{
  "$schema": "https://hwlab.pikastech.local/schemas/dev-gate-preflight-report.schema.json",
  "$id": "https://hwlab.pikastech.local/reports/dev-gate/dev-preflight-report.json",
  "reportVersion": "v1",
  "reportKind": "dev-gate-preflight",
  "issue": "pikasTech/HWLAB#34",
  "supports": [
    "pikasTech/HWLAB#7",
    "pikasTech/HWLAB#12",
    "pikasTech/HWLAB#22",
    "pikasTech/HWLAB#23",
    "pikasTech/HWLAB#29",
    "pikasTech/HWLAB#30",
    "pikasTech/HWLAB#31"
  ],
  "target": {
    "ref": "origin/main",
    "commitId": "6da6ab40bc356ddf6f2ebea11af935f4399e4945",
    "shortCommitId": "6da6ab4"
  },
  "generatedAt": "2026-05-21T16:53:29.568Z",
  "mode": "read-only",
  "devOnly": true,
  "prodDisabled": true,
  "forbiddenActions": [
    "prod-deploy",
    "secret-material-read",
    "unidesk-runtime-substitute",
    "heavy-e2e",
    "browser-e2e",
    "force-push",
    "runtime-restart"
  ],
  "validationCommands": [
    "node --check scripts/dev-gate-preflight.mjs",
    "node --check scripts/src/dev-gate-preflight.mjs",
    "node scripts/dev-gate-preflight.mjs",
    "node --check scripts/validate-dev-gate-report.mjs",
    "node scripts/validate-dev-gate-report.mjs"
  ],
  "conclusion": "blocked",
  "checks": [
    {
      "id": "source-contract-static",
      "category": "contract",
      "status": "pass",
      "summary": "Local deploy manifest and artifact catalog are internally consistent.",
      "evidence": []
    },
    {
      "id": "target-commit-pinning",
      "category": "contract",
      "status": "blocked",
      "summary": "deploy/catalog commitId 24eb3bf does not match origin/main 6da6ab4.",
      "evidence": []
    },
    {
      "id": "artifact-catalog-publish-state",
      "category": "registry",
      "status": "blocked",
      "summary": "Artifact catalog is still a skeleton and does not carry registry digests.",
      "evidence": []
    },
    {
      "id": "k8s-manifest-static",
      "category": "k3s",
      "status": "pass",
      "summary": "DEV k3s manifest files parse and stay scoped to hwlab-dev.",
      "evidence": []
    },
    {
      "id": "dev-artifact-publish-report",
      "category": "registry",
      "status": "blocked",
      "summary": "DEV artifact publish report status is blocked with 9/13 published for source 1e8d009e9531d71cef0762998663b4e3731032c6.",
      "evidence": []
    },
    {
      "id": "dev-edge-health-report",
      "category": "edge",
      "status": "blocked",
      "summary": "Committed DEV edge health report is blocked with classification frp_blocker.",
      "evidence": [
        {
          "report": "reports/dev-gate/dev-edge-health.json",
          "status": "blocked",
          "classification": "frp_blocker",
          "publicTcp": [
            {
              "host": "74.48.78.17",
              "port": 6667,
              "status": "error",
              "code": "ECONNREFUSED",
              "message": "connect ECONNREFUSED 74.48.78.17:6667",
              "durationMs": 221
            },
            {
              "host": "74.48.78.17",
              "port": 7000,
              "status": "error",
              "code": "ECONNREFUSED",
              "message": "connect ECONNREFUSED 74.48.78.17:7000",
              "durationMs": 218
            },
            {
              "host": "74.48.78.17",
              "port": 7402,
              "status": "error",
              "code": "ECONNREFUSED",
              "message": "connect ECONNREFUSED 74.48.78.17:7402",
              "durationMs": 207
            }
          ],
          "kubernetesObservable": false
        }
      ]
    },
    {
      "id": "frp-master-edge-static",
      "category": "edge",
      "status": "pass",
      "summary": "FRP and master-edge contracts describe D601-to-master DEV on port 6667.",
      "evidence": []
    },
    {
      "id": "runtime-substitution-boundary",
      "category": "safety",
      "status": "pass",
      "summary": "Deploy images do not point at UniDesk/provider-gateway/microservice-proxy substitutes.",
      "evidence": []
    },
    {
      "id": "d601-k3s-read-access",
      "category": "k3s",
      "status": "blocked",
      "summary": "kubectl is not installed in this runner, so hwlab-dev live cluster evidence cannot be collected.",
      "evidence": []
    },
    {
      "id": "public-dev-edge-health",
      "category": "edge",
      "status": "blocked",
      "summary": "Public DEV health endpoint did not respond successfully.",
      "evidence": [
        {
          "ok": false,
          "url": "http://74.48.78.17:6667/health/live",
          "method": "GET",
          "error": "fetch failed"
        }
      ]
    },
    {
      "id": "ghcr-anonymous-manifest-read",
      "category": "registry",
      "status": "blocked",
      "summary": "One or more catalog images could not be verified through anonymous GHCR manifest HEAD probes.",
      "evidence": [
        {
          "serviceId": "hwlab-cloud-api",
          "image": "ghcr.io/pikastech/hwlab-cloud-api:24eb3bf",
          "ok": false,
          "url": "https://ghcr.io/v2/pikastech/hwlab-cloud-api/manifests/24eb3bf",
          "method": "HEAD",
          "status": 401,
          "statusText": "Unauthorized",
          "body": ""
        },
        {
          "serviceId": "hwlab-cloud-web",
          "image": "ghcr.io/pikastech/hwlab-cloud-web:24eb3bf",
          "ok": false,
          "url": "https://ghcr.io/v2/pikastech/hwlab-cloud-web/manifests/24eb3bf",
          "method": "HEAD",
          "status": 401,
          "statusText": "Unauthorized",
          "body": ""
        },
        {
          "serviceId": "hwlab-agent-mgr",
          "image": "ghcr.io/pikastech/hwlab-agent-mgr:24eb3bf",
          "ok": false,
          "url": "https://ghcr.io/v2/pikastech/hwlab-agent-mgr/manifests/24eb3bf",
          "method": "HEAD",
          "status": 401,
          "statusText": "Unauthorized",
          "body": ""
        },
        {
          "serviceId": "hwlab-agent-worker",
          "image": "ghcr.io/pikastech/hwlab-agent-worker:24eb3bf",
          "ok": false,
          "url": "https://ghcr.io/v2/pikastech/hwlab-agent-worker/manifests/24eb3bf",
          "method": "HEAD",
          "status": 401,
          "statusText": "Unauthorized",
          "body": ""
        },
        {
          "serviceId": "hwlab-gateway",
          "image": "ghcr.io/pikastech/hwlab-gateway:24eb3bf",
          "ok": false,
          "url": "https://ghcr.io/v2/pikastech/hwlab-gateway/manifests/24eb3bf",
          "method": "HEAD",
          "status": 401,
          "statusText": "Unauthorized",
          "body": ""
        },
        {
          "serviceId": "hwlab-gateway-simu",
          "image": "ghcr.io/pikastech/hwlab-gateway-simu:24eb3bf",
          "ok": false,
          "url": "https://ghcr.io/v2/pikastech/hwlab-gateway-simu/manifests/24eb3bf",
          "method": "HEAD",
          "status": 401,
          "statusText": "Unauthorized",
          "body": ""
        },
        {
          "serviceId": "hwlab-box-simu",
          "image": "ghcr.io/pikastech/hwlab-box-simu:24eb3bf",
          "ok": false,
          "url": "https://ghcr.io/v2/pikastech/hwlab-box-simu/manifests/24eb3bf",
          "method": "HEAD",
          "status": 401,
          "statusText": "Unauthorized",
          "body": ""
        },
        {
          "serviceId": "hwlab-patch-panel",
          "image": "ghcr.io/pikastech/hwlab-patch-panel:24eb3bf",
          "ok": false,
          "url": "https://ghcr.io/v2/pikastech/hwlab-patch-panel/manifests/24eb3bf",
          "method": "HEAD",
          "status": 401,
          "statusText": "Unauthorized",
          "body": ""
        },
        {
          "serviceId": "hwlab-router",
          "image": "ghcr.io/pikastech/hwlab-router:24eb3bf",
          "ok": false,
          "url": "https://ghcr.io/v2/pikastech/hwlab-router/manifests/24eb3bf",
          "method": "HEAD",
          "status": 401,
          "statusText": "Unauthorized",
          "body": ""
        },
        {
          "serviceId": "hwlab-tunnel-client",
          "image": "ghcr.io/pikastech/hwlab-tunnel-client:24eb3bf",
          "ok": false,
          "url": "https://ghcr.io/v2/pikastech/hwlab-tunnel-client/manifests/24eb3bf",
          "method": "HEAD",
          "status": 401,
          "statusText": "Unauthorized",
          "body": ""
        },
        {
          "serviceId": "hwlab-edge-proxy",
          "image": "ghcr.io/pikastech/hwlab-edge-proxy:24eb3bf",
          "ok": false,
          "url": "https://ghcr.io/v2/pikastech/hwlab-edge-proxy/manifests/24eb3bf",
          "method": "HEAD",
          "status": 401,
          "statusText": "Unauthorized",
          "body": ""
        },
        {
          "serviceId": "hwlab-cli",
          "image": "ghcr.io/pikastech/hwlab-cli:24eb3bf",
          "ok": false,
          "url": "https://ghcr.io/v2/pikastech/hwlab-cli/manifests/24eb3bf",
          "method": "HEAD",
          "status": 401,
          "statusText": "Unauthorized",
          "body": ""
        },
        {
          "serviceId": "hwlab-agent-skills",
          "image": "ghcr.io/pikastech/hwlab-agent-skills:24eb3bf",
          "ok": false,
          "url": "https://ghcr.io/v2/pikastech/hwlab-agent-skills/manifests/24eb3bf",
          "method": "HEAD",
          "status": 401,
          "statusText": "Unauthorized",
          "body": ""
        }
      ]
    }
  ],
  "blockers": [
    {
      "status": "open",
      "type": "contract_blocker",
      "scope": "deploy-target",
      "summary": "deploy/deploy.json and deploy/artifact-catalog.dev.json still target 24eb3bf, not origin/main 6da6ab4.",
      "nextTask": "Publish or select a DEV artifact set for the current origin/main commit and update deploy/deploy.json plus deploy/artifact-catalog.dev.json to that immutable commit/tag."
    },
    {
      "status": "open",
      "type": "runtime_blocker",
      "scope": "artifact-catalog",
      "summary": "deploy/artifact-catalog.dev.json has ciPublished=false, registryVerified=false, and not_published digests.",
      "nextTask": "Run the DEV image publishing workflow and record immutable GHCR digests before real deployment."
    },
    {
      "status": "open",
      "type": "runtime_blocker",
      "scope": "dev-artifact-publish",
      "summary": "reports/dev-gate/dev-artifacts.json does not prove all HWLAB service artifacts for origin/main 6da6ab4; current status is blocked with 9/13 published.",
      "nextTask": "Complete DEV artifact publishing for every frozen HWLAB service at the current origin/main commit and record immutable registry digests."
    },
    {
      "status": "open",
      "type": "network_blocker",
      "scope": "dev-edge-health",
      "summary": "public 6667 and frps control 7000 both refuse TCP connections; frps is not reachable on the master edge",
      "nextTask": "Repair the master frps/public DEV edge route and rerun the read-only DEV edge health smoke before real deployment."
    },
    {
      "status": "open",
      "type": "environment_blocker",
      "scope": "d601-k3s",
      "summary": "D601 runner lacks kubectl and no default kubeconfig was used by this preflight.",
      "nextTask": "Provide a read-only kubectl/kubeconfig path for the real D601 hwlab-dev k3s cluster, then rerun this preflight."
    },
    {
      "status": "open",
      "type": "network_blocker",
      "scope": "dev-edge",
      "summary": "http://74.48.78.17:6667/health/live is not reachable from this runner.",
      "nextTask": "Bring up or repair the D601-to-master frp route and hwlab-edge-proxy, then rerun the health probe."
    },
    {
      "status": "open",
      "type": "runtime_blocker",
      "scope": "ghcr",
      "summary": "This preflight could not verify GHCR manifests for the DEV catalog images without reading credentials.",
      "nextTask": "Publish public DEV images or provide a non-secret registry evidence artifact with immutable digests for each HWLAB service."
    }
  ],
  "notes": "No PROD action, secret read, UniDesk runtime substitution, heavy e2e, browser e2e, runtime restart, or force push was performed."
}