HWLAB Code Queue
135 lines
6.1 KiB
Markdown
135 lines
6.1 KiB
Markdown
# DEV Evidence / Blocker Aggregator
|
|
|
|
This is the lightweight report-only entry point for `pikasTech/HWLAB#41` and
|
|
the M5 DEV gate aggregator v2 for `pikasTech/HWLAB#58`. It helps a commander
|
|
decide whether the DEV acceptance path is green, blocked, or ready for another
|
|
repair round across `#33-#39`, `#46`, `#7`, and the MVP DoD in `#9`.
|
|
|
|
Run from the repository root:
|
|
|
|
```sh
|
|
node scripts/dev-evidence-blocker-aggregator.mjs --pretty
|
|
```
|
|
|
|
For a short validation response:
|
|
|
|
```sh
|
|
node scripts/dev-evidence-blocker-aggregator.mjs --check
|
|
```
|
|
|
|
To refresh the committed v2 machine and human reports:
|
|
|
|
```sh
|
|
node scripts/dev-evidence-blocker-aggregator.mjs --write-report
|
|
```
|
|
|
|
The generated files are:
|
|
|
|
- `reports/dev-gate/dev-m5-gate-aggregator-v2.json`
|
|
- `reports/dev-gate/dev-m5-gate-aggregator-v2.md`
|
|
|
|
## Source Levels
|
|
|
|
The aggregator keeps evidence levels separate so fixture output cannot be
|
|
promoted to live DEV evidence:
|
|
|
|
| Level | Meaning |
|
|
| --- | --- |
|
|
| `SOURCE` | Repository contracts, schemas, docs, manifests, or examples. |
|
|
| `LOCAL` | Localhost or in-process smoke results only. |
|
|
| `DRY-RUN` | Fixture-backed or no-mutation dry-run readiness evidence. |
|
|
| `DEV-LIVE` | Read-only evidence observed from the real DEV route; this may prove entrypoint reachability without proving downstream DB, M3, M4, or M5 acceptance. |
|
|
| `BLOCKED` | Missing issue reads, missing DEV evidence, missing artifacts, or other open blockers. |
|
|
|
|
## Current DEV Layering
|
|
|
|
The v2 report exposes `currentDevLayering` so the public route can be green
|
|
without promoting the full gate:
|
|
|
|
| Layer | Meaning |
|
|
| --- | --- |
|
|
| `Frontend DEV revision` | Latest accepted Cloud Workbench frontend revision on the active `http://74.48.78.17:16666/` browser endpoint. Frontend revision evidence is browser-only and cannot green DB, M3, M4, or M5. |
|
|
| `EDGE/ROUTE live` | `16666` browser and `16667` health route evidence from read-only probes. |
|
|
| `DB live/degraded` | Cloud API DB readiness from redacted health evidence; route success does not imply DB live. |
|
|
| `M3 hardware trusted loop` | Real DEV `res_boxsimu_1:DO1 -> hwlab-patch-panel -> res_boxsimu_2:DI1` plus operation, trace, audit, and evidence identifiers. |
|
|
| `M4 agent loop` | Agent loop live preflight and scheduling/evidence closure, gated by DB and runtime readiness. |
|
|
| `artifact/desired-state source` | Artifact source coverage for the current target ref plus desired-state dry-run/apply status. |
|
|
|
|
The report also emits `activeEndpoints` and `deprecatedEndpoints`. Active
|
|
acceptance endpoints are:
|
|
|
|
- frontend/browser: `http://74.48.78.17:16666/`
|
|
- API/live: `http://74.48.78.17:16667/health/live`
|
|
|
|
Legacy public `http://74.48.78.17:6666` and
|
|
`http://74.48.78.17:6667` are historical/deprecated only and are not active
|
|
green evidence.
|
|
|
|
`latestFrontendDevFact` records the current #99/#108 frontend fact: revision
|
|
`1e8805664970839b72be40c34636b08f6d18b131` is accepted on DEV, with
|
|
`promotesM3M4M5=false`.
|
|
|
|
## Current Contract Map
|
|
|
|
| Milestone | Current visible level | Contract entry |
|
|
| --- | --- | --- |
|
|
| M0 | `SOURCE` | `docs/m0-contract-audit.md`, protocol schemas, evidence chain examples, M0 validator. |
|
|
| M1 | `LOCAL` | `docs/m1-local-smoke.md`, `fixtures/mvp/runtime.json`, `scripts/m1-contract-smoke.mjs`. |
|
|
| M2 | `DEV-LIVE` for frontend/route only | DEV deploy smoke fixture plus active read-only `16666`/`16667` endpoint smoke and accepted frontend revision. |
|
|
| M3 | `BLOCKED` | Hardware trusted loop topology fixture and local patch-panel smoke exist, but DEV-LIVE operation/trace/audit/evidence IDs are missing. |
|
|
| M4 | `BLOCKED` | Agent automation loop fixture and local smoke exist, but live preflight is blocked at DB live readiness. |
|
|
| M5 | `BLOCKED` | MVP e2e dry-run plan is green, but bounded DEV-LIVE acceptance is blocked by DB/M3/M4 and source/artifact coverage. |
|
|
|
|
`milestoneLevelClassification` is the compact M0-M5 answer for command
|
|
handoff. `milestoneBlockerClassification` gives the M3/M4/M5 blocker class,
|
|
dependency, and required next proof.
|
|
|
|
## Blocker Posture
|
|
|
|
The v2 report reads committed report fixtures only:
|
|
|
|
- `reports/dev-gate/dev-preflight-report.json`
|
|
- `reports/dev-gate/dev-deploy-report.json`
|
|
- `reports/dev-gate/dev-artifacts.json`
|
|
- `reports/dev-gate/dev-edge-health.json`
|
|
- `reports/dev-gate/dev-m2-deploy-smoke-active.json`
|
|
- `reports/dev-gate/dev-m3-hardware-loop.json`
|
|
- `reports/dev-gate/dev-m4-agent-loop.json`
|
|
- `reports/dev-gate/dev-mvp-gate-report.json`
|
|
- `reports/d601-k3s-readonly-observability.json`
|
|
|
|
The report remains blocked until real DEV-LIVE evidence is attached for the
|
|
required downstream HWLAB runtime services. Public route evidence on
|
|
`16666/16667` is necessary but not sufficient: DB live readiness, M3 trusted
|
|
loop evidence, M4 agent-loop evidence, and artifact/desired-state source
|
|
coverage stay separate.
|
|
|
|
The legacy base-image blocker is not current when the committed reports show an
|
|
approved Node 20 builder base. Artifact/current remains stricter: a target ref
|
|
can still keep `artifact-source-commit` or `dev-artifact-publish` open when it
|
|
changes artifact build inputs after the publish source commit, even if the
|
|
older DEV artifact report contains 13/13 published service digests. Registry
|
|
manifest reachability remains separate and belongs to the #66
|
|
process/Docker/k3s access dimensions.
|
|
|
|
## Next-Round Order
|
|
|
|
The JSON output groups recommended next actions in dependency order:
|
|
|
|
1. `d601-k3s`, `kubectl`, kubeconfig/maintenance bridge: restore read-only
|
|
hwlab-dev cluster observability without printing Secrets.
|
|
2. `cloud-api-db`: prove DEV cloud-api DB env and health readiness with
|
|
redacted values only.
|
|
3. `dev-edge`, `dev-edge-health`, `dev-ingress-health`: repair
|
|
`:16667`/frp/edge/router reachability, then rerun read-only DEV edge health
|
|
before M3/M4/M5 live loops.
|
|
4. `registry-manifest-read`: resolve #66 registry reachability without
|
|
treating it as a missing publish digest or rerunning heavy publish.
|
|
|
|
## Boundaries
|
|
|
|
The aggregator does not deploy, call DEV, call PROD, run browser tests, run
|
|
heavy e2e, read secrets, restart services, or replace HWLAB runtime services
|
|
with UniDesk services. It is a local report generator and static contract
|
|
checker only.
|