pikasTech-HWLAB/reports/dev-gate/dev-m5-gate-aggregator-v2.md

HWLAB M5 DEV Gate Aggregator v2

Status: blocked Generated from: 1e9591a6611e Scope: DEV only, report-only

Summary

SOURCE, LOCAL, and DRY-RUN evidence exists, but DEV-LIVE acceptance is blocked by artifact, observability, DB, edge/frp, and loop evidence gaps.

Milestones

Milestone	Status	Highest visible level	Live evidence	Summary
M0	pass	SOURCE	missing_or_blocked	contract source is available; highest visible level is SOURCE; status is pass.
M1	pass	LOCAL	missing_or_blocked	local smoke is available; highest visible level is LOCAL; status is pass.
M2	blocked	DRY-RUN	missing_or_blocked	deploy/runtime readiness is blocked before live DEV; highest visible level is DRY-RUN; status is blocked.
M3	blocked	LOCAL	missing_or_blocked	hardware loop has source/local shape but no live operation; highest visible level is LOCAL; status is blocked.
M4	blocked	LOCAL	missing_or_blocked	agent loop has local smoke but live preflight is blocked; highest visible level is LOCAL; status is blocked.
M5	blocked	DRY-RUN	missing_or_blocked	dry-run is green but live MVP gate is blocked; highest visible level is DRY-RUN; status is blocked.

#9 DoD Checks

Check	Status	Evidence level	Summary
m0-source-contract	pass	SOURCE	M0 contract checks are source-level evidence only.
m1-local-smoke	pass	LOCAL	M1 local smoke is not a live DEV substitute.
artifact-publish-digests	blocked	BLOCKED	artifactState=contract-skeleton, ciPublished=false, registryVerified=false, sha256=0, not_published=13
d601-k3s-observability	blocked	BLOCKED	D601 runner lacks kubectl/k3s/kubeconfig observability for hwlab-dev.
dev-edge-frp-6667	blocked	BLOCKED	No committed report proves live HTTP 200/JSON on http://74.48.78.17:6667.
cloud-api-db-ready	blocked	BLOCKED	Manifest-level DB env exists, but live DB health readiness is still blocked/missing.
m5-mvp-dev-live	blocked	BLOCKED	M5 dry-run passed; bounded DEV-LIVE MVP e2e has not passed.

Blockers

Priority	Order	Type	Scope	Summary
P0	1	environment_blocker	base-image	HWLAB_DEV_BASE_IMAGE is not set and no approved local DEV builder base image was found in the Docker image cache; expected node:20-bookworm-slim or 127.0.0.1:5000/hwlab/hwlab-dev-base:node20-bookworm-slim.
P1	3	observability_blocker	artifact-publish	DEV artifact catalog has no CI publish, registry verification, or registry digests
P1	3	observability_blocker	artifact-source-commit	deploy/catalog artifact commit 24eb3bf/24eb3bf does not match source 9b47ebe49f70
P1	3	runtime_blocker	artifact-catalog	deploy/artifact-catalog.dev.json does not prove published artifacts for origin/main 1a2efd4; ciPublished=false, registryVerified=false, not_published=13.
P1	3	runtime_blocker	dev-artifact-publish	reports/dev-gate/dev-artifacts.json does not prove all HWLAB service artifacts for origin/main 1a2efd4; current status is blocked with 0/13 published.
P1	3	runtime_blocker	ghcr	This preflight could not verify GHCR manifests for the DEV catalog images without reading credentials.
P1	4	environment_blocker	d601-k3s-client-binary	Neither kubectl nor k3s is installed in this runner PATH.
P1	4	environment_blocker	d601-kubeconfig-path	No readable KUBECONFIG/default k3s kubeconfig path was found by metadata checks.
P1	4	environment_blocker	d601-maintenance-ssh-bridge	No SSH maintenance bridge was detected from ssh binary plus known environment variables or ~/.ssh/config metadata.
P1	4	environment_blocker	kubectl	kubectl is not installed in the runner
P1	4	environment_blocker	d601-k3s	D601 runner lacks kubectl and no default kubeconfig was used by this preflight.
P1	5	runtime_blocker	cloud-api-db	cloud-api health reports DB config blocked; missing HWLAB_CLOUD_DB_URL, HWLAB_CLOUD_DB_SSL_MODE
P1	5	runtime_blocker	cloud-api-db-health-gate	cloud-api DB runtime env is not ready; missing HWLAB_CLOUD_DB_URL, HWLAB_CLOUD_DB_SSL_MODE.
P2	6	network_blocker	dev-edge	http://74.48.78.17:6667/health/live is not reachable from this runner.
P2	6	network_blocker	dev-edge-health	live network probes require --live
P2	6	network_blocker	dev-ingress-health	Blocked at the #33 DEV runtime readiness condition: public DEV ingress does not accept HWLAB health requests, so #36/M3 hardware-loop checks were not reached.
P2	6	network_blocker	devPreconditions	connect ECONNREFUSED 74.48.78.17:6667
P2	6	network_blocker	devPreconditions	http://74.48.78.17:6667/health and /live both fail with curl exit 7; live DEV ingress evidence is missing.

Next Unblock Order

1. Preload node:20-bookworm-slim into the D601 Docker cache, or tag it as 127.0.0.1:5000/hwlab/hwlab-dev-base:node20-bookworm-slim. Set HWLAB_DEV_BASE_IMAGE=node:20-bookworm-slim or HWLAB_DEV_BASE_IMAGE=127.0.0.1:5000/hwlab/hwlab-dev-base:node20-bookworm-slim when invoking artifact publish. Rerun this preflight and require status=ready before #35 artifact publish. Do not use UniDesk runtime, Code Queue runner, backend-core, provider-gateway, or microservice-proxy images as substitutes. Evidence required: Base-image preflight status=ready with approved Node 20 builder base and no UniDesk/runtime substitute.
2. Publish DEV images from the intended commit and update the catalog with registry digests and verification evidence. Evidence required: Artifact publish report with ciPublished=true, registryVerified=true, and sha256 digest for each frozen service ID.
3. Install kubectl in the D601 Code Queue runner image, or mount an approved k3s kubectl client path for read-only hwlab-dev observation. Evidence required: Read-only kubectl/k3s report proving pods/services/configmaps are observable in hwlab-dev without reading Secrets.
4. Configure and verify the DEV cloud-api DB env readiness through health output, without reading secret values. Evidence required: Cloud API health/live output showing DB env ready and redacted secret references, without secret material.
5. Bring up or repair the D601-to-master frp route and hwlab-edge-proxy, then rerun the health probe. Evidence required: Read-only DEV route observation for :6667/frp/edge/router with HWLAB service identity and artifact identity.

Validation

• node --check scripts/dev-evidence-blocker-aggregator.mjs
• node --check scripts/src/dev-evidence-blocker-aggregator.mjs
• node scripts/dev-evidence-blocker-aggregator.mjs --check
• node scripts/dev-evidence-blocker-aggregator.mjs --markdown
• node --check scripts/validate-dev-gate-report.mjs
• node scripts/validate-dev-gate-report.mjs

Boundary

This report reads committed reports and fixtures only. It does not deploy, call DEV, call PROD, read secrets, restart runtime, run heavy e2e, or substitute UniDesk runtime for HWLAB runtime.