feat(deploy): add typed command transport releases

2026-08-12 22:57:20 +03:00
parent 4b73a15765
commit 3ea2133bcd
10 changed files with 1028 additions and 75 deletions
@@ -0,0 +1,35 @@
+{
+  "schemaVersion": "nodedc.device-plane.device-control-core-release.v2",
+  "releaseId": "__PATCH_ID__",
+  "action": "upgrade",
+  "predecessor": {
+    "kind": "release",
+    "patchId": "device-control-core-release-20260812-024",
+    "artifactSha256": "a289e909283109642e6bba3d9822a31f63423cfe0bbcd52705979681bd2bc793"
+  },
+  "service": "device-control-core",
+  "composeActivation": "preserve-active-v4-topology",
+  "identity": "reuse-existing-runner-managed-host-local-private-key-public-certificate-export",
+  "identityRecovery": "forbidden-valid-existing-identity-required",
+  "tlsPurpose": "clientAuth",
+  "direction": "core-initiated",
+  "endpointPolicy": "public-ipv4-standard-https-tcp-443-only",
+  "coreNetworks": [
+    "device-plane-private",
+    "device-plane-egress"
+  ],
+  "publicIngress": "none-on-synology",
+  "edgeRegistrations": "preserved",
+  "commandTransport": "typed-service-ping-v1",
+  "commandCatalog": "allowlisted-adapter-typed-commands-only",
+  "credentialBoundary": "transient-core-memory-then-single-pinned-mtls-command-envelope-to-edge-never-persisted-never-logged-never-returned",
+  "gelios": "untouched-legacy-only",
+  "preservedServices": [
+    "device-manager",
+    "device-gateway",
+    "device-postgres",
+    "device-backhaul-target"
+  ],
+  "healthGate": "bounded-container-grace+core-edge-contract+exact-private-egress-network-boundary",
+  "rollback": "restore-preapply-source-and-core-runtime"
+}
@@ -0,0 +1,78 @@
+{
+  "schemaVersion": "nodedc.device-edge-vps.command-transport.v1",
+  "mode": "provider-neutral-typed-command-transport-over-accepted-core-channel",
+  "status": "active-typed-command-transport",
+  "authority": "DCPLATFORM-21/DCPLATFORM-76/ADR-0001",
+  "component": "device-edge-vps",
+  "phase": "command-transport",
+  "runtimeHost": "koffyvngij",
+  "predecessorPatch": "device-edge-vps-tracker-ingress-20260812-012",
+  "predecessorArtifactSha256": "290acef118839c6b0c31aac864c47da1832a289537366af9322d4624a1dd81ec",
+  "runtimeUser": "nodedc-channel",
+  "runtimeService": "nodedc-device-edge-channel.service",
+  "runtimeComposition": "single-process-core-channel-plus-universal-device-gateway",
+  "publicIngress": "tcp/443-mtls-core-channel+tcp/9921-bidirectional-tracker-session",
+  "trackerIngress": "preserved:allowlisted-adapters-only",
+  "initialAdapterProfile": "arusnavi.b2.internal.v1",
+  "commandTransport": "typed-service-ping-v1",
+  "commandCatalog": "allowlisted-adapter-typed-commands-only",
+  "allowedCommands": [
+    "service.ping"
+  ],
+  "credentialBoundary": "transient-over-pinned-mtls-in-memory-until-single-tracker-write-never-stored-never-logged-never-returned",
+  "responseBoundary": "exact-adapter-parser-serv-ok-only",
+  "health": "127.0.0.1:18222",
+  "adapterHealth": "127.0.0.1:18221",
+  "rawDeviceTcp9921": "public-bidirectional-tracker-session-no-generic-forwarding",
+  "gelios": "untouched-legacy-only",
+  "tailscale": "absent",
+  "dataBoundary": "no-vps-database-no-business-logic-no-synology-route",
+  "resourceCeilings": {
+    "memory": "192M",
+    "swap": "0",
+    "cpu": "75%",
+    "tasks": 128,
+    "openFiles": 1024,
+    "sessions": 128,
+    "sessionsPerAddress": 16,
+    "connectionsPerMinutePerAddress": 60,
+    "sessionBufferBytes": 65536,
+    "aggregateBufferBytes": 33554432
+  },
+  "preserved": [
+    "management-ssh-key",
+    "accepted-node-runtime",
+    "accepted-core-channel-trust-and-registration",
+    "accepted-tracker-ingress",
+    "retired-tailnet-boundary",
+    "gelios-production-path"
+  ],
+  "forbidden": [
+    "vps-initiated-synology-connection",
+    "generic-tcp-forwarding",
+    "tailscale-runtime",
+    "docker",
+    "public-health",
+    "vps-database",
+    "vps-business-logic",
+    "unregistered-adapter",
+    "raw-command",
+    "firmware-command",
+    "reboot-command",
+    "persistent-command-credential"
+  ],
+  "acceptance": [
+    "exact-tracker-ingress-012-predecessor",
+    "single-non-root-edge-process",
+    "core-channel-remains-accepted",
+    "public-tracker-tcp-9921-listening",
+    "adapter-profile-allowlisted",
+    "typed-service-ping-only",
+    "exact-serv-ok-response-parser",
+    "bounded-session-and-buffer-limits",
+    "tailscale-remains-absent",
+    "no-vps-to-synology-route",
+    "gelios-untouched"
+  ],
+  "rollback": "restore-exact-tracker-ingress-012-source-and-existing-runtime"
+}
@@ -0,0 +1,31 @@
+{
+  "schemaVersion": "nodedc.device-plane.device-manager-release.v3",
+  "releaseId": "__PATCH_ID__",
+  "action": "upgrade",
+  "predecessor": {
+    "kind": "release",
+    "patchId": "device-manager-release-20260811-010",
+    "artifactSha256": "d4132993216eb674967dc6fc65d9670cfc2a9efdf46186ca019030f259de2d0e"
+  },
+  "controlCorePredecessor": {
+    "patchId": "device-control-core-release-v2-20260812-025",
+    "artifactSha256": "c61b1f0de1bae23de0caa7289036865ea419ff5705611416f736ca929d1592db"
+  },
+  "edgeChannelPredecessor": {
+    "patchId": "device-edge-core-channel-upgrade-v4-20260812-023",
+    "artifactSha256": "c10d5b6b7d55ab239f85b6c8130e34ce9f84985e3b46e6e5534733156c7982fc"
+  },
+  "service": "device-manager",
+  "publicIngress": "reverse-proxy-only",
+  "deviceCoreManagementApi": "file-token-authenticated",
+  "launcherTrust": "file-token-scoped-to-device-core-handoff",
+  "edgeChannel": "preserve-active-v4-core-initiated-pinned-mtls",
+  "edgeChannelIdentity": "reuse-runner-managed-host-local-private-key-public-certificate-export",
+  "edgeChannelEgress": "preserve-dedicated-core-only-bridge-no-host-ingress-public-ipv4-tcp-443-only",
+  "healthGate": "bounded-container-grace+core-contract",
+  "commandTransport": "typed-service-ping-v1",
+  "commandCatalog": "allowlisted-adapter-typed-commands-only",
+  "credentialBoundary": "transient-core-memory-then-single-pinned-mtls-command-envelope-to-edge-never-persisted-never-logged-never-returned",
+  "gelios": "untouched-legacy-only",
+  "rollback": "restore-preapply-snapshot"
+}