lyon
61 lines
2.4 KiB
Markdown
61 lines
2.4 KiB
Markdown
# HWLAB Runtime Boundary Guard
|
|
|
|
The HWLAB runtime may use UniDesk CI/CD infrastructure and Code Queue
|
|
scheduling, but it must not use UniDesk backend, provider-gateway, or
|
|
microservice proxy as replacement runtime services. Those systems are external
|
|
supporting infrastructure only.
|
|
|
|
This guard is intentionally static. It reads repository files and does not
|
|
contact the DEV endpoint, deploy to DEV or PROD, read secrets, or restart any
|
|
UniDesk or HWLAB runtime process.
|
|
|
|
## Boundary Rule
|
|
|
|
- HWLAB runtime service identity is the frozen `hwlab-*` service ID set.
|
|
- DEV is the only accepted runtime environment for this guard.
|
|
- The fixed DEV endpoint is `http://74.48.78.17:16667`.
|
|
- The DEV namespace is `hwlab-dev`.
|
|
- PROD deployment and PROD acceptance remain disabled.
|
|
- UniDesk backend, provider-gateway, and microservice proxy are forbidden
|
|
runtime substitutes.
|
|
|
|
UniDesk may remain in the control-plane path for CI, CD, and Code Queue
|
|
scheduling. It must not terminate HWLAB health, API, gateway, router, tunnel,
|
|
agent, simulator, patch-panel, CLI, or skills runtime contracts on behalf of
|
|
HWLAB.
|
|
|
|
## Checked Artifacts
|
|
|
|
The machine-readable fixture is
|
|
`protocol/examples/runtime-boundary/guard.dev.json`. It records the expected
|
|
DEV-only boundary, frozen service IDs, forbidden substitutes, and paths checked
|
|
by `scripts/validate-runtime-boundary.mjs`.
|
|
|
|
The validator checks:
|
|
|
|
- `deploy/deploy.json` keeps `environment: dev`, `hwlab-dev`, the fixed DEV
|
|
endpoint, the complete HWLAB service set, HWLAB image names, and a disabled
|
|
PROD profile.
|
|
- `deploy/master-edge/health-contract.json` keeps the `frp` D601-to-master
|
|
reverse link, HWLAB contract service IDs, and the forbidden substitute list.
|
|
- `deploy/k8s/base/workloads.yaml` keeps workload names, labels, container
|
|
names, and images under HWLAB service IDs.
|
|
- `deploy/k8s/base/services.yaml` keeps Kubernetes service names and labels
|
|
under HWLAB service IDs.
|
|
- `deploy/k8s/dev/*` keeps the DEV overlay and runtime substitute policy.
|
|
- `deploy/k8s/prod/*` keeps PROD as a disabled placeholder only.
|
|
|
|
## Validation
|
|
|
|
Run:
|
|
|
|
```sh
|
|
node --check scripts/validate-runtime-boundary.mjs
|
|
node scripts/validate-runtime-boundary.mjs
|
|
```
|
|
|
|
The script is lightweight and has no package dependency. It fails if a checked
|
|
artifact drifts toward a UniDesk runtime substitute, a non-DEV environment, an
|
|
unexpected namespace, an unexpected endpoint, or an incomplete HWLAB service
|
|
boundary.
|