feat(device-manager): add control and audit workspaces

2026-08-13 11:37:36 +03:00
parent 4116f5ba95
commit 1c5246afe8
10 changed files with 1769 additions and 24 deletions
@@ -14,8 +14,18 @@ behavior; projects, inventory, collections and access remain shared Device Core
 - The BFF reads the Core bearer token from `NODEDC_DEVICE_CORE_TOKEN_FILE`; the token is
  never embedded into client assets or accepted as a raw environment value.
 - Device Control Core owns authorization, lifecycle validation, idempotency and persistence.
- Query responses contain masked identifiers only. Digests and credential references stay
-  inside Device Control Core.
+- Query responses contain masked identifiers and bounded metadata only. Identifier and
+  credential digests, external approval proofs, command parameters/transport refs, raw
+  configuration documents and audit payloads stay inside Device Control Core.
+
+The project workspace covers inventory, discovery, collections, adapter/profile metadata,
+Edges, routes, sessions, bindings, configuration state, the honest command ledger, immutable
+audit metadata and project grants. Navigation and actions are derived from effective project
+capabilities. Global adapter/profile/Edge mutation is additionally restricted to a Hub owner.
+
+Command planning and transport intentionally have no Device Manager mutation route yet.
+The UI never presents `sent` as success: `acknowledged` and `verified` remain different
+ledger states, and the disabled transport policy is visible in the Commands section.

 Hub currently supplies identity and groups but no signed company-membership/owner-scope
 claim. Therefore an admin may create projects in their personal scope. Existing company