mirrors/pikasTech-HWLAB
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: harden M3 simulator identities and wiring

Browse Source
This commit is contained in:
Code Queue Review
2026-05-23 04:30:01 +00:00
parent 82b1f9491e
commit c095d4d943
14 changed files with 416 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/dev-m3-hardware-loop-smoke.mjs
+24 -2
View File
@@ -419,6 +419,21 @@ async function collectReadOnlySupplementalEvidence() {
const patchPanelEndpointMap = patchPanel?.env.HWLAB_PATCH_PANEL_ENDPOINT_MAP
? JSON.parse(patchPanel.env.HWLAB_PATCH_PANEL_ENDPOINT_MAP)
: {};
const patchPanelWiringConfig = patchPanel?.env.HWLAB_PATCH_PANEL_WIRING_CONFIG
? JSON.parse(patchPanel.env.HWLAB_PATCH_PANEL_WIRING_CONFIG)
: null;
const patchPanelHasManifestRoute =
patchPanelWiringConfig?.status === "active" &&
patchPanelWiringConfig?.constraints?.propagation === "patch-panel-only" &&
patchPanelWiringConfig?.constraints?.localLoopbackSubstituteAllowed === false &&
(patchPanelWiringConfig?.connections ?? []).some(
(connection) =>
connection.from?.resourceId === requiredM3Connection.fromResourceId &&
connection.from?.port === requiredM3Connection.fromPort &&
connection.to?.resourceId === requiredM3Connection.toResourceId &&
connection.to?.port === requiredM3Connection.toPort &&
connection.mode === "exclusive"
);
const boxReadyForM3 =
box?.kind === "StatefulSet" &&
box?.replicas === 2 &&
@@ -436,7 +451,13 @@ async function collectReadOnlySupplementalEvidence() {
]);
const patchPanelReadyForM3 =
patchPanel?.replicas === 1 &&
patchPanelEndpointMap.res_boxsimu_2 === "http://hwlab-box-simu-2.hwlab-dev.svc.cluster.local:7201";
patchPanel?.m3Route?.fromResourceId === requiredM3Connection.fromResourceId &&
patchPanel?.m3Route?.fromPort === requiredM3Connection.fromPort &&
patchPanel?.m3Route?.patchPanelServiceId === "hwlab-patch-panel" &&
patchPanel?.m3Route?.toResourceId === requiredM3Connection.toResourceId &&
patchPanel?.m3Route?.toPort === requiredM3Connection.toPort &&
patchPanelEndpointMap.res_boxsimu_2 === "http://hwlab-box-simu-2.hwlab-dev.svc.cluster.local:7201" &&
patchPanelHasManifestRoute;
const manifestReadyForM3 = boxReadyForM3 && gatewayReadyForM3 && patchPanelReadyForM3 && hasInstanceServices;
return [
@@ -466,7 +487,8 @@ async function collectReadOnlySupplementalEvidence() {
},
"hwlab-patch-panel": {
replicas: patchPanel?.replicas ?? null,
env: patchPanel?.env ?? null
env: patchPanel?.env ?? null,
firstClassWiringConfig: patchPanelWiringConfig
},
instanceServices: [...serviceMap.keys()].filter((name) =>
name.startsWith("hwlab-box-simu-") || name.startsWith("hwlab-gateway-simu-")
scripts/src/deploy-contract-plan.mjs
+74
View File
@@ -144,9 +144,11 @@ function validateSource(ctx, manifest) {
const cloudApi = servicesById.get("hwlab-cloud-api");
const tunnelClient = servicesById.get("hwlab-tunnel-client");
const cli = servicesById.get("hwlab-cli");
const patchPanel = servicesById.get("hwlab-patch-panel");
expectEqual(ctx, cloudApi?.env?.HWLAB_PUBLIC_ENDPOINT, endpoints.api?.url, "$.services.hwlab-cloud-api.env.HWLAB_PUBLIC_ENDPOINT", "cloud API public endpoint env");
validateCloudApiDbSource(ctx, cloudApi?.env ?? {});
validateCloudApiCodeAgentSource(ctx, cloudApi?.env ?? {});
validateM3PatchPanelSource(ctx, patchPanel);
expectEqual(ctx, cli?.env?.HWLAB_CLI_ENDPOINT, endpoints.api?.url, "$.services.hwlab-cli.env.HWLAB_CLI_ENDPOINT", "CLI endpoint env");
expectEqual(ctx, tunnelClient?.env?.HWLAB_FRP_PUBLIC_PORT, String(expectedPorts.api), "$.services.hwlab-tunnel-client.env.HWLAB_FRP_PUBLIC_PORT", "tunnel API public port env");
expectEqual(ctx, tunnelClient?.env?.HWLAB_FRP_WEB_PUBLIC_PORT, String(expectedPorts.frontend), "$.services.hwlab-tunnel-client.env.HWLAB_FRP_WEB_PUBLIC_PORT", "tunnel frontend public port env");
@@ -189,6 +191,78 @@ function validateSource(ctx, manifest) {
return { manifest, endpoints, servicesById, proxies, serviceMappings, healthPath: manifest.health?.path };
}
function requiredM3Route() {
return {
fromResourceId: "res_boxsimu_1",
fromPort: "DO1",
patchPanelServiceId: "hwlab-patch-panel",
toResourceId: "res_boxsimu_2",
toPort: "DI1"
};
}
function parseJsonEnv(ctx, value, jsonPath, label) {
try {
return JSON.parse(String(value ?? ""));
} catch (error) {
addDiagnostic(ctx, "invalid_json", jsonPath, `${label} must be JSON`, {
actual: error instanceof Error ? error.message : String(error)
});
return null;
}
}
function validateM3PatchPanelSource(ctx, patchPanel) {
const route = requiredM3Route();
expectEqual(ctx, patchPanel?.m3Route?.fromResourceId, route.fromResourceId, "$.services.hwlab-patch-panel.m3Route.fromResourceId", "patch panel first-class M3 source resource");
expectEqual(ctx, patchPanel?.m3Route?.fromPort, route.fromPort, "$.services.hwlab-patch-panel.m3Route.fromPort", "patch panel first-class M3 source port");
expectEqual(ctx, patchPanel?.m3Route?.patchPanelServiceId, route.patchPanelServiceId, "$.services.hwlab-patch-panel.m3Route.patchPanelServiceId", "patch panel first-class M3 route owner");
expectEqual(ctx, patchPanel?.m3Route?.toResourceId, route.toResourceId, "$.services.hwlab-patch-panel.m3Route.toResourceId", "patch panel first-class M3 target resource");
expectEqual(ctx, patchPanel?.m3Route?.toPort, route.toPort, "$.services.hwlab-patch-panel.m3Route.toPort", "patch panel first-class M3 target port");
const endpointMap = parseJsonEnv(
ctx,
patchPanel?.env?.HWLAB_PATCH_PANEL_ENDPOINT_MAP,
"$.services.hwlab-patch-panel.env.HWLAB_PATCH_PANEL_ENDPOINT_MAP",
"patch panel endpoint map"
);
expectEqual(
ctx,
endpointMap?.res_boxsimu_2,
"http://hwlab-box-simu-2.hwlab-dev.svc.cluster.local:7201",
"$.services.hwlab-patch-panel.env.HWLAB_PATCH_PANEL_ENDPOINT_MAP.res_boxsimu_2",
"patch panel M3 target endpoint"
);
const wiring = parseJsonEnv(
ctx,
patchPanel?.env?.HWLAB_PATCH_PANEL_WIRING_CONFIG,
"$.services.hwlab-patch-panel.env.HWLAB_PATCH_PANEL_WIRING_CONFIG",
"patch panel wiring config"
);
const connection = wiring?.connections?.[0];
expectEqual(ctx, wiring?.status, "active", "$.services.hwlab-patch-panel.env.HWLAB_PATCH_PANEL_WIRING_CONFIG.status", "patch panel M3 wiring status");
expectEqual(
ctx,
wiring?.constraints?.propagation,
"patch-panel-only",
"$.services.hwlab-patch-panel.env.HWLAB_PATCH_PANEL_WIRING_CONFIG.constraints.propagation",
"patch panel M3 wiring propagation"
);
expectEqual(
ctx,
wiring?.constraints?.localLoopbackSubstituteAllowed,
false,
"$.services.hwlab-patch-panel.env.HWLAB_PATCH_PANEL_WIRING_CONFIG.constraints.localLoopbackSubstituteAllowed",
"patch panel M3 wiring forbids loopback substitute"
);
expectEqual(ctx, connection?.from?.resourceId, route.fromResourceId, "$.services.hwlab-patch-panel.env.HWLAB_PATCH_PANEL_WIRING_CONFIG.connections[0].from.resourceId", "patch panel M3 source resource");
expectEqual(ctx, connection?.from?.port, route.fromPort, "$.services.hwlab-patch-panel.env.HWLAB_PATCH_PANEL_WIRING_CONFIG.connections[0].from.port", "patch panel M3 source port");
expectEqual(ctx, connection?.to?.resourceId, route.toResourceId, "$.services.hwlab-patch-panel.env.HWLAB_PATCH_PANEL_WIRING_CONFIG.connections[0].to.resourceId", "patch panel M3 target resource");
expectEqual(ctx, connection?.to?.port, route.toPort, "$.services.hwlab-patch-panel.env.HWLAB_PATCH_PANEL_WIRING_CONFIG.connections[0].to.port", "patch panel M3 target port");
expectEqual(ctx, connection?.mode, "exclusive", "$.services.hwlab-patch-panel.env.HWLAB_PATCH_PANEL_WIRING_CONFIG.connections[0].mode", "patch panel M3 route mode");
}
function validateCloudApiDbSource(ctx, env) {
const alias = DEV_DB_ENV_CONTRACT.dns;
expectEqual(ctx, env.HWLAB_CLOUD_DB_URL, "secretRef:hwlab-cloud-api-dev-db/database-url", "$.services.hwlab-cloud-api.env.HWLAB_CLOUD_DB_URL", "cloud API DB URL Secret reference");
scripts/validate-contract.mjs
+46
View File
@@ -155,7 +155,9 @@ assert.equal(deployServicesById.has("hwlab-agent-worker"), true);
assert.equal(deployServicesById.has("hwlab-agent-skills"), true);
const cloudApi = deployServicesById.get("hwlab-cloud-api");
const patchPanel = deployServicesById.get("hwlab-patch-panel");
const cloudApiWorkloadEnv = getWorkloadEnv(k8sWorkloads, "hwlab-cloud-api");
const patchPanelWorkloadEnv = getWorkloadEnv(k8sWorkloads, "hwlab-patch-panel");
assert.equal(deployManifest.health.path, "/health/live", "deploy health source path");
assert.equal(deployManifest.publicEndpoints.frontend.url, "http://74.48.78.17:16666", "deploy frontend endpoint");
assert.equal(deployManifest.publicEndpoints.api.url, "http://74.48.78.17:16667", "deploy api endpoint");
@@ -208,6 +210,7 @@ assert.notEqual(
);
assert.equal(cloudApi.env.OPENAI_API_KEY, codeAgentSecretRefPlaceholder(), "cloud-api Code Agent OpenAI key must be a Secret reference placeholder");
assertCodeAgentProviderWorkloadContract(cloudApiWorkloadEnv);
assertM3PatchPanelDeployContract(patchPanel, patchPanelWorkloadEnv);
assertDbForbiddenInvalidHostContract();
assertValidationDoesNotExposeSecretValues(cloudApi.env, cloudApiWorkloadEnv);
@@ -262,6 +265,49 @@ function assertCodeAgentProviderWorkloadContract(env) {
assert.equal(apiKey?.key, secretRef.secretKey, "cloud-api workload Code Agent OpenAI Secret key");
}
function assertM3PatchPanelDeployContract(manifestService, workloadEnv) {
const route = {
fromResourceId: "res_boxsimu_1",
fromPort: "DO1",
patchPanelServiceId: "hwlab-patch-panel",
toResourceId: "res_boxsimu_2",
toPort: "DI1"
};
assert.deepEqual(manifestService.m3Route, route, "patch-panel deploy manifest first-class M3 route");
const manifestEndpointMap = JSON.parse(manifestService.env.HWLAB_PATCH_PANEL_ENDPOINT_MAP);
const workloadEndpointMap = JSON.parse(workloadEnv.HWLAB_PATCH_PANEL_ENDPOINT_MAP?.value ?? "{}");
assert.equal(
manifestEndpointMap.res_boxsimu_2,
"http://hwlab-box-simu-2.hwlab-dev.svc.cluster.local:7201",
"patch-panel deploy manifest M3 endpoint"
);
assert.deepEqual(workloadEndpointMap, manifestEndpointMap, "patch-panel workload M3 endpoint map");
const manifestWiring = JSON.parse(manifestService.env.HWLAB_PATCH_PANEL_WIRING_CONFIG);
const workloadWiring = JSON.parse(workloadEnv.HWLAB_PATCH_PANEL_WIRING_CONFIG?.value ?? "{}");
assert.deepEqual(workloadWiring, manifestWiring, "patch-panel workload first-class M3 wiring config");
assert.equal(manifestWiring.status, "active", "patch-panel M3 wiring status");
assert.equal(manifestWiring.constraints.propagation, "patch-panel-only", "patch-panel M3 wiring propagation");
assert.equal(
manifestWiring.constraints.localLoopbackSubstituteAllowed,
false,
"patch-panel M3 wiring loopback substitute"
);
assert.deepEqual(manifestWiring.connections, [
{
from: {
resourceId: route.fromResourceId,
port: route.fromPort
},
to: {
resourceId: route.toResourceId,
port: route.toPort
},
mode: "exclusive"
}
], "patch-panel M3 wiring route");
}
function assertDbForbiddenInvalidHostContract() {
const invalidHost = parseDbUrlContract("postgres://user:password@hwlab-dev-db.invalid:5432/hwlab");
assert.equal(invalidHost.ok, false, "DEV DB contract must reject .invalid runtime hosts");
scripts/validate-dev-m3-cardinality.mjs
+72 -1
View File
@@ -9,6 +9,32 @@ const namespace = "hwlab-dev";
const m3EndpointMap = Object.freeze({
res_boxsimu_2: "http://hwlab-box-simu-2.hwlab-dev.svc.cluster.local:7201"
});
const m3WiringConfig = Object.freeze({
wiringConfigId: "wir_m3_do1_di1",
projectId: "prj_m3_hardware_loop",
gatewaySessionId: "gws_gwsimu_1",
name: "M3 simulated DO1 to DI1 patch wiring",
status: "active",
connections: [
{
from: {
resourceId: "res_boxsimu_1",
port: "DO1"
},
to: {
resourceId: "res_boxsimu_2",
port: "DI1"
},
mode: "exclusive"
}
],
constraints: {
propagation: "patch-panel-only",
localLoopbackSubstituteAllowed: false
},
createdAt: "2026-05-21T00:00:00.000Z",
updatedAt: "2026-05-21T00:00:00.000Z"
});
const expected = Object.freeze({
"hwlab-box-simu": {
kind: "StatefulSet",
@@ -39,8 +65,16 @@ const expected = Object.freeze({
"hwlab-patch-panel": {
kind: "Deployment",
replicas: 1,
m3Route: {
fromResourceId: "res_boxsimu_1",
fromPort: "DO1",
patchPanelServiceId: "hwlab-patch-panel",
toResourceId: "res_boxsimu_2",
toPort: "DI1"
},
env: {
HWLAB_PATCH_PANEL_ENDPOINT_MAP: m3EndpointMap
HWLAB_PATCH_PANEL_ENDPOINT_MAP: m3EndpointMap,
HWLAB_PATCH_PANEL_WIRING_CONFIG: m3WiringConfig
}
}
});
@@ -197,6 +231,9 @@ function assertDeployManifestCardinality(deploy) {
assertSameMembers(service.instanceNames ?? [], requirement.instanceNames, `${serviceId} deploy instanceNames`);
assert.equal(service.identityStrategy, "indexed-workloads", `${serviceId} deploy identityStrategy`);
}
if (requirement.m3Route) {
assert.deepEqual(service.m3Route, requirement.m3Route, `${serviceId} deploy first-class M3 route`);
}
for (const [name, values] of Object.entries(requirement.env)) {
if (Array.isArray(values)) {
@@ -245,6 +282,25 @@ function assertM3FixtureWiring(topology) {
], "M3 fixture wiring config");
}
function assertM3RouteConfig(value, label) {
assert.deepEqual(value, m3WiringConfig, label);
assert.deepEqual(value.connections, [
{
from: {
resourceId: "res_boxsimu_1",
port: "DO1"
},
to: {
resourceId: "res_boxsimu_2",
port: "DI1"
},
mode: "exclusive"
}
], `${label} required route`);
assert.equal(value.constraints.propagation, "patch-panel-only", `${label} propagation`);
assert.equal(value.constraints.localLoopbackSubstituteAllowed, false, `${label} loopback substitute`);
}
const [deploy, workloads, services, topology] = await Promise.all([
readJson("deploy/deploy.json"),
readJson("deploy/k8s/base/workloads.yaml"),
@@ -252,10 +308,25 @@ const [deploy, workloads, services, topology] = await Promise.all([
readJson("fixtures/mvp/m3-hardware-loop/topology.json")
]);
const patchPanelWorkloadEnv = envMap(
workloadByName(workloads)
.get("hwlab-patch-panel")
?.spec?.template?.spec?.containers?.find((item) => item.name === "hwlab-patch-panel")
?.env
);
assertDeployManifestCardinality(deploy);
assertDeployManifestInstanceMappings(deploy);
assertDevK8sCardinality(workloads);
assertDevK8sInstanceServices(services);
assertM3FixtureWiring(topology);
assertM3RouteConfig(
parseEnvValue(patchPanelWorkloadEnv.HWLAB_PATCH_PANEL_WIRING_CONFIG),
"DEV workload first-class M3 patch-panel wiring config"
);
assertM3RouteConfig(
parseEnvValue(deploy.services.find((service) => service.serviceId === "hwlab-patch-panel")?.env?.HWLAB_PATCH_PANEL_WIRING_CONFIG),
"deploy manifest first-class M3 patch-panel wiring config"
);
console.log("validated DEV M3 manifest cardinality: 2 distinct box-simu, 2 distinct gateway-simu, 1 patch-panel, M3 DO1->DI1 wiring");