Adds Code Agent session and Skill CLI HWLAB API route gates to the RPT-004 harness, with default read-only live behavior and explicit --allow-m3-write for DEV-only M3 writes.
Host commander merge after personal review. PR #225 is clean against current main and preserves the current-main-safe part of stale PR #213: when deployment identity preflight blocks, the Code Agent browser journey is recorded as blocked/not_sent instead of omitted or misread as a successful POST. This is validation/smoke hardening only; no live mutation, no Code Agent POST, no Secret access, and no M3/M4/M5 acceptance claim.
Merge PR #152 after Code Queue rebase and validation. This lands the DEV Cloud Web publish/apply contract, dist freshness checks, artifact identity evidence, and read-only rollout observation. No PROD changes and no live deploy claim.
Commander review: direction is correct. This PR separates runner kubeconfig/read-only observability gaps from D601 public endpoint/k3s availability and keeps M3 blocked until real operation/trace/audit/evidence are observed. It does not touch PROD or restart services.
Merge PR #71 after commander review. Rebaselines DEV live evidence to 16666/16667, removes stale edge/frp blocker classification, keeps DB live and M3 patch-panel runtime as real blockers. Complies with HWLAB #78 / DC-DCSN-P0-2026-003 by preserving DEV-LIVE evidence boundaries and not treating Gate/UI as MVP success.
Refs #66. Merged by commander after reviewing Code Queue task codex_1779422778882_1. Separates process HTTP, Docker daemon push, and k3s pull registry capabilities so runner loopback HTTP degradation does not block artifact publish when Docker/k3s paths are proven.
Refs #49
Merged by commander after reviewing Code Queue task codex_1779422762669_1. Adds redacted DB readiness layering and refreshes DEV endpoint/report evidence. Follow-up: deploy/verify the new readiness probe in DEV via standard image CI/CD.
Code Queue Review