{
  "schemaVersion": "nodedc.device-edge-vps.core-channel.v1",
  "mode": "provider-neutral-core-initiated-mtls-http2",
  "status": "closed-tracker-ingress",
  "authority": "DCPLATFORM-21/DCPLATFORM-76/ADR-0001",
  "component": "device-edge-vps",
  "phase": "core-channel",
  "runtimeHost": "koffyvngij",
  "runtimeUser": "nodedc-channel",
  "runtimeService": "nodedc-device-edge-channel.service",
  "runtime": "accepted-node-v22.23.2-no-docker",
  "publicIngress": "tcp/443-mtls-only",
  "health": "127.0.0.1:18222",
  "trackerIngress": "disabled",
  "rawDeviceTcp9921": "closed",
  "commandTransport": "disabled",
  "gelios": "untouched",
  "privateKeyBoundary": "runner-managed-host-local-only",
  "peerTrustPrerequisite": "exact-pinned-self-signed-core-certificate-and-fingerprint",
  "tls": "TLSv1.3+h2+mutual-authentication",
  "networkPrivilege": "CAP_NET_BIND_SERVICE-only-for-non-root-tcp-443",
  "resourceCeilings": {
    "memory": "128M",
    "swap": "0",
    "cpu": "50%",
    "tasks": 64,
    "openFiles": 1024
  },
  "preserved": [
    "management-ssh-key",
    "accepted-node-runtime",
    "foundation-source",
    "gelios-production-path"
  ],
  "forbidden": [
    "vps-initiated-synology-connection",
    "generic-tcp-forwarding",
    "tailscale-ssh-backhaul",
    "docker",
    "public-health",
    "tracker-tcp/9921"
  ],
  "acceptance": [
    "exact-non-root-runtime-identity",
    "tls13-h2-mutual-authentication",
    "edge-server-and-core-client-self-signed-identities-mutually-pinned",
    "core-initiated-channel-accepted",
    "unknown-core-certificate-rejected",
    "public-443-only-beside-management-ssh",
    "tracker-tcp-9921-closed",
    "loopback-health-contract",
    "resource-ceilings-present"
  ],
  "rollback": "close-443-stop-channel-restore-exact-accepted-foundation-without-backhaul-or-relay"
}