DEV Evidence / Blocker Aggregator

This is the lightweight report-only entry point for pikasTech/HWLAB#41 and the M5 DEV gate aggregator v2 for pikasTech/HWLAB#58. It helps a commander decide whether the DEV acceptance path is green, blocked, or ready for another repair round across #33-#39, #46, #7, and the MVP DoD in #9.

Run from the repository root:

node scripts/dev-evidence-blocker-aggregator.mjs --pretty

For a short validation response:

node scripts/dev-evidence-blocker-aggregator.mjs --check

To refresh the committed v2 machine and human reports:

node scripts/dev-evidence-blocker-aggregator.mjs --write-report

The generated files are:

reports/dev-gate/dev-m5-gate-aggregator-v2.json
reports/dev-gate/dev-m5-gate-aggregator-v2.md

Source Levels

The aggregator keeps evidence levels separate so fixture output cannot be promoted to live DEV evidence:

Level	Meaning
`SOURCE`	Repository contracts, schemas, docs, manifests, or examples.
`LOCAL`	Localhost or in-process smoke results only.
`DRY-RUN`	Fixture-backed or no-mutation dry-run readiness evidence.
`DEV-LIVE`	Read-only evidence observed from the real DEV route; this may prove entrypoint reachability without proving downstream DB, M3, M4, or M5 acceptance.
`BLOCKED`	Missing issue reads, missing DEV evidence, missing artifacts, or other open blockers.

Current DEV Layering

The v2 report exposes currentDevLayering so the public route can be green without promoting the full gate:

Layer	Meaning
`Frontend DEV revision`	Latest accepted Cloud Workbench frontend revision on the active `http://74.48.78.17:16666/` browser endpoint. Frontend revision evidence is browser-only and cannot green DB, M3, M4, or M5.
`EDGE/ROUTE live`	`16666` browser and `16667` health route evidence from read-only probes.
`DB live/degraded`	Cloud API DB readiness from redacted health evidence; route success does not imply DB live.
`M3 hardware trusted loop`	Real DEV `res_boxsimu_1:DO1 -> hwlab-patch-panel -> res_boxsimu_2:DI1` plus operation, trace, audit, and evidence identifiers.
`M4 agent loop`	Agent loop live preflight and scheduling/evidence closure, gated by DB and runtime readiness.
`artifact/desired-state source`	Artifact source coverage for the current target ref plus desired-state dry-run/apply status.

The report also emits activeEndpoints and deprecatedEndpoints. Active acceptance endpoints are:

frontend/browser: http://74.48.78.17:16666/
API/live: http://74.48.78.17:16667/health/live

Legacy public http://74.48.78.17:6666 and http://74.48.78.17:6667 are historical/deprecated only and are not active green evidence.

latestFrontendDevFact records the current #99/#108 frontend fact: revision 1e8805664970839b72be40c34636b08f6d18b131 is accepted on DEV, with promotesM3M4M5=false.

Current Contract Map

Milestone	Current visible level	Contract entry
M0	`SOURCE`	`docs/m0-contract-audit.md`, protocol schemas, evidence chain examples, M0 validator.
M1	`LOCAL`	`docs/m1-local-smoke.md`, `fixtures/mvp/runtime.json`, `scripts/m1-contract-smoke.mjs`.
M2	`DEV-LIVE` for frontend/route only	DEV deploy smoke fixture plus active read-only `16666`/`16667` endpoint smoke and accepted frontend revision.
M3	`BLOCKED`	Hardware trusted loop topology fixture and local patch-panel smoke exist, but DEV-LIVE operation/trace/audit/evidence IDs are missing.
M4	`BLOCKED`	Agent automation loop fixture and local smoke exist, but live preflight is blocked at DB live readiness.
M5	`BLOCKED`	MVP e2e dry-run plan is green, but bounded DEV-LIVE acceptance is blocked by DB/M3/M4 and source/artifact coverage.

milestoneLevelClassification is the compact M0-M5 answer for command handoff. milestoneBlockerClassification gives the M3/M4/M5 blocker class, dependency, and required next proof.

Blocker Posture

The v2 report reads committed report fixtures only:

reports/dev-gate/dev-preflight-report.json
reports/dev-gate/dev-deploy-report.json
reports/dev-gate/dev-artifacts.json
reports/dev-gate/dev-edge-health.json
reports/dev-gate/dev-m2-deploy-smoke-active.json
reports/dev-gate/dev-m3-hardware-loop.json
reports/dev-gate/dev-m4-agent-loop.json
reports/dev-gate/dev-mvp-gate-report.json
reports/d601-k3s-readonly-observability.json

The report remains blocked until real DEV-LIVE evidence is attached for the required downstream HWLAB runtime services. Public route evidence on 16666/16667 is necessary but not sufficient: DB live readiness, M3 trusted loop evidence, M4 agent-loop evidence, and artifact/desired-state source coverage stay separate.

The legacy base-image blocker is not current when the committed reports show an approved Node 20 builder base. Artifact/current remains stricter: a target ref can still keep artifact-source-commit or dev-artifact-publish open when it changes artifact build inputs after the publish source commit, even if the older DEV artifact report contains 13/13 published service digests. Registry manifest reachability remains separate and belongs to the #66 process/Docker/k3s access dimensions.

Next-Round Order

The JSON output groups recommended next actions in dependency order:

d601-k3s, kubectl, kubeconfig/maintenance bridge: restore read-only hwlab-dev cluster observability without printing Secrets.
cloud-api-db: prove DEV cloud-api DB env and health readiness with redacted values only.
dev-edge, dev-edge-health, dev-ingress-health: repair :16667/frp/edge/router reachability, then rerun read-only DEV edge health before M3/M4/M5 live loops.
registry-manifest-read: resolve #66 registry reachability without treating it as a missing publish digest or rerunning heavy publish.

Boundaries

The aggregator does not deploy, call DEV, call PROD, run browser tests, run heavy e2e, read secrets, restart services, or replace HWLAB runtime services with UniDesk services. It is a local report generator and static contract checker only.

6.1 KiB Raw Blame History