pikasTech-HWLAB/docs/runtime-boundary-guard.md

HWLAB Runtime Boundary Guard

The HWLAB runtime may use UniDesk CI/CD infrastructure and Code Queue scheduling, but it must not use UniDesk backend, provider-gateway, or microservice proxy as replacement runtime services. Those systems are external supporting infrastructure only.

This guard is intentionally static. It reads repository files and does not contact the DEV endpoint, deploy to DEV or PROD, read secrets, or restart any UniDesk or HWLAB runtime process.

Boundary Rule

• HWLAB runtime service identity is the frozen hwlab-* service ID set.
• DEV is the only accepted runtime environment for this guard.
• The fixed DEV endpoint is http://74.48.78.17:16667.
• The DEV namespace is hwlab-dev.
• PROD deployment and PROD acceptance remain disabled.
• UniDesk backend, provider-gateway, and microservice proxy are forbidden runtime substitutes.

UniDesk may remain in the control-plane path for CI, CD, and Code Queue scheduling. It must not terminate HWLAB health, API, gateway, router, tunnel, agent, simulator, patch-panel, CLI, or skills runtime contracts on behalf of HWLAB.

Checked Artifacts

The machine-readable fixture is protocol/examples/runtime-boundary/guard.dev.json. It records the expected DEV-only boundary, frozen service IDs, forbidden substitutes, and paths checked by scripts/validate-runtime-boundary.mjs.

The validator checks:

• deploy/deploy.json keeps environment: dev, hwlab-dev, the fixed DEV endpoint, the complete HWLAB service set, HWLAB image names, and a disabled PROD profile.
• deploy/master-edge/health-contract.json keeps the frp D601-to-master reverse link, HWLAB contract service IDs, and the forbidden substitute list.
• deploy/k8s/base/workloads.yaml keeps workload names, labels, container names, and images under HWLAB service IDs.
• deploy/k8s/base/services.yaml keeps Kubernetes service names and labels under HWLAB service IDs.
• deploy/k8s/dev/* keeps the DEV overlay and runtime substitute policy.
• deploy/k8s/prod/* keeps PROD as a disabled placeholder only.

Validation

Run:

node --check scripts/validate-runtime-boundary.mjs
node scripts/validate-runtime-boundary.mjs

The script is lightweight and has no package dependency. It fails if a checked artifact drifts toward a UniDesk runtime substitute, a non-DEV environment, an unexpected namespace, an unexpected endpoint, or an incomplete HWLAB service boundary.