\n
\n HWLAB L6 Frontend / CLI MVP
\nDEV MVP Gate
\n 0, "--timeout-ms must be positive");
+ } else if (arg.startsWith("--")) {
flags.add(arg);
} else {
rest.push(arg);
}
}
- return { flags, rest };
+ return { flags, options, rest };
}
function loadFixture() {
@@ -129,6 +149,9 @@ function assertFixture(fixture) {
assert.equal(fixture.issue, "pikasTech/HWLAB#23");
assert.equal(fixture.environment, ENVIRONMENT_DEV);
assert.equal(fixture.endpoint, DEV_ENDPOINT);
+ assert.equal(fixture.frontendEndpoint, DEV_FRONTEND_ENDPOINT);
+ assert.equal(fixture.legacyPublicEndpoint?.endpoint, legacyPublicEndpoint);
+ assert.equal(fixture.legacyPublicEndpoint?.activeGreenEligible, false);
assert.equal(fixture.defaultMode, "dry-run");
assert.equal(fixture.safetyGates.dryRunOnly, true, "dry-run must be the default");
assert.ok(Array.isArray(fixture.safetyGates.realRequestsRequire), "real request gates must exist");
@@ -168,8 +191,240 @@ function assertFixture(fixture) {
assertTimestamp(observations.healthTimestamp, "observations.healthTimestamp");
}
+function redactedHeaders(headers) {
+ return Object.fromEntries(
+ ["content-type", "content-length", "cache-control", "date"].flatMap((name) => {
+ const value = headers.get(name);
+ return value ? [[name, value]] : [];
+ })
+ );
+}
+
+async function probeHttp({ id, url, expect }) {
+ const startedAt = Date.now();
+ const controller = new AbortController();
+ const timeout = setTimeout(() => controller.abort(), expect.timeoutMs);
+ try {
+ const response = await fetch(url, { signal: controller.signal });
+ const body = await response.text();
+ const contentType = response.headers.get("content-type") ?? "";
+ let json = null;
+ if (contentType.includes("application/json")) {
+ try {
+ json = JSON.parse(body);
+ } catch {
+ json = null;
+ }
+ }
+ return {
+ id,
+ url,
+ ok: response.ok,
+ status: response.status,
+ statusText: response.statusText,
+ durationMs: Date.now() - startedAt,
+ contentType,
+ headers: redactedHeaders(response.headers),
+ json,
+ title: body.match(/([^<]+)<\/title>/iu)?.[1] ?? null,
+ bodyPreview: body.slice(0, 512)
+ };
+ } catch (error) {
+ return {
+ id,
+ url,
+ ok: false,
+ status: null,
+ statusText: null,
+ durationMs: Date.now() - startedAt,
+ contentType: null,
+ headers: {},
+ json: null,
+ title: null,
+ bodyPreview: "",
+ error: error?.name === "AbortError" ? `timeout after ${expect.timeoutMs}ms` : String(error?.message ?? error)
+ };
+ } finally {
+ clearTimeout(timeout);
+ }
+}
+
+function acceptedProbe(probe) {
+ if (!probe.ok) return false;
+ if (probe.id === "frontend-root") {
+ return probe.contentType?.includes("text/html") && probe.title === "HWLAB DEV MVP Gate";
+ }
+ return Boolean(
+ probe.json &&
+ SERVICE_IDS.includes(probe.json.serviceId) &&
+ probe.json.environment === ENVIRONMENT_DEV &&
+ (probe.json.endpoint === undefined || probe.json.endpoint === DEV_ENDPOINT)
+ );
+}
+
+function probeEvidenceLine(probe) {
+ const accepted = acceptedProbe(probe) ? "yes" : "no";
+ const identity = probe.json?.serviceId ?? probe.title ?? "unknown";
+ return `${probe.id}: HTTP ${probe.status ?? "none"} accepted=${accepted} identity=${identity} url=${probe.url}`;
+}
+
+async function gitCommitId() {
+ try {
+ const result = await execFileAsync("git", ["rev-parse", "--short=12", "HEAD"], {
+ cwd: repoRoot,
+ timeout: 5000
+ });
+ return result.stdout.trim();
+ } catch {
+ return "unknown";
+ }
+}
+
+function buildActiveReport({ fixture, probes, generatedAt, commitId }) {
+ const passed = probes.every(acceptedProbe);
+ const status = passed ? "pass" : "blocked";
+ const commands = [
+ "curl -fsS --max-time 10 http://74.48.78.17:16667/health",
+ "curl -fsS --max-time 10 http://74.48.78.17:16667/health/live",
+ "curl -fsS --max-time 10 http://74.48.78.17:16666/"
+ ];
+
+ return {
+ $schema: "https://hwlab.pikastech.local/schemas/dev-gate-report.schema.json",
+ $id: "https://hwlab.pikastech.local/reports/dev-gate/dev-m2-deploy-smoke-active.json",
+ reportVersion: "v1",
+ issue: "pikasTech/HWLAB#23",
+ taskId: "m2-dev-deploy-smoke",
+ commitId,
+ acceptanceLevel: "dev_m2_deploy_smoke",
+ devOnly: true,
+ prodDisabled: true,
+ status,
+ generatedAt,
+ endpoint: DEV_ENDPOINT,
+ frontendEndpoint: DEV_FRONTEND_ENDPOINT,
+ sourceContract: {
+ status: "pass",
+ documents: [
+ "docs/m2-dev-deploy-smoke.md",
+ "docs/dev-acceptance-matrix.md",
+ "fixtures/dev-deploy-smoke/dev-deploy-smoke.json"
+ ],
+ summary: "M2 DEV deploy smoke is rebaselined to frontend :16666 and API/edge :16667."
+ },
+ validationCommands: [
+ "node --check scripts/m2-dev-deploy-smoke.mjs",
+ "node scripts/m2-dev-deploy-smoke.mjs --dry-run",
+ "node scripts/m2-dev-deploy-smoke.mjs --live --confirm-dev --confirmed-non-production --write-report",
+ "node --check scripts/validate-dev-gate-report.mjs",
+ "node scripts/validate-dev-gate-report.mjs"
+ ],
+ localSmoke: {
+ status: "pass",
+ commands: ["node scripts/m2-dev-deploy-smoke.mjs --dry-run"],
+ evidence: [
+ `[m2-smoke] validated ${fixture.serviceContracts.length} service contracts`,
+ `[m2-smoke] mode=dry-run endpoint=${DEV_ENDPOINT}`,
+ "[m2-smoke] no real DEV/PROD request was made"
+ ],
+ summary: "The fixture smoke validates the M2 route and artifact contract without contacting DEV."
+ },
+ dryRun: {
+ status: "pass",
+ commands: ["node scripts/m2-dev-deploy-smoke.mjs --dry-run"],
+ evidence: [
+ `fixture endpoint=${DEV_ENDPOINT}`,
+ `fixture frontendEndpoint=${DEV_FRONTEND_ENDPOINT}`,
+ "legacy :6667 public evidence is marked ineligible for active green"
+ ],
+ summary: "Dry-run evidence is contract-only and pinned to the current DEV public endpoints."
+ },
+ devPreconditions: {
+ status,
+ requirements: [
+ "GET http://74.48.78.17:16667/health returns HWLAB DEV JSON",
+ "GET http://74.48.78.17:16667/health/live returns HWLAB DEV JSON",
+ "GET http://74.48.78.17:16666/ returns the HWLAB DEV frontend",
+ "No PROD, secret read, runtime restart, deployment, or heavyweight e2e action is performed"
+ ],
+ commands,
+ evidence: probes.map(probeEvidenceLine),
+ summary: passed
+ ? "Read-only DEV public endpoint probes passed on :16666/:16667."
+ : "One or more read-only DEV public endpoint probes failed; no active green is claimed."
+ },
+ blockers: passed
+ ? []
+ : [
+ {
+ type: "network_blocker",
+ scope: "m2-public-endpoints",
+ status: "open",
+ summary: "One or more M2 DEV public endpoint probes failed on :16666/:16667."
+ }
+ ],
+ runtimeSmoke: {
+ mode: "live-read-only",
+ status,
+ generatedAt,
+ apiEndpoint: DEV_ENDPOINT,
+ frontendEndpoint: DEV_FRONTEND_ENDPOINT,
+ safety: {
+ environment: ENVIRONMENT_DEV,
+ prodTouched: false,
+ secretsRead: false,
+ restarts: false,
+ deployAttempted: false,
+ heavyE2E: false,
+ unideskRuntimeSubstitute: false
+ },
+ probes,
+ legacyPublicEndpoint: {
+ endpoint: legacyPublicEndpoint,
+ status: "deprecated",
+ activeGreenEligible: false,
+ summary: "Legacy public :6667 observations are retained only as historical blockers and are not accepted as active green evidence."
+ }
+ },
+ notes: "M2 active report uses read-only GET probes only; PROD, service restarts, deployments, and script-driven apply flows were not touched."
+ };
+}
+
+async function writeActiveReport(report, reportPath) {
+ await mkdir(path.dirname(reportPath), { recursive: true });
+ await writeFile(reportPath, `${JSON.stringify(report, null, 2)}\n`);
+}
+
+async function runLiveSmoke(fixture, options) {
+ const probes = await Promise.all([
+ probeHttp({
+ id: "api-health",
+ url: new URL("/health", DEV_ENDPOINT).href,
+ expect: { timeoutMs: options.timeoutMs }
+ }),
+ probeHttp({
+ id: "api-live",
+ url: new URL("/health/live", DEV_ENDPOINT).href,
+ expect: { timeoutMs: options.timeoutMs }
+ }),
+ probeHttp({
+ id: "frontend-root",
+ url: new URL("/", DEV_FRONTEND_ENDPOINT).href,
+ expect: { timeoutMs: options.timeoutMs }
+ })
+ ]);
+
+ const report = buildActiveReport({
+ fixture,
+ probes,
+ generatedAt: new Date().toISOString(),
+ commitId: await gitCommitId()
+ });
+ return report;
+}
+
async function main() {
- const { flags } = parseArgs(process.argv.slice(2));
+ const { flags, options } = parseArgs(process.argv.slice(2));
const isLive = flags.has("--live") || flags.has("--allow-live");
if (isLive) {
@@ -188,7 +443,20 @@ async function main() {
process.stdout.write(`[m2-smoke] validated ${fixture.serviceContracts.length} service contracts\n`);
process.stdout.write(`[m2-smoke] mode=${isLive ? "live" : "dry-run"} endpoint=${fixture.endpoint}\n`);
- process.stdout.write("[m2-smoke] no real DEV/PROD request was made\n");
+ if (isLive) {
+ const report = await runLiveSmoke(fixture, options);
+ if (flags.has("--write-report")) {
+ await writeActiveReport(report, options.reportPath);
+ process.stdout.write(`[m2-smoke] wrote ${path.relative(repoRoot, options.reportPath)}\n`);
+ }
+ process.stdout.write(`[m2-smoke] active-report=${report.status} probes=${report.runtimeSmoke.probes.length}\n`);
+ process.stdout.write("[m2-smoke] no DEV/PROD mutation was made\n");
+ if (report.status !== "pass") {
+ process.exitCode = 2;
+ }
+ } else {
+ process.stdout.write("[m2-smoke] no real DEV/PROD request was made\n");
+ }
}
try {
diff --git a/scripts/validate-dev-gate-report.mjs b/scripts/validate-dev-gate-report.mjs
index 13689ade..feb1a5f1 100644
--- a/scripts/validate-dev-gate-report.mjs
+++ b/scripts/validate-dev-gate-report.mjs
@@ -91,6 +91,19 @@ const requiredDevEdgeDocs = [
"docs/m0-contract-audit.md",
"docs/dev-edge-health.md"
];
+const requiredDevM2Issue = "pikasTech/HWLAB#23";
+const requiredDevM2ValidationCommands = [
+ "node --check scripts/m2-dev-deploy-smoke.mjs",
+ "node scripts/m2-dev-deploy-smoke.mjs --dry-run",
+ "node scripts/m2-dev-deploy-smoke.mjs --live --confirm-dev --confirmed-non-production --write-report",
+ "node --check scripts/validate-dev-gate-report.mjs",
+ "node scripts/validate-dev-gate-report.mjs"
+];
+const requiredDevM2Docs = [
+ "docs/m2-dev-deploy-smoke.md",
+ "docs/dev-acceptance-matrix.md",
+ "fixtures/dev-deploy-smoke/dev-deploy-smoke.json"
+];
const reportFamilyTemplates = new Map([
[
"dev-gate-report-contract",
@@ -353,6 +366,10 @@ async function validateReport(relativePath) {
await validateDevEdgeReport(report, label);
return;
}
+ if (report.issue === requiredDevM2Issue || report.taskId === "m2-dev-deploy-smoke") {
+ await validateDevM2Report(report, label);
+ return;
+ }
const template = reportFamilyTemplates.get(report.taskId);
assert.ok(
@@ -949,6 +966,128 @@ async function validateDevEdgeReport(report, label) {
assertObject(report.edgeHealth.kubernetes ?? {}, `${label}.edgeHealth.kubernetes`);
}
+async function validateDevM2Report(report, label) {
+ for (const field of [
+ "$schema",
+ "$id",
+ "reportVersion",
+ "issue",
+ "taskId",
+ "commitId",
+ "acceptanceLevel",
+ "devOnly",
+ "prodDisabled",
+ "status",
+ "generatedAt",
+ "endpoint",
+ "frontendEndpoint",
+ "sourceContract",
+ "validationCommands",
+ "localSmoke",
+ "dryRun",
+ "devPreconditions",
+ "blockers",
+ "runtimeSmoke"
+ ]) {
+ assert.ok(Object.hasOwn(report, field), `${label} missing ${field}`);
+ }
+
+ assertString(report.$schema, `${label}.$schema`);
+ assertString(report.$id, `${label}.$id`);
+ assert.equal(report.reportVersion, "v1", `${label}.reportVersion`);
+ assert.equal(report.issue, requiredDevM2Issue, `${label}.issue`);
+ assert.equal(report.taskId, "m2-dev-deploy-smoke", `${label}.taskId`);
+ assert.match(report.commitId, /^([a-f0-9]{7,40}|unknown)$/, `${label}.commitId`);
+ assert.equal(report.acceptanceLevel, "dev_m2_deploy_smoke", `${label}.acceptanceLevel`);
+ assert.equal(report.devOnly, true, `${label}.devOnly`);
+ assert.equal(report.prodDisabled, true, `${label}.prodDisabled`);
+ assert.equal(report.status, "pass", `${label}.status`);
+ assertTimestamp(report.generatedAt, `${label}.generatedAt`);
+ assert.equal(report.endpoint, "http://74.48.78.17:16667", `${label}.endpoint`);
+ assert.equal(report.frontendEndpoint, "http://74.48.78.17:16666", `${label}.frontendEndpoint`);
+
+ assertObject(report.sourceContract, `${label}.sourceContract`);
+ assertStatus(report.sourceContract.status, `${label}.sourceContract.status`);
+ await assertDocumentSet(
+ report.sourceContract.documents,
+ `${label}.sourceContract.documents`,
+ requiredDevM2Docs
+ );
+ assertString(report.sourceContract.summary, `${label}.sourceContract.summary`);
+
+ assertStringArray(report.validationCommands, `${label}.validationCommands`, {
+ minLength: requiredDevM2ValidationCommands.length
+ });
+ assertUnique(report.validationCommands, `${label}.validationCommands`);
+ for (const requiredCommand of requiredDevM2ValidationCommands) {
+ assert.ok(
+ report.validationCommands.includes(requiredCommand),
+ `${label}.validationCommands missing ${requiredCommand}`
+ );
+ }
+
+ for (const section of ["localSmoke", "dryRun", "devPreconditions"]) {
+ assertObject(report[section], `${label}.${section}`);
+ assertStatus(report[section].status, `${label}.${section}.status`);
+ assertStringArray(report[section].commands, `${label}.${section}.commands`, { minLength: 1 });
+ assertStringArray(report[section].evidence, `${label}.${section}.evidence`, { minLength: 1 });
+ assertString(report[section].summary, `${label}.${section}.summary`);
+ }
+ assertStringArray(report.devPreconditions.requirements, `${label}.devPreconditions.requirements`, {
+ minLength: 1
+ });
+ for (const command of [
+ "curl -fsS --max-time 10 http://74.48.78.17:16667/health",
+ "curl -fsS --max-time 10 http://74.48.78.17:16667/health/live",
+ "curl -fsS --max-time 10 http://74.48.78.17:16666/"
+ ]) {
+ assert.ok(
+ report.devPreconditions.commands.includes(command),
+ `${label}.devPreconditions.commands missing ${command}`
+ );
+ }
+ assertBlockers(report.blockers, `${label}.blockers`);
+
+ assertObject(report.runtimeSmoke, `${label}.runtimeSmoke`);
+ assert.equal(report.runtimeSmoke.mode, "live-read-only", `${label}.runtimeSmoke.mode`);
+ assert.equal(report.runtimeSmoke.status, "pass", `${label}.runtimeSmoke.status`);
+ assertTimestamp(report.runtimeSmoke.generatedAt, `${label}.runtimeSmoke.generatedAt`);
+ assert.equal(report.runtimeSmoke.apiEndpoint, "http://74.48.78.17:16667", `${label}.runtimeSmoke.apiEndpoint`);
+ assert.equal(report.runtimeSmoke.frontendEndpoint, "http://74.48.78.17:16666", `${label}.runtimeSmoke.frontendEndpoint`);
+
+ assertObject(report.runtimeSmoke.safety, `${label}.runtimeSmoke.safety`);
+ assert.equal(report.runtimeSmoke.safety.environment, "dev", `${label}.runtimeSmoke.safety.environment`);
+ for (const field of [
+ "prodTouched",
+ "secretsRead",
+ "restarts",
+ "deployAttempted",
+ "heavyE2E",
+ "unideskRuntimeSubstitute"
+ ]) {
+ assert.equal(report.runtimeSmoke.safety[field], false, `${label}.runtimeSmoke.safety.${field}`);
+ }
+
+ assertArray(report.runtimeSmoke.probes, `${label}.runtimeSmoke.probes`);
+ assert.ok(report.runtimeSmoke.probes.length >= 3, `${label}.runtimeSmoke.probes must include api and frontend probes`);
+ assertObject(report.runtimeSmoke.legacyPublicEndpoint, `${label}.runtimeSmoke.legacyPublicEndpoint`);
+ assert.equal(
+ report.runtimeSmoke.legacyPublicEndpoint.endpoint,
+ "http://74.48.78.17:6667",
+ `${label}.runtimeSmoke.legacyPublicEndpoint.endpoint`
+ );
+ assert.equal(
+ report.runtimeSmoke.legacyPublicEndpoint.status,
+ "deprecated",
+ `${label}.runtimeSmoke.legacyPublicEndpoint.status`
+ );
+ assert.equal(
+ report.runtimeSmoke.legacyPublicEndpoint.activeGreenEligible,
+ false,
+ `${label}.runtimeSmoke.legacyPublicEndpoint.activeGreenEligible`
+ );
+}
+
async function validateDevM3Report(report, label) {
for (const field of [
"$schema",
diff --git a/scripts/validate-m2-deploy-smoke-active.mjs b/scripts/validate-m2-deploy-smoke-active.mjs
new file mode 100644
index 00000000..d4ac4dab
--- /dev/null
+++ b/scripts/validate-m2-deploy-smoke-active.mjs
@@ -0,0 +1,76 @@
+#!/usr/bin/env node
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const reportPath = path.join(repoRoot, "reports/dev-gate/dev-m2-deploy-smoke-active.json");
+
+function assertString(value, label) {
+ assert.equal(typeof value, "string", `${label} must be a string`);
+ assert.ok(value.trim().length > 0, `${label} must not be empty`);
+}
+
+function assertObject(value, label) {
+ assert.ok(value && typeof value === "object" && !Array.isArray(value), `${label} must be an object`);
+}
+
+function assertArray(value, label) {
+ assert.ok(Array.isArray(value), `${label} must be an array`);
+}
+
+function assertTimestamp(value, label) {
+ assertString(value, label);
+ assert.ok(!Number.isNaN(Date.parse(value)), `${label} must be a timestamp`);
+}
+
+async function main() {
+ const report = JSON.parse(await readFile(reportPath, "utf8"));
+ assertObject(report, "report");
+ assert.equal(report.issue, "pikasTech/HWLAB#23");
+ assert.equal(report.taskId, "m2-dev-deploy-smoke");
+ assert.equal(report.status, "pass");
+ assert.equal(report.endpoint, "http://74.48.78.17:16667");
+ assert.equal(report.frontendEndpoint, "http://74.48.78.17:16666");
+ assertTimestamp(report.generatedAt, "generatedAt");
+
+ assertObject(report.runtimeSmoke, "runtimeSmoke");
+ assert.equal(report.runtimeSmoke.mode, "live-read-only");
+ assert.equal(report.runtimeSmoke.status, "pass");
+ assert.equal(report.runtimeSmoke.apiEndpoint, "http://74.48.78.17:16667");
+ assert.equal(report.runtimeSmoke.frontendEndpoint, "http://74.48.78.17:16666");
+ assertObject(report.runtimeSmoke.safety, "runtimeSmoke.safety");
+ for (const field of ["prodTouched", "secretsRead", "restarts", "deployAttempted", "heavyE2E", "unideskRuntimeSubstitute"]) {
+ assert.equal(report.runtimeSmoke.safety[field], false, `runtimeSmoke.safety.${field}`);
+ }
+ assertObject(report.runtimeSmoke.legacyPublicEndpoint, "runtimeSmoke.legacyPublicEndpoint");
+ assert.equal(report.runtimeSmoke.legacyPublicEndpoint.endpoint, "http://74.48.78.17:6667");
+ assert.equal(report.runtimeSmoke.legacyPublicEndpoint.activeGreenEligible, false);
+
+ assertObject(report.devPreconditions, "devPreconditions");
+ assert.equal(report.devPreconditions.status, "pass");
+ assertArray(report.devPreconditions.commands, "devPreconditions.commands");
+ assertArray(report.devPreconditions.evidence, "devPreconditions.evidence");
+ assert.ok(
+ report.devPreconditions.commands.includes("curl -fsS --max-time 10 http://74.48.78.17:16667/health"),
+ "devPreconditions.commands missing /health probe"
+ );
+ assert.ok(
+ report.devPreconditions.commands.includes("curl -fsS --max-time 10 http://74.48.78.17:16667/health/live"),
+ "devPreconditions.commands missing /health/live probe"
+ );
+ assert.ok(
+ report.devPreconditions.commands.includes("curl -fsS --max-time 10 http://74.48.78.17:16666/"),
+ "devPreconditions.commands missing frontend probe"
+ );
+
+ console.log("validated m2-dev-deploy-smoke-active.json");
+}
+
+try {
+ await main();
+} catch (error) {
+ process.stderr.write(`[validate-m2-dev-deploy-smoke-active] ${error instanceof Error ? error.message : String(error)}\n`);
+ process.exitCode = 1;
+}