mirrors/pikasTech-HWLAB
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #165 from pikasTech/fix/latest-main-rollout-blocked-catalog

Browse Source 
docs: surface latest-main blocked rollout reports
This commit is contained in:
Lyon
2026-05-23 01:18:26 +08:00
committed by GitHub
parent 40d2f320e5 5d8a63a08c
commit ab252f524e
3 changed files with 512 additions and 323 deletions
Download Patch File Download Diff File Expand all files Collapse all files
reports/dev-gate/dev-m5-gate-aggregator-v2.json
+78 -22
View File
@@ -20,8 +20,8 @@
"pikasTech/HWLAB#46",
"pikasTech/HWLAB#64"
],
"generatedAt": "2026-05-22T13:44:40.940Z",
"generatedFromCommit": "c7de4745f491",
"generatedAt": "2026-05-22T16:59:52.864Z",
"generatedFromCommit": "f64182b54fe6",
"environment": "dev",
"endpoint": "http://74.48.78.17:16667",
"frontendEndpoint": "http://74.48.78.17:16666",
@@ -68,7 +68,7 @@
"taskId": "dev-gate-preflight",
"lifecycleState": "active",
"status": "blocked",
"commitId": "8e89409dda5d"
"commitId": "f64182b54fe6"
},
"devDeploy": {
"path": "reports/dev-gate/dev-deploy-report.json",
@@ -92,7 +92,7 @@
"taskId": "dev-edge-health",
"lifecycleState": "active",
"status": "blocked",
"commitId": "86d769525caf"
"commitId": "c7de4745f491"
},
"devM2Smoke": {
"path": "reports/dev-gate/dev-m2-deploy-smoke-active.json",
@@ -188,7 +188,7 @@
"id": "artifact-publish-digests",
"status": "blocked",
"evidenceLevel": "BLOCKED",
"summary": "artifactState=published, ciPublished=true, registryVerified=true, sha256=13, not_published=0, targetCovered=false"
"summary": "artifactState=contract-skeleton, ciPublished=false, registryVerified=false, sha256=0, not_published=13, targetCovered=false"
},
{
"id": "d601-k3s-observability",
@@ -319,9 +319,9 @@
"label": "artifact/desired-state source",
"status": "blocked",
"evidenceLevel": "BLOCKED",
"summary": "artifact targetCovered=false; artifactSource=7e29522b65c8; target=8e89409dda5d; desiredApplyMode=dry-run; mutationAttempted=false.",
"summary": "artifact targetCovered=false; artifactSource=7e29522b65c8; target=f64182b54fe6; desiredApplyMode=dry-run; mutationAttempted=false.",
"evidence": [
"artifactState=published",
"artifactState=contract-skeleton",
"sourceStates=13 source-present, 0 intentionally-disabled",
"desiredState=ready dry-run-only"
],
@@ -456,7 +456,7 @@
"highestVisibleLevel": "DEV-LIVE",
"liveEvidence": "pass",
"evidenceCount": 7,
"blockerCount": 6,
"blockerCount": 7,
"summary": "deploy/runtime readiness is blocked before live DEV; highest visible level is DEV-LIVE; status is blocked."
},
{
@@ -483,7 +483,7 @@
"highestVisibleLevel": "DRY-RUN",
"liveEvidence": "missing_or_blocked",
"evidenceCount": 2,
"blockerCount": 13,
"blockerCount": 15,
"summary": "dry-run is green but live MVP gate is blocked; highest visible level is DRY-RUN; status is blocked."
}
],
@@ -556,7 +556,7 @@
"issue": "pikasTech/HWLAB#34",
"taskId": "dev-gate-preflight",
"reportPath": "reports/dev-gate/dev-preflight-report.json",
"commitId": "8e89409dda5d",
"commitId": "f64182b54fe6",
"lifecycleState": "active",
"level": "SOURCE",
"status": "pass",
@@ -572,8 +572,8 @@
],
"evidence": [
"source-contract-static=pass",
"artifact catalog state=published",
"catalog commit=7e29522"
"artifact catalog state=contract-skeleton",
"catalog commit=c7de474"
],
"summary": "Deploy manifests, FRP/master-edge contracts, and safety boundary are source-readable and scoped to hwlab-dev."
},
@@ -657,7 +657,7 @@
"issue": "pikasTech/HWLAB#36",
"taskId": "dev-edge-health",
"reportPath": "reports/dev-gate/dev-edge-health.json",
"commitId": "86d769525caf",
"commitId": "c7de4745f491",
"lifecycleState": "active",
"level": "DEV-LIVE",
"status": "blocker",
@@ -667,6 +667,7 @@
"node scripts/validate-dev-gate-report.mjs",
"node --check scripts/dev-edge-health-smoke.mjs",
"node --check scripts/src/dev-edge-health-smoke-lib.mjs",
"node --test scripts/src/dev-edge-health-smoke-lib.test.mjs",
"node scripts/dev-edge-health-smoke.mjs --live --write-report"
],
"evidence": [
@@ -1059,6 +1060,16 @@
"reportPath": "reports/dev-gate/dev-mvp-gate-report.json",
"summary": "Public DEV route/frp is reachable on 16666/16667, but live MVP remains blocked by DB live readiness and the M3 hardware loop topology; no historical 6667 failure is counted as active evidence."
},
{
"priority": "P1",
"order": 3,
"type": "runtime_blocker",
"scope": "artifact-catalog",
"sourceIssue": "pikasTech/HWLAB#34",
"source": "reports/dev-gate/dev-preflight-report.json",
"summary": "deploy/artifact-catalog.dev.json does not prove published artifacts for origin/main f64182b; ciPublished=false, registryVerified=false, not_published=13.",
"nextTask": "Run the DEV artifact publish workflow, then record only real sha256 digests with `node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --publish-report reports/dev-gate/dev-artifacts.json`; if publish is still blocked, keep not_published via `node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --blocked`."
},
{
"priority": "P1",
"order": 3,
@@ -1066,7 +1077,7 @@
"scope": "artifact-source-commit",
"sourceIssue": "pikasTech/HWLAB#34",
"source": "reports/dev-gate/dev-preflight-report.json",
"summary": "source commit origin/main 8e89409 is not covered by artifact source 7e29522; target changes since the artifact source touch artifact build inputs.",
"summary": "source commit origin/main f64182b is not covered by artifact source 7e29522; target changes since the artifact source touch artifact build inputs.",
"nextTask": "Refresh without fake digests using `node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --blocked`, or after a successful publish run `node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --publish-report reports/dev-gate/dev-artifacts.json`."
},
{
@@ -1076,7 +1087,7 @@
"scope": "dev-artifact-publish",
"sourceIssue": "pikasTech/HWLAB#34",
"source": "reports/dev-gate/dev-preflight-report.json",
"summary": "reports/dev-gate/dev-artifacts.json does not prove all required HWLAB service artifacts for origin/main 8e89409; current status is published with 13/13 required services published and source states resolved: 13 source-present, 0 intentionally-disabled.",
"summary": "reports/dev-gate/dev-artifacts.json does not prove all required HWLAB service artifacts for origin/main f64182b; current status is published with 13/13 required services published and source states resolved: 13 source-present, 0 intentionally-disabled.",
"nextTask": "Complete DEV artifact publishing for every enabled required HWLAB service at the artifact source commit, or prove the target commit has no artifact build input changes; keep disabled services marked not_published with reasons."
},
{
@@ -1096,7 +1107,7 @@
"scope": "cloud-api-db",
"sourceIssue": "pikasTech/HWLAB#36",
"source": "reports/dev-gate/dev-edge-health.json",
"summary": "cloud-api DB env is injected, but runtime health has not attempted a live DB connection"
"summary": "DB endpoint DNS resolution failed from the cloud-api runtime"
},
{
"priority": "P1",
@@ -1105,7 +1116,7 @@
"scope": "cloud-api-db",
"sourceIssue": "pikasTech/HWLAB#34",
"source": "reports/dev-gate/dev-preflight-report.json",
"summary": "cloud-api DB env is injected, but runtime health has not attempted a live DB connection",
"summary": "DB endpoint DNS resolution failed from the cloud-api runtime",
"nextTask": "Deploy cloud-api DB runtime readiness probe and/or repair DEV DB connectivity, then rerun the read-only health smoke without reading or printing the DB secret value."
},
{
@@ -1172,6 +1183,15 @@
"source": "reports/dev-gate/dev-mvp-gate-report.json",
"summary": "Live M3 smoke reached DEV simulators, but patch-panel active DO1 -> DI1 connection is missing."
},
{
"priority": "P3",
"order": 99,
"type": "agent_blocker",
"scope": "code-agent-provider-secret",
"sourceIssue": "pikasTech/HWLAB#36",
"source": "reports/dev-gate/dev-edge-health.json",
"summary": "Code Agent provider Secret hwlab-code-agent-provider/openai-api-key is not present as key-presence evidence; #143 real provider-backed chat remains blocked"
},
{
"priority": "P3",
"order": 99,
@@ -1193,6 +1213,24 @@
]
},
"blockers": [
{
"id": "dev-gate-preflight:artifact-catalog",
"priority": "P1",
"type": "runtime_blocker",
"scope": "artifact-catalog",
"status": "open",
"source": "reports/dev-gate/dev-preflight-report.json",
"sourceIssue": "pikasTech/HWLAB#34",
"summary": "deploy/artifact-catalog.dev.json does not prove published artifacts for origin/main f64182b; ciPublished=false, registryVerified=false, not_published=13.",
"nextTask": "Run the DEV artifact publish workflow, then record only real sha256 digests with `node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --publish-report reports/dev-gate/dev-artifacts.json`; if publish is still blocked, keep not_published via `node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --blocked`.",
"unblockOrder": 3,
"unblocks": [
"pikasTech/HWLAB#35",
"pikasTech/HWLAB#33",
"pikasTech/HWLAB#39"
],
"rationale": "The gate cannot promote deploy or runtime observations without immutable image provenance and digests."
},
{
"id": "dev-gate-preflight:artifact-source-commit",
"priority": "P1",
@@ -1201,7 +1239,7 @@
"status": "open",
"source": "reports/dev-gate/dev-preflight-report.json",
"sourceIssue": "pikasTech/HWLAB#34",
"summary": "source commit origin/main 8e89409 is not covered by artifact source 7e29522; target changes since the artifact source touch artifact build inputs.",
"summary": "source commit origin/main f64182b is not covered by artifact source 7e29522; target changes since the artifact source touch artifact build inputs.",
"nextTask": "Refresh without fake digests using `node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --blocked`, or after a successful publish run `node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --publish-report reports/dev-gate/dev-artifacts.json`.",
"unblockOrder": 3,
"unblocks": [
@@ -1219,7 +1257,7 @@
"status": "open",
"source": "reports/dev-gate/dev-preflight-report.json",
"sourceIssue": "pikasTech/HWLAB#34",
"summary": "reports/dev-gate/dev-artifacts.json does not prove all required HWLAB service artifacts for origin/main 8e89409; current status is published with 13/13 required services published and source states resolved: 13 source-present, 0 intentionally-disabled.",
"summary": "reports/dev-gate/dev-artifacts.json does not prove all required HWLAB service artifacts for origin/main f64182b; current status is published with 13/13 required services published and source states resolved: 13 source-present, 0 intentionally-disabled.",
"nextTask": "Complete DEV artifact publishing for every enabled required HWLAB service at the artifact source commit, or prove the target commit has no artifact build input changes; keep disabled services marked not_published with reasons.",
"unblockOrder": 3,
"unblocks": [
@@ -1258,7 +1296,7 @@
"status": "open",
"source": "reports/dev-gate/dev-edge-health.json",
"sourceIssue": "pikasTech/HWLAB#36",
"summary": "cloud-api DB env is injected, but runtime health has not attempted a live DB connection",
"summary": "DB endpoint DNS resolution failed from the cloud-api runtime",
"unblockOrder": 5,
"unblocks": [
"pikasTech/HWLAB#34",
@@ -1275,7 +1313,7 @@
"status": "open",
"source": "reports/dev-gate/dev-preflight-report.json",
"sourceIssue": "pikasTech/HWLAB#34",
"summary": "cloud-api DB env is injected, but runtime health has not attempted a live DB connection",
"summary": "DB endpoint DNS resolution failed from the cloud-api runtime",
"nextTask": "Deploy cloud-api DB runtime readiness probe and/or repair DEV DB connectivity, then rerun the read-only health smoke without reading or printing the DB secret value.",
"unblockOrder": 5,
"unblocks": [
@@ -1403,6 +1441,21 @@
],
"rationale": "M3 remains blocked until the real DEV hardware trusted loop proves DO1 -> patch-panel -> DI1 with operation, trace, audit, and evidence identifiers."
},
{
"id": "dev-edge-health:code-agent-provider-secret",
"priority": "P3",
"type": "agent_blocker",
"scope": "code-agent-provider-secret",
"status": "open",
"source": "reports/dev-gate/dev-edge-health.json",
"sourceIssue": "pikasTech/HWLAB#36",
"summary": "Code Agent provider Secret hwlab-code-agent-provider/openai-api-key is not present as key-presence evidence; #143 real provider-backed chat remains blocked",
"unblockOrder": 99,
"unblocks": [
"pikasTech/HWLAB#39"
],
"rationale": "Residual blocker that must be classified before claiming a green DEV gate."
},
{
"id": "dev-m4-agent-loop:agent-mgr-health",
"priority": "P3",
@@ -1440,6 +1493,7 @@
"blockerOrder": 3,
"priority": "P1",
"scopes": [
"artifact-catalog",
"artifact-source-commit",
"dev-artifact-publish"
],
@@ -1450,7 +1504,7 @@
"pikasTech/HWLAB#39"
],
"rationale": "The gate cannot promote deploy or runtime observations without immutable image provenance and digests.",
"action": "Refresh without fake digests using `node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --blocked`, or after a successful publish run `node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --publish-report reports/dev-gate/dev-artifacts.json`.",
"action": "Run the DEV artifact publish workflow, then record only real sha256 digests with `node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --publish-report reports/dev-gate/dev-artifacts.json`; if publish is still blocked, keep not_published via `node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --blocked`.",
"evidenceRequired": "Artifact publish report with ciPublished=true, registryVerified=true, and sha256 digest for each frozen service ID."
},
{
@@ -1516,10 +1570,12 @@
"blockerOrder": 99,
"priority": "P3",
"scopes": [
"code-agent-provider-secret",
"agent-mgr-health",
"skills-commit-version-injection"
],
"sourceIssues": [
"pikasTech/HWLAB#36",
"pikasTech/HWLAB#37",
"pikasTech/HWLAB#39"
],
reports/dev-gate/dev-m5-gate-aggregator-v2.md
+10 -8
View File
@@ -1,7 +1,7 @@
# HWLAB M5 DEV Gate Aggregator v2
Status: blocked
Generated from: `c7de4745f491`
Generated from: `f64182b54fe6`
Scope: DEV only, report-only
Active frontend: `http://74.48.78.17:16666/`
Active API/live: `http://74.48.78.17:16667/health/live`
@@ -25,7 +25,7 @@ The latest accepted #99/#108 frontend DEV fact is revision `1e8805664970839b72be
| D601 runner observability | blocked | DEV-LIVE | D601 public DEV endpoints are reachable, but the runner cannot read /etc/rancher/k3s/k3s.yaml; classify as #46 runner permission/mount or read-only observability gap, not D601 global offline. Alternate read-only cluster probes are readable. runnerKubeconfigReadable=false, runnerKubeconfigProbeExitCode=0, runnerKubeconfigProbeStderr=empty, d601PublicEndpointsReachable=true, d601K3sUnavailable=false. | Treat #46 runner kubeconfig/readonly gaps separately from D601 service health; rerun read-only observability after the mount or permission path is repaired. |
| M3 hardware trusted loop | blocked | BLOCKED | No live DEV operation was attempted because read-only direct target checks did not prove the required patch-panel-owned M3 route. Blocker: DEV exposes two box-simu endpoints, but live identities are not the required distinct resources res_boxsimu_1 and res_boxsimu_2; observed resources=res_boxsimu_1. | Only a real DEV res_boxsimu_1:DO1 -> hwlab-patch-panel -> res_boxsimu_2:DI1 observation with operation/trace/audit/evidence can clear M3. |
| M4 agent loop | blocked | BLOCKED | Blocked at DB live readiness before scheduling a DEV agent task. | Do not schedule or claim the agent loop as live until DB live and required runtime/evidence preconditions pass. |
| artifact/desired-state source | blocked | BLOCKED | artifact targetCovered=false; artifactSource=7e29522b65c8; target=8e89409dda5d; desiredApplyMode=dry-run; mutationAttempted=false. | Refresh artifact/source coverage for current origin/main and keep desired-state apply separate from read-only route proof. |
| artifact/desired-state source | blocked | BLOCKED | artifact targetCovered=false; artifactSource=7e29522b65c8; target=f64182b54fe6; desiredApplyMode=dry-run; mutationAttempted=false. | Refresh artifact/source coverage for current origin/main and keep desired-state apply separate from read-only route proof. |
## M0-M5 Level Classification
@@ -55,7 +55,7 @@ The latest accepted #99/#108 frontend DEV fact is revision `1e8805664970839b72be
| --- | --- | --- | --- |
| m0-source-contract | pass | SOURCE | M0 contract checks are source-level evidence only. |
| m1-local-smoke | pass | LOCAL | M1 local smoke is not a live DEV substitute. |
| artifact-publish-digests | blocked | BLOCKED | artifactState=published, ciPublished=true, registryVerified=true, sha256=13, not_published=0, targetCovered=false |
| artifact-publish-digests | blocked | BLOCKED | artifactState=contract-skeleton, ciPublished=false, registryVerified=false, sha256=0, not_published=13, targetCovered=false |
| d601-k3s-observability | blocked | DEV-LIVE | D601 public DEV endpoints are reachable, but the runner cannot read /etc/rancher/k3s/k3s.yaml; classify as #46 runner permission/mount or read-only observability gap, not D601 global offline. Alternate read-only cluster probes are readable. runnerKubeconfigReadable=false, runnerKubeconfigProbeExitCode=0, runnerKubeconfigProbeStderr=empty, d601PublicEndpointsReachable=true, d601K3sUnavailable=false. |
| dev-edge-frp-16667 | pass | DEV-LIVE | Committed edge report proves read-only public HTTP on :16667 /health and /health/live; this is route evidence, not DB/M3/M4/M5 acceptance. |
| cloud-api-db-ready | blocked | BLOCKED | cloud-api DB status=degraded; ready=false; connected=false; liveDbEvidence=false. |
@@ -75,11 +75,12 @@ The latest accepted #99/#108 frontend DEV fact is revision `1e8805664970839b72be
| Priority | Order | Type | Scope | Summary |
| --- | ---: | --- | --- | --- |
| P1 | 3 | contract_blocker | artifact-source-commit | source commit origin/main 8e89409 is not covered by artifact source 7e29522; target changes since the artifact source touch artifact build inputs. |
| P1 | 3 | runtime_blocker | dev-artifact-publish | reports/dev-gate/dev-artifacts.json does not prove all required HWLAB service artifacts for origin/main 8e89409; current status is published with 13/13 required services published and source states resolved: 13 source-present, 0 intentionally-disabled. |
| P1 | 3 | runtime_blocker | artifact-catalog | deploy/artifact-catalog.dev.json does not prove published artifacts for origin/main f64182b; ciPublished=false, registryVerified=false, not_published=13. |
| P1 | 3 | contract_blocker | artifact-source-commit | source commit origin/main f64182b is not covered by artifact source 7e29522; target changes since the artifact source touch artifact build inputs. |
| P1 | 3 | runtime_blocker | dev-artifact-publish | reports/dev-gate/dev-artifacts.json does not prove all required HWLAB service artifacts for origin/main f64182b; current status is published with 13/13 required services published and source states resolved: 13 source-present, 0 intentionally-disabled. |
| P1 | 4 | observability_blocker | runner-kubeconfig-readonly-gap | The runner cannot read /etc/rancher/k3s/k3s.yaml; classify this as a runner permission/mount gap, not a D601 global outage. Alternate read-only cluster probes and public DEV endpoint probes are reported separately. |
| P1 | 5 | runtime_blocker | cloud-api-db | cloud-api DB env is injected, but runtime health has not attempted a live DB connection |
| P1 | 5 | network_blocker | cloud-api-db | cloud-api DB env is injected, but runtime health has not attempted a live DB connection |
| P1 | 5 | runtime_blocker | cloud-api-db | DB endpoint DNS resolution failed from the cloud-api runtime |
| P1 | 5 | network_blocker | cloud-api-db | DB endpoint DNS resolution failed from the cloud-api runtime |
| P1 | 5 | runtime_blocker | cloud-api-db-health-gate | cloud-api DB runtime env is not ready; missing HWLAB_CLOUD_DB_URL, HWLAB_CLOUD_DB_SSL_MODE. |
| P1 | 5 | runtime_blocker | db-live | cloud-api /health/live reports DB degraded; connected=false; ready=false. |
| P1 | 5 | runtime_blocker | db-live | cloud-api /health/live reports DB degraded; db.ready=false, db.connected=false, and live DB evidence is not established. |
@@ -87,12 +88,13 @@ The latest accepted #99/#108 frontend DEV fact is revision `1e8805664970839b72be
| P0 | 6 | runtime_blocker | m3-gateway-simu-identity | DEV exposes two gateway-simu endpoints, but live gateway identities are not distinct; observed identities=gateway-a:gws_gateway-a. |
| P0 | 6 | runtime_blocker | m3-patch-panel-wiring | DEV patch-panel is callable, but live wiring does not contain res_boxsimu_1:DO1 -> res_boxsimu_2:DI1; active=res_boxsim_alpha:uart0->res_boxsim_beta:uart0, res_boxsim_alpha:gpio0->res_boxsim_beta:gpio0; configured=res_boxsim_alpha:uart0->res_boxsim_beta:uart0, res_boxsim_alpha:gpio0->res_boxsim_beta:gpio0. |
| P0 | 6 | runtime_blocker | m3-hardware-loop-runtime | Live M3 smoke reached DEV simulators, but patch-panel active DO1 -> DI1 connection is missing. |
| P3 | 99 | agent_blocker | code-agent-provider-secret | Code Agent provider Secret hwlab-code-agent-provider/openai-api-key is not present as key-presence evidence; #143 real provider-backed chat remains blocked |
| P3 | 99 | agent_blocker | agent-mgr-health | hwlab-agent-mgr /health/live is degraded. |
| P3 | 99 | agent_blocker | skills-commit-version-injection | DEV skills injection is incomplete: missing hwlab-agent-skills.HWLAB_SKILLS_VERSION, worker-dry-run.HWLAB_SKILL_VERSION_FROM_DEV. |
## Next Unblock Order
1. Refresh without fake digests using `node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --blocked`, or after a successful publish run `node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --publish-report reports/dev-gate/dev-artifacts.json`.
1. Run the DEV artifact publish workflow, then record only real sha256 digests with `node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --publish-report reports/dev-gate/dev-artifacts.json`; if publish is still blocked, keep not_published via `node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --blocked`.
Evidence required: Artifact publish report with ciPublished=true, registryVerified=true, and sha256 digest for each frozen service ID.
2. Provide the approved read-only runner kubeconfig mount or document the intended alternate KUBECONFIG path, then rerun the read-only report.
Evidence required: Read-only report with runnerKubeconfigReadable, runnerKubeconfigProbeExitCode/stderr, d601PublicEndpointsReachable, and d601K3sUnavailable recorded separately, plus direct M3 service target discovery before any DO write.
reports/dev-gate/dev-preflight-report.json
+424 -293
View File
File diff suppressed because it is too large Load Diff