feat(manager): expose safe VPS edge health

services/device-control-core/test/app.test.mjs

@@ -347,14 +347,23 @@ test("project query is service-authenticated and forwards only the trusted actor
 test("project workspace query accepts only a canonical project path", async () => {
   const projectId = "11111111-1111-4111-8111-111111111111";
   let queried;
+  const edgeChannels = {
+    enabled: true,
+    edges: [{
+      edgeRegistrationId: "edge:bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb",
+      channel: "accepted",
+      lastErrorCode: null,
+    }],
+  };
   const runtime = await startTestServer({
     managementApiEnabled: true,
     managementToken,
+    edgeChannelStatusProvider: () => edgeChannels,
     repository: {
       health: async () => "ready",
       executeManagementCommand: async () => ({ replayed: false, result: {} }),
-      getProjectWorkspace: async (actor, id) => {
-        queried = { actor, id };
+      getProjectWorkspace: async (actor, id, options) => {
+        queried = { actor, id, options };
         return { project: { projectRef: `project:${id}` }, devices: [] };
       },
     },
@@ -367,6 +376,7 @@ test("project workspace query accepts only a canonical project path", async () =
     assert.equal(response.status, 200);
     assert.equal((await response.json()).workspace.devices.length, 0);
     assert.equal(queried.id, projectId);
+    assert.equal(queried.options.edgeChannelStatus, edgeChannels);
 
     const invalid = await fetch(
       `${runtime.baseUrl}/internal/v1/query/projects/not-a-project/workspace`,

services/device-control-core/test/project-query-repository.test.mjs

@@ -53,7 +53,15 @@ test("project list applies direct-grant precedence and returns bounded summaries
 
 test("project workspace returns only masked identity projections", async () => {
   const client = workspaceClient();
-  const workspace = await getDeviceProjectWorkspace(client, actor, projectId);
+  const workspace = await getDeviceProjectWorkspace(client, actor, projectId, {
+    edgeChannelStatus: {
+      edges: [{
+        edgeRegistrationId: "edge:bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb",
+        channel: "accepted",
+        lastErrorCode: null,
+      }],
+    },
+  });
 
   assert.equal(workspace.project.projectRef, `project:${projectId}`);
   assert.equal(workspace.devices[0].identifier.masked, "***********0001");
@@ -66,6 +74,12 @@ test("project workspace returns only masked identity projections", async () => {
   assert.equal(workspace.adapterPackages[0].packageKey, "generic-tracker");
   assert.equal(workspace.modelProfiles[0].modelProfileRef, "vendor.model.v1");
   assert.equal(workspace.routes[0].activeSessionCount, 1);
+  assert.deepEqual(workspace.edges[0].channel, {
+    lifecycleState: "active",
+    generationRef: "channel-generation:1",
+    runtimeState: "accepted",
+    lastErrorCode: null,
+  });
   assert.equal(workspace.sessions[0].frameCount, 12);
   assert.equal(workspace.bindings[0].lifecycleState, "pending_external_approval");
   assert.equal(workspace.configurationRevisions[0].revisionNumber, 1);
@@ -103,6 +117,10 @@ test("project read source never selects identifier digests or credential refs",
     source,
     /\b(?:identifier_digest|expected_identifier_digest|credential_ref|parameters_digest|parameters_projection|transport_message_ref|external_approval_ref|external_approval_digest)\b/,
   );
+  assert.doesNotMatch(
+    source,
+    /\b(?:channel_endpoint|channel_servername|channel_trust_bundle_ref|channel_certificate_identities)\b/,
+  );
   assert.doesNotMatch(source, /\b(?:dae\.payload|dcr\.configuration)\b/);
 });
 
@@ -167,6 +185,8 @@ function workspaceClient({ queries = [] } = {}) {
           display_name: "Edge one",
           deployment_ref: "deployment:edge-one",
           lifecycle_state: "active",
+          channel_lifecycle_state: "active",
+          channel_generation_ref: "channel-generation:1",
           created_at: timestamp,
           updated_at: timestamp,
         }] };