# Topology Constraints

The MVP topology separates cloud, gateway, worker, simulated box, patch panel,
router, tunnel, and edge proxy responsibilities.

## Constraints

- `hwlab-cloud-api` is the cloud API boundary for DEV.
- `hwlab-cloud-web` consumes cloud APIs and must not control hardware directly.
- `hwlab-agent-mgr` schedules agent work and creates worker sessions.
- `hwlab-agent-worker` executes scoped work through declared gateway and box
  capabilities.
- `hwlab-gateway` is the hardware control boundary.
- `hwlab-gateway-simu` and `hwlab-box-simu` may simulate gateway and box
  behavior for MVP validation.
- `hwlab-patch-panel` owns patch panel state.
- `hwlab-router`, `hwlab-tunnel-client`, and `hwlab-edge-proxy` own network
  reachability concerns.
- `hwlab-cli` is a client and must not bypass service contracts.
- `hwlab-agent-skills` contains reusable agent skill assets.

## Wiring

Wiring configs describe allowed connections between resource ports. A valid
wiring config must:

- belong to a project
- reference known gateway and box resources
- declare endpoints explicitly
- avoid cycles unless a later capability explicitly allows them
- represent one active config per resource group unless the patch panel reports
  an override