feat: establish standalone Device Core repository

2026-08-21 11:51:21 +03:00
commit e0bac205d0
244 changed files with 51962 additions and 0 deletions
@@ -0,0 +1,114 @@
+{
+  "schemaVersion": "nodedc.device-edge.core-channel.v1",
+  "status": "accepted-design",
+  "authority": "DCPLATFORM-76/ADR-0001",
+  "direction": "device-gateway-core-initiated",
+  "transport": {
+    "protocol": "http2-bidirectional-stream",
+    "tls": "TLSv1.3-mutual-authentication",
+    "edgeListen": "0.0.0.0:443",
+    "endpointSource": "device-control-core.edge-registration",
+    "browserAccess": "forbidden",
+    "bearerOnlyAuthentication": "forbidden",
+    "genericTcpForwarding": "forbidden"
+  },
+  "identity": {
+    "corePrivateKeyLocation": "synology-canonical-secret-boundary",
+    "edgePrivateKeyLocation": "edge-runner-managed-trust-boundary",
+    "privateKeysInArtifacts": false,
+    "certificateRotation": "generation-bound-audited",
+    "unknownOrRevokedEdge": "reject"
+  },
+  "networkBoundary": {
+    "synologyPublicIngress": false,
+    "synologyPortForward": false,
+    "vpsInitiatedSynologyConnection": false,
+    "subnetRoutes": false,
+    "exitNode": false,
+    "tailscaleSsh": false,
+    "dockerSocket": false,
+    "allowedEdgeListeners": [
+      "management-ssh",
+      "raw-device-tcp/9921",
+      "core-channel-mtls/443"
+    ]
+  },
+  "messageContract": {
+    "versioned": true,
+    "bounded": true,
+    "requiredKeys": [
+      "schemaVersion",
+      "edgeRegistrationId",
+      "channelGeneration",
+      "trackerSessionId",
+      "adapterProfileRef",
+      "sequence",
+      "eventAt",
+      "receivedAt",
+      "messageKind",
+      "correlationId"
+    ],
+    "unknownKind": "close-logical-session",
+    "rawArbitraryDestination": "forbidden"
+  },
+  "acknowledgement": {
+    "trackerPackageAck": "only-after-bounded-core-acceptance",
+    "coreUnavailable": "do-not-acknowledge-tracker-package",
+    "deduplicationKey": [
+      "edgeRegistrationId",
+      "channelGeneration",
+      "trackerSessionId",
+      "packageNumber",
+      "contentDigest"
+    ],
+    "deliverySemantics": "at-least-once"
+  },
+  "pilotLimits": {
+    "maxTrackerSessions": 128,
+    "maxSessionsPerObservedSource": 16,
+    "maxNewConnectionsPerMinutePerObservedSource": 60,
+    "maxBufferedBytesPerTrackerSession": 262144,
+    "maxAggregateBufferedBytes": 33554432,
+    "maxEnvelopePayloadBytes": 1048576,
+    "keepaliveSeconds": 15,
+    "deadPeerSeconds": 45,
+    "reconnectMinimumSeconds": 1,
+    "reconnectMaximumSeconds": 30,
+    "durableEdgeSpool": false
+  },
+  "pilotSlo": {
+    "trackerAckBeforeDurableCoreAcceptance": 0,
+    "lossOfCoreAcceptedPackages": 0,
+    "edgeReceiveToCoreAcceptanceP95Milliseconds": 2000,
+    "edgeReceiveToCoreAcceptanceP99Milliseconds": 5000,
+    "channelReestablishmentP95Seconds": 60,
+    "channelReestablishmentHardCeilingSeconds": 120,
+    "deadCoreDetectionHardCeilingSeconds": 45,
+    "malformedOrUnauthenticatedAcceptedRecords": 0,
+    "availabilityCommitment": "deferred-until-measured"
+  },
+  "commandBoundary": {
+    "typedOnly": true,
+    "rawPayload": "forbidden",
+    "durableEdgeQueue": false,
+    "sentEqualsSuccess": false,
+    "protocolAckMeans": "acknowledged-not-verified",
+    "unsafeAutomaticRetry": "forbidden"
+  },
+  "preserved": [
+    "device-control-core-database",
+    "device-gateway-core",
+    "hub-authentik",
+    "engine",
+    "foundry-runtime",
+    "gelios-production-path"
+  ],
+  "rollout": [
+    "source-and-ops-contract",
+    "closed-port-synthetic-core-channel",
+    "negative-network-and-identity-acceptance",
+    "separate-public-device-ingress-transition",
+    "one-device-pilot"
+  ],
+  "rollback": "restore-closed-port-predecessor-without-vps-initiated-backhaul"
+}