write-report` with `/health/live`, `/v1`, and M3 true/false durable green evidence | Running M3 writes while runtime durable readiness is blocked, Secret output, PROD, or manual rollout |
 
 Secret handling rules are the same for every row: verify env names,
 `secretKeyRef` names/keys, configured provider/model/base URL, redacted endpoint
@@ -271,6 +324,9 @@ be true:
 - Source validation passes for `internal/db/migrations/0001_cloud_core_skeleton.sql`,
   the durable runtime tables/columns, and the `hwlab_schema_migrations` ledger
   row.
+- DEV DB provisioning is ready: target role and database are either already
+  present or created by `scripts/dev-runtime-provisioning.mjs`, and the report
+  carries only created/existed booleans plus redacted endpoint class.
 - The runtime is requesting the Postgres durable adapter, not silently using
   memory: `runtime.adapter="postgres"` or equivalent selected-adapter evidence,
   with `runtime.durableRequested=true`.