pikasTech-HWLAB/reports/dev-gate/dev-m5-gate-aggregator-v2.md

HWLAB M5 DEV Gate Aggregator v2

Status: blocked Generated from: 96e802b2a22c Scope: DEV only, report-only Active frontend: http://74.48.78.17:16666/ Active API/live: http://74.48.78.17:16667/health/live Deprecated public endpoints: http://74.48.78.17:6666, http://74.48.78.17:6667

Summary

Frontend revision 1e88056649 is usable in degraded/read-only mode and EDGE/ROUTE DEV-LIVE evidence exists on :16666/:16667, but M5 remains blocked by artifact source drift, API/runtime durability degradation, missing M3 trusted loop operation evidence, and blocked M4 agent-loop preflight.

Frontend DEV Fact

The latest #99/#108 frontend DEV visibility fact is revision 1e8805664970839b72be40c34636b08f6d18b131 at http://74.48.78.17:16666/. It means the deployed UI is usable in degraded/read-only mode only; this is DEV-LIVE browser/frontend evidence and does not promote M3, M4, or M5.

Current DEV Layering

Layer	Status	Evidence level	Current conclusion	Required next proof
Frontend DEV revision	pass	DEV-LIVE	http://74.48.78.17:16666/ serves the Cloud Workbench frontend revision 1e8805664970839b72be40c34636b08f6d18b131; deployed UI is usable in degraded/read-only mode only and this is browser/frontend evidence only.	Keep frontend revision proof separate from DB live readiness, M3 hardware-loop evidence, M4 agent-loop evidence, and M5 acceptance.
EDGE/ROUTE live	pass	DEV-LIVE	http://74.48.78.17:16666/, http://74.48.78.17:16667/health, and http://74.48.78.17:16667/health/live returned observed HWLAB DEV route responses in the active M2 read-only smoke.	Keep this separated from DB readiness, M3/M4 loop evidence, and M5 acceptance.
DB live/degraded	blocked	BLOCKED	cloud-api DB status=degraded; configReady=true; ready=false; connected=false; endpointSource=unknown; liveDbEvidence=false.	Provide live DB connection evidence through redacted health output; route reachability alone is insufficient.
D601 runner observability	blocked	DEV-LIVE	D601 public DEV endpoints are reachable, but the runner cannot read /etc/rancher/k3s/k3s.yaml; classify as #46 runner permission/mount or read-only observability gap, not D601 global offline. Alternate read-only cluster probes are readable. runnerKubeconfigReadable=false, runnerKubeconfigProbeExitCode=0, runnerKubeconfigProbeStderr=empty, d601PublicEndpointsReachable=true, d601K3sUnavailable=false.	Treat #46 runner kubeconfig/readonly gaps separately from D601 service health; rerun read-only observability after the mount or permission path is repaired.
M3 hardware trusted loop	blocked	BLOCKED	No live DEV operation was attempted because read-only direct target checks did not prove the required patch-panel-owned M3 route. Blocker: DEV exposes two box-simu endpoints, but live identities are not the required distinct resources res_boxsimu_1 and res_boxsimu_2; observed resources=res_boxsimu_1.	Only a real DEV res_boxsimu_1:DO1 -> hwlab-patch-panel -> res_boxsimu_2:DI1 observation with operation/trace/audit/evidence can clear M3.
M4 agent loop	blocked	BLOCKED	Blocked at DB live readiness before scheduling a DEV agent task.	Do not schedule or claim the agent loop as live until DB live and required runtime/evidence preconditions pass.
artifact/desired-state source	blocked	BLOCKED	artifact targetCovered=false; artifactSource=7e29522b65c8; target=f64182b54fe6; desiredApplyMode=dry-run; mutationAttempted=false.	Refresh artifact/source coverage for current origin/main and keep desired-state apply separate from read-only route proof.

M0-M5 Level Classification

Milestone	Current classification	Status	Strongest evidence	Live evidence	Summary
M0	SOURCE	pass	SOURCE	missing_or_blocked	Source contract is green at source level only.
M1	LOCAL	pass	LOCAL	missing_or_blocked	Local smoke is green; it is not DEV-LIVE.
M2	DEV-LIVE	blocked	DEV-LIVE	pass	Current public frontend/API route evidence is DEV-LIVE for route/front-end reachability only.
M3	BLOCKED	blocked	LOCAL	missing_or_blocked	DEV-LIVE hardware trusted loop is blocked; local/source shape is not acceptance.
M4	BLOCKED	blocked	DRY-RUN	missing_or_blocked	DEV-LIVE agent loop is blocked at DB live readiness; local smoke is not acceptance.
M5	BLOCKED	blocked	DRY-RUN	missing_or_blocked	Dry-run is green, but bounded DEV-LIVE MVP e2e is blocked.

Milestones

Milestone	Status	Highest visible level	Live evidence	Summary
M0	pass	SOURCE	missing_or_blocked	contract source is available; highest visible level is SOURCE; status is pass.
M1	pass	LOCAL	missing_or_blocked	local smoke is available; highest visible level is LOCAL; status is pass.
M2	blocked	DEV-LIVE	pass	deploy/runtime readiness is blocked before live DEV; highest visible level is DEV-LIVE; status is blocked.
M3	blocked	LOCAL	missing_or_blocked	hardware loop has source/local shape but no live operation; highest visible level is LOCAL; status is blocked.
M4	blocked	DRY-RUN	missing_or_blocked	agent loop has local smoke but live preflight is blocked; highest visible level is DRY-RUN; status is blocked.
M5	blocked	DRY-RUN	missing_or_blocked	dry-run is green but live MVP gate is blocked; highest visible level is DRY-RUN; status is blocked.

#9 DoD Checks

Check	Status	Evidence level	Summary
m0-source-contract	pass	SOURCE	M0 contract checks are source-level evidence only.
m1-local-smoke	pass	LOCAL	M1 local smoke is not a live DEV substitute.
artifact-publish-digests	blocked	BLOCKED	artifactState=contract-skeleton, ciPublished=false, registryVerified=false, sha256=0, not_published=13, targetCovered=false
d601-k3s-observability	blocked	DEV-LIVE	D601 public DEV endpoints are reachable, but the runner cannot read /etc/rancher/k3s/k3s.yaml; classify as #46 runner permission/mount or read-only observability gap, not D601 global offline. Alternate read-only cluster probes are readable. runnerKubeconfigReadable=false, runnerKubeconfigProbeExitCode=0, runnerKubeconfigProbeStderr=empty, d601PublicEndpointsReachable=true, d601K3sUnavailable=false.
dev-edge-frp-16667	pass	DEV-LIVE	Committed edge report proves read-only public HTTP on :16667 /health and /health/live; this is route evidence, not DB/M3/M4/M5 acceptance.
cloud-api-db-ready	blocked	BLOCKED	cloud-api DB status=degraded; ready=false; connected=false; endpointSource=unknown; liveDbEvidence=false.
m3-hardware-trusted-loop	blocked	BLOCKED	M3 trusted loop is blocked until res_boxsimu_1:DO1 -> patch-panel -> res_boxsimu_2:DI1 is proven with operation/trace/audit/evidence.
m4-agent-loop-live	blocked	BLOCKED	M4 agent loop live path is blocked before accepted agent scheduling/evidence closure.
m5-mvp-dev-live	blocked	BLOCKED	M5 dry-run passed; bounded DEV-LIVE MVP e2e has not passed.

M3/M4/M5 Blocker Classification

Milestone	Status	Current level	Blocker class	Dependency	Required next proof
M3	blocked	BLOCKED	direct-target-identity-gap	Two distinct live box-simu resources and two distinct gateway-simu identities are required before M3 can run.	Fix DEV simulator instance identity so two box-simu pods report res_boxsimu_1/res_boxsimu_2 and two gateway-simu pods report distinct gateway identities.
M4	blocked	BLOCKED	db-live-readiness	Cloud API /health/live must report DB ready=true, connected=true, endpointSource=secret-url-host, and liveDbEvidence=true before live agent scheduling/evidence closure.	Repair DB live readiness and rerun the M4 live preflight without scheduling a DEV agent task before preconditions pass.
M5	blocked	BLOCKED	composite-db-m3-m4-live	M5 needs DB live readiness, M3 trusted-loop DEV evidence, M4 live preflight/evidence closure, and current source/artifact coverage.	After DB/M3/M4 blockers are cleared, run only the bounded DEV MVP live gate command with explicit DEV/non-PROD confirmations.

Blockers

Priority	Order	Type	Scope	Summary
P1	3	runtime_blocker	artifact-catalog	deploy/artifact-catalog.dev.json does not prove published artifacts for origin/main f64182b; ciPublished=false, registryVerified=false, not_published=13.
P1	3	contract_blocker	artifact-source-commit	source commit origin/main f64182b is not covered by artifact source 7e29522; target changes since the artifact source touch artifact build inputs.
P1	3	runtime_blocker	dev-artifact-publish	reports/dev-gate/dev-artifacts.json does not prove all required HWLAB service artifacts for origin/main f64182b; current status is published with 13/13 required services published and source states resolved: 13 source-present, 0 intentionally-disabled.
P1	4	observability_blocker	runner-kubeconfig-readonly-gap	The runner cannot read /etc/rancher/k3s/k3s.yaml; classify this as a runner permission/mount gap, not a D601 global outage. Alternate read-only cluster probes and public DEV endpoint probes are reported separately.
P1	5	runtime_blocker	cloud-api-db	DB endpoint DNS resolution failed from the cloud-api runtime
P1	5	network_blocker	cloud-api-db	DB endpoint DNS resolution failed from the cloud-api runtime
P1	5	runtime_blocker	cloud-api-db-health-gate	cloud-api DB runtime env is not ready; missing HWLAB_CLOUD_DB_URL, HWLAB_CLOUD_DB_SSL_MODE.
P1	5	runtime_blocker	db-live	cloud-api /health/live reports DB degraded; connected=false; ready=false.
P1	5	runtime_blocker	db-live	cloud-api /health/live reports DB degraded; db.ready=false, db.connected=false, and live DB evidence is not established.
P0	6	runtime_blocker	m3-box-simu-identity	DEV exposes two box-simu endpoints, but live identities are not the required distinct resources res_boxsimu_1 and res_boxsimu_2; observed resources=res_boxsimu_1.
P0	6	runtime_blocker	m3-gateway-simu-identity	DEV exposes two gateway-simu endpoints, but live gateway identities are not distinct; observed identities=gateway-a:gws_gateway-a.
P0	6	runtime_blocker	m3-patch-panel-wiring	DEV patch-panel is callable, but live wiring does not contain res_boxsimu_1:DO1 -> res_boxsimu_2:DI1; active=res_boxsim_alpha:uart0->res_boxsim_beta:uart0, res_boxsim_alpha:gpio0->res_boxsim_beta:gpio0; configured=res_boxsim_alpha:uart0->res_boxsim_beta:uart0, res_boxsim_alpha:gpio0->res_boxsim_beta:gpio0.
P0	6	runtime_blocker	m3-hardware-loop-runtime	Live M3 smoke reached DEV simulators, but patch-panel active DO1 -> DI1 connection is missing.
P3	99	agent_blocker	code-agent-provider-secret	Code Agent provider Secret hwlab-code-agent-provider/openai-api-key is not present as key-presence evidence; #143 real provider-backed chat remains blocked
P3	99	safety_blocker	m3-live-write-authorization	Plan-only mode is intentionally non-mutating; run the bounded live smoke only after explicit DEV/non-PROD approval and after read-only preconditions identify the exact HWLAB targets.
P3	99	agent_blocker	agent-mgr-health	hwlab-agent-mgr /health/live is degraded.
P3	99	agent_blocker	skills-commit-version-injection	DEV skills injection is incomplete: missing hwlab-agent-skills.HWLAB_SKILLS_VERSION, worker-dry-run.HWLAB_SKILL_VERSION_FROM_DEV.

Next Unblock Order

1. Run the DEV artifact publish workflow, then record only real sha256 digests with node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --publish-report reports/dev-gate/dev-artifacts.json; if publish is still blocked, keep not_published via node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --blocked. Evidence required: Artifact publish report with ciPublished=true, registryVerified=true, and sha256 digest for each frozen service ID.
2. Provide the approved read-only runner kubeconfig mount or document the intended alternate KUBECONFIG path, then rerun the read-only report. Evidence required: Read-only report with runnerKubeconfigReadable, runnerKubeconfigProbeExitCode/stderr, d601PublicEndpointsReachable, and d601K3sUnavailable recorded separately, plus direct M3 service target discovery before any DO write.
3. Deploy cloud-api DB runtime readiness probe and/or repair DEV DB connectivity, then rerun the read-only health smoke without reading or printing the DB secret value. Evidence required: Cloud API health/live output showing DB env ready, endpointSource=secret-url-host, redacted secret references, and no secret material.
4. Fix DEV box-simu instance identity so direct endpoints expose distinct res_boxsimu_1 and res_boxsimu_2 resources. Evidence required: Read-only direct box-simu /health/live and /status output showing distinct res_boxsimu_1 and res_boxsimu_2 resources.
5. Resolve the blocker and attach source/local/dry-run/DEV-live evidence at the correct level. Evidence required: A committed report with the exact evidence level and command used.

Validation

• node --check scripts/dev-evidence-blocker-aggregator.mjs
• node --check scripts/src/dev-evidence-blocker-aggregator.mjs
• node scripts/dev-evidence-blocker-aggregator.mjs --check
• node scripts/dev-evidence-blocker-aggregator.mjs --markdown
• node --check scripts/validate-dev-gate-report.mjs
• node scripts/validate-dev-gate-report.mjs

Boundary

This report reads committed reports and fixtures only. It does not deploy, call DEV, call PROD, read secrets, restart runtime, run heavy e2e, or substitute UniDesk runtime for HWLAB runtime.