SILVER/NODEDC_DEVICE_CORE
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Compare commits

base: SILVER/NODEDC_DEVICE_CORE:1d3ed5e16eaf7bc0c32de64796afc585882eac0b
Branches Tags
SILVER/NODEDC_DEVICE_CORE:main
...
compare: SILVER/NODEDC_DEVICE_CORE:07ffb22d3831a156ec2fbbe2dcbb569f9b0ae5d8
Branches Tags
SILVER/NODEDC_DEVICE_CORE:main
5 Commits
1d3ed5e16e ... 07ffb22d38
Author SHA1 Message Date
DCCONSTRUCTIONS 07ffb22d38 fix(manager): ship canonical NODE.DC favicon set 2026-08-22 10:49:52 +03:00
DCCONSTRUCTIONS 06cb780777 fix(manager): match Mission Core landing geometry 2026-08-22 10:23:07 +03:00
DCCONSTRUCTIONS 506d786ee6 fix(manager): persist environment presentation and media 2026-08-22 09:47:57 +03:00
DCCONSTRUCTIONS 40cd637f72 test(deploy): pin Manager v3 runtime acceptance 2026-08-22 09:09:32 +03:00
DCCONSTRUCTIONS b601b4ea46 deploy: advance manager v3 to recovered Core 2026-08-22 02:10:42 +03:00
19 changed files with 821 additions and 61 deletions
Expand all files Collapse all files
apps/device-manager/index.html
+6
View File
@@ -4,6 +4,12 @@
<meta charset="UTF-8" /> <meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" />
<meta name="theme-color" content="#101114" /> <meta name="theme-color" content="#101114" />
<link rel="icon" type="image/svg+xml" sizes="any" href="/favicon/icon-adaptive.svg" />
<link rel="icon" type="image/x-icon" href="/favicon/favicon.ico" />
<link rel="apple-touch-icon" sizes="180x180" href="/favicon/apple-touch-icon.png" />
<link rel="icon" type="image/png" sizes="192x192" href="/favicon/icon-192.png" />
<link rel="icon" type="image/png" sizes="512x512" href="/favicon/icon-512.png" />
<link rel="manifest" href="/favicon/manifest.webmanifest.json" />
<title>NODE.DC Device Core</title> <title>NODE.DC Device Core</title>
</head> </head>
<body> <body>
apps/device-manager/public/favicon.ico
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 17 KiB

apps/device-manager/public/favicon/apple-touch-icon.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 4.0 KiB

apps/device-manager/public/favicon/favicon.ico
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 17 KiB

apps/device-manager/public/favicon/icon-192.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 4.3 KiB

apps/device-manager/public/favicon/icon-512.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 13 KiB

apps/device-manager/public/favicon/icon-adaptive.svg
+13
View File
@@ -0,0 +1,13 @@
<svg width="32" height="32" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg">
<style>
.icon-fav-01 { fill: #333334; } /* Тёмный цвет для светлого таб-бара */
@media (prefers-color-scheme: dark) {
.icon-fav-01 { fill: #FEFEFE; } /* Светлый цвет для тёмного таб-бара */
}
@media (prefers-color-scheme: light) {
.icon-fav-01 { fill: #000000; } /* Тёмный цвет для светлого таб-бара (для явности) */
}
</style>
<path class="icon-fav-01" d="M17.8738 15.9159L16.0002 18.9718L14.1267 15.9159H17.8738ZM23.6307 12.7864H8.36914L15.9999 25.2308L23.6307 12.7864Z"/>
<path class="icon-fav-01" d="M10.9793 19.4872L6.67269 11.5918H25.5344L21.2281 19.4872H25.0581L31.2614 8H0.738281L7.16244 19.4872H10.9793Z"/>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 852 B

apps/device-manager/public/favicon/manifest.webmanifest.json
+29
View File
@@ -0,0 +1,29 @@
{
"theme_color": "#eeeff4",
"background_color": "#eeeff4",
"display": "browser",
"scope": "/",
"start_url": "/",
"icons": [
{
"src": "icon-adaptive.svg",
"type": "image/svg+xml",
"sizes": "any"
},
{
"src": "icon-192.png",
"type": "image/png",
"sizes": "192x192"
},
{
"src": "icon-512.png",
"type": "image/png",
"sizes": "512x512"
},
{
"src": "apple-touch-icon.png",
"type": "image/png",
"sizes": "180x180"
}
]
}
apps/device-manager/server/device-manager-presentation.mjs
+1 -1
View File
@@ -2,7 +2,7 @@ import { randomUUID } from "node:crypto";
import { mkdir, readFile, rename, writeFile } from "node:fs/promises"; import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
import { basename, dirname, extname, join, resolve, sep } from "node:path"; import { basename, dirname, extname, join, resolve, sep } from "node:path";
const DEFAULT_ACCENT = "#b9ff4a"; const DEFAULT_ACCENT = "#f5f5f5";
export function createDeviceManagerPresentationStore({ export function createDeviceManagerPresentationStore({
layoutPath, layoutPath,
apps/device-manager/server/device-manager-presentation.test.mjs
+78
View File
@@ -12,6 +12,8 @@ import {
test("Device Core environment defaults to the product-level canonical identity", () => { test("Device Core environment defaults to the product-level canonical identity", () => {
const presentation = defaultPresentation(); const presentation = defaultPresentation();
assert.equal(presentation.environment.theme, "dark");
assert.equal(presentation.environment.accentHex, "#f5f5f5");
assert.deepEqual(presentation.environment.overview, { assert.deepEqual(presentation.environment.overview, {
headerLabel: "Device Core", headerLabel: "Device Core",
eyebrow: "NODEDC / DEVICE CORE", eyebrow: "NODEDC / DEVICE CORE",
@@ -27,6 +29,61 @@ test("Device Core environment defaults to the product-level canonical identity",
}); });
}); });
test("environment accent keeps a valid user choice and falls back to neutral white", () => {
assert.equal(
normalizeEnvironmentPresentation({ accentHex: "#8A2BE2" }).accentHex,
"#8a2be2",
);
assert.equal(
normalizeEnvironmentPresentation({ accentHex: "not-a-color" }).accentHex,
"#f5f5f5",
);
});
test("production Compose provides exact persistent writable presentation storage", async () => {
const compose = await readFile(
new URL("../../../docker-compose.device-manager.yml", import.meta.url),
"utf8",
);
for (const expected of [
"NODEDC_DEVICE_MANAGER_PRESENTATION_PATH: /var/lib/nodedc-device-manager/device-manager-presentation.json",
"NODEDC_DEVICE_MANAGER_MEDIA_ROOT: /var/lib/nodedc-device-manager/media",
"source: /volume1/docker/nodedc-device-plane/data/device-manager",
"target: /var/lib/nodedc-device-manager",
"read_only: false",
"create_host_path: false",
]) assert.ok(compose.includes(expected), expected);
const client = await readFile(
new URL("../src/DeviceManagerApp.tsx", import.meta.url),
"utf8",
);
assert.ok(client.includes('accentHex: "#f5f5f5"'));
assert.ok(!client.includes("#b9ff4a"));
});
test("Device Core overview follows the Mission Core landing-stage geometry", async () => {
const styles = await readFile(
new URL("../src/styles.css", import.meta.url),
"utf8",
);
for (const expected of [
".device-manager-stage {\n height: 100%;\n overflow: hidden;",
"left: clamp(2rem, 5vw, 6rem);",
"width: min(39rem, 50%);",
"transform: translateY(-55%);",
"linear-gradient(90deg, rgb(5 6 8 / 0.82) 0%, rgb(5 6 8 / 0.54) 46%, rgb(5 6 8 / 0.24) 100%)",
"font-size: clamp(3rem, 7vw, 7.6rem);",
]) assert.ok(styles.includes(expected), expected);
assert.ok(!/\.device-manager-home\s*\{[^}]*max-width:\s*1420px/s.test(styles));
const client = await readFile(
new URL("../src/DeviceManagerApp.tsx", import.meta.url),
"utf8",
);
assert.ok(client.includes('className="device-manager-home"'));
assert.ok(client.includes('data-has-media={hasMedia ? "true" : undefined}'));
assert.ok(!client.includes('<GlassSurface className="device-manager-home"'));
});
test("legacy single teaser migrates into the environment media playlist", () => { test("legacy single teaser migrates into the environment media playlist", () => {
const environment = normalizeEnvironmentPresentation({ const environment = normalizeEnvironmentPresentation({
defaultTeaser: { defaultTeaser: {
@@ -60,6 +117,23 @@ test("environment media accepts MOV even when the browser omits or varies its MI
} }
}); });
test("environment media persists an MP4 upload in the configured data root", async (t) => {
const root = await mkdtemp(join(tmpdir(), "nodedc-device-presentation-mp4-"));
t.after(() => rm(root, { recursive: true, force: true }));
const store = createDeviceManagerPresentationStore({
layoutPath: join(root, "device-manager-presentation.json"),
uploadRoot: join(root, "media"),
});
const uploaded = await store.saveMedia({
bytes: Buffer.from("mp4-payload"),
contentType: "video/mp4",
originalName: "environment.mp4",
kind: "background",
});
assert.match(uploaded.fileSrc, /^\/device-manager-media\/background-[0-9a-f-]+\.mp4$/);
assert.equal(await readFile(store.resolveMedia(uploaded.fileSrc), "utf8"), "mp4-payload");
});
test("environment presentation persists ordered mixed media and image duration", async (t) => { test("environment presentation persists ordered mixed media and image duration", async (t) => {
const root = await mkdtemp(join(tmpdir(), "nodedc-device-presentation-")); const root = await mkdtemp(join(tmpdir(), "nodedc-device-presentation-"));
t.after(() => rm(root, { recursive: true, force: true })); t.after(() => rm(root, { recursive: true, force: true }));
@@ -68,6 +142,8 @@ test("environment presentation persists ordered mixed media and image duration",
uploadRoot: join(root, "media"), uploadRoot: join(root, "media"),
}); });
const next = defaultPresentation(); const next = defaultPresentation();
next.environment.theme = "light";
next.environment.accentHex = "#8a2be2";
next.environment.overview.background = { next.environment.overview.background = {
enabled: true, enabled: true,
imageDurationSeconds: 17, imageDurationSeconds: 17,
@@ -93,6 +169,8 @@ test("environment presentation persists ordered mixed media and image duration",
await store.write(next); await store.write(next);
const restored = await store.read(); const restored = await store.read();
assert.equal(restored.environment.theme, "light");
assert.equal(restored.environment.accentHex, "#8a2be2");
assert.equal(restored.environment.overview.background.imageDurationSeconds, 17); assert.equal(restored.environment.overview.background.imageDurationSeconds, 17);
assert.deepEqual( assert.deepEqual(
restored.environment.overview.background.items.map((item) => item.id), restored.environment.overview.background.items.map((item) => item.id),
apps/device-manager/src/DeviceManagerApp.tsx
+9 -3
View File
@@ -130,7 +130,7 @@ const emptyMedia = (): DeviceManagerMediaValue => ({
const defaultPresentation = (): DeviceManagerPresentation => ({ const defaultPresentation = (): DeviceManagerPresentation => ({
environment: { environment: {
theme: "dark", theme: "dark",
accentHex: "#b9ff4a", accentHex: "#f5f5f5",
overview: { overview: {
headerLabel: "Device Core", headerLabel: "Device Core",
eyebrow: "NODEDC / DEVICE CORE", eyebrow: "NODEDC / DEVICE CORE",
@@ -684,6 +684,9 @@ function DeviceStage({
&& primarySections.some((section) => section.value === value) && primarySections.some((section) => section.value === value)
&& values.indexOf(value) === index && values.indexOf(value) === index
)); ));
const hasMedia = overview.background.enabled && overview.background.items.some(
(item) => Boolean(mediaSource(item)) && Boolean(item.mediaKind),
);
return ( return (
<div className="device-manager-stage"> <div className="device-manager-stage">
{error ? ( {error ? (
@@ -694,7 +697,10 @@ function DeviceStage({
</GlassSurface> </GlassSurface>
) : null} ) : null}
<GlassSurface className="device-manager-home" padding="lg" tone="soft"> <section
className="device-manager-home"
data-has-media={hasMedia ? "true" : undefined}
>
<EnvironmentBackdrop background={overview.background} /> <EnvironmentBackdrop background={overview.background} />
<div className="device-manager-home__scrim" aria-hidden="true" /> <div className="device-manager-home__scrim" aria-hidden="true" />
<section className="device-manager-hero"> <section className="device-manager-hero">
@@ -715,7 +721,7 @@ function DeviceStage({
</div> </div>
) : null} ) : null}
</section> </section>
</GlassSurface> </section>
</div> </div>
); );
} }
apps/device-manager/src/styles.css
+63 -31
View File
@@ -257,46 +257,56 @@ body {
.device-manager-stage { .device-manager-stage {
height: 100%; height: 100%;
overflow: auto; overflow: hidden;
padding: clamp(1rem, 2.5vw, 2.5rem);
scrollbar-width: thin;
} }
.device-manager-home { .device-manager-home {
position: relative; position: relative;
display: flex; width: 100%;
min-height: calc(100% - 1px); height: 100%;
max-width: 1420px; min-width: 0;
min-height: 0;
overflow: hidden; overflow: hidden;
flex-direction: column; border-radius: var(--nodedc-radius-card);
justify-content: center; background: var(--nodedc-canvas);
gap: clamp(3rem, 7vh, 6rem);
isolation: isolate; isolation: isolate;
margin: 0 auto;
padding: clamp(2.5rem, 6vw, 6rem) !important;
} }
.device-manager-home__media, .device-manager-home__media,
.device-manager-home__scrim { .device-manager-home__scrim {
position: absolute; position: absolute;
z-index: -2;
inset: 0; inset: 0;
width: 100%; width: 100%;
height: 100%; height: 100%;
} }
.device-manager-home__media { .device-manager-home__media {
z-index: 0;
display: block;
object-fit: cover; object-fit: cover;
} }
.device-manager-home__scrim { .device-manager-home__scrim {
z-index: -1; z-index: 1;
background: var(--nodedc-overlay-bg); background:
opacity: 0.82; linear-gradient(90deg, rgb(5 6 8 / 0.82) 0%, rgb(5 6 8 / 0.54) 46%, rgb(5 6 8 / 0.24) 100%),
linear-gradient(0deg, rgb(5 6 8 / 0.58), transparent 38%);
pointer-events: none;
}
.device-manager-home:not([data-has-media="true"]) .device-manager-home__scrim {
background:
radial-gradient(circle at 68% 42%, rgb(255 255 255 / 0.035), transparent 34%),
linear-gradient(90deg, rgb(5 6 8 / 0.2), transparent 62%);
} }
.device-manager-hero { .device-manager-hero {
max-width: 900px; position: absolute;
z-index: 2;
top: 50%;
left: clamp(2rem, 5vw, 6rem);
width: min(39rem, 50%);
transform: translateY(-55%);
} }
.device-manager-hero__icon { .device-manager-hero__icon {
@@ -316,27 +326,33 @@ body {
} }
.device-manager-hero h1 { .device-manager-hero h1 {
margin: 0.7rem 0 0.9rem; margin: 0.75rem 0 1rem;
color: var(--nodedc-text-primary); color: var(--nodedc-text-primary);
font-size: clamp(4rem, 8vw, 8.5rem); font-size: clamp(3rem, 7vw, 7.6rem);
font-weight: 520; font-weight: 600;
letter-spacing: -0.065em; letter-spacing: -0.072em;
line-height: 0.9; line-height: 0.87;
} }
.device-manager-hero p { .device-manager-hero p {
max-width: 680px; max-width: 34rem;
margin: 0; margin: 0;
color: var(--nodedc-text-secondary); color: var(--nodedc-text-secondary);
font-size: clamp(0.96rem, 1.4vw, 1.14rem); font-size: clamp(0.8rem, 1vw, 1rem);
line-height: 1.55; line-height: 1.6;
} }
.device-manager-hero__actions { .device-manager-hero__actions {
display: flex; display: flex;
flex-wrap: wrap; flex-wrap: wrap;
gap: 0.75rem; gap: 0.65rem;
margin-top: 1.5rem; margin-top: 1.6rem;
}
@media (max-width: 1480px) {
.device-manager-hero {
width: min(35rem, 54%);
}
} }
.environment-settings { .environment-settings {
@@ -948,20 +964,36 @@ body {
gap: 1rem; gap: 1rem;
} }
@media (max-height: 720px) and (min-width: 761px) {
.device-manager-hero h1 {
font-size: clamp(2.7rem, 6vw, 5rem);
}
.device-manager-hero p {
font-size: 0.76rem;
}
.device-manager-hero__actions {
margin-top: 1rem;
}
}
@media (max-width: 760px) { @media (max-width: 760px) {
body { overflow: auto; } body { overflow: auto; }
.device-manager-stage { .device-manager-stage {
padding: 1rem; overflow: hidden;
} }
.device-manager-home { .device-manager-hero {
min-height: auto; top: 42%;
padding: 2.5rem 1.25rem !important; right: 1.2rem;
left: 1.2rem;
width: auto;
} }
.device-manager-hero h1 { .device-manager-hero h1 {
font-size: clamp(3.4rem, 17vw, 6rem); font-size: clamp(2.8rem, 14vw, 5rem);
} }
.device-manager-panel-toolbar, .device-manager-panel-toolbar,
deployment/device-manager-release-v3.json
+2 -2
View File
@@ -8,8 +8,8 @@
"artifactSha256": "d4132993216eb674967dc6fc65d9670cfc2a9efdf46186ca019030f259de2d0e" "artifactSha256": "d4132993216eb674967dc6fc65d9670cfc2a9efdf46186ca019030f259de2d0e"
}, },
"controlCorePredecessor": { "controlCorePredecessor": {
"patchId": "device-control-core-release-v2-20260813-028", "patchId": "device-control-core-release-v2-20260821-030",
"artifactSha256": "816ef07fd81923328c3ff54d833dcc49f873aef13256259ae4f66061e7453635" "artifactSha256": "8459521a662541a5a87cb0188991cdcfb51727427db8ec2a232ce4846bfc3454"
}, },
"edgeChannelPredecessor": { "edgeChannelPredecessor": {
"patchId": "device-edge-core-channel-upgrade-v4-20260812-023", "patchId": "device-edge-core-channel-upgrade-v4-20260812-023",
deployment/device-manager-release-v4.json
+39
View File
@@ -0,0 +1,39 @@
{
"schemaVersion": "nodedc.device-plane.device-manager-release.v4",
"releaseId": "__PATCH_ID__",
"action": "upgrade",
"predecessor": {
"kind": "release",
"patchId": "device-manager-release-v3-20260822-032",
"artifactSha256": "6e0eb3a0a6f19ceab92d46832b93bffbcea21247dbdc2ea50625a51ff460e4ca"
},
"controlCorePredecessor": {
"patchId": "device-control-core-release-v2-20260821-030",
"artifactSha256": "8459521a662541a5a87cb0188991cdcfb51727427db8ec2a232ce4846bfc3454"
},
"edgeChannelPredecessor": {
"patchId": "device-edge-core-channel-upgrade-v4-20260812-023",
"artifactSha256": "c10d5b6b7d55ab239f85b6c8130e34ce9f84985e3b46e6e5534733156c7982fc"
},
"service": "device-manager",
"publicIngress": "reverse-proxy-only",
"deviceCoreManagementApi": "file-token-authenticated",
"launcherTrust": "file-token-scoped-to-device-core-handoff",
"edgeChannel": "preserve-active-v4-core-initiated-pinned-mtls",
"edgeChannelIdentity": "reuse-runner-managed-host-local-private-key-public-certificate-export",
"edgeChannelEgress": "preserve-dedicated-core-only-bridge-no-host-ingress-public-ipv4-tcp-443-only",
"healthGate": "bounded-container-grace+core-contract+persistent-data",
"commandTransport": "typed-service-ping-v1",
"commandCatalog": "allowlisted-adapter-typed-commands-only",
"credentialBoundary": "transient-core-memory-then-single-pinned-mtls-command-envelope-to-edge-never-persisted-never-logged-never-returned",
"presentationPersistence": "runner-managed-host-data-bind",
"presentationDataHostPath": "/volume1/docker/nodedc-device-plane/data/device-manager",
"presentationDataContainerPath": "/var/lib/nodedc-device-manager",
"presentationDataOwnership": "uid-1000-gid-1000-mode-0750",
"presentationDataLifecycle": "preserve-across-manager-recreate-and-source-rollback",
"presentationPath": "/var/lib/nodedc-device-manager/device-manager-presentation.json",
"mediaRoot": "/var/lib/nodedc-device-manager/media",
"defaultAccentHex": "#f5f5f5",
"gelios": "untouched-legacy-only",
"rollback": "restore-preapply-snapshot-preserve-manager-data"
}
deployment/device-manager-release-v5.json
+40
View File
@@ -0,0 +1,40 @@
{
"schemaVersion": "nodedc.device-plane.device-manager-release.v5",
"releaseId": "__PATCH_ID__",
"action": "upgrade",
"predecessor": {
"kind": "release",
"patchId": "device-manager-release-v4-20260822-033",
"artifactSha256": "52ba322042f1e4f595bbfea99f8bb35630b15984e0da648dc55348bc9e5b2066"
},
"controlCorePredecessor": {
"patchId": "device-control-core-release-v2-20260821-030",
"artifactSha256": "8459521a662541a5a87cb0188991cdcfb51727427db8ec2a232ce4846bfc3454"
},
"edgeChannelPredecessor": {
"patchId": "device-edge-core-channel-upgrade-v4-20260812-023",
"artifactSha256": "c10d5b6b7d55ab239f85b6c8130e34ce9f84985e3b46e6e5534733156c7982fc"
},
"service": "device-manager",
"publicIngress": "reverse-proxy-only",
"deviceCoreManagementApi": "file-token-authenticated",
"launcherTrust": "file-token-scoped-to-device-core-handoff",
"edgeChannel": "preserve-active-v4-core-initiated-pinned-mtls",
"edgeChannelIdentity": "reuse-runner-managed-host-local-private-key-public-certificate-export",
"edgeChannelEgress": "preserve-dedicated-core-only-bridge-no-host-ingress-public-ipv4-tcp-443-only",
"healthGate": "bounded-container-grace+core-contract+persistent-data",
"commandTransport": "typed-service-ping-v1",
"commandCatalog": "allowlisted-adapter-typed-commands-only",
"credentialBoundary": "transient-core-memory-then-single-pinned-mtls-command-envelope-to-edge-never-persisted-never-logged-never-returned",
"presentationPersistence": "runner-managed-host-data-bind",
"presentationDataHostPath": "/volume1/docker/nodedc-device-plane/data/device-manager",
"presentationDataContainerPath": "/var/lib/nodedc-device-manager",
"presentationDataOwnership": "uid-1000-gid-1000-mode-0750",
"presentationDataLifecycle": "preserve-across-manager-recreate-and-source-rollback",
"presentationPath": "/var/lib/nodedc-device-manager/device-manager-presentation.json",
"mediaRoot": "/var/lib/nodedc-device-manager/media",
"defaultAccentHex": "#f5f5f5",
"overviewLayout": "mission-core-landing-stage-v1",
"gelios": "untouched-legacy-only",
"rollback": "restore-preapply-snapshot-preserve-manager-data"
}
deployment/device-manager-release-v6.json
+41
View File
@@ -0,0 +1,41 @@
{
"schemaVersion": "nodedc.device-plane.device-manager-release.v6",
"releaseId": "__PATCH_ID__",
"action": "upgrade",
"predecessor": {
"kind": "release",
"patchId": "device-manager-release-v5-20260822-034",
"artifactSha256": "acc1d2ae2cda66861054826928c25d01a2428e688cc8132a9c381831bf29ab5a"
},
"controlCorePredecessor": {
"patchId": "device-control-core-release-v2-20260821-030",
"artifactSha256": "8459521a662541a5a87cb0188991cdcfb51727427db8ec2a232ce4846bfc3454"
},
"edgeChannelPredecessor": {
"patchId": "device-edge-core-channel-upgrade-v4-20260812-023",
"artifactSha256": "c10d5b6b7d55ab239f85b6c8130e34ce9f84985e3b46e6e5534733156c7982fc"
},
"service": "device-manager",
"publicIngress": "reverse-proxy-only",
"deviceCoreManagementApi": "file-token-authenticated",
"launcherTrust": "file-token-scoped-to-device-core-handoff",
"edgeChannel": "preserve-active-v4-core-initiated-pinned-mtls",
"edgeChannelIdentity": "reuse-runner-managed-host-local-private-key-public-certificate-export",
"edgeChannelEgress": "preserve-dedicated-core-only-bridge-no-host-ingress-public-ipv4-tcp-443-only",
"healthGate": "bounded-container-grace+core-contract+persistent-data",
"commandTransport": "typed-service-ping-v1",
"commandCatalog": "allowlisted-adapter-typed-commands-only",
"credentialBoundary": "transient-core-memory-then-single-pinned-mtls-command-envelope-to-edge-never-persisted-never-logged-never-returned",
"presentationPersistence": "runner-managed-host-data-bind",
"presentationDataHostPath": "/volume1/docker/nodedc-device-plane/data/device-manager",
"presentationDataContainerPath": "/var/lib/nodedc-device-manager",
"presentationDataOwnership": "uid-1000-gid-1000-mode-0750",
"presentationDataLifecycle": "preserve-across-manager-recreate-and-source-rollback",
"presentationPath": "/var/lib/nodedc-device-manager/device-manager-presentation.json",
"mediaRoot": "/var/lib/nodedc-device-manager/media",
"defaultAccentHex": "#f5f5f5",
"overviewLayout": "mission-core-landing-stage-v1",
"faviconSet": "nodedc-adaptive-v1",
"gelios": "untouched-legacy-only",
"rollback": "restore-preapply-snapshot-preserve-manager-data"
}
docker-compose.device-manager.yml
+8
View File
@@ -34,6 +34,8 @@ services:
NODEDC_LAUNCHER_INTERNAL_TOKEN_FILE: /run/nodedc-secrets/device-core-internal-token NODEDC_LAUNCHER_INTERNAL_TOKEN_FILE: /run/nodedc-secrets/device-core-internal-token
NODEDC_DEVICE_CORE_INTERNAL_URL: http://device-control-core:18120 NODEDC_DEVICE_CORE_INTERNAL_URL: http://device-control-core:18120
NODEDC_DEVICE_CORE_TOKEN_FILE: /run/nodedc-secrets/management-core-token NODEDC_DEVICE_CORE_TOKEN_FILE: /run/nodedc-secrets/management-core-token
NODEDC_DEVICE_MANAGER_PRESENTATION_PATH: /var/lib/nodedc-device-manager/device-manager-presentation.json
NODEDC_DEVICE_MANAGER_MEDIA_ROOT: /var/lib/nodedc-device-manager/media
volumes: volumes:
- type: bind - type: bind
source: /volume1/docker/nodedc-platform/secrets/device-core-internal-token source: /volume1/docker/nodedc-platform/secrets/device-core-internal-token
@@ -47,6 +49,12 @@ services:
read_only: true read_only: true
bind: bind:
create_host_path: false create_host_path: false
- type: bind
source: /volume1/docker/nodedc-device-plane/data/device-manager
target: /var/lib/nodedc-device-manager
read_only: false
bind:
create_host_path: false
expose: expose:
- "18122" - "18122"
networks: networks:
infra/deploy-runner/build-device-manager-control-plane-artifact.mjs
+136 -13
View File
@@ -11,15 +11,31 @@ const platformRoot = resolve(scriptDir, "../..");
const devicePlaneRoot = platformRoot; const devicePlaneRoot = platformRoot;
const managerRoot = resolve(platformRoot, "apps/device-manager"); const managerRoot = resolve(platformRoot, "apps/device-manager");
const artifactDir = resolve(process.env.NODEDC_DEPLOY_ARTIFACT_DIR || resolve(scriptDir, "../deploy-artifacts")); const artifactDir = resolve(process.env.NODEDC_DEPLOY_ARTIFACT_DIR || resolve(scriptDir, "../deploy-artifacts"));
const [patchId = "device-manager-release-v3-20260812-026", ...extra] = process.argv.slice(2); const [patchId = "device-manager-release-v6-20260822-035", ...extra] = process.argv.slice(2);
if (extra.length || !/^[A-Za-z0-9._-]{1,96}$/.test(patchId)) throw new Error("usage: build-device-manager-control-plane-artifact.mjs [patch-id]"); if (extra.length || !/^[A-Za-z0-9._-]{1,96}$/.test(patchId)) throw new Error("usage: build-device-manager-control-plane-artifact.mjs [patch-id]");
const descriptorPath = patchId.startsWith("device-manager-release-v3-") const descriptorPath = patchId.startsWith("device-manager-release-v6-")
? "deployment/device-manager-release-v3.json" ? "deployment/device-manager-release-v6.json"
: "deployment/device-manager-release-v1.json"; : patchId.startsWith("device-manager-release-v5-")
? "deployment/device-manager-release-v5.json"
: patchId.startsWith("device-manager-release-v4-")
? "deployment/device-manager-release-v4.json"
: patchId.startsWith("device-manager-release-v3-")
? "deployment/device-manager-release-v3.json"
: "deployment/device-manager-release-v1.json";
const isV3 = descriptorPath.endsWith("release-v3.json"); const isV3 = descriptorPath.endsWith("release-v3.json");
const entries = isV3 ? [ const isV4 = descriptorPath.endsWith("release-v4.json");
const isV5 = descriptorPath.endsWith("release-v5.json");
const isV6 = descriptorPath.endsWith("release-v6.json");
const isPersistent = isV4 || isV5 || isV6;
const isManagerOnly = isV3 || isPersistent;
const composeSource = resolve(devicePlaneRoot, "docker-compose.device-manager.yml");
const composeSourceSha256 = createHash("sha256").update(await readFile(composeSource)).digest("hex");
if (!isPersistent && composeSourceSha256 !== "4954120aaddc999798b64c304d8cf692b79714feb727d873117bd1f3434e865e") {
throw new Error("historical_device_manager_compose_has_advanced");
}
const entries = isManagerOnly ? [
"docker-compose.device-manager.yml", "docker-compose.device-manager.yml",
"services/device-manager", "services/device-manager",
descriptorPath, descriptorPath,
@@ -70,7 +86,7 @@ try {
} }
await copySafe(resolve(devicePlaneRoot, entry), join(payload, entry), devicePlaneRoot); await copySafe(resolve(devicePlaneRoot, entry), join(payload, entry), devicePlaneRoot);
} }
if (!isV3) { if (!isManagerOnly) {
await validateDockerCopySources( await validateDockerCopySources(
join(payload, "services/device-control-core/Dockerfile"), join(payload, "services/device-control-core/Dockerfile"),
payload, payload,
@@ -80,7 +96,7 @@ try {
join(payload, "services/device-manager/Dockerfile"), join(payload, "services/device-manager/Dockerfile"),
join(payload, "services/device-manager"), join(payload, "services/device-manager"),
); );
for (const modulePath of isV3 ? [] : [ for (const modulePath of isManagerOnly ? [] : [
"services/device-control-core/src/sensitive-reference-management.mjs", "services/device-control-core/src/sensitive-reference-management.mjs",
"services/device-control-core/src/device-gateway-core-runtime.mjs", "services/device-control-core/src/device-gateway-core-runtime.mjs",
"packages/device-edge-channel-contract/src/index.mjs", "packages/device-edge-channel-contract/src/index.mjs",
@@ -111,6 +127,14 @@ try {
"NODEDC_LAUNCHER_INTERNAL_TOKEN_FILE: /run/nodedc-secrets/device-core-internal-token", "NODEDC_LAUNCHER_INTERNAL_TOKEN_FILE: /run/nodedc-secrets/device-core-internal-token",
"NODEDC_DEVICE_CORE_TOKEN_FILE: /run/nodedc-secrets/management-core-token", "NODEDC_DEVICE_CORE_TOKEN_FILE: /run/nodedc-secrets/management-core-token",
"name: nodedc-platform_edge", "name: nodedc-platform_edge",
...(isPersistent ? [
"NODEDC_DEVICE_MANAGER_PRESENTATION_PATH: /var/lib/nodedc-device-manager/device-manager-presentation.json",
"NODEDC_DEVICE_MANAGER_MEDIA_ROOT: /var/lib/nodedc-device-manager/media",
"source: /volume1/docker/nodedc-device-plane/data/device-manager",
"target: /var/lib/nodedc-device-manager",
"read_only: false",
"create_host_path: false",
] : []),
]) if (!compose.includes(required)) throw new Error(`device_manager_compose_contract_missing:${required}`); ]) if (!compose.includes(required)) throw new Error(`device_manager_compose_contract_missing:${required}`);
for (const forbidden of [ for (const forbidden of [
"NODEDC_INTERNAL_ACCESS_TOKEN:", "NODEDC_INTERNAL_ACCESS_TOKEN:",
@@ -135,18 +159,117 @@ try {
|| !/^[A-Za-z0-9._-]{1,96}$/.test(predecessor.patchId || "") || !/^[A-Za-z0-9._-]{1,96}$/.test(predecessor.patchId || "")
|| !/^[a-f0-9]{64}$/.test(predecessor.artifactSha256 || "") || !/^[a-f0-9]{64}$/.test(predecessor.artifactSha256 || "")
|| (descriptor.action === "activate") !== (predecessor.kind === "reconciliation") || (descriptor.action === "activate") !== (predecessor.kind === "reconciliation")
|| descriptor.healthGate !== "bounded-container-grace+core-contract" || descriptor.healthGate !== (isPersistent
|| descriptor.rollback !== "restore-preapply-snapshot" ? "bounded-container-grace+core-contract+persistent-data"
: "bounded-container-grace+core-contract")
|| descriptor.rollback !== (isPersistent
? "restore-preapply-snapshot-preserve-manager-data"
: "restore-preapply-snapshot")
); );
if (commonContractInvalid) throw new Error("device_manager_activation_successor_contract_mismatch"); if (commonContractInvalid) throw new Error("device_manager_activation_successor_contract_mismatch");
if (descriptorPath.endsWith("release-v3.json")) { if (descriptorPath.endsWith("release-v6.json")) {
if (
descriptor.schemaVersion !== "nodedc.device-plane.device-manager-release.v6"
|| descriptor.predecessor?.kind !== "release"
|| descriptor.predecessor?.patchId !== "device-manager-release-v5-20260822-034"
|| descriptor.predecessor?.artifactSha256 !== "acc1d2ae2cda66861054826928c25d01a2428e688cc8132a9c381831bf29ab5a"
|| descriptor.commandTransport !== "typed-service-ping-v1"
|| descriptor.commandCatalog !== "allowlisted-adapter-typed-commands-only"
|| descriptor.credentialBoundary !== "transient-core-memory-then-single-pinned-mtls-command-envelope-to-edge-never-persisted-never-logged-never-returned"
|| descriptor.controlCorePredecessor?.patchId !== "device-control-core-release-v2-20260821-030"
|| descriptor.controlCorePredecessor?.artifactSha256 !== "8459521a662541a5a87cb0188991cdcfb51727427db8ec2a232ce4846bfc3454"
|| descriptor.edgeChannelPredecessor?.patchId !== "device-edge-core-channel-upgrade-v4-20260812-023"
|| descriptor.edgeChannelPredecessor?.artifactSha256 !== "c10d5b6b7d55ab239f85b6c8130e34ce9f84985e3b46e6e5534733156c7982fc"
|| descriptor.presentationPersistence !== "runner-managed-host-data-bind"
|| descriptor.presentationDataHostPath !== "/volume1/docker/nodedc-device-plane/data/device-manager"
|| descriptor.presentationDataContainerPath !== "/var/lib/nodedc-device-manager"
|| descriptor.presentationDataOwnership !== "uid-1000-gid-1000-mode-0750"
|| descriptor.presentationDataLifecycle !== "preserve-across-manager-recreate-and-source-rollback"
|| descriptor.presentationPath !== "/var/lib/nodedc-device-manager/device-manager-presentation.json"
|| descriptor.mediaRoot !== "/var/lib/nodedc-device-manager/media"
|| descriptor.defaultAccentHex !== "#f5f5f5"
|| descriptor.overviewLayout !== "mission-core-landing-stage-v1"
|| descriptor.faviconSet !== "nodedc-adaptive-v1"
|| descriptor.rollback !== "restore-preapply-snapshot-preserve-manager-data"
|| descriptor.gelios !== "untouched-legacy-only"
) throw new Error("device_manager_v6_favicon_contract_mismatch");
const faviconHashes = {
"favicon.ico": "f8933114a85646335ea5c94944f56d3cd8c48a6032016719f7905ff244ec0aa2",
"favicon/favicon.ico": "f8933114a85646335ea5c94944f56d3cd8c48a6032016719f7905ff244ec0aa2",
"favicon/icon-adaptive.svg": "481984e83997d786bb0a72ad1ee80037db13aef3a0792ab3109df95c2199b38e",
"favicon/apple-touch-icon.png": "afdccc28152a566e264e533ca218362f05d5bcec936c647f9a54f414c0bd4763",
"favicon/icon-192.png": "5b10a24feb4754f15c69761cef42f91a01f885d04095156b1a12e254875fdd4d",
"favicon/icon-512.png": "f98bac3dba59b7eefbe89f8bb8abc25567226a54ab7ed3b6b1a4caffbdd9ee15",
"favicon/manifest.webmanifest.json": "2a8ecdc6e6c64833f812ae02bbc0c7bd9b435e0cfa75cc21d6edf054d41275fc",
};
for (const [relativePath, expectedSha256] of Object.entries(faviconHashes)) {
const content = await readFile(join(payload, "services/device-manager/dist", relativePath));
const actualSha256 = createHash("sha256").update(content).digest("hex");
if (actualSha256 !== expectedSha256) throw new Error(`device_manager_v6_favicon_hash_mismatch:${relativePath}`);
}
const indexHtml = await readFile(join(payload, "services/device-manager/dist/index.html"), "utf8");
for (const requiredLink of [
'href="/favicon/icon-adaptive.svg"',
'href="/favicon/favicon.ico"',
'href="/favicon/apple-touch-icon.png"',
'href="/favicon/icon-192.png"',
'href="/favicon/icon-512.png"',
'href="/favicon/manifest.webmanifest.json"',
]) if (!indexHtml.includes(requiredLink)) throw new Error(`device_manager_v6_favicon_link_missing:${requiredLink}`);
} else if (descriptorPath.endsWith("release-v5.json")) {
if (
descriptor.schemaVersion !== "nodedc.device-plane.device-manager-release.v5"
|| descriptor.predecessor?.kind !== "release"
|| descriptor.predecessor?.patchId !== "device-manager-release-v4-20260822-033"
|| descriptor.predecessor?.artifactSha256 !== "52ba322042f1e4f595bbfea99f8bb35630b15984e0da648dc55348bc9e5b2066"
|| descriptor.commandTransport !== "typed-service-ping-v1"
|| descriptor.commandCatalog !== "allowlisted-adapter-typed-commands-only"
|| descriptor.credentialBoundary !== "transient-core-memory-then-single-pinned-mtls-command-envelope-to-edge-never-persisted-never-logged-never-returned"
|| descriptor.controlCorePredecessor?.patchId !== "device-control-core-release-v2-20260821-030"
|| descriptor.controlCorePredecessor?.artifactSha256 !== "8459521a662541a5a87cb0188991cdcfb51727427db8ec2a232ce4846bfc3454"
|| descriptor.edgeChannelPredecessor?.patchId !== "device-edge-core-channel-upgrade-v4-20260812-023"
|| descriptor.edgeChannelPredecessor?.artifactSha256 !== "c10d5b6b7d55ab239f85b6c8130e34ce9f84985e3b46e6e5534733156c7982fc"
|| descriptor.presentationPersistence !== "runner-managed-host-data-bind"
|| descriptor.presentationDataHostPath !== "/volume1/docker/nodedc-device-plane/data/device-manager"
|| descriptor.presentationDataContainerPath !== "/var/lib/nodedc-device-manager"
|| descriptor.presentationDataOwnership !== "uid-1000-gid-1000-mode-0750"
|| descriptor.presentationDataLifecycle !== "preserve-across-manager-recreate-and-source-rollback"
|| descriptor.presentationPath !== "/var/lib/nodedc-device-manager/device-manager-presentation.json"
|| descriptor.mediaRoot !== "/var/lib/nodedc-device-manager/media"
|| descriptor.defaultAccentHex !== "#f5f5f5"
|| descriptor.overviewLayout !== "mission-core-landing-stage-v1"
|| descriptor.rollback !== "restore-preapply-snapshot-preserve-manager-data"
|| descriptor.gelios !== "untouched-legacy-only"
) throw new Error("device_manager_v5_overview_layout_contract_mismatch");
} else if (descriptorPath.endsWith("release-v4.json")) {
if (
descriptor.schemaVersion !== "nodedc.device-plane.device-manager-release.v4"
|| descriptor.commandTransport !== "typed-service-ping-v1"
|| descriptor.commandCatalog !== "allowlisted-adapter-typed-commands-only"
|| descriptor.credentialBoundary !== "transient-core-memory-then-single-pinned-mtls-command-envelope-to-edge-never-persisted-never-logged-never-returned"
|| descriptor.controlCorePredecessor?.patchId !== "device-control-core-release-v2-20260821-030"
|| descriptor.controlCorePredecessor?.artifactSha256 !== "8459521a662541a5a87cb0188991cdcfb51727427db8ec2a232ce4846bfc3454"
|| descriptor.edgeChannelPredecessor?.patchId !== "device-edge-core-channel-upgrade-v4-20260812-023"
|| descriptor.edgeChannelPredecessor?.artifactSha256 !== "c10d5b6b7d55ab239f85b6c8130e34ce9f84985e3b46e6e5534733156c7982fc"
|| descriptor.presentationPersistence !== "runner-managed-host-data-bind"
|| descriptor.presentationDataHostPath !== "/volume1/docker/nodedc-device-plane/data/device-manager"
|| descriptor.presentationDataContainerPath !== "/var/lib/nodedc-device-manager"
|| descriptor.presentationDataOwnership !== "uid-1000-gid-1000-mode-0750"
|| descriptor.presentationDataLifecycle !== "preserve-across-manager-recreate-and-source-rollback"
|| descriptor.presentationPath !== "/var/lib/nodedc-device-manager/device-manager-presentation.json"
|| descriptor.mediaRoot !== "/var/lib/nodedc-device-manager/media"
|| descriptor.defaultAccentHex !== "#f5f5f5"
|| descriptor.rollback !== "restore-preapply-snapshot-preserve-manager-data"
|| descriptor.gelios !== "untouched-legacy-only"
) throw new Error("device_manager_v4_persistence_contract_mismatch");
} else if (descriptorPath.endsWith("release-v3.json")) {
if ( if (
descriptor.schemaVersion !== "nodedc.device-plane.device-manager-release.v3" descriptor.schemaVersion !== "nodedc.device-plane.device-manager-release.v3"
|| descriptor.commandTransport !== "typed-service-ping-v1" || descriptor.commandTransport !== "typed-service-ping-v1"
|| descriptor.commandCatalog !== "allowlisted-adapter-typed-commands-only" || descriptor.commandCatalog !== "allowlisted-adapter-typed-commands-only"
|| descriptor.credentialBoundary !== "transient-core-memory-then-single-pinned-mtls-command-envelope-to-edge-never-persisted-never-logged-never-returned" || descriptor.credentialBoundary !== "transient-core-memory-then-single-pinned-mtls-command-envelope-to-edge-never-persisted-never-logged-never-returned"
|| descriptor.controlCorePredecessor?.patchId !== "device-control-core-release-v2-20260813-028" || descriptor.controlCorePredecessor?.patchId !== "device-control-core-release-v2-20260821-030"
|| descriptor.controlCorePredecessor?.artifactSha256 !== "816ef07fd81923328c3ff54d833dcc49f873aef13256259ae4f66061e7453635" || descriptor.controlCorePredecessor?.artifactSha256 !== "8459521a662541a5a87cb0188991cdcfb51727427db8ec2a232ce4846bfc3454"
|| descriptor.edgeChannelPredecessor?.patchId !== "device-edge-core-channel-upgrade-v4-20260812-023" || descriptor.edgeChannelPredecessor?.patchId !== "device-edge-core-channel-upgrade-v4-20260812-023"
|| descriptor.edgeChannelPredecessor?.artifactSha256 !== "c10d5b6b7d55ab239f85b6c8130e34ce9f84985e3b46e6e5534733156c7982fc" || descriptor.edgeChannelPredecessor?.artifactSha256 !== "c10d5b6b7d55ab239f85b6c8130e34ce9f84985e3b46e6e5534733156c7982fc"
|| descriptor.edgeChannel !== "preserve-active-v4-core-initiated-pinned-mtls" || descriptor.edgeChannel !== "preserve-active-v4-core-initiated-pinned-mtls"
@@ -173,7 +296,7 @@ try {
artifact: target, artifact: target,
sha256, sha256,
entries, entries,
services: isV3 ? ["device-manager"] : ["device-control-core", "device-manager"], services: isManagerOnly ? ["device-manager"] : ["device-control-core", "device-manager"],
preserved: ["device-postgres", "device-gateway", "device-backhaul-target", "Gelios"], preserved: ["device-postgres", "device-gateway", "device-backhaul-target", "Gelios"],
}, null, 2)); }, null, 2));
} finally { } finally {
infra/deploy-runner/test_device_manager_control_plane_artifacts.py
+356 -11
View File
@@ -43,7 +43,11 @@ LAUNCHER_HUB_SERVICE_TRUST_UI_ENTRIES = (
) )
def healthy_device_plane_inventory(*, include_manager=False): def healthy_device_plane_inventory(
*,
include_manager=False,
include_backhaul=False,
):
services = [ services = [
("device-control-core", "a"), ("device-control-core", "a"),
("device-gateway", "b"), ("device-gateway", "b"),
@@ -51,6 +55,8 @@ def healthy_device_plane_inventory(*, include_manager=False):
] ]
if include_manager: if include_manager:
services.append(("device-manager", "d")) services.append(("device-manager", "d"))
if include_backhaul:
services.append(("device-backhaul-target", "e"))
return { return {
"schemaVersion": "nodedc.device-plane.runtime-inventory.v1", "schemaVersion": "nodedc.device-plane.runtime-inventory.v1",
"composeProject": "nodedc-device-plane", "composeProject": "nodedc-device-plane",
@@ -131,6 +137,13 @@ def device_manager_release_v3_descriptor(
class DeviceManagerControlPlaneArtifactsTest(unittest.TestCase): class DeviceManagerControlPlaneArtifactsTest(unittest.TestCase):
def historical_manager_compose_is_current(self):
compose = DEVICE_CORE_ROOT / "docker-compose.device-manager.yml"
return (
hashlib.sha256(compose.read_bytes()).hexdigest()
== RUNNER.DEVICE_PLANE_MANAGER_RELEASE_V1_COMPOSE_SHA256
)
def build(self, script, patch_id, artifact_dir): def build(self, script, patch_id, artifact_dir):
environment = os.environ.copy() environment = os.environ.copy()
environment["NODEDC_DEPLOY_ARTIFACT_DIR"] = str(artifact_dir) environment["NODEDC_DEPLOY_ARTIFACT_DIR"] = str(artifact_dir)
@@ -215,6 +228,8 @@ class DeviceManagerControlPlaneArtifactsTest(unittest.TestCase):
self.assertEqual(result["services"], ["launcher"]) self.assertEqual(result["services"], ["launcher"])
def test_device_manager_artifact_selects_only_core_and_manager(self): def test_device_manager_artifact_selects_only_core_and_manager(self):
if not self.historical_manager_compose_is_current():
self.skipTest("historical Manager v1 Compose has advanced to v4")
manifest, entries, names, result = self.assert_deterministic_artifact( manifest, entries, names, result = self.assert_deterministic_artifact(
"build-device-manager-control-plane-artifact.mjs", "build-device-manager-control-plane-artifact.mjs",
"device-manager-control-plane-unit-001", "device-manager-control-plane-unit-001",
@@ -287,6 +302,8 @@ class DeviceManagerControlPlaneArtifactsTest(unittest.TestCase):
self.assertEqual(checks[0]["expected_json"]["discoveryIngest"], "enabled") self.assertEqual(checks[0]["expected_json"]["discoveryIngest"], "enabled")
def test_device_manager_release_v3_is_exact_typed_and_secret_free(self): def test_device_manager_release_v3_is_exact_typed_and_secret_free(self):
if not self.historical_manager_compose_is_current():
self.skipTest("historical Manager v3 Compose has advanced to v4")
patch_id = "device-manager-release-v3-unit-001" patch_id = "device-manager-release-v3-unit-001"
manifest, entries, names, result = self.assert_deterministic_artifact( manifest, entries, names, result = self.assert_deterministic_artifact(
"build-device-manager-control-plane-artifact.mjs", "build-device-manager-control-plane-artifact.mjs",
@@ -299,6 +316,23 @@ class DeviceManagerControlPlaneArtifactsTest(unittest.TestCase):
("device-manager",), ("device-manager",),
) )
self.assertEqual(result["services"], ["device-manager"]) self.assertEqual(result["services"], ["device-manager"])
template = json.loads(
(
DEVICE_CORE_ROOT
/ "deployment/device-manager-release-v3.json"
).read_text(encoding="utf-8")
)
self.assertEqual(
template["controlCorePredecessor"],
{
"patchId": (
"device-control-core-release-v2-20260821-030"
),
"artifactSha256": (
"8459521a662541a5a87cb0188991cdcfb51727427db8ec2a232ce4846bfc3454"
),
},
)
self.assertIn( self.assertIn(
"payload/deployment/device-manager-release-v3.json", "payload/deployment/device-manager-release-v3.json",
names, names,
@@ -337,6 +371,233 @@ class DeviceManagerControlPlaneArtifactsTest(unittest.TestCase):
) )
) )
def test_device_manager_release_v4_is_persistent_manager_only_and_white(self):
patch_id = "device-manager-release-v4-unit-001"
manifest, entries, names, result = self.assert_deterministic_artifact(
"build-device-manager-control-plane-artifact.mjs",
patch_id,
RUNNER.DEVICE_PLANE_MANAGER_RELEASE_V4_ENTRIES,
)
self.assertEqual(manifest["component"], "device-plane")
self.assertEqual(
RUNNER.component_services("device-plane", entries),
("device-manager",),
)
self.assertEqual(result["services"], ["device-manager"])
self.assertIn(
"payload/deployment/device-manager-release-v4.json",
names,
)
self.assertFalse(
any(name.startswith("payload/services/device-control-core/") for name in names)
)
self.assertFalse(any(name.startswith("payload/packages/") for name in names))
self.assertFalse(any(name.endswith(".test.mjs") for name in names))
template = json.loads(
(
DEVICE_CORE_ROOT
/ "deployment/device-manager-release-v4.json"
).read_text(encoding="utf-8")
)
descriptor = {
**template,
"releaseId": patch_id,
}
self.assertIs(
RUNNER.validate_device_plane_manager_release_descriptor(
descriptor,
schema_version=(
"nodedc.device-plane.device-manager-release.v4"
),
boundaries=(
RUNNER.expected_device_plane_manager_release_v4_boundaries()
),
expected_release_id=patch_id,
),
descriptor,
)
self.assertEqual(descriptor["defaultAccentHex"], "#f5f5f5")
self.assertEqual(
descriptor["predecessor"],
{
"kind": "release",
"patchId": "device-manager-release-v3-20260822-032",
"artifactSha256": (
"6e0eb3a0a6f19ceab92d46832b93bffbcea21247dbdc2ea50625a51ff460e4ca"
),
},
)
compose = (
DEVICE_CORE_ROOT / "docker-compose.device-manager.yml"
).read_text(encoding="utf-8")
for expected in (
"NODEDC_DEVICE_MANAGER_PRESENTATION_PATH: "
"/var/lib/nodedc-device-manager/device-manager-presentation.json",
"NODEDC_DEVICE_MANAGER_MEDIA_ROOT: "
"/var/lib/nodedc-device-manager/media",
"source: /volume1/docker/nodedc-device-plane/data/device-manager",
"target: /var/lib/nodedc-device-manager",
"read_only: false",
"create_host_path: false",
):
self.assertIn(expected, compose)
self.assertTrue(
RUNNER.is_device_plane_manager_release_v4_slice(
"device-plane",
entries,
)
)
def test_device_manager_release_v5_matches_mission_core_landing_geometry(self):
patch_id = "device-manager-release-v5-unit-001"
manifest, entries, names, result = self.assert_deterministic_artifact(
"build-device-manager-control-plane-artifact.mjs",
patch_id,
RUNNER.DEVICE_PLANE_MANAGER_RELEASE_V5_ENTRIES,
)
self.assertEqual(manifest["component"], "device-plane")
self.assertEqual(result["services"], ["device-manager"])
self.assertFalse(
any(
name.startswith("payload/services/device-control-core/")
for name in names
)
)
self.assertFalse(any(name.startswith("payload/packages/") for name in names))
self.assertFalse(
any(name.endswith((".test.mjs", ".map")) for name in names)
)
template = json.loads(
(
DEVICE_CORE_ROOT
/ "deployment/device-manager-release-v5.json"
).read_text(encoding="utf-8")
)
descriptor = {**template, "releaseId": patch_id}
self.assertIs(
RUNNER.validate_device_plane_manager_release_descriptor(
descriptor,
schema_version=(
"nodedc.device-plane.device-manager-release.v5"
),
boundaries=(
RUNNER.expected_device_plane_manager_release_v5_boundaries()
),
expected_release_id=patch_id,
),
descriptor,
)
self.assertEqual(
descriptor["overviewLayout"],
"mission-core-landing-stage-v1",
)
self.assertEqual(
descriptor["predecessor"],
{
"kind": "release",
"patchId": "device-manager-release-v4-20260822-033",
"artifactSha256": (
"52ba322042f1e4f595bbfea99f8bb35630b15984e0da648dc55348bc9e5b2066"
),
},
)
self.assertTrue(
RUNNER.is_device_plane_manager_release_v5_slice(
"device-plane",
entries,
)
)
def test_device_manager_release_v6_includes_canonical_favicon_set(self):
patch_id = "device-manager-release-v6-unit-001"
manifest, entries, names, result = self.assert_deterministic_artifact(
"build-device-manager-control-plane-artifact.mjs",
patch_id,
RUNNER.DEVICE_PLANE_MANAGER_RELEASE_V6_ENTRIES,
)
self.assertEqual(manifest["component"], "device-plane")
self.assertEqual(result["services"], ["device-manager"])
self.assertFalse(
any(name.startswith("payload/services/device-control-core/") for name in names)
)
self.assertFalse(any(name.startswith("payload/packages/") for name in names))
self.assertFalse(any(name.endswith((".test.mjs", ".map")) for name in names))
for name in (
"payload/services/device-manager/dist/favicon.ico",
"payload/services/device-manager/dist/favicon/favicon.ico",
"payload/services/device-manager/dist/favicon/icon-adaptive.svg",
"payload/services/device-manager/dist/favicon/apple-touch-icon.png",
"payload/services/device-manager/dist/favicon/icon-192.png",
"payload/services/device-manager/dist/favicon/icon-512.png",
"payload/services/device-manager/dist/favicon/manifest.webmanifest.json",
):
self.assertIn(name, names)
template = json.loads(
(
DEVICE_CORE_ROOT
/ "deployment/device-manager-release-v6.json"
).read_text(encoding="utf-8")
)
descriptor = {**template, "releaseId": patch_id}
self.assertIs(
RUNNER.validate_device_plane_manager_release_descriptor(
descriptor,
schema_version=(
"nodedc.device-plane.device-manager-release.v6"
),
boundaries=(
RUNNER.expected_device_plane_manager_release_v6_boundaries()
),
expected_release_id=patch_id,
),
descriptor,
)
self.assertEqual(descriptor["faviconSet"], "nodedc-adaptive-v1")
self.assertEqual(
descriptor["predecessor"],
{
"kind": "release",
"patchId": "device-manager-release-v5-20260822-034",
"artifactSha256": (
"acc1d2ae2cda66861054826928c25d01a2428e688cc8132a9c381831bf29ab5a"
),
},
)
self.assertTrue(
RUNNER.is_device_plane_manager_release_v6_slice(
"device-plane",
entries,
)
)
def test_historical_manager_builder_fails_closed_after_v4_compose(self):
if self.historical_manager_compose_is_current():
self.skipTest("historical Manager Compose is still current")
with tempfile.TemporaryDirectory(
prefix="nodedc-device-manager-historical-reject-",
) as directory:
environment = os.environ.copy()
environment["NODEDC_DEPLOY_ARTIFACT_DIR"] = directory
completed = subprocess.run(
[
"node",
str(
SCRIPT_DIR
/ "build-device-manager-control-plane-artifact.mjs"
),
"device-manager-release-v3-rebuild-forbidden-001",
],
cwd=DEVICE_CORE_ROOT,
env=environment,
capture_output=True,
text=True,
)
self.assertNotEqual(completed.returncode, 0)
self.assertIn(
"historical_device_manager_compose_has_advanced",
completed.stderr,
)
def test_edge_core_channel_bootstrap_is_core_only_and_secret_free(self): def test_edge_core_channel_bootstrap_is_core_only_and_secret_free(self):
manifest, entries, names, result = self.assert_deterministic_artifact( manifest, entries, names, result = self.assert_deterministic_artifact(
"build-device-edge-core-channel-bootstrap-artifact.mjs", "build-device-edge-core-channel-bootstrap-artifact.mjs",
@@ -599,6 +860,7 @@ class DeviceManagerControlPlaneArtifactsTest(unittest.TestCase):
("device-plane", "device-manager"), ("device-plane", "device-manager"),
("device-plane", "device-gateway"), ("device-plane", "device-gateway"),
("device-plane", "device-postgres"), ("device-plane", "device-postgres"),
("device-plane", "device-backhaul-target"),
], ],
) )
url_health.assert_called_once_with( url_health.assert_called_once_with(
@@ -849,6 +1111,11 @@ class DeviceManagerControlPlaneArtifactsTest(unittest.TestCase):
"inspect_device_edge_channel_core_identity_state", "inspect_device_edge_channel_core_identity_state",
return_value="valid-reuse-at-apply", return_value="valid-reuse-at-apply",
), ),
mock.patch.object(
RUNNER,
"validate_device_plane_control_core_selected_predecessor_runtime",
return_value={"health": "unhealthy"},
),
mock.patch.object(RUNNER, "healthcheck_compose_service"), mock.patch.object(RUNNER, "healthcheck_compose_service"),
mock.patch.object( mock.patch.object(
RUNNER, RUNNER,
@@ -857,7 +1124,8 @@ class DeviceManagerControlPlaneArtifactsTest(unittest.TestCase):
): ):
result = ( result = (
RUNNER.validate_device_plane_control_core_release_predecessor( RUNNER.validate_device_plane_control_core_release_predecessor(
root / "candidate-payload" root / "candidate-payload",
preflight_phase="plan",
) )
) )
@@ -1485,6 +1753,64 @@ class DeviceManagerControlPlaneArtifactsTest(unittest.TestCase):
) )
runtime_acceptance.assert_called_once_with() runtime_acceptance.assert_called_once_with()
def test_manager_v3_apply_gate_uses_private_egress_core_boundary(self):
entries = RUNNER.DEVICE_PLANE_MANAGER_RELEASE_V3_ENTRIES
services = ("device-manager",)
with (
mock.patch.object(
RUNNER,
"healthcheck_compose_service_with_grace",
) as service_health,
mock.patch.object(RUNNER, "healthcheck_url") as url_health,
mock.patch.object(
RUNNER,
"validate_device_manager_control_plane_runtime",
) as runtime_acceptance,
):
RUNNER.run_healthchecks("device-plane", entries, services)
service_health.assert_called_once_with(
"device-plane",
"device-manager",
)
self.assertEqual(
[call.args for call in url_health.call_args_list],
[
(check,)
for check in RUNNER.component_healthchecks(
"device-plane",
entries,
services,
)
],
)
runtime_acceptance.assert_called_once_with(
require_edge_channel=True,
core_network_mode="private-egress",
)
def test_manager_v4_apply_gate_requires_persistent_data_boundary(self):
entries = RUNNER.DEVICE_PLANE_MANAGER_RELEASE_V4_ENTRIES
services = ("device-manager",)
with (
mock.patch.object(
RUNNER,
"healthcheck_compose_service_with_grace",
),
mock.patch.object(RUNNER, "healthcheck_url"),
mock.patch.object(
RUNNER,
"validate_device_manager_control_plane_runtime",
) as runtime_acceptance,
):
RUNNER.run_healthchecks("device-plane", entries, services)
runtime_acceptance.assert_called_once_with(
require_edge_channel=True,
core_network_mode="private-egress",
require_persistent_data=True,
)
def test_upgrade_v2_apply_gate_checks_preserved_runtime_and_edge_contract(self): def test_upgrade_v2_apply_gate_checks_preserved_runtime_and_edge_contract(self):
entries = RUNNER.DEVICE_PLANE_EDGE_CORE_CHANNEL_UPGRADE_V2_ENTRIES entries = RUNNER.DEVICE_PLANE_EDGE_CORE_CHANNEL_UPGRADE_V2_ENTRIES
services = ("device-control-core",) services = ("device-control-core",)
@@ -1648,7 +1974,8 @@ class DeviceManagerControlPlaneArtifactsTest(unittest.TestCase):
): ):
result = ( result = (
RUNNER.validate_device_plane_manager_activation_predecessor( RUNNER.validate_device_plane_manager_activation_predecessor(
root / "payload" root / "payload",
preflight_phase="plan",
) )
) )
@@ -1782,18 +2109,15 @@ class DeviceManagerControlPlaneArtifactsTest(unittest.TestCase):
): ):
result = ( result = (
RUNNER.validate_device_plane_manager_activation_predecessor( RUNNER.validate_device_plane_manager_activation_predecessor(
root / "candidate-payload" root / "candidate-payload",
preflight_phase="plan",
) )
) )
self.assertEqual(result["mode"], "active-manager-forward-upgrade") self.assertEqual(result["mode"], "active-manager-forward-upgrade")
self.assertEqual( self.assertEqual(
[call.args for call in health.call_args_list], [call.args for call in health.call_args_list],
[ [],
("device-plane", "device-control-core"),
("device-plane", "device-manager"),
("device-plane", "device-postgres"),
],
) )
def test_initial_install_rollback_removes_manager_and_restores_core_only(self): def test_initial_install_rollback_removes_manager_and_restores_core_only(self):
@@ -2110,9 +2434,13 @@ class DeviceManagerControlPlaneArtifactsTest(unittest.TestCase):
encoding="utf-8", encoding="utf-8",
) )
(backup / "runtime-before.json").write_text( (backup / "runtime-before.json").write_text(
json.dumps(healthy_device_plane_inventory(include_manager=True)), json.dumps(healthy_device_plane_inventory(
include_manager=True,
include_backhaul=True,
)),
encoding="utf-8", encoding="utf-8",
) )
restored_core_id = "f" * 64
with ( with (
mock.patch.object( mock.patch.object(
RUNNER, RUNNER,
@@ -2131,6 +2459,23 @@ class DeviceManagerControlPlaneArtifactsTest(unittest.TestCase):
RUNNER, RUNNER,
"healthcheck_compose_service_with_grace", "healthcheck_compose_service_with_grace",
) as restore_health, ) as restore_health,
mock.patch.object(
RUNNER,
"compose_service_container_id",
return_value=restored_core_id,
),
mock.patch.object(
RUNNER,
"inspect_device_plane_container",
return_value={
"Id": restored_core_id,
"State": {
"Status": "running",
"Running": True,
"Health": {"Status": "healthy"},
},
},
),
mock.patch.object( mock.patch.object(
RUNNER, RUNNER,
"validate_device_manager_control_plane_runtime", "validate_device_manager_control_plane_runtime",
@@ -2154,10 +2499,10 @@ class DeviceManagerControlPlaneArtifactsTest(unittest.TestCase):
self.assertEqual( self.assertEqual(
[call.args for call in restore_health.call_args_list], [call.args for call in restore_health.call_args_list],
[ [
("device-plane", "device-control-core"),
("device-plane", "device-manager"), ("device-plane", "device-manager"),
("device-plane", "device-gateway"), ("device-plane", "device-gateway"),
("device-plane", "device-postgres"), ("device-plane", "device-postgres"),
("device-plane", "device-backhaul-target"),
], ],
) )
runtime_acceptance.assert_called_once_with( runtime_acceptance.assert_called_once_with(