docs: pin hwlab and agentrun to nc01

config/hwlab-node-lanes.yaml

@@ -3,40 +3,12 @@ kind: HwlabNodeLaneConfig
 metadata:
   name: hwlab-node-lanes
 defaults:
-  node: G14
+  node: NC01
   lane: v03
 requiredNoProxy:
   - hyueapi.com
   - .hyueapi.com
 nodes:
-  G14:
-    route: G14
-    kubeRoute: G14:k3s
-    sourceWorkspace: /root/hwlab
-    gitopsRoot: deploy/gitops/node
-    networkProfile: node-ci-egress
-    downloadProfile: node-default
-  D601:
-    route: D601
-    kubeRoute: D601:k3s
-    sourceWorkspace: /home/ubuntu/workspace/hwlab-v03
-    gitopsRoot: deploy/gitops/node
-    networkProfile: d601-node-ci-egress
-    downloadProfile: d601-node-default
-  D518:
-    route: D518
-    kubeRoute: D518:k3s
-    sourceWorkspace: /home/ubuntu/workspace/hwlab-v03
-    gitopsRoot: deploy/gitops/node
-    networkProfile: d518-node-ci-egress
-    downloadProfile: d518-node-default
-  JD01:
-    route: JD01
-    kubeRoute: JD01:k3s
-    sourceWorkspace: /root/workspace/hwlab-v03
-    gitopsRoot: deploy/gitops/node
-    networkProfile: jd01-node-ci-egress
-    downloadProfile: jd01-node-default
   NC01:
     route: NC01
     kubeRoute: NC01:k3s
@@ -45,47 +17,9 @@ nodes:
     networkProfile: jd01-node-ci-egress
     downloadProfile: jd01-node-default
 lanes:
-  v02:
-    node: G14
-    minor: 2
-    version: v0.2
-    sourceBranch: v0.2
-    workspace: /root/hwlab-v02
-    cicdRepo: /root/hwlab-v02-cicd.git
-    cicdRepoLock: /tmp/hwlab-v02-cicd-repo.lock
-    app: hwlab-g14-v02
-    pipeline: hwlab-v02-ci-image-publish
-    pipelineRunPrefix: hwlab-v02-ci-poll
-    serviceAccountName: hwlab-v02-tekton-runner
-    controlPlaneFieldManager: unidesk-hwlab-v02-control-plane
-    git:
-      url: git@github.com:pikasTech/HWLAB.git
-      readUrl: http://git-mirror-http.devops-infra.svc.cluster.local/pikasTech/HWLAB.git
-      writeUrl: http://git-mirror-write.devops-infra.svc.cluster.local/pikasTech/HWLAB.git
-    gitopsBranch: v0.2-gitops
-    catalogPath: deploy/artifact-catalog.v02.json
-    runtime:
-      path: deploy/gitops/g14/runtime-v02
-      namespace: hwlab-v02
-      renderDir: runtime-v02
-    tektonDir: tekton-v02
-    argoApplicationFile: application-v02.yaml
-    registryPrefix: 127.0.0.1:5000/hwlab
-    baseImage: 127.0.0.1:5000/hwlab/hwlab-node20-base:20-bookworm-slim
-    serviceIds:
-      - hwlab-cloud-api
-      - hwlab-cloud-web
-      - hwlab-gateway
-      - hwlab-edge-proxy
-      - hwlab-agent-skills
-    observability:
-      prometheusOperator: true
-    public:
-      webUrl: http://74.48.78.17:19666
-      apiUrl: http://74.48.78.17:19667
   v03:
-    node: G14
-    activeTarget: JD01
+    node: NC01
+    activeTarget: NC01
     minor: 3
     version: v0.3
     sourceBranch: v0.3
@@ -99,7 +33,7 @@ lanes:
       stageRefPrefix: "refs/unidesk/snapshots/hwlab-node-runtime/{branch}"
       missingObjectPolicy: fail-fast
       refreshPolicy: sync-before-snapshot
-    workspace: /root/hwlab-v03
+    workspace: /root/hwlab
     cicdRepo: /root/hwlab-v03-cicd.git
     cicdRepoLock: /tmp/hwlab-v03-cicd-repo.lock
     app: hwlab-node-v03
@@ -139,7 +73,7 @@ lanes:
     bootstrapAdmin:
       username: admin
       displayName: HWLAB v0.3 Admin
-      passwordSourceRef: hwlab/g14-v03-bootstrap-admin.env
+      passwordSourceRef: hwlab/nc01-v03-bootstrap-admin.env
       passwordSourceKey: HWLAB_BOOTSTRAP_ADMIN_PASSWORD
       passwordHashTransform: hwlab-sha256
       secretName: hwlab-v03-bootstrap-admin
@@ -147,734 +81,6 @@ lanes:
       rollout:
         deployment: hwlab-cloud-api
     targets:
-      D601:
-        node: D601
-        workspace: /home/ubuntu/workspace/hwlab-v03
-        cicdRepo: /home/ubuntu/workspace/hwlab-v03-cicd.git
-        cicdRepoLock: /tmp/hwlab-v03-cicd-repo.lock
-        app: hwlab-node-v03
-        pipeline: hwlab-v03-ci-image-publish
-        pipelineRunPrefix: hwlab-v03-ci-poll
-        serviceAccountName: hwlab-v03-tekton-runner
-        controlPlaneFieldManager: unidesk-hwlab-d601-v03-control-plane
-        git:
-          url: git@github.com:pikasTech/HWLAB.git
-          readUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/HWLAB.git
-          writeUrl: http://git-mirror-write.devops-infra.svc.cluster.local:8080/pikasTech/HWLAB.git
-        argo:
-          repoURL: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/HWLAB.git
-        gitopsBranch: v0.3-gitops
-        catalogPath: deploy/artifact-catalog.d601-v03.json
-        runtime:
-          path: deploy/gitops/node/d601/runtime-v03
-          namespace: hwlab-v03
-          renderDir: runtime-v03
-        runtimeStore:
-          postgres:
-            mode: local-k3s
-            secretName: hwlab-v03-postgres
-            statefulSet: hwlab-v03-postgres
-            serviceName: hwlab-v03-postgres
-            adminUser: hwlab_v03
-            adminPasswordSourceRef: hwlab/d601-v03-postgres.env
-            adminPasswordSourceKey: HWLAB_V03_POSTGRES_PASSWORD
-            cloudApi:
-              secretName: hwlab-cloud-api-v03-db
-              secretKey: database-url
-              database: hwlab_v03
-              role: hwlab_v03
-            openfga:
-              secretName: hwlab-v03-openfga
-              secretKey: datastore-uri
-              authnKey: authn-preshared-key
-              postgresPasswordKey: postgres-password
-              database: hwlab_openfga
-              role: hwlab_openfga
-            poolMax: 16
-            connectionTimeoutMs: 5000
-            queryRetryMaxAttempts: 5
-            queryRetryInitialDelayMs: 250
-            queryRetryMaxDelayMs: 5000
-        hwpodPreinstall:
-          enabled: true
-          configRefs:
-            preinstall: "config/hwlab-hwpod-preinstalls/constart-71freq-c.yaml#hwpodPreinstall"
-            projectManagementSource: "config/hwlab-project-management/constart-71freq-mdtodo.yaml#projectManagement.sources[0]"
-            gatewayProfile: "config/hwlab-gateway/constart-71freq-d601-v03.yaml#gateway.profile"
-        webProbe:
-          extends: templates.hwlabV03.webProbeWorkbench
-        tektonDir: tekton-v03
-        argoApplicationFile: application-v03.yaml
-        registryPrefix: 127.0.0.1:5000/hwlab
-        baseImage: 127.0.0.1:5000/hwlab/hwlab-node20-base:20-bookworm-slim
-        baseImageSource: node:20-bookworm-slim
-        serviceIds:
-          - hwlab-cloud-api
-          - hwlab-workbench-runtime
-          - hwlab-user-billing
-          - hwlab-project-management
-          - hwlab-cloud-web
-          - hwlab-gateway
-          - hwlab-edge-proxy
-          - hwlab-agent-skills
-        buildkit:
-          sidecarImage: 127.0.0.1:5000/hwlab/buildkit:rootless
-          sourceImage: docker.io/moby/buildkit:rootless
-        stepEnv:
-          HOME: /tekton/home
-          XDG_CONFIG_HOME: /tekton/home/.config
-        observability:
-          prometheusOperator: false
-          traceExplorerUrlTemplate: "/v1/workbench/traces/{trace_id}/events"
-          metricsEndpoint:
-            serviceName: hwlab-cloud-api
-            containerName: hwlab-cloud-api
-            port: 6667
-            scheme: http
-            path: /v1/web-performance/metrics
-            scrapeMode: pod-loopback
-            publicRawMetrics: denied
-          webProbe:
-            sentinels:
-              - id: workbench-dsflash-go-tool-call-10x
-                enabled: true
-                configRef: "config/hwlab-web-probe-sentinels/d601-v03/workbench-dsflash-go-tool-call-10x.yaml#sentinel"
-              - id: workbench-auth-session-switch-2users
-                enabled: true
-                configRef: "config/hwlab-web-probe-sentinels/d601-v03/workbench-auth-session-switch-2users.yaml#sentinel"
-              - id: mdtodo-visual-regression
-                enabled: true
-                configRef: "config/hwlab-web-probe-sentinels/d601-v03/mdtodo-visual-regression.yaml#sentinel"
-          workbench:
-            enabled: true
-            summaryPath: /v1/web-performance/summary
-            lowSampleThreshold: 5
-            metricPrefixes:
-              - hwlab_workbench_
-              - hwlab_agentrun_
-              - hwlab_webui_
-              - hwlab_http_
-            requiredSeries:
-              []
-            backendLabelDenylist:
-              - unknown
-            maxUnknownEventLines: 0
-          recordingRules:
-            - id: workbench_submit_first_visible_p95
-              metric: hwlab:workbench_submit_first_visible:p95_seconds
-              sourceMetric: hwlab_workbench_journey_duration_seconds
-              quantile: 0.95
-              window: 5m
-              minSamples: 5
-              groupBy:
-                - namespace
-                - gitops_target
-                - journey
-                - route
-                - backend
-                - transport
-                - entry
-                - outcome
-              matchLabels:
-                journey: submit_to_first_visible
-            - id: workbench_backend_event_visible_p95
-              metric: hwlab:workbench_backend_event_visible:p95_seconds
-              sourceMetric: hwlab_workbench_backend_event_visible_latency_seconds
-              quantile: 0.95
-              window: 5m
-              minSamples: 5
-              groupBy:
-                - namespace
-                - gitops_target
-                - event_type
-                - backend
-                - transport
-                - outcome
-            - id: workbench_session_switch_p95
-              metric: hwlab:workbench_session_switch:p95_seconds
-              sourceMetric: hwlab_workbench_journey_duration_seconds
-              quantile: 0.95
-              window: 5m
-              minSamples: 5
-              groupBy:
-                - namespace
-                - gitops_target
-                - journey
-                - route
-                - target_state
-                - cache
-                - source
-                - outcome
-              matchLabels:
-                journey: session_switch_first_visible|session_switch_full_load
-            - id: workbench_open_p95
-              metric: hwlab:workbench_open:p95_seconds
-              sourceMetric: hwlab_workbench_journey_duration_seconds
-              quantile: 0.95
-              window: 5m
-              minSamples: 5
-              groupBy:
-                - namespace
-                - gitops_target
-                - journey
-                - route
-                - cache
-                - auth_state
-                - outcome
-              matchLabels:
-                journey: workbench_open_first_visible|workbench_open_full_load
-            - id: workbench_projection_lag_p95
-              metric: hwlab:workbench_projection_lag:p95_seconds
-              sourceMetric: hwlab_workbench_projection_lag_seconds
-              quantile: 0.95
-              window: 5m
-              minSamples: 1
-              groupBy:
-                - namespace
-                - gitops_target
-                - node
-                - lane
-                - projection_status
-                - source
-                - status
-                - reason
-            - id: workbench_terminal_projection_delay_p95
-              metric: hwlab:workbench_terminal_projection_delay:p95_seconds
-              sourceMetric: hwlab_workbench_terminal_projection_delay_seconds
-              quantile: 0.95
-              window: 5m
-              minSamples: 1
-              groupBy:
-                - namespace
-                - gitops_target
-                - node
-                - lane
-                - projection_status
-                - source
-                - status
-                - reason
-            - id: workbench_turn_get_p95
-              metric: hwlab:workbench_turn_get:p95_seconds
-              sourceMetric: hwlab_workbench_turn_get_duration_seconds
-              quantile: 0.95
-              window: 5m
-              minSamples: 1
-              groupBy:
-                - namespace
-                - gitops_target
-                - node
-                - lane
-                - route
-                - status
-                - degraded_reason
-            - id: agentrun_result_p95
-              metric: hwlab:agentrun_result:p95_seconds
-              sourceMetric: hwlab_agentrun_result_duration_seconds
-              quantile: 0.95
-              window: 5m
-              minSamples: 1
-              groupBy:
-                - namespace
-                - gitops_target
-                - node
-                - lane
-                - event_count_bucket
-                - status
-            - id: workbench_projector_batch_p95
-              metric: hwlab:workbench_projector_batch:p95_seconds
-              sourceMetric: hwlab_workbench_projector_batch_duration_seconds
-              quantile: 0.95
-              window: 5m
-              minSamples: 1
-              groupBy:
-                - namespace
-                - gitops_target
-                - node
-                - lane
-                - phase
-                - status
-          warningAlerts:
-            - id: HWLABWorkbenchSubmitFirstVisibleSlow
-              ruleId: workbench_submit_first_visible_p95
-              severity: warning
-              thresholdSeconds: 15
-              minSamples: 5
-              for: 10m
-              matchLabels:
-                journey: submit_to_first_visible
-            - id: HWLABWorkbenchBackendEventVisibleSlow
-              ruleId: workbench_backend_event_visible_p95
-              severity: warning
-              thresholdSeconds: 10
-              minSamples: 5
-              for: 10m
-            - id: HWLABWorkbenchSessionSwitchSlow
-              ruleId: workbench_session_switch_p95
-              severity: warning
-              thresholdSeconds: 8
-              minSamples: 5
-              for: 10m
-            - id: HWLABWorkbenchOpenSlow
-              ruleId: workbench_open_p95
-              severity: warning
-              thresholdSeconds: 13
-              minSamples: 5
-              for: 10m
-            - id: WorkbenchProjectionStuck
-              ruleId: workbench_projection_lag_p95
-              severity: warning
-              thresholdSeconds: 60
-              minSamples: 1
-              for: 10m
-            - id: WorkbenchTerminalProjectionMissing
-              ruleId: workbench_terminal_projection_delay_p95
-              severity: warning
-              thresholdSeconds: 60
-              minSamples: 1
-              for: 10m
-            - id: WorkbenchTurnReadSlow
-              ruleId: workbench_turn_get_p95
-              severity: warning
-              thresholdSeconds: 5
-              minSamples: 1
-              for: 10m
-            - id: AgentRunResultSlowLongTrace
-              ruleId: agentrun_result_p95
-              severity: warning
-              thresholdSeconds: 2.5
-              minSamples: 1
-              for: 10m
-            - id: WorkbenchProjectorNoProgress
-              ruleId: workbench_projector_batch_p95
-              severity: warning
-              thresholdSeconds: 10
-              minSamples: 1
-              for: 10m
-        runtimeImageRewrites:
-          - extends: templates.hwlabV03.runtimeImageRewrites.frpc
-          - extends: templates.hwlabV03.runtimeImageRewrites.openfga
-        runtimeImageBuilds:
-          - extends: templates.hwlabV03.runtimeImageBuilds.moonbridge
-          - extends: templates.hwlabV03.runtimeImageBuilds.opencodeGit
-        public:
-          webUrl: https://hwlab.pikapython.com
-          apiUrl: https://hwlab.pikapython.com
-        bootstrapAdmin:
-          username: admin
-          displayName: HWLAB v0.3 Admin
-          passwordSourceRef: hwlab/d601-v03-bootstrap-admin.env
-          passwordSourceKey: HWLAB_BOOTSTRAP_ADMIN_PASSWORD
-          passwordHashTransform: hwlab-sha256
-          secretName: hwlab-v03-bootstrap-admin
-          secretKey: password-hash
-          rollout:
-            deployment: hwlab-cloud-api
-        publicExposure:
-          extends: templates.hwlabV03.publicExposurePk01
-          frpc:
-            webProxy:
-              remotePort: 22096
-            apiProxy:
-              remotePort: 22095
-        externalPostgres:
-          extends: templates.hwlabV03.externalPostgresConsumer
-          provider: PK01
-          configRef: config/platform-db/postgres-pk01.yaml
-          serviceName: d601-pk01-platform-postgres
-          endpointAddress: 82.156.23.220
-          runtimeAccess:
-            routeName: d601-pk01-postgres
-            endpointAddress: d601-tcp-egress-gateway.unidesk.svc.cluster.local
-            port: 25432
-          database: hwlab_d601_v03
-          cloudApi:
-            sourceRef: hwlab/d601-v03-cloud-api-db.env
-            role: hwlab_d601_v03_app
-          openfga:
-            sourceRef: hwlab/d601-v03-openfga-db.env
-            role: hwlab_d601_v03_app
-        variables:
-          LANE: v03
-          NODE: D601
-      D518:
-        node: D518
-        workspace: /home/ubuntu/workspace/hwlab-v03
-        sourceWorkspace:
-          requiredCommands:
-            - git
-            - node
-            - npm
-            - npx
-          requiredFiles:
-            - AGENTS.md
-            - package.json
-            - package-lock.json
-            - scripts/src/browser-launcher.mjs
-            - scripts/web-live-dom-probe.mjs
-          install:
-            executor: k3s-job
-            dependencyCommand: npm ci
-            browserCommand: PLAYWRIGHT_BROWSERS_PATH=0 npx playwright install chromium
-            timeoutSeconds: 900
-        cicdRepo: /home/ubuntu/workspace/hwlab-v03-cicd.git
-        cicdRepoLock: /tmp/hwlab-v03-cicd-repo.lock
-        app: hwlab-node-v03
-        pipeline: hwlab-d518-v03-ci-image-publish
-        pipelineRunPrefix: hwlab-d518-v03-ci-poll
-        serviceAccountName: hwlab-d518-v03-tekton-runner
-        controlPlaneFieldManager: unidesk-hwlab-d518-v03-control-plane
-        git:
-          url: git@github.com:pikasTech/HWLAB.git
-          readUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/HWLAB.git
-          writeUrl: http://git-mirror-write.devops-infra.svc.cluster.local:8080/pikasTech/HWLAB.git
-        argo:
-          repoURL: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/HWLAB.git
-        gitopsBranch: v0.3-gitops
-        catalogPath: deploy/artifact-catalog.d518-v03.json
-        runtime:
-          path: deploy/gitops/node/d518/runtime-v03
-          namespace: hwlab-v03
-          renderDir: runtime-v03
-        runtimeStore:
-          postgres:
-            mode: local-k3s
-            secretName: hwlab-v03-postgres
-            statefulSet: hwlab-v03-postgres
-            serviceName: hwlab-v03-postgres
-            adminUser: hwlab_v03
-            adminPasswordSourceRef: hwlab/d518-v03-postgres.env
-            adminPasswordSourceKey: HWLAB_V03_POSTGRES_PASSWORD
-            cloudApi:
-              secretName: hwlab-cloud-api-v03-db
-              secretKey: database-url
-              database: hwlab_v03
-              role: hwlab_v03
-            openfga:
-              secretName: hwlab-v03-openfga
-              secretKey: datastore-uri
-              authnKey: authn-preshared-key
-              postgresPasswordKey: postgres-password
-              database: hwlab_openfga
-              role: hwlab_openfga
-            poolMax: 16
-            connectionTimeoutMs: 5000
-            queryRetryMaxAttempts: 5
-            queryRetryInitialDelayMs: 250
-            queryRetryMaxDelayMs: 5000
-        webProbe:
-          extends: templates.hwlabV03.webProbeWorkbench
-          browserProxyMode: direct
-          browserFreezePolicy:
-            memory:
-              totalRssBlockerMb: 500
-        tektonDir: tekton-v03
-        argoApplicationFile: application-v03.yaml
-        registryPrefix: 127.0.0.1:5000/hwlab
-        baseImage: 127.0.0.1:5000/hwlab/hwlab-node20-base:20-bookworm-slim
-        baseImageSource: node:20-bookworm-slim
-        serviceIds:
-          - hwlab-cloud-api
-          - hwlab-workbench-runtime
-          - hwlab-user-billing
-          - hwlab-project-management
-          - hwlab-cloud-web
-          - hwlab-gateway
-          - hwlab-edge-proxy
-          - hwlab-agent-skills
-        buildkit:
-          sidecarImage: 127.0.0.1:5000/hwlab/buildkit:rootless
-          sourceImage: docker.io/moby/buildkit:rootless
-        stepEnv:
-          HOME: /tekton/home
-          XDG_CONFIG_HOME: /tekton/home/.config
-        observability:
-          prometheusOperator: false
-          webProbe:
-            monitorRoot:
-              enabled: true
-              sentinelId: workbench-fake-echo-session-invariance-10x
-              publicBaseUrl: https://monitor.pikapython.com
-              routePrefix: /
-              caddyManagedBlockOwner: hwlab-web-probe-sentinel-active-root
-            sentinels:
-              - id: workbench-dsflash-go-tool-call-10x
-                enabled: true
-                configRef: "config/hwlab-web-probe-sentinels/d518-v03/workbench-dsflash-go-tool-call-10x.yaml#sentinel"
-              - id: workbench-fake-echo-session-invariance-10x
-                enabled: true
-                configRef: "config/hwlab-web-probe-sentinels/d518-v03/workbench-fake-echo-session-invariance-10x.yaml#sentinel"
-        runtimeImageRewrites:
-          - extends: templates.hwlabV03.runtimeImageRewrites.frpc
-          - extends: templates.hwlabV03.runtimeImageRewrites.openfga
-        runtimeImageBuilds:
-          - extends: templates.hwlabV03.runtimeImageBuilds.moonbridge
-          - extends: templates.hwlabV03.runtimeImageBuilds.opencodeGit
-        public:
-          webUrl: https://hwlab.pikapython.com
-          apiUrl: https://hwlab.pikapython.com
-        bootstrapAdmin:
-          username: admin
-          displayName: HWLAB v0.3 Admin
-          passwordSourceRef: hwlab/d518-v03-bootstrap-admin.env
-          passwordSourceKey: HWLAB_BOOTSTRAP_ADMIN_PASSWORD
-          passwordHashTransform: hwlab-sha256
-          secretName: hwlab-v03-bootstrap-admin
-          secretKey: password-hash
-          rollout:
-            deployment: hwlab-cloud-api
-        codeAgentProvider:
-          secretName: hwlab-v03-code-agent-provider
-          sourceRef: hwlab/d518-v03-code-agent-provider.env
-          openaiSourceKey: OPENAI_API_KEY
-          opencodeSourceKey: OPENCODE_API_KEY
-        codeAgentRuntime:
-          enabled: true
-          adapter: agentrun-v02
-          managerUrl: http://agentrun-mgr.agentrun-v02.svc.cluster.local:8080
-          apiKeySecretName: hwlab-v03-master-server-admin-api-key
-          apiKeySecretKey: api-key
-          runnerNamespace: agentrun-v02
-          secretNamespace: agentrun-v02
-          repoUrlFrom: runtimeGitReadUrl
-          providerIdFrom: runtimeNodeId
-          defaultProviderProfile: fake-echo
-          codexStdioSupervisor: repo-owned
-          kafkaShadowProducer:
-            enabled: true
-            mode: shadow-produce-only
-            consumeEnabled: false
-            configRef: "config/platform-infra/kafka.yaml#clients.hwlab-v03-cloud-api"
-            bootstrapServers: platform-infra-kafka-kafka-bootstrap.platform-infra.svc.cluster.local:9092
-            commandTopic: hwlab.agentrun.command.v1
-            clientId: hwlab-v03-cloud-api
-        publicExposure:
-          extends: templates.hwlabV03.publicExposurePk01
-          frpc:
-            webProxy:
-              remotePort: 22092
-            apiProxy:
-              remotePort: 22091
-        externalPostgres:
-          extends: templates.hwlabV03.externalPostgresConsumer
-          provider: PK01
-          configRef: config/platform-db/postgres-pk01.yaml
-          serviceName: d518-pk01-platform-postgres
-          endpointAddress: 82.156.23.220
-          runtimeAccess:
-            routeName: d518-pk01-postgres
-            endpointAddress: d518-tcp-egress-gateway.unidesk.svc.cluster.local
-            port: 25432
-          database: hwlab_d518_v03
-          cloudApi:
-            sourceRef: hwlab/d518-v03-cloud-api-db.env
-            role: hwlab_d518_v03_app
-          openfga:
-            sourceRef: hwlab/d518-v03-openfga-db.env
-            role: hwlab_d518_v03_app
-        variables:
-          LANE: v03
-          NODE: D518
-      JD01:
-        node: JD01
-        workspace: /root/workspace/hwlab-v03
-        sourceAuthority:
-          extends: templates.hwlabV03.sourceAuthorityGiteaSnapshot
-          giteaMirrorRepoKey: hwlab-jd01-v03
-        sourceSnapshot:
-          extends: templates.hwlabV03.sourceSnapshotGiteaControlled
-        sourceWorkspace:
-          git:
-            remoteName: github
-            remoteUrl: git@github.com:pikasTech/HWLAB.git
-            identityTarget: JD01
-            identityId: github.com
-            proxyEnvPath: /etc/unidesk/proxy.env
-            verifyRemote: true
-            requireUpToDate: true
-          requiredCommands:
-            - git
-            - node
-            - npm
-            - npx
-          requiredFiles:
-            - AGENTS.md
-            - package.json
-            - package-lock.json
-            - scripts/src/browser-launcher.mjs
-            - scripts/web-live-dom-probe.mjs
-          hostDependencies:
-            checkCommands:
-              - git
-              - node
-              - npm
-              - npx
-            stateDir: /var/lib/unidesk/hwlab-source-workspace
-            install:
-              timeoutSeconds: 300
-              command: "set -eu\n. /etc/unidesk/proxy.env 2>/dev/null || true\nexport HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY http_proxy https_proxy all_proxy no_proxy\nnpm_version=11.17.0\ntmp_dir=$(mktemp -d)\ntrap 'rm -rf \"$tmp_dir\"' EXIT\ncurl -fsSL --retry 3 --connect-timeout 20 --max-time 300 \"https://registry.npmmirror.com/npm/-/npm-${npm_version}.tgz\" -o \"$tmp_dir/npm.tgz\"\nmkdir -p /usr/local/lib/node_modules\nrm -rf /usr/local/lib/node_modules/npm\ntar -xzf \"$tmp_dir/npm.tgz\" -C \"$tmp_dir\"\nmv \"$tmp_dir/package\" /usr/local/lib/node_modules/npm\nln -sfn /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm\nln -sfn /usr/local/lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx\nnpm --version\nnpx --version\n"
-          install:
-            executor: host
-            dependencyCommand: "set -eu\nnpm install --no-save --package-lock=false --ignore-scripts --no-audit --no-fund playwright@1.59.1\nif [ -n \"${HTTP_PROXY:-}\" ]; then\n  cat >/etc/apt/apt.conf.d/99unidesk-host-proxy <<APT_PROXY\nAcquire::http::Proxy \"${HTTP_PROXY}\";\nAcquire::https::Proxy \"${HTTPS_PROXY:-$HTTP_PROXY}\";\nAcquire::Retries \"3\";\nAcquire::http::Timeout \"60\";\nAcquire::https::Timeout \"60\";\nAPT_PROXY\nfi\nfor apt_source in /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; do\n  [ -f \"$apt_source\" ] || continue\n  sed -i 's|http://mirrors.jdcloudcs.com/ubuntu|http://archive.ubuntu.com/ubuntu|g' \"$apt_source\"\ndone\nnpx playwright install-deps chromium\n"
-            browserCommand: PLAYWRIGHT_BROWSERS_PATH=0 npx playwright install chromium
-            stateDir: /var/lib/unidesk/hwlab-source-workspace-install
-            timeoutSeconds: 900
-        cicdRepo: /root/workspace/hwlab-v03-cicd.git
-        cicdRepoLock: /tmp/hwlab-v03-cicd-repo.lock
-        app: hwlab-node-v03
-        pipeline: hwlab-jd01-v03-ci-image-publish
-        pipelineRunPrefix: hwlab-jd01-v03-ci-poll
-        serviceAccountName: hwlab-jd01-v03-tekton-runner
-        controlPlaneFieldManager: unidesk-hwlab-jd01-v03-control-plane
-        git:
-          url: git@github.com:pikasTech/HWLAB.git
-          readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-HWLAB.git
-          writeUrl: http://git-mirror-write.devops-infra.svc.cluster.local:8080/pikasTech/HWLAB.git
-        argo:
-          repoURL: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/HWLAB.git
-        gitopsBranch: v0.3-gitops
-        catalogPath: deploy/artifact-catalog.jd01-v03.json
-        runtime:
-          path: deploy/gitops/node/jd01/runtime-v03
-          namespace: hwlab-v03
-          renderDir: runtime-v03
-        runtimeStore:
-          postgres:
-            mode: platform-service
-            secretName: hwlab-v03-postgres
-            statefulSet: hwlab-v03-postgres
-            serviceName: hwlab-v03-postgres
-            adminUser: hwlab_v03
-            adminPasswordSourceRef: hwlab/jd01-v03-postgres.env
-            adminPasswordSourceKey: HWLAB_V03_POSTGRES_PASSWORD
-            cloudApi:
-              secretName: hwlab-cloud-api-v03-db
-              secretKey: database-url
-              database: hwlab_v03
-              role: hwlab_v03
-            openfga:
-              secretName: hwlab-v03-openfga
-              secretKey: datastore-uri
-              authnKey: authn-preshared-key
-              postgresPasswordKey: postgres-password
-              database: hwlab_openfga
-              role: hwlab_openfga
-            poolMax: 16
-            connectionTimeoutMs: 5000
-            queryRetryMaxAttempts: 5
-            queryRetryInitialDelayMs: 250
-            queryRetryMaxDelayMs: 5000
-        webProbe:
-          extends: templates.hwlabV03.webProbeWorkbench
-          playwrightBrowsersPath: "0"
-        tektonDir: tekton-v03
-        argoApplicationFile: application-v03.yaml
-        registryPrefix: 127.0.0.1:5000/hwlab
-        baseImage: 127.0.0.1:5000/hwlab/hwlab-node20-base:20-bookworm-slim
-        baseImageSource: node:20-bookworm-slim
-        serviceIds:
-          - hwlab-cloud-api
-          - hwlab-workbench-runtime
-          - hwlab-user-billing
-          - hwlab-project-management
-          - hwlab-cloud-web
-          - hwlab-gateway
-          - hwlab-edge-proxy
-          - hwlab-agent-skills
-        buildkit:
-          sidecarImage: 127.0.0.1:5000/hwlab/buildkit:rootless
-          sourceImage: docker.io/moby/buildkit:rootless
-        stepEnv:
-          HOME: /tekton/home
-          XDG_CONFIG_HOME: /tekton/home/.config
-        observability:
-          prometheusOperator: false
-          webProbe:
-            monitorRoot:
-              enabled: true
-              sentinelId: jd01-web-probe-sentinel
-              publicBaseUrl: https://monitor.pikapython.com
-              routePrefix: /
-              caddyManagedBlockOwner: hwlab-web-probe-sentinel-active-root
-            sentinels:
-              - id: jd01-web-probe-sentinel
-                enabled: true
-                configRef: "config/hwlab-web-probe-sentinel/profiles.yaml#nodes.${NODE}.sentinels.${nodeLower}-web-probe-sentinel.sentinel"
-        runtimeImageRewrites:
-          - extends: templates.hwlabV03.runtimeImageRewrites.postgres
-          - extends: templates.hwlabV03.runtimeImageRewrites.frpc
-          - extends: templates.hwlabV03.runtimeImageRewrites.openfga
-          - extends: templates.hwlabV03.runtimeImageRewrites.opencode
-        runtimeImageBuilds:
-          - extends: templates.hwlabV03.runtimeImageBuilds.moonbridge
-          - extends: templates.hwlabV03.runtimeImageBuilds.opencodeGit
-        public:
-          webUrl: https://hwlab.pikapython.com
-          apiUrl: https://hwlab.pikapython.com
-        bootstrapAdmin:
-          username: admin
-          displayName: HWLAB v0.3 Admin
-          usernameSourceRef: .env/HWLAB_admin.txt
-          usernameSourceLine: 1
-          passwordSourceRef: .env/HWLAB_admin.txt
-          passwordSourceKey: HWLAB_ADMIN_PASSWORD
-          passwordSourceLine: 2
-          passwordHashTransform: hwlab-sha256
-          secretName: hwlab-v03-bootstrap-admin
-          secretKey: password-hash
-          rollout:
-            deployment: hwlab-cloud-api
-        codeAgentProvider:
-          secretName: hwlab-v03-code-agent-provider
-          sourceRef: hwlab/jd01-v03-code-agent-provider.env
-          openaiSourceKey: OPENAI_API_KEY
-          opencodeSourceKey: OPENCODE_API_KEY
-        codeAgentRuntime:
-          enabled: true
-          adapter: agentrun-v02
-          managerUrl: http://agentrun-mgr.agentrun-v02.svc.cluster.local:8080
-          apiKeySecretName: hwlab-v03-master-server-admin-api-key
-          apiKeySecretKey: api-key
-          runnerNamespace: agentrun-v02
-          secretNamespace: agentrun-v02
-          repoUrlFrom: runtimeGitReadUrl
-          providerIdFrom: runtimeNodeId
-          defaultProviderProfile: dsflash-go
-          codexStdioSupervisor: repo-owned
-        publicExposure:
-          extends: templates.hwlabV03.publicExposurePk01
-          frpc:
-            webProxy:
-              remotePort: 22090
-            apiProxy:
-              remotePort: 22088
-            extraProxies:
-              - id: opencode
-                name: hwlab-jd01-v03-opencode
-                remotePort: 22095
-                localIP: hwlab-cloud-web.hwlab-v03.svc.cluster.local
-                localPort: 8080
-                hostname: opencode-jd01-v03.pikapython.com
-                publicBaseUrl: https://opencode-jd01-v03.pikapython.com
-                cloudWebEnvName: HWLAB_CLOUD_WEB_OPENCODE_URL
-        externalPostgres:
-          extends: templates.hwlabV03.externalPostgresConsumer
-          provider: PK01
-          configRef: config/platform-db/postgres-pk01.yaml
-          serviceName: jd01-pk01-platform-postgres
-          endpointAddress: 82.156.23.220
-          runtimeAccess:
-            endpointAddress: 82.156.23.220
-            port: 5432
-          database: hwlab_jd01_v03
-          cloudApi:
-            sourceRef: hwlab/jd01-v03-cloud-api-db.env
-            role: hwlab_jd01_v03_app
-          openfga:
-            sourceRef: hwlab/jd01-v03-openfga-db.env
-            role: hwlab_jd01_v03_app
-        variables:
-          LANE: v03
-          NODE: JD01
       NC01:
         node: NC01
         workspace: /root/hwlab
@@ -942,8 +148,11 @@ lanes:
         bootstrapAdmin:
           username: admin
           displayName: HWLAB v0.3 Admin
-          passwordSourceRef: hwlab/nc01-v03-bootstrap-admin.env
-          passwordSourceKey: HWLAB_BOOTSTRAP_ADMIN_PASSWORD
+          usernameSourceRef: .env/hwlab.auth
+          usernameSourceLine: 1
+          passwordSourceRef: .env/hwlab.auth
+          passwordSourceKey: HWLAB_ADMIN_PASSWORD
+          passwordSourceLine: 2
           passwordHashTransform: hwlab-sha256
           secretName: hwlab-v03-bootstrap-admin
           secretKey: password-hash
@@ -1458,4 +667,4 @@ templates:
     sourceSnapshotGiteaControlled:
       stageRefPrefix: "refs/unidesk/snapshots/gitea-actions/hwlab-node-runtime/{branch}"
       missingObjectPolicy: fail-fast
-      refreshPolicy: gitea-controlled-snapshot
+      refreshPolicy: gitea-controlled-snapshot