From be93d1d35fc9d834c120790b17d633d58ff9e4f8 Mon Sep 17 00:00:00 2001 From: Codex Date: Thu, 28 May 2026 07:25:14 +0000 Subject: [PATCH] docs: clarify HWLAB guard minimalism --- docs/reference/g14.md | 2 ++ docs/reference/hwlab.md | 8 ++++++++ 2 files changed, 10 insertions(+) diff --git a/docs/reference/g14.md b/docs/reference/g14.md index c9f2e8a3..57396334 100644 --- a/docs/reference/g14.md +++ b/docs/reference/g14.md @@ -63,6 +63,8 @@ The fixed `v0.2` runtime namespace is `hwlab-v02`. The intended public FRP alloc The `v0.2` CI/CD integration must be additive: add a `v0.2` source watcher, GitOps desired-state lane, Argo CD Application, namespace resources, artifact catalog, and `deploy.json` environment only when they target `v0.2`/`hwlab-v02` explicitly. Do not retarget the existing `G14` poller, DEV/PROD Argo Applications, DEV/PROD runtime paths, or existing namespace resources to bootstrap `v0.2`. +Do not turn `v0.2` expansion governance into a stack of broad compatibility gates. The stable control points are branch, GitOps branch, namespace, runtime path, Argo Application, FRP ports and generated-output ownership. Legacy DEV/D601/main preflights that block the `v0.2` lane should be removed from that lane, not patched with fallback or legacy modes. Naming, RBAC scope, cleanup policy, resource quota and rollback order are design decisions or runbook entries unless they protect a concrete high-value risk that cannot be enforced by the fixed boundaries above. + ## Node-Local VPN Proxy G14 has a node-local VPN/proxy stack for infrastructure bootstrap and recovery downloads: diff --git a/docs/reference/hwlab.md b/docs/reference/hwlab.md index b945a318..c6fe4b8b 100644 --- a/docs/reference/hwlab.md +++ b/docs/reference/hwlab.md @@ -34,6 +34,14 @@ - 旧公网 `:6666` 和 `:6667` 不是浏览器验收入口；内部 k3s service 仍可使用 `6667` 作为服务端口。 - 当前 G14 入口由 G14 侧公开代理承担；不要把 master 上的其他 UniDesk frontend/backend-core 路径误判为 HWLAB 前端。D601 legacy `16666/16667` 的 FRP 说明只用于历史对照。 +## 门禁最小化与扩容治理 + +不要滑向不必要的复杂门禁是 HWLAB 指挥侧通用原则。G14 DEV/PROD、`v0.2` 扩容、CI/CD 迁移、运行面热修和文档治理都应优先靠固定边界、清晰命名、唯一真相源、标准入口和长期参考文档收敛，不要把每个设计约定、运行策略或回滚手册都做成新的 preflight、guard、gate 或报告生成器。 + +旧 DEV/D601/main 门禁如果阻碍当前 G14 或 `v0.2` 路径，默认处理是从当前调用链删除，而不是做兼容迁移、fallback、legacy mode、双路径绕行或在旧门禁上叠加例外。新增门禁只能覆盖明确高价值风险，且必须最小、低噪声、容易删除；资源配额、RBAC 命名、清理策略、回滚顺序、人工同步策略等默认是设计约定或 runbook，不是 CI/CD 通过条件。 + +`v0.2` 扩容时指挥侧只把以下内容视为硬边界：source branch 是 `v0.2`、GitOps branch 是 `v0.2-gitops`、runtime namespace 是 `hwlab-v02`、runtime path 是 `deploy/gitops/g14/runtime-v02`、公网入口是 `19666/19667`、`v0.2` source branch 不跟踪生成物、旧 DEV/D601/main 门禁不进入 `v0.2` 调用链。其他事项应先作为决策表或 runbook 固化，只有被证明无法靠边界和标准入口自然收敛时，才允许加最小检查。 + ## 最小 Device Agent/Gateway 桥接模型 最小打通目标是只新增桥接面，不改动既有 HWLAB 应用、GitOps、FRP、CD 或前端路径：