fix: harden M3 simulator identities and wiring

2026-05-23 04:30:01 +00:00
parent 82b1f9491e
commit c095d4d943
14 changed files with 416 additions and 18 deletions
@@ -155,7 +155,9 @@ assert.equal(deployServicesById.has("hwlab-agent-worker"), true);
 assert.equal(deployServicesById.has("hwlab-agent-skills"), true);

 const cloudApi = deployServicesById.get("hwlab-cloud-api");
+const patchPanel = deployServicesById.get("hwlab-patch-panel");
 const cloudApiWorkloadEnv = getWorkloadEnv(k8sWorkloads, "hwlab-cloud-api");
+const patchPanelWorkloadEnv = getWorkloadEnv(k8sWorkloads, "hwlab-patch-panel");
 assert.equal(deployManifest.health.path, "/health/live", "deploy health source path");
 assert.equal(deployManifest.publicEndpoints.frontend.url, "http://74.48.78.17:16666", "deploy frontend endpoint");
 assert.equal(deployManifest.publicEndpoints.api.url, "http://74.48.78.17:16667", "deploy api endpoint");
@@ -208,6 +210,7 @@ assert.notEqual(
 );
 assert.equal(cloudApi.env.OPENAI_API_KEY, codeAgentSecretRefPlaceholder(), "cloud-api Code Agent OpenAI key must be a Secret reference placeholder");
 assertCodeAgentProviderWorkloadContract(cloudApiWorkloadEnv);
+assertM3PatchPanelDeployContract(patchPanel, patchPanelWorkloadEnv);
 assertDbForbiddenInvalidHostContract();
 assertValidationDoesNotExposeSecretValues(cloudApi.env, cloudApiWorkloadEnv);

@@ -262,6 +265,49 @@ function assertCodeAgentProviderWorkloadContract(env) {
  assert.equal(apiKey?.key, secretRef.secretKey, "cloud-api workload Code Agent OpenAI Secret key");
 }

+function assertM3PatchPanelDeployContract(manifestService, workloadEnv) {
+  const route = {
+    fromResourceId: "res_boxsimu_1",
+    fromPort: "DO1",
+    patchPanelServiceId: "hwlab-patch-panel",
+    toResourceId: "res_boxsimu_2",
+    toPort: "DI1"
+  };
+  assert.deepEqual(manifestService.m3Route, route, "patch-panel deploy manifest first-class M3 route");
+  const manifestEndpointMap = JSON.parse(manifestService.env.HWLAB_PATCH_PANEL_ENDPOINT_MAP);
+  const workloadEndpointMap = JSON.parse(workloadEnv.HWLAB_PATCH_PANEL_ENDPOINT_MAP?.value ?? "{}");
+  assert.equal(
+    manifestEndpointMap.res_boxsimu_2,
+    "http://hwlab-box-simu-2.hwlab-dev.svc.cluster.local:7201",
+    "patch-panel deploy manifest M3 endpoint"
+  );
+  assert.deepEqual(workloadEndpointMap, manifestEndpointMap, "patch-panel workload M3 endpoint map");
+
+  const manifestWiring = JSON.parse(manifestService.env.HWLAB_PATCH_PANEL_WIRING_CONFIG);
+  const workloadWiring = JSON.parse(workloadEnv.HWLAB_PATCH_PANEL_WIRING_CONFIG?.value ?? "{}");
+  assert.deepEqual(workloadWiring, manifestWiring, "patch-panel workload first-class M3 wiring config");
+  assert.equal(manifestWiring.status, "active", "patch-panel M3 wiring status");
+  assert.equal(manifestWiring.constraints.propagation, "patch-panel-only", "patch-panel M3 wiring propagation");
+  assert.equal(
+    manifestWiring.constraints.localLoopbackSubstituteAllowed,
+    false,
+    "patch-panel M3 wiring loopback substitute"
+  );
+  assert.deepEqual(manifestWiring.connections, [
+    {
+      from: {
+        resourceId: route.fromResourceId,
+        port: route.fromPort
+      },
+      to: {
+        resourceId: route.toResourceId,
+        port: route.toPort
+      },
+      mode: "exclusive"
+    }
+  ], "patch-panel M3 wiring route");
+}
+
 function assertDbForbiddenInvalidHostContract() {
  const invalidHost = parseDbUrlContract("postgres://user:password@hwlab-dev-db.invalid:5432/hwlab");
  assert.equal(invalidHost.ok, false, "DEV DB contract must reject .invalid runtime hosts");