pikasTech-HWLAB/reports/dev-gate/dev-m5-gate-aggregator-v2.md

HWLAB M5 DEV Gate Aggregator v2

Status: blocked Generated from: 66586ccf109e Scope: DEV only, report-only Active frontend: http://74.48.78.17:16666/ Active API/live: http://74.48.78.17:16667/health/live Deprecated public endpoints: http://74.48.78.17:6666, http://74.48.78.17:6667

Summary

Frontend revision 1e88056649 is usable in degraded/read-only mode and EDGE/ROUTE DEV-LIVE evidence exists on :16666/:16667, but M5 remains blocked by artifact source drift, runtime durable adapter or skills injection readiness, missing M3 trusted loop operation evidence, and blocked M4 agent-loop preflight.

Frontend DEV Fact

The latest #99/#108 frontend DEV visibility fact is revision 1e8805664970839b72be40c34636b08f6d18b131 at http://74.48.78.17:16666/. It means the deployed UI is usable in degraded/read-only mode only; this is DEV-LIVE browser/frontend evidence and does not promote M3, M4, or M5.

Current DEV Layering

Layer	Status	Evidence level	Current conclusion	Required next proof
Frontend DEV revision	pass	DEV-LIVE	http://74.48.78.17:16666/ serves the Cloud Workbench frontend revision 1e8805664970839b72be40c34636b08f6d18b131; deployed UI is usable in degraded/read-only mode only and this is browser/frontend evidence only.	Keep frontend revision proof separate from DB live readiness, M3 hardware-loop evidence, M4 agent-loop evidence, and M5 acceptance.
EDGE/ROUTE live	pass	DEV-LIVE	http://74.48.78.17:16666/, http://74.48.78.17:16667/health, and http://74.48.78.17:16667/health/live returned observed HWLAB DEV route responses in the active M2 read-only smoke.	Keep this separated from DB readiness, M3/M4 loop evidence, and M5 acceptance.
DB live/degraded	pass	DEV-LIVE	cloud-api DB status=ok; configReady=true; ready=true; connected=true; endpointSource=secret-url-host; liveDbEvidence=true.	Provide live DB connection evidence through redacted health output; route reachability alone is insufficient.
Runtime durable adapter	blocked	BLOCKED	runtime adapter=postgres; durableRequested=true; durable=false; ready=false; blocker=runtime_durable_adapter_query_blocked; migration=0001_cloud_core_skeleton checked=false ready=false; queryResult=query_blocked.	Repair the postgres durable runtime adapter query/migration readiness and rerun health/M4 preflight without treating DB live as durability proof.
Agent skills injection	blocked	BLOCKED	DEV skills injection is incomplete: missing hwlab-agent-skills.HWLAB_SKILLS_VERSION, worker-dry-run.HWLAB_SKILL_VERSION_FROM_DEV.	Inject explicit skill commit and version into hwlab-agent-mgr, hwlab-agent-skills, and scheduled worker jobs before claiming M4/M5 agent evidence.
Code Agent provider	pass	DEV-LIVE	code-agent provider=openai-responses; status=available; ready=true.	Keep provider-backed Code Agent readiness separate from DB live and runtime durable adapter readiness.
D601 runner observability	blocked	DEV-LIVE	D601 public DEV endpoints are reachable, but the runner cannot read /etc/rancher/k3s/k3s.yaml; classify as #46 runner permission/mount or read-only observability gap, not D601 global offline. Alternate read-only cluster probes are readable. runnerKubeconfigReadable=false, runnerKubeconfigProbeExitCode=0, runnerKubeconfigProbeStderr=empty, d601PublicEndpointsReachable=true, d601K3sUnavailable=false.	Treat #46 runner kubeconfig/readonly gaps separately from D601 service health; rerun read-only observability after the mount or permission path is repaired.
M3 hardware trusted loop	blocked	BLOCKED	No live DEV operation was attempted because read-only direct target checks did not prove the required patch-panel-owned M3 route. Blocker: DEV exposes two box-simu endpoints, but live identities are not the required distinct resources res_boxsimu_1 and res_boxsimu_2; observed resources=res_boxsimu_1.	Only a real DEV res_boxsimu_1:DO1 -> hwlab-patch-panel -> res_boxsimu_2:DI1 observation with operation/trace/audit/evidence can clear M3.
M4 agent loop	blocked	BLOCKED	Blocked at runtime durable adapter readiness before scheduling a DEV agent task.	Do not schedule or claim the agent loop as live until DB live, runtime durable adapter, skills injection, and required evidence preconditions pass.
artifact/desired-state source	blocked	BLOCKED	artifact targetCovered=false; artifactSource=7e29522b65c8; target=f64182b54fe6; desiredApplyMode=dry-run; mutationAttempted=false.	Refresh artifact/source coverage for current origin/main and keep desired-state apply separate from read-only route proof.

M0-M5 Level Classification

Milestone	Current classification	Status	Strongest evidence	Live evidence	Summary
M0	SOURCE	pass	SOURCE	missing_or_blocked	Source contract is green at source level only.
M1	LOCAL	pass	LOCAL	missing_or_blocked	Local smoke is green; it is not DEV-LIVE.
M2	DEV-LIVE	blocked	DEV-LIVE	pass	Current public frontend/API route evidence is DEV-LIVE for route/front-end reachability only.
M3	BLOCKED	blocked	LOCAL	missing_or_blocked	DEV-LIVE hardware trusted loop is blocked; local/source shape is not acceptance.
M4	BLOCKED	blocked	DRY-RUN	missing_or_blocked	DEV-LIVE agent loop is blocked at runtime durable adapter or skills injection readiness; local smoke is not acceptance.
M5	BLOCKED	blocked	DRY-RUN	missing_or_blocked	Dry-run is green, but bounded DEV-LIVE MVP e2e is blocked.

Milestones

Milestone	Status	Highest visible level	Live evidence	Summary
M0	pass	SOURCE	missing_or_blocked	contract source is available; highest visible level is SOURCE; status is pass.
M1	pass	LOCAL	missing_or_blocked	local smoke is available; highest visible level is LOCAL; status is pass.
M2	blocked	DEV-LIVE	pass	deploy/runtime readiness is blocked before live DEV; highest visible level is DEV-LIVE; status is blocked.
M3	blocked	LOCAL	missing_or_blocked	hardware loop has source/local shape but no live operation; highest visible level is LOCAL; status is blocked.
M4	blocked	DRY-RUN	missing_or_blocked	agent loop has local smoke but live preflight is blocked; highest visible level is DRY-RUN; status is blocked.
M5	blocked	DRY-RUN	missing_or_blocked	dry-run is green but live MVP gate is blocked; highest visible level is DRY-RUN; status is blocked.

#9 DoD Checks

Check	Status	Evidence level	Summary
m0-source-contract	pass	SOURCE	M0 contract checks are source-level evidence only.
m1-local-smoke	pass	LOCAL	M1 local smoke is not a live DEV substitute.
artifact-publish-digests	blocked	BLOCKED	artifactState=contract-skeleton, ciPublished=false, registryVerified=false, sha256=0, not_published=13, targetCovered=false
d601-k3s-observability	blocked	DEV-LIVE	D601 public DEV endpoints are reachable, but the runner cannot read /etc/rancher/k3s/k3s.yaml; classify as #46 runner permission/mount or read-only observability gap, not D601 global offline. Alternate read-only cluster probes are readable. runnerKubeconfigReadable=false, runnerKubeconfigProbeExitCode=0, runnerKubeconfigProbeStderr=empty, d601PublicEndpointsReachable=true, d601K3sUnavailable=false.
dev-edge-frp-16667	pass	DEV-LIVE	Committed edge report proves read-only public HTTP on :16667 /health and /health/live; this is route evidence, not DB/M3/M4/M5 acceptance.
cloud-api-db-ready	pass	DEV-LIVE	cloud-api DB status=ok; ready=true; connected=true; endpointSource=secret-url-host; liveDbEvidence=true.
m3-hardware-trusted-loop	blocked	BLOCKED	M3 trusted loop is blocked until res_boxsimu_1:DO1 -> patch-panel -> res_boxsimu_2:DI1 is proven with operation/trace/audit/evidence.
m4-agent-loop-live	blocked	BLOCKED	M4 agent loop live path is blocked before accepted agent scheduling/evidence closure.
m5-mvp-dev-live	blocked	BLOCKED	M5 dry-run passed; bounded DEV-LIVE MVP e2e has not passed.

M3/M4/M5 Blocker Classification

Milestone	Status	Current level	Blocker class	Dependency	Required next proof
M3	blocked	BLOCKED	direct-target-identity-gap	Two distinct live box-simu resources and two distinct gateway-simu identities are required before M3 can run.	Fix DEV simulator instance identity so two box-simu pods report res_boxsimu_1/res_boxsimu_2 and two gateway-simu pods report distinct gateway identities.
M4	blocked	BLOCKED	runtime_durable_adapter_query_blocked	Cloud API /health/live must prove the postgres durable runtime adapter schema, 0001_cloud_core_skeleton migration ledger, and read-query readiness before live agent scheduling/evidence closure.	Repair the runtime durable adapter query/migration readiness and rerun the M4 live preflight without scheduling a DEV agent task before preconditions pass.
M5	blocked	BLOCKED	composite-runtime-durable-m3-m4-live	M5 needs DB live readiness, runtime durable adapter readiness, skills commit/version injection, M3 trusted-loop DEV evidence, M4 live preflight/evidence closure, and current source/artifact coverage.	After DB/runtime durable adapter/skills/M3/M4 blockers are cleared, run only the bounded DEV MVP live gate command with explicit DEV/non-PROD confirmations.

Blockers

Priority	Order	Type	Scope	Summary
P1	3	runtime_blocker	artifact-catalog	deploy/artifact-catalog.dev.json does not prove published artifacts for origin/main f64182b; ciPublished=false, registryVerified=false, not_published=13.
P1	3	contract_blocker	artifact-source-commit	source commit origin/main f64182b is not covered by artifact source 7e29522; target changes since the artifact source touch artifact build inputs.
P1	3	runtime_blocker	dev-artifact-publish	reports/dev-gate/dev-artifacts.json does not prove all required HWLAB service artifacts for origin/main f64182b; current status is published with 13/13 required services published and source states resolved: 13 source-present, 0 intentionally-disabled.
P1	4	observability_blocker	runner-kubeconfig-readonly-gap	The runner cannot read /etc/rancher/k3s/k3s.yaml; classify this as a runner permission/mount gap, not a D601 global outage. Alternate read-only cluster probes and public DEV endpoint probes are reported separately.
P1	5	agent_blocker	agent-mgr-health	hwlab-agent-mgr /health/live is degraded.
P1	5	runtime_blocker	runtime-durable-adapter	cloud-api durable runtime adapter is blocked: runtime_durable_adapter_query_blocked; adapter=postgres; durable=false; ready=false; migration=0001_cloud_core_skeleton checked=false ready=false missing=true; queryResult=query_blocked.
P1	5	agent_blocker	skills-commit-version-injection	DEV skills injection is incomplete: missing hwlab-agent-skills.HWLAB_SKILLS_VERSION, worker-dry-run.HWLAB_SKILL_VERSION_FROM_DEV.
P0	6	runtime_blocker	m3-box-simu-identity	DEV exposes two box-simu endpoints, but live identities are not the required distinct resources res_boxsimu_1 and res_boxsimu_2; observed resources=res_boxsimu_1.
P0	6	runtime_blocker	m3-gateway-simu-identity	DEV exposes two gateway-simu endpoints, but live gateway identities are not distinct; observed identities=gateway-a:gws_gateway-a.
P0	6	runtime_blocker	m3-patch-panel-wiring	DEV patch-panel is callable, but live wiring does not contain res_boxsimu_1:DO1 -> res_boxsimu_2:DI1; active=res_boxsim_alpha:uart0->res_boxsim_beta:uart0, res_boxsim_alpha:gpio0->res_boxsim_beta:gpio0; configured=res_boxsim_alpha:uart0->res_boxsim_beta:uart0, res_boxsim_alpha:gpio0->res_boxsim_beta:gpio0.
P0	6	runtime_blocker	m3-hardware-loop-runtime	Live M3 smoke reached DEV simulators, but patch-panel active DO1 -> DI1 connection is missing.
P3	99	safety_blocker	m3-live-write-authorization	Plan-only mode is intentionally non-mutating; run the bounded live smoke only after explicit DEV/non-PROD approval and after read-only preconditions identify the exact HWLAB targets.

Next Unblock Order

1. Run the DEV artifact publish workflow, then record only real sha256 digests with node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --publish-report reports/dev-gate/dev-artifacts.json; if publish is still blocked, keep not_published via node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --blocked. Evidence required: Artifact publish report with ciPublished=true, registryVerified=true, and sha256 digest for each frozen service ID.
2. Provide the approved read-only runner kubeconfig mount or document the intended alternate KUBECONFIG path, then rerun the read-only report. Evidence required: Read-only report with runnerKubeconfigReadable, runnerKubeconfigProbeExitCode/stderr, d601PublicEndpointsReachable, and d601K3sUnavailable recorded separately, plus direct M3 service target discovery before any DO write.
3. Inject explicit skills commit and version into agent manager, skills service, and worker jobs, then rerun the M4 read-only/live preflight. Evidence required: Read-only hwlab-agent-mgr/hwlab-agent-skills health plus worker dry-run manifest showing skillCommitId/skillVersion and HWLAB_SKILL_COMMIT_ID/HWLAB_SKILL_VERSION injected.
4. Fix DEV box-simu instance identity so direct endpoints expose distinct res_boxsimu_1 and res_boxsimu_2 resources. Evidence required: Read-only direct box-simu /health/live and /status output showing distinct res_boxsimu_1 and res_boxsimu_2 resources.
5. Resolve the blocker and attach source/local/dry-run/DEV-live evidence at the correct level. Evidence required: A committed report with the exact evidence level and command used.

Validation

• node --check scripts/dev-evidence-blocker-aggregator.mjs
• node --check scripts/src/dev-evidence-blocker-aggregator.mjs
• node scripts/dev-evidence-blocker-aggregator.mjs --check
• node scripts/dev-evidence-blocker-aggregator.mjs --markdown
• node --check scripts/validate-dev-gate-report.mjs
• node scripts/validate-dev-gate-report.mjs

Boundary

This report reads committed reports and fixtures only. It does not deploy, call DEV, call PROD, read secrets, restart runtime, run heavy e2e, or substitute UniDesk runtime for HWLAB runtime.