Code Queue Review
136 lines
6.8 KiB
Markdown
136 lines
6.8 KiB
Markdown
# DEV Evidence / Blocker Aggregator
|
|
|
|
This is the lightweight report-only entry point for `pikasTech/HWLAB#41` and
|
|
the M5 DEV gate aggregator v2 for `pikasTech/HWLAB#58`. It helps a commander
|
|
decide whether the DEV acceptance path is green, blocked, or ready for another
|
|
repair round across `#33-#39`, `#46`, `#7`, and the MVP DoD in `#9`.
|
|
|
|
Run from the repository root:
|
|
|
|
```sh
|
|
node scripts/dev-evidence-blocker-aggregator.mjs --pretty
|
|
```
|
|
|
|
For a short validation response:
|
|
|
|
```sh
|
|
node scripts/dev-evidence-blocker-aggregator.mjs --check
|
|
```
|
|
|
|
To refresh the committed v2 machine and human reports:
|
|
|
|
```sh
|
|
node scripts/dev-evidence-blocker-aggregator.mjs --report /tmp/hwlab-dev-gate/report.json
|
|
```
|
|
|
|
The generated files are:
|
|
|
|
- `/tmp/hwlab-dev-gate/dev-m5-gate-aggregator-v2.json`
|
|
- `/tmp/hwlab-dev-gate/dev-m5-gate-aggregator-v2.md`
|
|
|
|
## Source Levels
|
|
|
|
The aggregator keeps evidence levels separate so fixture output cannot be
|
|
promoted to live DEV evidence:
|
|
|
|
| Level | Meaning |
|
|
| --- | --- |
|
|
| `SOURCE` | Repository contracts, schemas, docs, manifests, or examples. |
|
|
| `LOCAL` | Localhost or in-process smoke results only. |
|
|
| `DRY-RUN` | Fixture-backed or no-mutation dry-run readiness evidence. |
|
|
| `DEV-LIVE` | Read-only evidence observed from the real DEV route; this may prove entrypoint reachability without proving downstream DB, M3, M4, or M5 acceptance. |
|
|
| `BLOCKED` | Missing issue reads, missing DEV evidence, missing artifacts, or other open blockers. |
|
|
|
|
## Current DEV Layering
|
|
|
|
The v2 report exposes `currentDevLayering` so the public route can be green
|
|
without promoting the full gate:
|
|
|
|
| Layer | Meaning |
|
|
| --- | --- |
|
|
| `Frontend DEV revision` | Latest Cloud Workbench frontend revision visible on the active `http://74.48.78.17:16666/` browser endpoint. While API health or runtime durability is degraded, this may only be summarized as deployed UI usable in degraded/read-only mode; frontend evidence cannot green DB, M3, M4, or M5. |
|
|
| `EDGE/ROUTE live` | `16666` browser and `16667` health route evidence from read-only probes. |
|
|
| `DB live/degraded` | Cloud API DB readiness from redacted health evidence; route success and env presence do not imply DB live. A `dns_error`/`dns_resolution_failed` DB probe is a DB live blocker. |
|
|
| `Code Agent provider Secret` | #143 provider-backed chat readiness from redacted runtime error and Secret key-presence evidence only; missing provider Secret is independent from DB live. |
|
|
| `M3 hardware trusted loop` | Real DEV `res_boxsimu_1:DO1 -> hwlab-patch-panel -> res_boxsimu_2:DI1` plus operation, trace, audit, and evidence identifiers. |
|
|
| `M4 agent loop` | Agent loop live preflight and scheduling/evidence closure, gated by DB and runtime readiness. |
|
|
| `artifact/desired-state source` | Artifact source coverage for the current target ref plus desired-state dry-run/apply status. |
|
|
|
|
The report also emits `activeEndpoints` and `deprecatedEndpoints`. Active
|
|
acceptance endpoints are:
|
|
|
|
- frontend/browser: `http://74.48.78.17:16666/`
|
|
- API/live: `http://74.48.78.17:16667/health/live`
|
|
|
|
Legacy public `http://74.48.78.17:6666` and
|
|
`http://74.48.78.17:6667` are historical/deprecated only and are not active
|
|
green evidence.
|
|
|
|
`latestFrontendDevFact` records the current #99/#108 frontend visibility fact:
|
|
revision `1e8805664970839b72be40c34636b08f6d18b131` is visible on DEV in
|
|
degraded/read-only mode, with `promotesM3M4M5=false`.
|
|
|
|
## Current Contract Map
|
|
|
|
| Milestone | Current visible level | Contract entry |
|
|
| --- | --- | --- |
|
|
| M0 | `SOURCE` | `docs/m0-contract-audit.md`, protocol schemas, evidence chain examples, M0 validator. |
|
|
| M1 | `LOCAL` | `docs/m1-local-smoke.md`, `fixtures/mvp/runtime.json`, `scripts/m1-contract-smoke.mjs`. |
|
|
| M2 | `DEV-LIVE` for frontend/route only | DEV deploy smoke fixture plus active read-only `16666`/`16667` endpoint smoke and degraded/read-only frontend visibility. |
|
|
| M3 | `BLOCKED` | Hardware trusted loop topology fixture, local patch-panel smoke, and the no-write DEV plan exist, but DEV-LIVE operation/trace/audit/evidence IDs for `res_boxsimu_1:DO1 -> hwlab-patch-panel -> res_boxsimu_2:DI1` are missing. |
|
|
| M4 | `BLOCKED` | Agent automation loop fixture and local smoke exist, but live preflight is blocked at runtime durable adapter readiness and skills commit/version injection, not stale DB-live readiness. |
|
|
| M5 | `BLOCKED` | MVP e2e dry-run plan is green, but bounded DEV-LIVE acceptance is blocked by runtime durable adapter, skills injection, M3/M4, and source/artifact coverage. |
|
|
|
|
`milestoneLevelClassification` is the compact M0-M5 answer for command
|
|
handoff. `milestoneBlockerClassification` gives the M3/M4/M5 blocker class,
|
|
dependency, and required next proof.
|
|
|
|
## Blocker Posture
|
|
|
|
The v2 report reads committed report fixtures only:
|
|
|
|
- `/tmp/hwlab-dev-gate/dev-preflight-report.json`
|
|
- `/tmp/hwlab-dev-gate/dev-deploy-report.json`
|
|
- `/tmp/hwlab-dev-gate/dev-artifacts.json`
|
|
- `/tmp/hwlab-dev-gate/dev-edge-health.json`
|
|
- `/tmp/hwlab-dev-gate/dev-m2-deploy-smoke-active.json`
|
|
- `/tmp/hwlab-dev-gate/dev-m3-hardware-loop.json`
|
|
- `/tmp/hwlab-dev-gate/dev-m4-agent-loop.json`
|
|
- `GitHub issue/PR comments`
|
|
- `/tmp/hwlab-dev-gate/d601-k3s-readonly-observability.json`
|
|
|
|
The report remains blocked until real DEV-LIVE evidence is attached for the
|
|
required downstream HWLAB runtime services. Public route evidence on
|
|
`16666/16667` is necessary but not sufficient: DB live readiness, #143 Code
|
|
Agent provider Secret readiness, M3 trusted loop evidence, M4 agent-loop
|
|
evidence, and artifact/desired-state source coverage stay separate.
|
|
|
|
The legacy base-image blocker is not current when the committed reports show an
|
|
approved Node 20 builder base. Artifact/current remains stricter: a target ref
|
|
can still keep `artifact-source-commit` or `dev-artifact-publish` open when it
|
|
changes artifact build inputs after the publish source commit, even if the
|
|
older DEV artifact report contains 13/13 published service digests. Registry
|
|
manifest reachability remains separate and belongs to the #66
|
|
process/Docker/k3s access dimensions.
|
|
|
|
## Next-Round Order
|
|
|
|
The JSON output groups recommended next actions in dependency order:
|
|
|
|
1. `d601-k3s`, `kubectl`, kubeconfig/maintenance bridge: restore read-only
|
|
hwlab-dev cluster observability without printing Secrets.
|
|
2. `cloud-api-db`: prove DEV cloud-api DB env and health readiness with
|
|
redacted values only.
|
|
3. `dev-edge`, `dev-edge-health`, `dev-ingress-health`: repair
|
|
`:16667`/frp/edge/router reachability, then rerun read-only DEV edge health
|
|
before M3/M4/M5 live loops.
|
|
4. `registry-manifest-read`: resolve #66 registry reachability without
|
|
treating it as a missing publish digest or rerunning heavy publish.
|
|
|
|
## Boundaries
|
|
|
|
The aggregator does not deploy, call DEV, call PROD, run browser tests, run
|
|
heavy e2e, read secrets, restart services, or replace HWLAB runtime services
|
|
with UniDesk services. It is a local report generator and static contract
|
|
checker only.
|