fix(device-plane): reconcile failed manager activation

device-plane/services/device-control-core/test/sensitive-reference-management.test.mjs

@@ -9,6 +9,12 @@ import {
   ALL_DEVICE_MANAGEMENT_COMMAND_KINDS,
   normalizeDeviceManagementCommand,
 } from "../src/management-command.mjs";
+import {
+  normalizeNdcCredentialReference as normalizeRuntimeCredentialReference,
+} from "../src/credential-reference.mjs";
+import {
+  normalizeNdcCredentialReference as normalizePlatformCredentialReference,
+} from "../../../../packages/external-provider-contract/src/credential-reference.mjs";
 
 const projectRef = "project:11111111-1111-4111-8111-111111111111";
 const deviceRef = "device:22222222-2222-4222-8222-222222222222";
@@ -65,6 +71,52 @@ test("credential binding accepts only the platform canonical opaque ref", () =>
   );
 });
 
+test("runtime credential reference adapter matches the platform contract", () => {
+  const accepted = [
+    {
+      owner: "ndc_l2_credentials",
+      reference: "ndc-credref:pilot-command-0001",
+    },
+    {
+      owner: "ndc_l2_credentials",
+      reference: "ndc-credref:A1234567",
+    },
+  ];
+  for (const input of accepted) {
+    assert.deepEqual(
+      normalizeRuntimeCredentialReference(input),
+      normalizePlatformCredentialReference(input),
+    );
+  }
+
+  const rejected = [
+    null,
+    [],
+    { owner: "device_core", reference: "ndc-credref:pilot-command-0001" },
+    { owner: "ndc_l2_credentials", reference: "secret:test" },
+    {
+      owner: "ndc_l2_credentials",
+      reference: "ndc-credref:pilot-command-0001",
+      token: "forbidden",
+    },
+  ];
+  for (const input of rejected) {
+    let runtimeError;
+    let platformError;
+    try {
+      normalizeRuntimeCredentialReference(input);
+    } catch (error) {
+      runtimeError = error;
+    }
+    try {
+      normalizePlatformCredentialReference(input);
+    } catch (error) {
+      platformError = error;
+    }
+    assert.equal(runtimeError?.message, platformError?.message);
+  }
+});
+
 test("credential binding rejects raw secret-shaped fields", () => {
   for (const field of ["password", "token", "secretValue", "endpoint"]) {
     assert.throws(