# HWLAB Runtime Boundary Guard

The HWLAB runtime may use UniDesk CI/CD infrastructure and Code Queue
scheduling, but it must not use UniDesk backend, provider-gateway, or
microservice proxy as replacement runtime services. Those systems are external
supporting infrastructure only.

This guard is intentionally static. It reads repository files and does not
contact the DEV endpoint, deploy to DEV or PROD, read secrets, or restart any
UniDesk or HWLAB runtime process.

## Boundary Rule

- HWLAB runtime service identity is the frozen `hwlab-*` service ID set.
- DEV is the only accepted runtime environment for this guard.
- The fixed DEV endpoint is `http://74.48.78.17:16667`.
- The DEV namespace is `hwlab-dev`.
- PROD deployment and PROD acceptance remain disabled.
- UniDesk backend, provider-gateway, and microservice proxy are forbidden
  runtime substitutes.

UniDesk may remain in the control-plane path for CI, CD, and Code Queue
scheduling. It must not terminate HWLAB health, API, gateway, router, tunnel,
agent, simulator, patch-panel, CLI, or skills runtime contracts on behalf of
HWLAB.

## Checked Artifacts

The machine-readable fixture is
`protocol/examples/runtime-boundary/guard.dev.json`. It records the expected
DEV-only boundary, frozen service IDs, forbidden substitutes, and paths checked
by `scripts/validate-runtime-boundary.mjs`.

The validator checks:

- `deploy/deploy.json` keeps `environment: dev`, `hwlab-dev`, the fixed DEV
  endpoint, the complete HWLAB service set, HWLAB image names, and a disabled
  PROD profile.
- `deploy/master-edge/health-contract.json` keeps the `frp` D601-to-master
  reverse link, HWLAB contract service IDs, and the forbidden substitute list.
- `deploy/k8s/base/workloads.yaml` keeps workload names, labels, container
  names, and images under HWLAB service IDs.
- `deploy/k8s/base/services.yaml` keeps Kubernetes service names and labels
  under HWLAB service IDs.
- `deploy/k8s/dev/*` keeps the DEV overlay and runtime substitute policy.
- `deploy/k8s/prod/*` keeps PROD as a disabled placeholder only.

## Validation

Run:

```sh
node --check scripts/validate-runtime-boundary.mjs
node scripts/validate-runtime-boundary.mjs
```

The script is lightweight and has no package dependency. It fails if a checked
artifact drifts toward a UniDesk runtime substitute, a non-DEV environment, an
unexpected namespace, an unexpected endpoint, or an incomplete HWLAB service
boundary.