feat: add HWLAB fake echo provider

config/agentrun.yaml

@@ -834,6 +834,24 @@ controlPlane:
             key: model-catalog.json
           providerCredential:
             profile: dsflash-go
+        - id: provider-fake-echo-auth-json
+          sourceMode: file
+          sourceRef: agentrun/d518-v02-provider-fake-echo-auth.json
+          targetRef:
+            namespace: agentrun-v02
+            name: agentrun-v02-provider-fake-echo
+            key: auth.json
+          providerCredential:
+            profile: fake-echo
+        - id: provider-fake-echo-config
+          sourceMode: file
+          sourceRef: agentrun/d518-v02-provider-fake-echo-config.toml
+          targetRef:
+            namespace: agentrun-v02
+            name: agentrun-v02-provider-fake-echo
+            key: config.toml
+          providerCredential:
+            profile: fake-echo
         - id: tool-github-pr-token
           sourceRef: /root/.config/unidesk/github.env
           sourceKey: GH_TOKEN

config/hwlab-fake-model-provider/d518-v03/fake-echo.yaml

@@ -0,0 +1,18 @@
+version: 1
+kind: HwlabFakeModelProvider
+metadata:
+  id: d518-v03-fake-echo
+  owner: UniDesk
+  issue: 1190
+provider:
+  id: fake-echo
+  enabled: true
+  mode: responses-echo
+  target:
+    node: D518
+    lane: v03
+    agentrunLane: d518-v02
+  configRefs:
+    runtime: config/hwlab-fake-model-provider/runtime.d518-v03.yaml#provider.runtime
+    secrets: config/hwlab-fake-model-provider/secrets.d518-v03.yaml#provider.secrets
+    profile: config/hwlab-fake-model-provider/profile.fake-echo.d518-v03.yaml#provider.profile

config/hwlab-fake-model-provider/profile.fake-echo.d518-v03.yaml

@@ -0,0 +1,30 @@
+version: 1
+kind: HwlabFakeModelProviderProfile
+metadata:
+  id: d518-v03-fake-echo-profile
+  owner: UniDesk
+  issue: 1190
+provider:
+  profile:
+    name: fake-echo
+    agentrun:
+      node: D518
+      lane: d518-v02
+      configRef: config/agentrun.yaml#controlPlane.lanes.d518-v02
+    providerCredential:
+      namespace: agentrun-v02
+      secretName: agentrun-v02-provider-fake-echo
+      keys:
+        - auth.json
+        - config.toml
+      authJsonSourceRef: agentrun/d518-v02-provider-fake-echo-auth.json
+      configTomlSourceRef: agentrun/d518-v02-provider-fake-echo-config.toml
+    codexConfig:
+      model: fake-echo
+      modelProvider: fake
+      baseUrl: http://hwlab-fake-model-provider.agentrun-v02.svc.cluster.local:8080/v1
+      wireApi: responses
+      requiresOpenaiAuth: true
+      modelContextWindow: 4096
+      modelAutoCompactTokenLimit: 3500
+      modelSupportsReasoningSummaries: false

config/hwlab-fake-model-provider/runtime.d518-v03.yaml

@@ -0,0 +1,51 @@
+version: 1
+kind: HwlabFakeModelProviderRuntime
+metadata:
+  id: d518-v03-fake-model-provider-runtime
+  owner: UniDesk
+  issue: 1190
+provider:
+  runtime:
+    target:
+      node: D518
+      lane: v03
+      agentrunLane: d518-v02
+    namespace: agentrun-v02
+    serviceAccountName: default
+    deploymentName: hwlab-fake-model-provider
+    serviceName: hwlab-fake-model-provider
+    configMapName: hwlab-fake-model-provider-source
+    secretName: hwlab-fake-model-provider-api-key
+    containerName: fake-responses-provider
+    listenHost: 0.0.0.0
+    servicePort: 8080
+    healthPath: /healthz
+    modelsPath: /v1/models
+    responsesPath: /v1/responses
+    image:
+      mode: configmap-bun-entrypoint
+      imageRef: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
+      imagePullPolicy: IfNotPresent
+      containerfile: deploy/container/fake-responses-provider.Containerfile
+    source:
+      entrypoint: scripts/fake-responses-provider-service.ts
+      files:
+        - scripts/fake-responses-provider-service.ts
+        - scripts/src/fake-responses-provider-service.ts
+    config:
+      modelId: fake-echo
+      mode: echo
+      responseDelayMs: 0
+      nonEchoPolicy: error
+    resources:
+      requests:
+        cpu: 25m
+        memory: 64Mi
+      limits:
+        cpu: 250m
+        memory: 256Mi
+    probes:
+      initialDelaySeconds: 3
+      periodSeconds: 10
+      timeoutSeconds: 3
+      failureThreshold: 3

config/hwlab-fake-model-provider/secrets.d518-v03.yaml

@@ -0,0 +1,31 @@
+version: 1
+kind: HwlabFakeModelProviderSecrets
+metadata:
+  id: d518-v03-fake-model-provider-secrets
+  owner: UniDesk
+  issue: 1190
+provider:
+  secrets:
+    sources:
+      - purpose: provider-api-key
+        sourceRef: hwlab/fake-echo-provider.env
+        sourceKey: FAKE_ECHO_API_KEY
+        createIfMissing:
+          enabled: true
+          randomHexBytes: 24
+      - purpose: sentinel-prompts
+        sourceRef: hwlab/web-probe-sentinel-fake-echo.env
+        sourceKey: FAKE_ECHO_SENTINEL_PROMPTS_JSON
+        createIfMissing:
+          enabled: true
+    runtimeSecrets:
+      - name: hwlab-fake-model-provider-api-key
+        namespace: agentrun-v02
+        data:
+          - sourcePurpose: provider-api-key
+            targetKey: api-key
+      - name: hwlab-web-probe-sentinel-prompt-set
+        namespace: hwlab-v03
+        data:
+          - sourcePurpose: sentinel-prompts
+            targetKey: prompts.json

config/hwlab-node-lanes.yaml

@@ -654,9 +654,9 @@ lanes:
           prometheusOperator: false
           webProbe:
             sentinels:
-              - id: workbench-dsflash-go-tool-call-10x
+              - id: workbench-fake-echo-session-invariance-10x
                 enabled: true
-                configRef: config/hwlab-web-probe-sentinels/d518-v03/workbench-dsflash-go-tool-call-10x.yaml#sentinel
+                configRef: config/hwlab-web-probe-sentinels/d518-v03/workbench-fake-echo-session-invariance-10x.yaml#sentinel
         runtimeImageRewrites:
           - source: fatedier/frpc:v0.68.1
             target: 127.0.0.1:5000/hwlab/frpc:v0.68.1
@@ -691,7 +691,7 @@ lanes:
           opencodeSourceKey: OPENCODE_API_KEY
         codeAgentRuntime:
           enabled: true
-          adapter: agentrun-v01
+          adapter: agentrun-v02
           managerUrl: http://agentrun-mgr.agentrun-v02.svc.cluster.local:8080
           apiKeySecretName: hwlab-v03-master-server-admin-api-key
           apiKeySecretKey: api-key
@@ -699,7 +699,7 @@ lanes:
           secretNamespace: agentrun-v02
           repoUrlFrom: runtimeGitReadUrl
           providerIdFrom: runtimeNodeId
-          defaultProviderProfile: deepseek
+          defaultProviderProfile: fake-echo
         publicExposure:
           mode: pk01-caddy-frp
           publicBaseUrl: https://hwlab.pikapython.com

config/hwlab-web-probe-sentinel/cicd.fake-echo.d518-v03.yaml

@@ -0,0 +1,67 @@
+version: 1
+kind: HwlabWebProbeSentinelCicd
+metadata:
+  id: d518-v03-web-probe-sentinel-fake-echo-cicd
+  owner: UniDesk
+  specRef: PJ2026-01060508
+  issue: 1190
+sentinel:
+  cicd:
+    controlPlaneConfigRef: config/hwlab-node-control-plane.yaml#targets[1]
+    source:
+      repository: pikasTech/unidesk
+      branch: master
+      gitSshUrl: ssh://git@ssh.github.com:443/pikasTech/unidesk.git
+      gitMirrorReadUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/unidesk.git
+      buildContext: .
+      entrypoint: scripts/web-probe-sentinel-service.ts
+      checkoutPaths:
+        - scripts
+        - config
+        - config.json
+        - src
+        - package.json
+        - bun.lock
+        - bun.lockb
+    builder:
+      namespace: devops-infra
+      sourceMode: sparse-git-checkout
+      jobPrefix: web-probe-sentinel-publish
+      gitSshSecretName: git-mirror-github-ssh
+      dockerSocketPath: /var/run/docker.sock
+      activeDeadlineSeconds: 900
+      ttlSecondsAfterFinished: 3600
+    gitopsPath: deploy/gitops/node/d518/web-probe-sentinel
+    argo:
+      namespace: argocd
+      projectName: hwlab-d518
+      applicationName: hwlab-web-probe-sentinel
+      repoURL: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/HWLAB.git
+      targetRevision: v0.3-gitops
+    image:
+      repository: 127.0.0.1:5000/hwlab/web-probe-sentinel
+      tagSource: source-commit
+      baseImageRef: config/hwlab-node-control-plane.yaml#targets[1].tekton.toolsImage.output
+      envRecipeRef: config/hwlab-web-probe-sentinel/runtime.d518-v03.yaml#sentinel.runtime
+    maintenance:
+      startCommand: sentinel maintenance start
+      stopCommand: sentinel maintenance stop
+    monitorWeb:
+      frontendStack: vue3-vendored-browser-build
+      runtimeMode: runner-served-bridge
+      assetRoot: scripts/assets/web-probe-sentinel-monitor-web
+      envReuse:
+        mode: docker-layer-and-ci-node-deps
+        nodeDepsPath: /opt/hwlab-ci-node-deps/node_modules
+      gitMirror:
+        source: source.gitMirrorReadUrl
+        preSync: required
+        postFlush: required
+      ciBudget:
+        maxSeconds: 120
+    confirmWait:
+      maxSeconds: 120
+    targetValidation:
+      scenarioId: workbench-fake-echo-session-invariance-10x
+      maxSeconds: 300
+      serviceUnavailablePolicy: structured-failure

config/hwlab-web-probe-sentinel/prompt-set.fake-echo.yaml

@@ -0,0 +1,27 @@
+version: 1
+kind: HwlabWebProbeSentinelPromptSet
+metadata:
+  id: d518-v03-web-probe-sentinel-fake-echo-prompt-set
+  owner: UniDesk
+  specRef: PJ2026-01060508
+  issue: 1190
+sentinel:
+  promptSet:
+    id: fake-echo-session-invariance-10x
+    providerProfile: fake-echo
+    providerProfileMode: exact
+    promptSourceRef: hwlab/web-probe-sentinel-fake-echo.env
+    promptSourceKey: FAKE_ECHO_SENTINEL_PROMPTS_JSON
+    promptCount: 10
+    expectedMarkers:
+      - sentinel-01
+      - sentinel-02
+      - sentinel-03
+      - sentinel-04
+      - sentinel-05
+      - sentinel-06
+      - sentinel-07
+      - sentinel-08
+      - sentinel-09
+      - sentinel-10
+    redaction: hash-and-byte-count

config/hwlab-web-probe-sentinel/public-exposure.fake-echo.d518-v03.yaml

@@ -0,0 +1,38 @@
+version: 1
+kind: HwlabWebProbeSentinelPublicExposure
+metadata:
+  id: d518-v03-web-probe-sentinel-fake-echo-public-exposure
+  owner: UniDesk
+  specRef: PJ2026-01060508
+  issue: 1190
+sentinel:
+  publicExposure:
+    enabled: true
+    mode: pk01-caddy-frp
+    publicBaseUrl: https://monitor.pikapython.com/sentinels/d518-workbench-fake-echo-session-invariance-10x
+    hostname: monitor.pikapython.com
+    routePrefix: /sentinels/d518-workbench-fake-echo-session-invariance-10x
+    expectedA: 82.156.23.220
+    frpc:
+      deploymentName: hwlab-web-probe-sentinel-frpc
+      image: 127.0.0.1:5000/hwlab/frpc:v0.68.1
+      serverAddr: 82.156.23.220
+      serverPort: 22000
+      tokenSourceRef: platform-infra/pk01-frp.env
+      tokenSourceKey: FRP_TOKEN
+      secretName: hwlab-web-probe-sentinel-frpc
+      secretKey: frpc.toml
+      tokenKey: token
+      httpProxy:
+        name: hwlab-d518-v03-web-probe-sentinel
+        remotePort: 22093
+        localIP: hwlab-web-probe-sentinel.hwlab-v03.svc.cluster.local
+        localPort: 8080
+    caddy:
+      route: PK01
+      configPath: /etc/caddy/Caddyfile
+      serviceName: caddy
+      email: ops@pikapython.com
+      tls: auto
+      responseHeaderTimeoutSeconds: 600
+      managedBlockOwner: hwlab-web-probe-sentinel-d518-v03

config/hwlab-web-probe-sentinel/scenarios.fake-echo.workbench.yaml

@@ -0,0 +1,58 @@
+version: 1
+kind: HwlabWebProbeSentinelScenarios
+metadata:
+  id: d518-v03-web-probe-sentinel-fake-echo-scenarios
+  owner: UniDesk
+  specRef: PJ2026-01060508
+  issue: 1190
+sentinel:
+  scenarios:
+    - id: workbench-fake-echo-session-invariance-10x
+      enabled: true
+      cadence: 10m
+      observeTargetPath: /workbench
+      sampleIntervalMs: 1000
+      screenshotIntervalMs: 60000
+      maxRunSeconds: 1200
+      providerProfile: fake-echo
+      providerProfileMode: exact
+      promptSetRef: config/hwlab-web-probe-sentinel/prompt-set.fake-echo.yaml#sentinel.promptSet
+      reportViewRef: config/hwlab-web-probe-sentinel/report-views.yaml#sentinel.reportViews
+      commandSequence:
+        - type: newSession
+        - type: selectProvider
+          provider: fake-echo
+        - type: sendPrompt
+          promptSource: promptSet
+          repeat: 10
+      sessionInvarianceChecks:
+        - id: after-round-1-navigation-invariance
+          afterRound: 1
+          refreshCurrent: true
+          switchAwayAndBack: true
+          alternateSessionStrategy: existing-or-create
+          assertSessionInvariant: true
+          expectedSentinelRange: sentinel-01..sentinel-01
+          findingId: workbench-message-order-user-clustered-after-navigation
+          severity: amber
+          blocking: false
+        - id: after-round-5-navigation-invariance
+          afterRound: 5
+          refreshCurrent: true
+          switchAwayAndBack: true
+          alternateSessionStrategy: existing-or-create
+          assertSessionInvariant: true
+          requireComposerReady: true
+          expectedSentinelRange: sentinel-01..sentinel-05
+          findingId: workbench-message-order-user-clustered-after-navigation
+          severity: amber
+          blocking: false
+        - id: after-round-10-refresh-invariance
+          afterRound: 10
+          refreshCurrent: true
+          switchAwayAndBack: false
+          assertSessionInvariant: true
+          expectedSentinelRange: sentinel-01..sentinel-10
+          findingId: workbench-message-order-user-clustered-after-navigation
+          severity: amber
+          blocking: false

config/hwlab-web-probe-sentinel/secrets.fake-echo.d518-v03.yaml

@@ -0,0 +1,35 @@
+version: 1
+kind: HwlabWebProbeSentinelSecrets
+metadata:
+  id: d518-v03-web-probe-sentinel-fake-echo-secrets
+  owner: UniDesk
+  specRef: PJ2026-01060508
+  issue: 1190
+sentinel:
+  secrets:
+    sources:
+      - purpose: bootstrap-admin
+        sourceRef: hwlab/d518-v03-bootstrap-admin.env
+        sourceKey: HWLAB_BOOTSTRAP_ADMIN_PASSWORD
+      - purpose: prompt-set
+        sourceRef: hwlab/web-probe-sentinel-fake-echo.env
+        sourceKey: FAKE_ECHO_SENTINEL_PROMPTS_JSON
+      - purpose: frp-token
+        sourceRef: platform-infra/pk01-frp.env
+        sourceKey: FRP_TOKEN
+    runtimeSecrets:
+      - name: hwlab-web-probe-sentinel-bootstrap
+        namespace: hwlab-v03
+        data:
+          - sourcePurpose: bootstrap-admin
+            targetKey: bootstrap-admin-password
+      - name: hwlab-web-probe-sentinel-prompt-set
+        namespace: hwlab-v03
+        data:
+          - sourcePurpose: prompt-set
+            targetKey: prompts.json
+      - name: hwlab-web-probe-sentinel-frpc
+        namespace: hwlab-v03
+        data:
+          - sourcePurpose: frp-token
+            targetKey: token

config/hwlab-web-probe-sentinels/d518-v03/workbench-fake-echo-session-invariance-10x.yaml

@@ -0,0 +1,19 @@
+version: 1
+kind: HwlabWebProbeSentinel
+metadata:
+  id: d518-v03-workbench-fake-echo-session-invariance-10x
+  owner: UniDesk
+  specRef: PJ2026-01060508
+  issue: 1190
+sentinel:
+  id: workbench-fake-echo-session-invariance-10x
+  enabled: true
+  mode: web-probe-observe-wrapper
+  configRefs:
+    runtime: config/hwlab-web-probe-sentinel/runtime.d518-v03.yaml#sentinel.runtime
+    scenarios: config/hwlab-web-probe-sentinel/scenarios.fake-echo.workbench.yaml#sentinel.scenarios
+    promptSet: config/hwlab-web-probe-sentinel/prompt-set.fake-echo.yaml#sentinel.promptSet
+    reportViews: config/hwlab-web-probe-sentinel/report-views.yaml#sentinel.reportViews
+    publicExposure: config/hwlab-web-probe-sentinel/public-exposure.fake-echo.d518-v03.yaml#sentinel.publicExposure
+    cicd: config/hwlab-web-probe-sentinel/cicd.fake-echo.d518-v03.yaml#sentinel.cicd
+    secrets: config/hwlab-web-probe-sentinel/secrets.fake-echo.d518-v03.yaml#sentinel.secrets