{
  "$schema": "https://hwlab.pikastech.local/schemas/dev-gate-report.schema.json",
  "$id": "https://hwlab.pikastech.local/reports/dev-gate/dev-m4-agent-loop.json",
  "reportVersion": "v1",
  "issue": "pikasTech/HWLAB#37",
  "taskId": "dev-m4-agent-loop",
  "commitId": "d881a50",
  "acceptanceLevel": "dev_m4_agent_loop",
  "devOnly": true,
  "prodDisabled": true,
  "reportLifecycle": {
    "version": "v1",
    "state": "active",
    "activeEndpoint": "http://74.48.78.17:16667",
    "activeBrowserEndpoint": "http://74.48.78.17:16666",
    "deprecatedEndpoint": null,
    "summary": "Current DEV M4 agent-loop preflight report; it does not substitute for M3 DEV-LIVE acceptance."
  },
  "sourceContract": {
    "status": "pass",
    "documents": [
      "docs/dev-acceptance-matrix.md",
      "docs/dev-m4-agent-loop.md"
    ],
    "summary": "The DEV M4 report is anchored to the frozen acceptance matrix and the M4 loop doc."
  },
  "validationCommands": [
    "node --check scripts/validate-dev-gate-report.mjs",
    "node scripts/validate-dev-gate-report.mjs",
    "node --check scripts/dev-m4-agent-loop-smoke.mjs",
    "node --check scripts/src/dev-m4-agent-loop-smoke-lib.mjs",
    "node scripts/dev-m4-agent-loop-smoke.mjs --dry-run",
    "node scripts/dev-m4-agent-loop-smoke.mjs --live --confirm-dev --confirmed-non-production",
    "KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl -n hwlab-dev get pods,svc,deploy,job,cm -o wide",
    "KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl -n hwlab-dev create -f - --dry-run=server -o json"
  ],
  "localSmoke": {
    "status": "pass",
    "commands": [
      "node scripts/m4-agent-loop-smoke.mjs"
    ],
    "evidence": [
      "Local runtime skeleton smoke confirms create/start/trace/finish/cleanup coverage.",
      "Workspace isolation and explicit skills commit wiring are covered by fixture assertions."
    ],
    "summary": "Local contract smoke passes on the repo fixture."
  },
  "dryRun": {
    "status": "pass",
    "commands": [
      "node scripts/dev-m4-agent-loop-smoke.mjs --dry-run"
    ],
    "evidence": [
      "hwlab-agent-mgr:session=agt_m4_agent_loop_01:created=queued:final=cleanup",
      "hwlab-agent-worker:session=wkr_agt_m4_agent_loop_01:status=cleanup",
      "workspace:vol_agt_m4_agent_loop_01:cleaned=true:existsAfterCleanup=false",
      "hwlab-agent-skills:commit=6509a35:version=v1",
      "trace:trc_agt_m4_agent_loop_01:events=5",
      "evidence:evi_agt_m4_agent_loop_01:kind=report",
      "cleanup:cln_agt_m4_agent_loop_01:removed=true"
    ],
    "summary": "Local dry-run covered agent manager, worker, workspace isolation, skills commit, trace, evidence, and cleanup without live DEV mutation."
  },
  "componentEvidence": {
    "agentManagerWorker": {
      "level": "DRY-RUN",
      "status": "pass",
      "services": [
        "hwlab-agent-mgr",
        "hwlab-agent-worker"
      ],
      "summary": "Manager created a scoped local session and worker completed the bounded dry-run task."
    },
    "workspaceIsolation": {
      "level": "DRY-RUN",
      "status": "pass",
      "evidence": [
        "primary=prj_m4_agent_loop/agt_m4_agent_loop_01",
        "isolation=prj_m4_agent_loop_alt/agt_m4_agent_loop_02"
      ],
      "summary": "Workspace identity is per agent session and fixture isolation remains source/local evidence only."
    },
    "skillsCommit": {
      "level": "DRY-RUN",
      "status": "pass",
      "serviceId": "hwlab-agent-skills",
      "commitId": "6509a35",
      "version": "v1",
      "summary": "Agent skills are accepted only with explicit commitId and version wiring."
    },
    "traceEvidenceCleanup": {
      "level": "DRY-RUN",
      "status": "pass",
      "summary": "Dry-run produced trace/evidence records and removed the temporary worker workspace."
    },
    "dbLive": {
      "level": "DEV-LIVE",
      "status": "pass",
      "summary": "Current read-only /health/live evidence reports DB ready=true, connected=true, and liveDbEvidence=true; DB live is no longer the active M4 blocker."
    },
    "m3HardwareLoopDependency": {
      "level": "BLOCKED",
      "status": "not_run",
      "requiredPath": "DO1 -> hwlab-patch-panel -> DI1",
      "summary": "M4 can only support M3 through cloud-api/hardware API and the patch-panel trusted path; no direct box/gateway path is used."
    },
    "runtimeDurableAdapter": {
      "level": "BLOCKED",
      "status": "blocked",
      "summary": "Live scheduling is stopped at runtime durable adapter readiness; DB live evidence alone is not runtime durability evidence."
    }
  },
  "dependencyState": {
    "dbLive": {
      "status": "pass",
      "summary": "cloud-api /health/live reports DB ready=true, connected=true, and liveDbEvidence=true."
    },
    "m3HardwareLoop": {
      "status": "not_run",
      "requiredEvidence": "Traceable DO1 -> hwlab-patch-panel -> DI1 operation with auditId and evidenceId.",
      "summary": "M3 hardware loop was not reached while an earlier M4 precondition remained blocked."
    },
    "hardwareDispatchBoundary": {
      "status": "pass",
      "allowedPath": "cloud-api /rpc hardware.operation.request -> hwlab-patch-panel trusted route",
      "forbiddenPaths": [
        "direct hwlab-box-simu access",
        "direct hwlab-gateway-simu access",
        "agent-side fixture promotion to DEV-LIVE"
      ]
    },
    "runtimeDurableAdapter": {
      "status": "blocked",
      "requiredEvidence": "Postgres runtime adapter schema, migration ledger, and read-query readiness with liveRuntimeEvidence=true.",
      "summary": "cloud-api durable runtime adapter is blocked: runtime_durable_adapter_query_blocked; migration 0001_cloud_core_skeleton is missing or not checked; read-query durability is not proven."
    }
  },
  "d601K3sNative": {
    "status": "blocked",
    "mode": "dev-read-only-plus-server-dry-run",
    "generatedAt": "2026-05-22T12:12:47.156Z",
    "commands": [
      "KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl get namespace hwlab-dev -o json",
      "KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl -n hwlab-dev get pods,svc,deploy,job,cm -o wide",
      "KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl -n hwlab-dev get deploy hwlab-agent-mgr hwlab-agent-skills -o json",
      "KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl -n hwlab-dev get job hwlab-agent-worker-template -o json",
      "KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl -n hwlab-dev get svc hwlab-agent-mgr hwlab-agent-skills -o json",
      "KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl -n hwlab-dev get endpoints hwlab-agent-mgr hwlab-agent-skills -o json",
      "KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl auth can-i create jobs -n hwlab-dev",
      "KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl auth can-i delete jobs -n hwlab-dev",
      "KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl auth can-i get secrets -n hwlab-dev",
      "KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl -n hwlab-dev create -f - --dry-run=server -o json"
    ],
    "safety": {
      "namespace": "hwlab-dev",
      "kubeconfig": "/etc/rancher/k3s/k3s.yaml",
      "readOnly": true,
      "prodTouched": false,
      "secretResourcesRead": false,
      "secretMaterialPrinted": false,
      "servicesRestarted": false,
      "workerJobPersisted": false,
      "longRunningAgentStarted": false,
      "note": "The smoke checks Secret RBAC only with kubectl auth can-i; it never reads Secret resources or kubeconfig contents."
    },
    "clusterReadable": true,
    "namespace": {
      "name": "hwlab-dev",
      "readable": true,
      "error": null
    },
    "rbac": {
      "createJobs": true,
      "deleteJobs": true,
      "getSecrets": true,
      "secretReadNotPerformed": true
    },
    "agentManager": {
      "deployment": {
        "name": "hwlab-agent-mgr",
        "image": "127.0.0.1:5000/hwlab/hwlab-agent-mgr:d881a50",
        "readyReplicas": 1,
        "replicas": 1,
        "available": "True",
        "ready": true,
        "env": {
          "values": {
            "HWLAB_AGENT_SESSION_MODE": "control-plane"
          },
          "valueFrom": []
        }
      },
      "endpointCount": 1,
      "health": {
        "statusCode": 200,
        "status": "degraded",
        "serviceId": "hwlab-agent-mgr",
        "missingSkills": [
          "manager.skillCommitId",
          "manager.skillVersion"
        ],
        "error": null
      }
    },
    "agentSkills": {
      "deployment": {
        "name": "hwlab-agent-skills",
        "image": "127.0.0.1:5000/hwlab/hwlab-agent-skills:d881a50",
        "readyReplicas": 1,
        "replicas": 1,
        "available": "True",
        "ready": true,
        "env": {
          "values": {
            "HWLAB_SKILLS_COMMIT_ID": "d881a50"
          },
          "valueFrom": []
        }
      },
      "endpointCount": 1,
      "health": {
        "statusCode": 200,
        "status": "ok",
        "serviceId": "hwlab-agent-skills",
        "revision": "d881a50",
        "error": null
      }
    },
    "workerJob": {
      "template": {
        "name": "hwlab-agent-worker-template",
        "suspend": true,
        "image": "127.0.0.1:5000/hwlab/hwlab-agent-worker:d881a50",
        "restartPolicy": "Never",
        "env": {
          "values": {
            "HWLAB_AGENT_SESSION_MODE": "session-scoped"
          },
          "valueFrom": []
        }
      },
      "serverDryRun": {
        "status": "pass",
        "accepted": true,
        "command": "KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl -n hwlab-dev create -f - --dry-run=server -o json",
        "persisted": false,
        "generatedName": "hwlab-agent-worker-smoke-dryrun-20260522",
        "injectedEnvNames": [
          "HWLAB_AGENT_SESSION_ID",
          "HWLAB_AGENT_SESSION_MODE",
          "HWLAB_PROJECT_ID",
          "HWLAB_SKILL_COMMIT_ID",
          "HWLAB_SKILL_VERSION",
          "HWLAB_WORKSPACE_ROOT"
        ],
        "dryRunKind": "Job",
        "dryRunSuspend": true,
        "summary": "Server-side admission accepted a suspended worker Job generated from the template with session/workspace/skills env injected; no Job was persisted."
      }
    },
    "skillsInjection": {
      "status": "blocked",
      "source": "k3s deployment env plus generated worker dry-run manifest",
      "serviceCommitId": "d881a50",
      "serviceVersion": null,
      "workerDryRunCommitId": "d881a50",
      "workerDryRunVersion": "",
      "workerDryRunSource": "derived-from-live-dev-skills-env",
      "missing": [
        "hwlab-agent-skills.HWLAB_SKILLS_VERSION",
        "worker-dry-run.HWLAB_SKILL_VERSION_FROM_DEV"
      ]
    },
    "traceEvidenceCleanup": {
      "status": "dry-run-only",
      "summary": "Live worker execution was not started. Trace/evidence/cleanup closure is covered by the bounded local dry-run and remains explicitly non-M3 DEV-LIVE."
    },
    "evidence": [
      "k3s:namespace=hwlab-dev:read=true",
      "k3s:deploy/hwlab-agent-mgr:ready=1/1:available=True",
      "k3s:deploy/hwlab-agent-skills:ready=1/1:available=True",
      "k3s:svc/hwlab-agent-mgr:endpoints=1",
      "k3s:svc/hwlab-agent-skills:endpoints=1",
      "agent-mgr:/health/live:degraded:missing=manager.skillCommitId,manager.skillVersion",
      "agent-skills:/health/live:ok:d881a50",
      "worker-template:suspend=true:image=127.0.0.1:5000/hwlab/hwlab-agent-worker:d881a50",
      "worker-job:server-dry-run=true:persisted=false",
      "skills-injection:commit=d881a50:version=missing",
      "secret-rbac:get=yes:secretResourcesRead=false"
    ],
    "blockers": [
      {
        "type": "agent_blocker",
        "scope": "agent-mgr-health",
        "status": "open",
        "summary": "hwlab-agent-mgr /health/live is degraded.",
        "classification": "agent runtime",
        "nextFix": "Inject explicit skill commit and version into agent-mgr health configuration, then redeploy DEV."
      },
      {
        "type": "agent_blocker",
        "scope": "skills-commit-version-injection",
        "status": "open",
        "summary": "DEV skills injection is incomplete: missing hwlab-agent-skills.HWLAB_SKILLS_VERSION, worker-dry-run.HWLAB_SKILL_VERSION_FROM_DEV.",
        "classification": "skills injection",
        "nextFix": "Add HWLAB_SKILLS_VERSION to hwlab-agent-skills and ensure scheduled worker jobs receive HWLAB_SKILL_COMMIT_ID plus HWLAB_SKILL_VERSION."
      }
    ],
    "minimumFixRecommendations": [
      "Inject explicit skill commit and version into agent-mgr health configuration, then redeploy DEV.",
      "Add HWLAB_SKILLS_VERSION to hwlab-agent-skills and ensure scheduled worker jobs receive HWLAB_SKILL_COMMIT_ID plus HWLAB_SKILL_VERSION."
    ]
  },
  "publicEntrypoints": {
    "status": "pass",
    "commands": [
      "curl -fsS --max-time 10 http://74.48.78.17:16667/health",
      "curl -fsS --max-time 10 http://74.48.78.17:16667/health/live",
      "curl -fsS -I --max-time 10 http://74.48.78.17:16666/"
    ],
    "api": {
      "endpoint": "http://74.48.78.17:16667",
      "health": {
        "statusCode": 200,
        "serviceId": "hwlab-edge-proxy",
        "environment": "dev",
        "status": "ok",
        "error": null
      },
      "live": {
        "statusCode": 200,
        "serviceId": "hwlab-cloud-api",
        "environment": "dev",
        "status": "degraded",
        "db": {
          "status": "ok",
          "connected": true,
          "liveConnected": true,
          "ready": true,
          "configReady": true,
          "connectionChecked": true,
          "connectionAttempted": true,
          "connectionResult": "connected",
          "endpointSource": "secret-url-host",
          "liveDbEvidence": true,
          "evidence": "live_db_tcp_connection_ready"
        },
        "error": null,
        "codeAgent": {
          "endpoint": "POST /v1/agent/chat",
          "status": "available",
          "ready": true,
          "provider": "openai-responses",
          "schema": [
            "conversationId",
            "sessionId",
            "messageId",
            "status",
            "createdAt",
            "updatedAt",
            "traceId",
            "provider",
            "model",
            "backend",
            "error.message"
          ]
        },
        "runtime": {
          "adapter": "postgres",
          "durable": false,
          "durableRequested": true,
          "durableCapable": false,
          "ready": false,
          "status": "blocked",
          "blocker": "runtime_durable_adapter_query_blocked",
          "reason": "Postgres runtime adapter is configured, but durable read-query readiness is blocked; migration 0001_cloud_core_skeleton is missing or not checked.",
          "liveRuntimeEvidence": false,
          "fixtureEvidence": false,
          "connection": {
            "queryAttempted": true,
            "queryResult": "query_blocked",
            "endpointRedacted": true,
            "valueRedacted": true,
            "errorCode": "not_observed"
          },
          "schema": {
            "checked": true,
            "ready": true,
            "missingTables": [],
            "missingColumns": []
          },
          "migration": {
            "checked": false,
            "ready": false,
            "missing": true,
            "requiredMigrationId": "0001_cloud_core_skeleton",
            "requiredSchemaVersion": "runtime-durable-postgres-v1",
            "appliedMigrationId": null,
            "appliedSchemaVersion": null
          },
          "gates": {
            "auth": {
              "checked": true,
              "ready": true,
              "status": "ready",
              "blocker": null
            },
            "schema": {
              "checked": true,
              "ready": true,
              "status": "ready",
              "blocker": null
            },
            "migration": {
              "checked": false,
              "ready": false,
              "status": "blocked",
              "blocker": "runtime_durable_adapter_migration_blocked"
            },
            "durability": {
              "checked": true,
              "ready": false,
              "status": "blocked",
              "blocker": "runtime_durable_adapter_query_blocked"
            }
          },
          "durabilityContract": {
            "ready": false,
            "status": "blocked",
            "blockedLayer": "durability_query",
            "requiredEvidence": "runtime_adapter_schema_migration_read_query",
            "dbLiveEvidenceIsDurabilityEvidence": false,
            "secretMaterialRead": false
          },
          "counts": {}
        },
        "readiness": {
          "contractVersion": "v3",
          "ready": false,
          "status": "degraded",
          "blockerCodes": [
            "runtime_durable_adapter_query_blocked"
          ],
          "components": {
            "db": "ready",
            "codeAgent": "ready",
            "runtime": "blocked"
          },
          "durability": {
            "status": "blocked",
            "ready": false,
            "adapter": "postgres",
            "durable": false,
            "durableRequested": true,
            "durableCapable": false,
            "runtimeStatus": "blocked",
            "runtimeReady": false,
            "liveRuntimeEvidence": false,
            "dbLiveEvidenceObserved": true,
            "dbLiveEvidenceIsDurabilityEvidence": false,
            "requiredEvidence": "runtime_adapter_schema_migration_read_query",
            "blockedLayer": "durability_query",
            "blocker": "runtime_durable_adapter_query_blocked",
            "gates": {
              "auth": {
                "checked": true,
                "ready": true,
                "status": "ready",
                "blocker": null
              },
              "schema": {
                "checked": true,
                "ready": true,
                "status": "ready",
                "blocker": null
              },
              "migration": {
                "checked": false,
                "ready": false,
                "status": "blocked",
                "blocker": "runtime_durable_adapter_migration_blocked"
              },
              "durability": {
                "checked": true,
                "ready": false,
                "status": "blocked",
                "blocker": "runtime_durable_adapter_query_blocked"
              }
            },
            "queryAttempted": true,
            "queryResult": "query_blocked",
            "secretMaterialRead": false
          }
        },
        "blockerCodes": [
          "runtime_durable_adapter_query_blocked"
        ]
      }
    },
    "frontend": {
      "endpoint": "http://74.48.78.17:16666",
      "statusCode": 200,
      "contentType": "text/html; charset=utf-8",
      "contentLength": "11180",
      "error": null
    },
    "summary": "Public DEV API http://74.48.78.17:16667 health=200 live=200 with DB live ready and runtime durable adapter blocked; frontend http://74.48.78.17:16666/=200."
  },
  "safetyEvidence": {
    "devOnly": true,
    "namespace": "hwlab-dev",
    "kubeconfig": "/etc/rancher/k3s/k3s.yaml",
    "prodTouched": false,
    "prodNamespaceTouched": false,
    "secretMaterialRead": false,
    "secretResourcesRead": false,
    "servicesRestarted": false,
    "longRunningAgentStarted": false,
    "workerJobPersisted": false,
    "notes": [
      "kubectl commands were scoped to hwlab-dev and /etc/rancher/k3s/k3s.yaml.",
      "Secret RBAC was checked with kubectl auth can-i only; no Secret resource or secret value was read.",
      "Worker createability used server-side dry-run with suspend=true and did not persist a Job."
    ]
  },
  "devPreconditions": {
    "status": "blocked",
    "classification": "runtime_durable_adapter_query_blocked",
    "requirements": [
      "DEV route remains frozen at http://74.48.78.17:16667",
      "DEV browser route remains frozen at http://74.48.78.17:16666",
      "D601 native k3s access uses KUBECONFIG=/etc/rancher/k3s/k3s.yaml and namespace hwlab-dev",
      "No secret reads, real deployment, or long-running agent task is attempted",
      "DB live readiness and runtime durable adapter readiness are separate gates; DB live alone cannot promote M4",
      "Agent manager, worker, and skills are reachable only through the cloud API boundary",
      "M4 hardware assistance must go through cloud-api/hardware API and patch-panel; direct box/gateway access is forbidden"
    ],
    "summary": "Blocked at runtime durable adapter readiness before scheduling a DEV agent task."
  },
  "blockers": [
    {
      "type": "runtime_blocker",
      "scope": "runtime-durable-adapter",
      "status": "open",
      "sourceIssue": "pikasTech/HWLAB#164",
      "summary": "cloud-api durable runtime adapter is blocked: runtime_durable_adapter_query_blocked; adapter=postgres; durable=false; ready=false; migration=0001_cloud_core_skeleton checked=false ready=false missing=true; queryResult=query_blocked.",
      "classification": "runtime_durable_adapter_query_blocked"
    },
    {
      "status": "open",
      "type": "agent_blocker",
      "scope": "agent-mgr-health",
      "summary": "hwlab-agent-mgr /health/live is degraded.",
      "classification": "agent runtime",
      "nextFix": "Inject explicit skill commit and version into agent-mgr health configuration, then redeploy DEV."
    },
    {
      "status": "open",
      "type": "agent_blocker",
      "scope": "skills-commit-version-injection",
      "summary": "DEV skills injection is incomplete: missing hwlab-agent-skills.HWLAB_SKILLS_VERSION, worker-dry-run.HWLAB_SKILL_VERSION_FROM_DEV.",
      "classification": "skills injection",
      "nextFix": "Add HWLAB_SKILLS_VERSION to hwlab-agent-skills and ensure scheduled worker jobs receive HWLAB_SKILL_COMMIT_ID plus HWLAB_SKILL_VERSION."
    }
  ],
  "livePreflight": {
    "status": "blocked",
    "classification": "runtime_durable_adapter_query_blocked",
    "commands": [
      "node scripts/dev-m4-agent-loop-smoke.mjs --live --confirm-dev --confirmed-non-production"
    ],
    "evidence": [
      "k3s:namespace=hwlab-dev:read=true",
      "k3s:deploy/hwlab-agent-mgr:ready=1/1:available=True",
      "k3s:deploy/hwlab-agent-skills:ready=1/1:available=True",
      "k3s:svc/hwlab-agent-mgr:endpoints=1",
      "k3s:svc/hwlab-agent-skills:endpoints=1",
      "agent-mgr:/health/live:degraded:missing=manager.skillCommitId,manager.skillVersion",
      "agent-skills:/health/live:ok:d881a50",
      "worker-template:suspend=true:image=127.0.0.1:5000/hwlab/hwlab-agent-worker:d881a50",
      "worker-job:server-dry-run=true:persisted=false",
      "skills-injection:commit=d881a50:version=missing",
      "secret-rbac:get=yes:secretResourcesRead=false",
      "Public DEV API http://74.48.78.17:16667 health=200 live=200 with DB live ready and runtime durable adapter blocked; frontend http://74.48.78.17:16666/=200.",
      "health:hwlab-edge-proxy:dev:ok",
      "live:hwlab-cloud-api:degraded:runtime-durable-adapter-blocked:runtime_durable_adapter_query_blocked",
      "db-live:ready=true:connected=true:liveDbEvidence=true",
      "runtime-durable-adapter:adapter=postgres:blocker=runtime_durable_adapter_query_blocked:migration=0001_cloud_core_skeleton:migrationChecked=false:migrationReady=false:queryResult=query_blocked"
    ],
    "summary": "Blocked at runtime durable adapter readiness before scheduling a DEV agent task."
  },
  "notes": "DEV M4 agent loop report. SOURCE/LOCAL/DRY-RUN evidence is not DEV-LIVE, and no secret material is read."
}