{
  "$schema": "https://hwlab.pikastech.local/schemas/dev-gate-preflight-report.schema.json",
  "$id": "https://hwlab.pikastech.local/reports/dev-gate/dev-preflight-report.json",
  "reportVersion": "v1",
  "reportKind": "dev-gate-preflight",
  "issue": "pikasTech/HWLAB#34",
  "supports": [
    "pikasTech/HWLAB#7",
    "pikasTech/HWLAB#12",
    "pikasTech/HWLAB#14",
    "pikasTech/HWLAB#22",
    "pikasTech/HWLAB#23",
    "pikasTech/HWLAB#29",
    "pikasTech/HWLAB#30",
    "pikasTech/HWLAB#31",
    "pikasTech/HWLAB#33",
    "pikasTech/HWLAB#39",
    "pikasTech/HWLAB#49",
    "pikasTech/HWLAB#33",
    "pikasTech/HWLAB#35",
    "pikasTech/HWLAB#48"
  ],
  "target": {
    "ref": "origin/main",
    "commitId": "1a2efd4915b2d7a6f640a22cc22087e7cae4c654",
    "shortCommitId": "1a2efd4"
  },
  "generatedAt": "2026-05-21T18:00:08.924Z",
  "mode": "read-only",
  "devOnly": true,
  "prodDisabled": true,
  "forbiddenActions": [
    "prod-deploy",
    "secret-material-read",
    "unidesk-runtime-substitute",
    "heavy-e2e",
    "browser-e2e",
    "force-push",
    "runtime-restart"
  ],
  "validationCommands": [
    "node --check scripts/dev-gate-preflight.mjs",
    "node --check scripts/src/dev-gate-preflight.mjs",
    "node --check scripts/refresh-artifact-catalog.mjs",
    "node scripts/dev-gate-preflight.mjs",
    "node --check scripts/validate-dev-gate-report.mjs",
    "node scripts/validate-dev-gate-report.mjs"
  ],
  "artifactIdentity": {
    "source": {
      "ref": "origin/main",
      "commitId": "1a2efd4915b2d7a6f640a22cc22087e7cae4c654",
      "shortCommitId": "1a2efd4"
    },
    "deployManifest": {
      "path": "deploy/deploy.json",
      "commitId": "1a2efd4",
      "matchesSource": true
    },
    "artifactCatalog": {
      "path": "deploy/artifact-catalog.dev.json",
      "commitId": "1a2efd4",
      "artifactState": "contract-skeleton",
      "ciPublished": false,
      "registryVerified": false,
      "provenance": "not_available_until_publish",
      "digestCounts": {
        "sha256": 0,
        "notPublished": 13,
        "invalid": 0
      },
      "matchesSource": true
    },
    "services": [
      {
        "serviceId": "hwlab-cloud-api",
        "commitId": "1a2efd4",
        "matchesSource": true,
        "image": "ghcr.io/pikastech/hwlab-cloud-api:1a2efd4",
        "imageTag": "1a2efd4",
        "digest": "not_published",
        "publishState": "skeleton-only"
      },
      {
        "serviceId": "hwlab-cloud-web",
        "commitId": "1a2efd4",
        "matchesSource": true,
        "image": "ghcr.io/pikastech/hwlab-cloud-web:1a2efd4",
        "imageTag": "1a2efd4",
        "digest": "not_published",
        "publishState": "skeleton-only"
      },
      {
        "serviceId": "hwlab-agent-mgr",
        "commitId": "1a2efd4",
        "matchesSource": true,
        "image": "ghcr.io/pikastech/hwlab-agent-mgr:1a2efd4",
        "imageTag": "1a2efd4",
        "digest": "not_published",
        "publishState": "skeleton-only"
      },
      {
        "serviceId": "hwlab-agent-worker",
        "commitId": "1a2efd4",
        "matchesSource": true,
        "image": "ghcr.io/pikastech/hwlab-agent-worker:1a2efd4",
        "imageTag": "1a2efd4",
        "digest": "not_published",
        "publishState": "skeleton-only"
      },
      {
        "serviceId": "hwlab-gateway",
        "commitId": "1a2efd4",
        "matchesSource": true,
        "image": "ghcr.io/pikastech/hwlab-gateway:1a2efd4",
        "imageTag": "1a2efd4",
        "digest": "not_published",
        "publishState": "skeleton-only"
      },
      {
        "serviceId": "hwlab-gateway-simu",
        "commitId": "1a2efd4",
        "matchesSource": true,
        "image": "ghcr.io/pikastech/hwlab-gateway-simu:1a2efd4",
        "imageTag": "1a2efd4",
        "digest": "not_published",
        "publishState": "skeleton-only"
      },
      {
        "serviceId": "hwlab-box-simu",
        "commitId": "1a2efd4",
        "matchesSource": true,
        "image": "ghcr.io/pikastech/hwlab-box-simu:1a2efd4",
        "imageTag": "1a2efd4",
        "digest": "not_published",
        "publishState": "skeleton-only"
      },
      {
        "serviceId": "hwlab-patch-panel",
        "commitId": "1a2efd4",
        "matchesSource": true,
        "image": "ghcr.io/pikastech/hwlab-patch-panel:1a2efd4",
        "imageTag": "1a2efd4",
        "digest": "not_published",
        "publishState": "skeleton-only"
      },
      {
        "serviceId": "hwlab-router",
        "commitId": "1a2efd4",
        "matchesSource": true,
        "image": "ghcr.io/pikastech/hwlab-router:1a2efd4",
        "imageTag": "1a2efd4",
        "digest": "not_published",
        "publishState": "skeleton-only"
      },
      {
        "serviceId": "hwlab-tunnel-client",
        "commitId": "1a2efd4",
        "matchesSource": true,
        "image": "ghcr.io/pikastech/hwlab-tunnel-client:1a2efd4",
        "imageTag": "1a2efd4",
        "digest": "not_published",
        "publishState": "skeleton-only"
      },
      {
        "serviceId": "hwlab-edge-proxy",
        "commitId": "1a2efd4",
        "matchesSource": true,
        "image": "ghcr.io/pikastech/hwlab-edge-proxy:1a2efd4",
        "imageTag": "1a2efd4",
        "digest": "not_published",
        "publishState": "skeleton-only"
      },
      {
        "serviceId": "hwlab-cli",
        "commitId": "1a2efd4",
        "matchesSource": true,
        "image": "ghcr.io/pikastech/hwlab-cli:1a2efd4",
        "imageTag": "1a2efd4",
        "digest": "not_published",
        "publishState": "skeleton-only"
      },
      {
        "serviceId": "hwlab-agent-skills",
        "commitId": "1a2efd4",
        "matchesSource": true,
        "image": "ghcr.io/pikastech/hwlab-agent-skills:1a2efd4",
        "imageTag": "1a2efd4",
        "digest": "not_published",
        "publishState": "skeleton-only"
      }
    ],
    "serviceCommitIds": [
      "1a2efd4"
    ],
    "matchesSource": true,
    "publishVerified": false,
    "refreshCommands": {
      "blocked": "node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --blocked",
      "published": "node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --publish-report reports/dev-gate/dev-artifacts.json"
    }
  },
  "conclusion": "blocked",
  "checks": [
    {
      "id": "source-contract-static",
      "category": "contract",
      "status": "pass",
      "summary": "Local deploy manifest and artifact catalog are internally consistent.",
      "evidence": []
    },
    {
      "id": "target-commit-pinning",
      "category": "contract",
      "status": "pass",
      "summary": "Source origin/main 1a2efd4 matches deploy/catalog artifact commit 1a2efd4.",
      "evidence": [
        {
          "source": {
            "ref": "origin/main",
            "commitId": "1a2efd4915b2d7a6f640a22cc22087e7cae4c654",
            "shortCommitId": "1a2efd4"
          },
          "deployManifest": {
            "path": "deploy/deploy.json",
            "commitId": "1a2efd4",
            "matchesSource": true
          },
          "artifactCatalog": {
            "path": "deploy/artifact-catalog.dev.json",
            "commitId": "1a2efd4",
            "artifactState": "contract-skeleton",
            "ciPublished": false,
            "registryVerified": false,
            "provenance": "not_available_until_publish",
            "digestCounts": {
              "sha256": 0,
              "notPublished": 13,
              "invalid": 0
            },
            "matchesSource": true
          },
          "services": [
            {
              "serviceId": "hwlab-cloud-api",
              "commitId": "1a2efd4",
              "matchesSource": true,
              "image": "ghcr.io/pikastech/hwlab-cloud-api:1a2efd4",
              "imageTag": "1a2efd4",
              "digest": "not_published",
              "publishState": "skeleton-only"
            },
            {
              "serviceId": "hwlab-cloud-web",
              "commitId": "1a2efd4",
              "matchesSource": true,
              "image": "ghcr.io/pikastech/hwlab-cloud-web:1a2efd4",
              "imageTag": "1a2efd4",
              "digest": "not_published",
              "publishState": "skeleton-only"
            },
            {
              "serviceId": "hwlab-agent-mgr",
              "commitId": "1a2efd4",
              "matchesSource": true,
              "image": "ghcr.io/pikastech/hwlab-agent-mgr:1a2efd4",
              "imageTag": "1a2efd4",
              "digest": "not_published",
              "publishState": "skeleton-only"
            },
            {
              "serviceId": "hwlab-agent-worker",
              "commitId": "1a2efd4",
              "matchesSource": true,
              "image": "ghcr.io/pikastech/hwlab-agent-worker:1a2efd4",
              "imageTag": "1a2efd4",
              "digest": "not_published",
              "publishState": "skeleton-only"
            },
            {
              "serviceId": "hwlab-gateway",
              "commitId": "1a2efd4",
              "matchesSource": true,
              "image": "ghcr.io/pikastech/hwlab-gateway:1a2efd4",
              "imageTag": "1a2efd4",
              "digest": "not_published",
              "publishState": "skeleton-only"
            },
            {
              "serviceId": "hwlab-gateway-simu",
              "commitId": "1a2efd4",
              "matchesSource": true,
              "image": "ghcr.io/pikastech/hwlab-gateway-simu:1a2efd4",
              "imageTag": "1a2efd4",
              "digest": "not_published",
              "publishState": "skeleton-only"
            },
            {
              "serviceId": "hwlab-box-simu",
              "commitId": "1a2efd4",
              "matchesSource": true,
              "image": "ghcr.io/pikastech/hwlab-box-simu:1a2efd4",
              "imageTag": "1a2efd4",
              "digest": "not_published",
              "publishState": "skeleton-only"
            },
            {
              "serviceId": "hwlab-patch-panel",
              "commitId": "1a2efd4",
              "matchesSource": true,
              "image": "ghcr.io/pikastech/hwlab-patch-panel:1a2efd4",
              "imageTag": "1a2efd4",
              "digest": "not_published",
              "publishState": "skeleton-only"
            },
            {
              "serviceId": "hwlab-router",
              "commitId": "1a2efd4",
              "matchesSource": true,
              "image": "ghcr.io/pikastech/hwlab-router:1a2efd4",
              "imageTag": "1a2efd4",
              "digest": "not_published",
              "publishState": "skeleton-only"
            },
            {
              "serviceId": "hwlab-tunnel-client",
              "commitId": "1a2efd4",
              "matchesSource": true,
              "image": "ghcr.io/pikastech/hwlab-tunnel-client:1a2efd4",
              "imageTag": "1a2efd4",
              "digest": "not_published",
              "publishState": "skeleton-only"
            },
            {
              "serviceId": "hwlab-edge-proxy",
              "commitId": "1a2efd4",
              "matchesSource": true,
              "image": "ghcr.io/pikastech/hwlab-edge-proxy:1a2efd4",
              "imageTag": "1a2efd4",
              "digest": "not_published",
              "publishState": "skeleton-only"
            },
            {
              "serviceId": "hwlab-cli",
              "commitId": "1a2efd4",
              "matchesSource": true,
              "image": "ghcr.io/pikastech/hwlab-cli:1a2efd4",
              "imageTag": "1a2efd4",
              "digest": "not_published",
              "publishState": "skeleton-only"
            },
            {
              "serviceId": "hwlab-agent-skills",
              "commitId": "1a2efd4",
              "matchesSource": true,
              "image": "ghcr.io/pikastech/hwlab-agent-skills:1a2efd4",
              "imageTag": "1a2efd4",
              "digest": "not_published",
              "publishState": "skeleton-only"
            }
          ],
          "serviceCommitIds": [
            "1a2efd4"
          ],
          "matchesSource": true,
          "publishVerified": false,
          "refreshCommands": {
            "blocked": "node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --blocked",
            "published": "node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --publish-report reports/dev-gate/dev-artifacts.json"
          }
        }
      ]
    },
    {
      "id": "artifact-catalog-publish-state",
      "category": "registry",
      "status": "blocked",
      "summary": "Artifact catalog publish state is contract-skeleton; ciPublished=false, registryVerified=false, digests sha256=0, not_published=13, invalid=0.",
      "evidence": [
        {
          "path": "deploy/artifact-catalog.dev.json",
          "commitId": "1a2efd4",
          "artifactState": "contract-skeleton",
          "ciPublished": false,
          "registryVerified": false,
          "provenance": "not_available_until_publish",
          "digestCounts": {
            "sha256": 0,
            "notPublished": 13,
            "invalid": 0
          },
          "matchesSource": true
        }
      ]
    },
    {
      "id": "k8s-manifest-static",
      "category": "k3s",
      "status": "pass",
      "summary": "DEV k3s manifest files parse and stay scoped to hwlab-dev.",
      "evidence": []
    },
    {
      "id": "cloud-api-db-env-contract",
      "category": "db",
      "status": "pass",
      "summary": "cloud-api DEV DB manifest declares the required env names and redacted Secret reference.",
      "evidence": [
        {
          "staticContract": {
            "contractVersion": "v1",
            "environment": "dev",
            "ready": true,
            "requiredEnv": [
              {
                "name": "HWLAB_CLOUD_DB_URL",
                "manifestPresent": true,
                "k8sPresent": true,
                "redacted": true,
                "source": "k8s-secret-ref",
                "secretRef": {
                  "secretName": "hwlab-cloud-api-dev-db",
                  "secretKey": "database-url",
                  "present": true,
                  "redacted": true
                }
              },
              {
                "name": "HWLAB_CLOUD_DB_SSL_MODE",
                "manifestPresent": true,
                "k8sPresent": true,
                "redacted": false,
                "source": "runtime-env",
                "secretRef": null
              }
            ],
            "missingDeployEnv": [],
            "missingK8sEnv": [],
            "missingSecretRefs": [],
            "secretMaterialRead": false,
            "valuesRedacted": true,
            "liveDbEvidence": false,
            "fixtureEvidence": false
          },
          "healthContract": {
            "status": "blocked",
            "ready": false,
            "configReady": false,
            "connected": false,
            "connectionChecked": false,
            "requiredEnv": [
              {
                "name": "HWLAB_CLOUD_DB_URL",
                "present": false,
                "redacted": true
              },
              {
                "name": "HWLAB_CLOUD_DB_SSL_MODE",
                "present": false,
                "redacted": false
              }
            ],
            "missingEnv": [
              "HWLAB_CLOUD_DB_URL",
              "HWLAB_CLOUD_DB_SSL_MODE"
            ],
            "secretRefs": [
              {
                "env": "HWLAB_CLOUD_DB_URL",
                "secretName": "hwlab-cloud-api-dev-db",
                "secretKey": "database-url",
                "present": false,
                "redacted": true
              }
            ],
            "liveDbEvidence": false,
            "fixtureEvidence": false
          },
          "fixtureEvidence": false,
          "liveDbEvidence": false
        }
      ]
    },
    {
      "id": "cloud-api-db-health-gate",
      "category": "db",
      "status": "blocked",
      "summary": "cloud-api DB health gate is missing HWLAB_CLOUD_DB_URL, HWLAB_CLOUD_DB_SSL_MODE.",
      "evidence": [
        {
          "staticContract": {
            "contractVersion": "v1",
            "environment": "dev",
            "ready": true,
            "requiredEnv": [
              {
                "name": "HWLAB_CLOUD_DB_URL",
                "manifestPresent": true,
                "k8sPresent": true,
                "redacted": true,
                "source": "k8s-secret-ref",
                "secretRef": {
                  "secretName": "hwlab-cloud-api-dev-db",
                  "secretKey": "database-url",
                  "present": true,
                  "redacted": true
                }
              },
              {
                "name": "HWLAB_CLOUD_DB_SSL_MODE",
                "manifestPresent": true,
                "k8sPresent": true,
                "redacted": false,
                "source": "runtime-env",
                "secretRef": null
              }
            ],
            "missingDeployEnv": [],
            "missingK8sEnv": [],
            "missingSecretRefs": [],
            "secretMaterialRead": false,
            "valuesRedacted": true,
            "liveDbEvidence": false,
            "fixtureEvidence": false
          },
          "healthContract": {
            "status": "blocked",
            "ready": false,
            "configReady": false,
            "connected": false,
            "connectionChecked": false,
            "requiredEnv": [
              {
                "name": "HWLAB_CLOUD_DB_URL",
                "present": false,
                "redacted": true
              },
              {
                "name": "HWLAB_CLOUD_DB_SSL_MODE",
                "present": false,
                "redacted": false
              }
            ],
            "missingEnv": [
              "HWLAB_CLOUD_DB_URL",
              "HWLAB_CLOUD_DB_SSL_MODE"
            ],
            "secretRefs": [
              {
                "env": "HWLAB_CLOUD_DB_URL",
                "secretName": "hwlab-cloud-api-dev-db",
                "secretKey": "database-url",
                "present": false,
                "redacted": true
              }
            ],
            "liveDbEvidence": false,
            "fixtureEvidence": false
          },
          "fixtureEvidence": false,
          "liveDbEvidence": false
        }
      ]
    },
    {
      "id": "dev-artifact-publish-report",
      "category": "registry",
      "status": "blocked",
      "summary": "DEV artifact publish report status is blocked with 0/13 published for source 70bb9168ead272ec1f77b752df8e178e70858df4.",
      "evidence": []
    },
    {
      "id": "dev-edge-health-report",
      "category": "edge",
      "status": "blocked",
      "summary": "Committed DEV edge health report is not_run with classification not_run.",
      "evidence": [
        {
          "report": "reports/dev-gate/dev-edge-health.json",
          "status": "not_run",
          "classification": "not_run",
          "publicTcp": [],
          "kubernetesObservable": false
        }
      ]
    },
    {
      "id": "frp-master-edge-static",
      "category": "edge",
      "status": "pass",
      "summary": "FRP and master-edge contracts describe D601-to-master DEV on port 6667.",
      "evidence": []
    },
    {
      "id": "runtime-substitution-boundary",
      "category": "safety",
      "status": "pass",
      "summary": "Deploy images do not point at UniDesk/provider-gateway/microservice-proxy substitutes.",
      "evidence": []
    },
    {
      "id": "d601-k3s-read-access",
      "category": "k3s",
      "status": "blocked",
      "summary": "kubectl is not installed in this runner, so hwlab-dev live cluster evidence cannot be collected.",
      "evidence": []
    },
    {
      "id": "public-dev-edge-health",
      "category": "edge",
      "status": "blocked",
      "summary": "Public DEV health endpoint did not respond successfully.",
      "evidence": [
        {
          "ok": false,
          "url": "http://74.48.78.17:6667/health/live",
          "method": "GET",
          "error": "fetch failed"
        }
      ]
    },
    {
      "id": "ghcr-anonymous-manifest-read",
      "category": "registry",
      "status": "blocked",
      "summary": "One or more catalog images could not be verified through anonymous GHCR manifest HEAD probes.",
      "evidence": [
        {
          "serviceId": "hwlab-cloud-api",
          "image": "ghcr.io/pikastech/hwlab-cloud-api:1a2efd4",
          "ok": false,
          "url": "https://ghcr.io/v2/pikastech/hwlab-cloud-api/manifests/1a2efd4",
          "method": "HEAD",
          "error": "This operation was aborted"
        },
        {
          "serviceId": "hwlab-cloud-web",
          "image": "ghcr.io/pikastech/hwlab-cloud-web:1a2efd4",
          "ok": false,
          "url": "https://ghcr.io/v2/pikastech/hwlab-cloud-web/manifests/1a2efd4",
          "method": "HEAD",
          "status": 401,
          "statusText": "Unauthorized",
          "body": ""
        },
        {
          "serviceId": "hwlab-agent-mgr",
          "image": "ghcr.io/pikastech/hwlab-agent-mgr:1a2efd4",
          "ok": false,
          "url": "https://ghcr.io/v2/pikastech/hwlab-agent-mgr/manifests/1a2efd4",
          "method": "HEAD",
          "status": 401,
          "statusText": "Unauthorized",
          "body": ""
        },
        {
          "serviceId": "hwlab-agent-worker",
          "image": "ghcr.io/pikastech/hwlab-agent-worker:1a2efd4",
          "ok": false,
          "url": "https://ghcr.io/v2/pikastech/hwlab-agent-worker/manifests/1a2efd4",
          "method": "HEAD",
          "status": 401,
          "statusText": "Unauthorized",
          "body": ""
        },
        {
          "serviceId": "hwlab-gateway",
          "image": "ghcr.io/pikastech/hwlab-gateway:1a2efd4",
          "ok": false,
          "url": "https://ghcr.io/v2/pikastech/hwlab-gateway/manifests/1a2efd4",
          "method": "HEAD",
          "status": 401,
          "statusText": "Unauthorized",
          "body": ""
        },
        {
          "serviceId": "hwlab-gateway-simu",
          "image": "ghcr.io/pikastech/hwlab-gateway-simu:1a2efd4",
          "ok": false,
          "url": "https://ghcr.io/v2/pikastech/hwlab-gateway-simu/manifests/1a2efd4",
          "method": "HEAD",
          "status": 401,
          "statusText": "Unauthorized",
          "body": ""
        },
        {
          "serviceId": "hwlab-box-simu",
          "image": "ghcr.io/pikastech/hwlab-box-simu:1a2efd4",
          "ok": false,
          "url": "https://ghcr.io/v2/pikastech/hwlab-box-simu/manifests/1a2efd4",
          "method": "HEAD",
          "status": 401,
          "statusText": "Unauthorized",
          "body": ""
        },
        {
          "serviceId": "hwlab-patch-panel",
          "image": "ghcr.io/pikastech/hwlab-patch-panel:1a2efd4",
          "ok": false,
          "url": "https://ghcr.io/v2/pikastech/hwlab-patch-panel/manifests/1a2efd4",
          "method": "HEAD",
          "status": 401,
          "statusText": "Unauthorized",
          "body": ""
        },
        {
          "serviceId": "hwlab-router",
          "image": "ghcr.io/pikastech/hwlab-router:1a2efd4",
          "ok": false,
          "url": "https://ghcr.io/v2/pikastech/hwlab-router/manifests/1a2efd4",
          "method": "HEAD",
          "status": 401,
          "statusText": "Unauthorized",
          "body": ""
        },
        {
          "serviceId": "hwlab-tunnel-client",
          "image": "ghcr.io/pikastech/hwlab-tunnel-client:1a2efd4",
          "ok": false,
          "url": "https://ghcr.io/v2/pikastech/hwlab-tunnel-client/manifests/1a2efd4",
          "method": "HEAD",
          "status": 401,
          "statusText": "Unauthorized",
          "body": ""
        },
        {
          "serviceId": "hwlab-edge-proxy",
          "image": "ghcr.io/pikastech/hwlab-edge-proxy:1a2efd4",
          "ok": false,
          "url": "https://ghcr.io/v2/pikastech/hwlab-edge-proxy/manifests/1a2efd4",
          "method": "HEAD",
          "status": 401,
          "statusText": "Unauthorized",
          "body": ""
        },
        {
          "serviceId": "hwlab-cli",
          "image": "ghcr.io/pikastech/hwlab-cli:1a2efd4",
          "ok": false,
          "url": "https://ghcr.io/v2/pikastech/hwlab-cli/manifests/1a2efd4",
          "method": "HEAD",
          "status": 401,
          "statusText": "Unauthorized",
          "body": ""
        },
        {
          "serviceId": "hwlab-agent-skills",
          "image": "ghcr.io/pikastech/hwlab-agent-skills:1a2efd4",
          "ok": false,
          "url": "https://ghcr.io/v2/pikastech/hwlab-agent-skills/manifests/1a2efd4",
          "method": "HEAD",
          "status": 401,
          "statusText": "Unauthorized",
          "body": ""
        }
      ]
    }
  ],
  "blockers": [
    {
      "status": "open",
      "type": "runtime_blocker",
      "scope": "artifact-catalog",
      "summary": "deploy/artifact-catalog.dev.json does not prove published artifacts for origin/main 1a2efd4; ciPublished=false, registryVerified=false, not_published=13.",
      "nextTask": "Run the DEV artifact publish workflow, then record only real sha256 digests with `node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --publish-report reports/dev-gate/dev-artifacts.json`; if publish is still blocked, keep not_published via `node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --blocked`."
    },
    {
      "status": "open",
      "type": "runtime_blocker",
      "scope": "cloud-api-db-health-gate",
      "summary": "cloud-api DB runtime env is not ready; missing HWLAB_CLOUD_DB_URL, HWLAB_CLOUD_DB_SSL_MODE.",
      "nextTask": "Configure DEV hwlab-cloud-api with Secret hwlab-cloud-api-dev-db/database-url and HWLAB_CLOUD_DB_SSL_MODE=require, then rerun health/preflight without printing the secret value."
    },
    {
      "status": "open",
      "type": "runtime_blocker",
      "scope": "dev-artifact-publish",
      "summary": "reports/dev-gate/dev-artifacts.json does not prove all HWLAB service artifacts for origin/main 1a2efd4; current status is blocked with 0/13 published.",
      "nextTask": "Complete DEV artifact publishing for every frozen HWLAB service at the current origin/main commit and record immutable registry digests."
    },
    {
      "status": "open",
      "type": "network_blocker",
      "scope": "dev-edge-health",
      "summary": "live network probes require --live",
      "nextTask": "Repair the master frps/public DEV edge route and rerun the read-only DEV edge health smoke before real deployment."
    },
    {
      "status": "open",
      "type": "environment_blocker",
      "scope": "d601-k3s",
      "summary": "D601 runner lacks kubectl and no default kubeconfig was used by this preflight.",
      "nextTask": "Provide a read-only kubectl/kubeconfig path for the real D601 hwlab-dev k3s cluster, then rerun this preflight."
    },
    {
      "status": "open",
      "type": "network_blocker",
      "scope": "dev-edge",
      "summary": "http://74.48.78.17:6667/health/live is not reachable from this runner.",
      "nextTask": "Bring up or repair the D601-to-master frp route and hwlab-edge-proxy, then rerun the health probe."
    },
    {
      "status": "open",
      "type": "runtime_blocker",
      "scope": "ghcr",
      "summary": "This preflight could not verify GHCR manifests for the DEV catalog images without reading credentials.",
      "nextTask": "Publish public DEV images or provide a non-secret registry evidence artifact with immutable digests for each HWLAB service."
    }
  ],
  "notes": "No PROD action, secret read, UniDesk runtime substitution, heavy e2e, browser e2e, runtime restart, or force push was performed."
}