# DEV Evidence / Blocker Aggregator

This is the lightweight report-only entry point for `pikasTech/HWLAB#41` and
the M5 DEV gate aggregator v2 for `pikasTech/HWLAB#58`. It helps a commander
decide whether the DEV acceptance path is green, blocked, or ready for another
repair round across `#33-#39`, `#46`, `#7`, and the MVP DoD in `#9`.

Run from the repository root:

```sh
node scripts/dev-evidence-blocker-aggregator.mjs --pretty
```

For a short validation response:

```sh
node scripts/dev-evidence-blocker-aggregator.mjs --check
```

To refresh the committed v2 machine and human reports:

```sh
node scripts/dev-evidence-blocker-aggregator.mjs --report /tmp/hwlab-dev-gate/report.json
```

The generated files are:

- `/tmp/hwlab-dev-gate/dev-m5-gate-aggregator-v2.json`
- `/tmp/hwlab-dev-gate/dev-m5-gate-aggregator-v2.md`

## Source Levels

The aggregator keeps evidence levels separate so fixture output cannot be
promoted to live DEV evidence:

| Level | Meaning |
| --- | --- |
| `SOURCE` | Repository contracts, schemas, docs, manifests, or examples. |
| `LOCAL` | Localhost or in-process smoke results only. |
| `DRY-RUN` | Fixture-backed or no-mutation dry-run readiness evidence. |
| `DEV-LIVE` | Read-only evidence observed from the real DEV route; this may prove entrypoint reachability without proving downstream DB, M3, M4, or M5 acceptance. |
| `BLOCKED` | Missing issue reads, missing DEV evidence, missing artifacts, or other open blockers. |

## Current DEV Layering

The v2 report exposes `currentDevLayering` so the public route can be green
without promoting the full gate:

| Layer | Meaning |
| --- | --- |
| `Frontend DEV revision` | Latest Cloud Workbench frontend revision visible on the active `http://74.48.78.17:16666/` browser endpoint. While API health or runtime durability is degraded, this may only be summarized as deployed UI usable in degraded/read-only mode; frontend evidence cannot green DB, M3, M4, or M5. |
| `EDGE/ROUTE live` | `16666` browser and `16667` health route evidence from read-only probes. |
| `DB live/degraded` | Cloud API DB readiness from redacted health evidence; route success and env presence do not imply DB live. A `dns_error`/`dns_resolution_failed` DB probe is a DB live blocker. |
| `Code Agent provider Secret` | #143 provider-backed chat readiness from redacted runtime error and Secret key-presence evidence only; missing provider Secret is independent from DB live. |
| `M3 hardware trusted loop` | Real DEV `res_boxsimu_1:DO1 -> hwlab-patch-panel -> res_boxsimu_2:DI1` plus operation, trace, audit, and evidence identifiers. |
| `M4 agent loop` | Agent loop live preflight and scheduling/evidence closure, gated by DB and runtime readiness. |
| `artifact/desired-state source` | Artifact source coverage for the current target ref plus desired-state dry-run/apply status. |

The report also emits `activeEndpoints` and `deprecatedEndpoints`. Active
acceptance endpoints are:

- frontend/browser: `http://74.48.78.17:16666/`
- API/live: `http://74.48.78.17:16667/health/live`

Legacy public `http://74.48.78.17:6666` and
`http://74.48.78.17:6667` are historical/deprecated only and are not active
green evidence.

`latestFrontendDevFact` records the current #99/#108 frontend visibility fact:
revision `1e8805664970839b72be40c34636b08f6d18b131` is visible on DEV in
degraded/read-only mode, with `promotesM3M4M5=false`.

## Current Contract Map

| Milestone | Current visible level | Contract entry |
| --- | --- | --- |
| M0 | `SOURCE` | `docs/m0-contract-audit.md`, protocol schemas, evidence chain examples, M0 validator. |
| M1 | `LOCAL` | `docs/m1-local-smoke.md`, `fixtures/mvp/runtime.json`, `scripts/m1-contract-smoke.mjs`. |
| M2 | `DEV-LIVE` for frontend/route only | DEV deploy smoke fixture plus active read-only `16666`/`16667` endpoint smoke and degraded/read-only frontend visibility. |
| M3 | `BLOCKED` | Hardware trusted loop topology fixture, local patch-panel smoke, and the no-write DEV plan exist, but DEV-LIVE operation/trace/audit/evidence IDs for `res_boxsimu_1:DO1 -> hwlab-patch-panel -> res_boxsimu_2:DI1` are missing. |
| M4 | `BLOCKED` | Agent automation loop fixture and local smoke exist, but live preflight is blocked at runtime durable adapter readiness and skills commit/version injection, not stale DB-live readiness. |
| M5 | `BLOCKED` | MVP e2e dry-run plan is green, but bounded DEV-LIVE acceptance is blocked by runtime durable adapter, skills injection, M3/M4, and source/artifact coverage. |

`milestoneLevelClassification` is the compact M0-M5 answer for command
handoff. `milestoneBlockerClassification` gives the M3/M4/M5 blocker class,
dependency, and required next proof.

## Blocker Posture

The v2 report reads committed report fixtures only:

- `/tmp/hwlab-dev-gate/dev-preflight-report.json`
- `/tmp/hwlab-dev-gate/dev-deploy-report.json`
- `/tmp/hwlab-dev-gate/dev-artifacts.json`
- `/tmp/hwlab-dev-gate/dev-edge-health.json`
- `/tmp/hwlab-dev-gate/dev-m2-deploy-smoke-active.json`
- `/tmp/hwlab-dev-gate/dev-m3-hardware-loop.json`
- `/tmp/hwlab-dev-gate/dev-m4-agent-loop.json`
- `GitHub issue/PR comments`
- `/tmp/hwlab-dev-gate/d601-k3s-readonly-observability.json`

The report remains blocked until real DEV-LIVE evidence is attached for the
required downstream HWLAB runtime services. Public route evidence on
`16666/16667` is necessary but not sufficient: DB live readiness, #143 Code
Agent provider Secret readiness, M3 trusted loop evidence, M4 agent-loop
evidence, and artifact/desired-state source coverage stay separate.

The legacy base-image blocker is not current when the committed reports show an
approved Node 20 builder base. Artifact/current remains stricter: a target ref
can still keep `artifact-source-commit` or `dev-artifact-publish` open when it
changes artifact build inputs after the publish source commit, even if the
older DEV artifact report contains 13/13 published service digests. Registry
manifest reachability remains separate and belongs to the #66
process/Docker/k3s access dimensions.

## Next-Round Order

The JSON output groups recommended next actions in dependency order:

1. `d601-k3s`, `kubectl`, kubeconfig/maintenance bridge: restore read-only
   hwlab-dev cluster observability without printing Secrets.
2. `cloud-api-db`: prove DEV cloud-api DB env and health readiness with
   redacted values only.
3. `dev-edge`, `dev-edge-health`, `dev-ingress-health`: repair
   `:16667`/frp/edge/router reachability, then rerun read-only DEV edge health
   before M3/M4/M5 live loops.
4. `registry-manifest-read`: resolve #66 registry reachability without
   treating it as a missing publish digest or rerunning heavy publish.

## Boundaries

The aggregator does not deploy, call DEV, call PROD, run browser tests, run
heavy e2e, read secrets, restart services, or replace HWLAB runtime services
with UniDesk services. It is a local report generator and static contract
checker only.