pikasTech-HWLAB/reports/dev-gate/dev-m5-gate-aggregator-v2.md

HWLAB M5 DEV Gate Aggregator v2

Status: blocked Generated from: 8e89409dda5d Scope: DEV only, report-only

Summary

EDGE/ROUTE DEV-LIVE evidence exists on :16666/:16667, but M5 remains blocked by artifact source drift, DB live degradation, missing M3 trusted loop operation evidence, and blocked M4 agent-loop preflight.

Current DEV Layering

Layer	Status	Evidence level	Current conclusion	Required next proof
EDGE/ROUTE live	pass	DEV-LIVE	16666 browser, 16667 /health, and 16667 /health/live returned accepted HWLAB DEV responses in the active M2 read-only smoke.	Keep this separated from DB readiness, M3/M4 loop evidence, and M5 acceptance.
DB live/degraded	blocked	BLOCKED	cloud-api DB status=degraded; configReady=true; ready=false; connected=false; liveDbEvidence=false.	Provide live DB connection evidence through redacted health output; route reachability alone is insufficient.
M3 hardware trusted loop	blocked	BLOCKED	No live DEV operation has run yet. Blocker: patch-panel active DO1 -> DI1 connection missing.	Only a real DEV res_boxsimu_1:DO1 -> hwlab-patch-panel -> res_boxsimu_2:DI1 observation with operation/trace/audit/evidence can clear M3.
M4 agent loop	blocked	BLOCKED	Blocked at DB live readiness before scheduling a DEV agent task.	Do not schedule or claim the agent loop as live until DB live and required runtime/evidence preconditions pass.
artifact/desired-state source	blocked	BLOCKED	artifact targetCovered=false; artifactSource=7e29522b65c8; target=8e89409dda5d; desiredApplyMode=dry-run; mutationAttempted=false.	Refresh artifact/source coverage for current origin/main and keep desired-state apply separate from read-only route proof.

Milestones

Milestone	Status	Highest visible level	Live evidence	Summary
M0	pass	SOURCE	missing_or_blocked	contract source is available; highest visible level is SOURCE; status is pass.
M1	pass	LOCAL	missing_or_blocked	local smoke is available; highest visible level is LOCAL; status is pass.
M2	blocked	DEV-LIVE	pass	deploy/runtime readiness is blocked before live DEV; highest visible level is DEV-LIVE; status is blocked.
M3	blocked	LOCAL	missing_or_blocked	hardware loop has source/local shape but no live operation; highest visible level is LOCAL; status is blocked.
M4	blocked	LOCAL	missing_or_blocked	agent loop has local smoke but live preflight is blocked; highest visible level is LOCAL; status is blocked.
M5	blocked	DRY-RUN	missing_or_blocked	dry-run is green but live MVP gate is blocked; highest visible level is DRY-RUN; status is blocked.

#9 DoD Checks

Check	Status	Evidence level	Summary
m0-source-contract	pass	SOURCE	M0 contract checks are source-level evidence only.
m1-local-smoke	pass	LOCAL	M1 local smoke is not a live DEV substitute.
artifact-publish-digests	blocked	BLOCKED	artifactState=published, ciPublished=true, registryVerified=true, sha256=13, not_published=0, targetCovered=false
d601-k3s-observability	pass	DEV-LIVE	D601 hwlab-dev cluster was readable.
dev-edge-frp-16667	pass	DEV-LIVE	Committed edge report proves read-only public HTTP on :16667 /health and /health/live; this is route evidence, not DB/M3/M4/M5 acceptance.
cloud-api-db-ready	blocked	BLOCKED	cloud-api DB status=degraded; ready=false; connected=false; liveDbEvidence=false.
m3-hardware-trusted-loop	blocked	BLOCKED	M3 trusted loop is blocked until res_boxsimu_1:DO1 -> patch-panel -> res_boxsimu_2:DI1 is proven with operation/trace/audit/evidence.
m4-agent-loop-live	blocked	BLOCKED	M4 agent loop live path is blocked before accepted agent scheduling/evidence closure.
m5-mvp-dev-live	blocked	BLOCKED	M5 dry-run passed; bounded DEV-LIVE MVP e2e has not passed.

Blockers

Priority	Order	Type	Scope	Summary
P1	3	contract_blocker	artifact-source-commit	source commit origin/main 8e89409 is not covered by artifact source 7e29522; target changes since the artifact source touch artifact build inputs.
P1	3	runtime_blocker	dev-artifact-publish	reports/dev-gate/dev-artifacts.json does not prove all required HWLAB service artifacts for origin/main 8e89409; current status is published with 13/13 required services published and source states resolved: 13 source-present, 0 intentionally-disabled.
P1	5	runtime_blocker	cloud-api-db	cloud-api DB env is injected, but runtime health has not attempted a live DB connection
P1	5	network_blocker	cloud-api-db	cloud-api DB env is injected, but runtime health has not attempted a live DB connection
P1	5	runtime_blocker	cloud-api-db-health-gate	cloud-api DB runtime env is not ready; missing HWLAB_CLOUD_DB_URL, HWLAB_CLOUD_DB_SSL_MODE.
P1	5	runtime_blocker	db-live	cloud-api /health/live reports DB degraded; connected=false; ready=false.
P1	5	runtime_blocker	db-live	cloud-api /health/live reports DB degraded; db.ready=false, db.connected=false, and live DB evidence is not established.
P0	6	runtime_blocker	m3-hardware-loop-runtime	patch-panel active DO1 -> DI1 connection missing
P0	6	runtime_blocker	m3-hardware-loop-runtime	Live M3 smoke reached DEV simulators, but patch-panel active DO1 -> DI1 connection is missing.

Next Unblock Order

1. Refresh without fake digests using node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --blocked, or after a successful publish run node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --publish-report reports/dev-gate/dev-artifacts.json. Evidence required: Artifact publish report with ciPublished=true, registryVerified=true, and sha256 digest for each frozen service ID.
2. Deploy cloud-api DB runtime readiness probe and/or repair DEV DB connectivity, then rerun the read-only health smoke without reading or printing the DB secret value. Evidence required: Cloud API health/live output showing DB env ready and redacted secret references, without secret material.
3. Prove the real DEV M3 trusted loop res_boxsimu_1:DO1 -> hwlab-patch-panel -> res_boxsimu_2:DI1 with operation, trace, audit, and evidence identifiers. Evidence required: Operation, trace, audit, and evidence IDs from the real DEV DO1 -> patch-panel -> DI1 trusted loop.

Validation

• node --check scripts/dev-evidence-blocker-aggregator.mjs
• node --check scripts/src/dev-evidence-blocker-aggregator.mjs
• node scripts/dev-evidence-blocker-aggregator.mjs --check
• node scripts/dev-evidence-blocker-aggregator.mjs --markdown
• node --check scripts/validate-dev-gate-report.mjs
• node scripts/validate-dev-gate-report.mjs

Boundary

This report reads committed reports and fixtures only. It does not deploy, call DEV, call PROD, read secrets, restart runtime, run heavy e2e, or substitute UniDesk runtime for HWLAB runtime.