refactor: primitive G14 CI without Docker fallback

scripts/src/dev-gate-preflight.mjs

@@ -739,17 +739,17 @@ function validateRegistryCapabilities(reporter, registryCapabilities) {
     "registry-capability-classification",
     "registry",
     registryCapabilities.classification,
-    `Registry capability classification is ${registryCapabilities.classification}: process HTTP, Docker daemon push path, and k3s pull path are reported separately.`,
+    `Registry capability classification is ${registryCapabilities.classification}: BuildKit publish registry API, legacy Docker diagnostic, and k3s pull path are reported separately.`,
     [registryCapabilities]
   );
 
   const dockerDaemonPushAccess = registryCapabilities.dimensions.dockerDaemonPushAccess;
-  if (dockerDaemonPushAccess.status === "blocked") {
+  if (dockerDaemonPushAccess.requiredForPublish && dockerDaemonPushAccess.status === "blocked") {
     reporter.block({
       type: "network_blocker",
       scope: "docker-daemon-push-access",
       summary: dockerDaemonPushAccess.summary,
-      nextTask: "Restore Docker daemon access to the D601 local/internal registry before claiming DEV artifact publish readiness."
+      nextTask: "Restore the required publish-path registry access before claiming DEV artifact publish readiness."
     });
   }
 

scripts/src/g14-ci-plan-lib.mjs

@@ -158,7 +158,7 @@ export async function createG14CiPlan(options = {}) {
       plannerMutatesDeployJson: false,
       serviceIdSource: serviceIdResolution.source,
       defaultComponentLazyBuild: true,
-      legacyFullBuildFallback: true
+      fullBuildFallback: false
     },
     inputs: {
       registryPrefix,

scripts/src/registry-capabilities.mjs

@@ -157,13 +157,13 @@ async function probeProcessHttpAccess(registryPrefix, timeoutMs) {
   return {
     id: "process-http-access",
     status: passed ? "pass" : "degraded",
-    requiredForPublish: false,
+    requiredForPublish: true,
     requiredForDeploy: false,
     endpoint,
     probeKind: "runner-process-http-v2",
     summary: passed
-      ? `Runner process can reach ${endpoint}.`
-      : `Runner process cannot reach ${endpoint}; this is process HTTP access only and does not prove Docker daemon push failure.`,
+      ? `Runner or BuildKit-side process can reach ${endpoint}.`
+      : `Runner process cannot reach ${endpoint}; BuildKit publish may not be able to reach the registry from this execution surface.`,
     evidence: {
       probe,
       publishFailure: false
@@ -176,12 +176,12 @@ async function probeDockerDaemonPushAccess(registryPrefix, timeoutMs) {
   if (!dockerVersion.ok) {
     return {
       id: "docker-daemon-push-access",
-      status: "blocked",
-      requiredForPublish: true,
+      status: "degraded",
+      requiredForPublish: false,
       requiredForDeploy: false,
       endpoint: registryPrefix,
       probeKind: "docker-cli-read-only",
-      summary: "Docker CLI is not available, so Docker daemon push access cannot be assessed.",
+      summary: "Docker CLI is not available; legacy Docker daemon registry visibility is diagnostic only and is not required for BuildKit publish.",
       evidence: {
         dockerVersion: summarizeCommand(dockerVersion),
         pushAttempted: false,
@@ -194,12 +194,12 @@ async function probeDockerDaemonPushAccess(registryPrefix, timeoutMs) {
   if (!dockerPs.ok) {
     return {
       id: "docker-daemon-push-access",
-      status: "blocked",
-      requiredForPublish: true,
+      status: "degraded",
+      requiredForPublish: false,
       requiredForDeploy: false,
       endpoint: registryPrefix,
       probeKind: "docker-ps-read-only",
-      summary: "Docker daemon is not readable, so Docker daemon push access cannot be assessed.",
+      summary: "Docker daemon is not readable; legacy Docker daemon registry visibility is diagnostic only and is not required for BuildKit publish.",
       evidence: {
         dockerVersion: summarizeCommand(dockerVersion),
         dockerPs: summarizeCommand(dockerPs),
@@ -217,16 +217,16 @@ async function probeDockerDaemonPushAccess(registryPrefix, timeoutMs) {
   const registryAccepted = registryVisible || k8sNativeLoopbackRegistry;
   return {
     id: "docker-daemon-push-access",
-    status: registryAccepted ? "pass" : "blocked",
-    requiredForPublish: true,
+    status: registryAccepted ? "pass" : "degraded",
+    requiredForPublish: false,
     requiredForDeploy: false,
     endpoint: registryPrefix,
     probeKind: "docker-ps-read-only",
     summary: registryVisible
-      ? "Docker daemon can see a local/internal registry target for publish preflight purposes; no push was attempted."
+      ? "Docker daemon can see a local/internal registry target; this legacy diagnostic did not push and is not required for BuildKit publish."
       : (k8sNativeLoopbackRegistry
         ? "Docker daemon did not show the registry container, but HWLAB_DEV_REGISTRY_K8S_NATIVE=1 declares the loopback registry is owned by Kubernetes and reachable through the node network."
-        : "Docker daemon did not show a registry container publishing port 5000."),
+        : "Docker daemon did not show a registry container publishing port 5000; this no longer blocks the BuildKit publish path."),
     evidence: {
       dockerVersion: summarizeCommand(dockerVersion),
       registryPrefix,
@@ -364,7 +364,9 @@ async function probeK3sPullAccess(registryPrefix, timeoutMs) {
 }
 
 function capabilityClassification(dimensions) {
-  const values = Object.values(dimensions).map((dimension) => dimension.status);
+  const values = Object.values(dimensions)
+    .filter((dimension) => dimension.requiredForPublish || dimension.requiredForDeploy)
+    .map((dimension) => dimension.status);
   if (values.includes("blocked")) return "blocked";
   if (values.includes("degraded")) return "degraded";
   return "pass";
@@ -392,8 +394,8 @@ export async function probeRegistryCapabilities({
     classification: capabilityClassification(dimensions),
     dimensions,
     interpretation: {
-      processHttpAccess: "Runner process HTTP access to /v2/ is diagnostic only and must not be treated as Docker daemon push access.",
-      dockerDaemonPushAccess: "Docker daemon push access is the publish-path capability. This probe is read-only and does not push.",
+      processHttpAccess: "Runner/BuildKit-side process HTTP access to /v2/ is the publish-path registry API preflight.",
+      dockerDaemonPushAccess: "Docker daemon registry visibility is a legacy read-only diagnostic only. It is not required for the BuildKit publish path and does not push.",
       k3sPullAccess: "k3s pull access is the deploy-path capability. This probe is read-only and does not create pods or read secrets."
     }
   };