feat(deploy): add typed command transport releases

infra/deploy-runner/build-device-edge-vps-artifact.mjs

@@ -37,11 +37,12 @@ if (
     "core-channel",
     "tailscale-retirement",
     "tracker-ingress",
+    "command-transport",
   ].includes(phase)
   || !/^[A-Za-z0-9._-]{1,96}$/.test(patchId || "")
 ) {
   throw new Error(
-    "usage: build-device-edge-vps-artifact.mjs <foundation|runtime-reconciliation|backhaul|relay|core-channel|tailscale-retirement|tracker-ingress> <patch-id>",
+    "usage: build-device-edge-vps-artifact.mjs <foundation|runtime-reconciliation|backhaul|relay|core-channel|tailscale-retirement|tracker-ingress|command-transport> <patch-id>",
   );
 }
 
@@ -52,6 +53,10 @@ if (
 ) {
   throw new Error("vps_initiated_transport_frozen:ADR-0001");
 }
+const acceptedSharedSourcePhases = new Set(["core-channel", "tracker-ingress"]);
+if (acceptedSharedSourcePhases.has(phase)) {
+  throw new Error(`accepted_vps_phase_rebuild_frozen:${phase}:ADR-0001`);
+}
 
 const nodeArchive = "node-v22.23.2-linux-x64.tar.xz";
 const tailscaleArchive = "tailscale_1.102.2_amd64.tgz";
@@ -110,6 +115,21 @@ const entriesByPhase = {
     "vps/systemd/nodedc-device-edge-runtime.service",
     "deployment/device-edge-vps-tracker-ingress-v1.json",
   ],
+  "command-transport": [
+    "packages/device-edge-channel-contract/package.json",
+    "packages/device-edge-channel-contract/src",
+    "services/device-edge-channel/package.json",
+    "services/device-edge-channel/src",
+    "packages/device-adapter-runtime/package.json",
+    "packages/device-adapter-runtime/src",
+    "packages/device-adapter-catalog/package.json",
+    "packages/device-adapter-catalog/src",
+    "packages/arusnavi-b2-adapter/package.json",
+    "packages/arusnavi-b2-adapter/src",
+    "services/device-gateway/src/runtime.mjs",
+    "vps/edge-process/device-edge-runtime.mjs",
+    "deployment/device-edge-vps-command-transport-v1.json",
+  ],
 };
 const entries = entriesByPhase[phase];
 const ignoredBasenames = new Set([".DS_Store", ".git", "node_modules"]);
@@ -171,10 +191,12 @@ try {
       ? "tcp/9921"
       : ["core-channel", "tailscale-retirement"].includes(phase)
         ? "tcp/443-mtls-only"
-        : phase === "tracker-ingress"
+        : ["tracker-ingress", "command-transport"].includes(phase)
           ? "tcp/443-mtls+tcp/9921-telemetry"
         : "disabled",
-    commandTransport: "disabled",
+    commandTransport: phase === "command-transport"
+      ? "typed-service-ping-v1"
+      : "disabled",
     gelios: "untouched",
   }, null, 2));
 } finally {
@@ -190,8 +212,10 @@ async function assertBoundary() {
   if (
     descriptor.component !== "device-edge-vps"
     || descriptor.runtimeHost !== "koffyvngij"
-    || descriptor.commandTransport !== "disabled"
-    || descriptor.gelios !== "untouched"
+    || descriptor.commandTransport !== (phase === "command-transport"
+      ? "typed-service-ping-v1"
+      : "disabled")
+    || !String(descriptor.gelios || "").startsWith("untouched")
     || !String(descriptor.rollback || "").length
   ) {
     throw new Error(`descriptor_boundary_mismatch:${phase}`);
@@ -365,6 +389,36 @@ async function assertBoundary() {
       }
     }
   }
+  if (phase === "command-transport") {
+    for (const required of [
+      '"predecessorPatch": "device-edge-vps-tracker-ingress-20260812-012"',
+      '"runtimeService": "nodedc-device-edge-channel.service"',
+      '"runtimeComposition": "single-process-core-channel-plus-universal-device-gateway"',
+      '"commandTransport": "typed-service-ping-v1"',
+      '"commandCatalog": "allowlisted-adapter-typed-commands-only"',
+      '"responseBoundary": "exact-adapter-parser-serv-ok-only"',
+      "buildTypedCommand",
+      "parseTypedCommandResponse",
+      "submitCommandStatus",
+      '"service.ping"',
+    ]) {
+      if (!combined.includes(required)) {
+        throw new Error(`command_transport_boundary_missing:${required}`);
+      }
+    }
+    for (const forbidden of [
+      "LocalForward",
+      "tailscale-userspace",
+      "DEVICE_EDGE_RELAY_UPSTREAM",
+      "device.dc.ru",
+      "PRIVATE KEY",
+      "TS_AUTHKEY",
+    ]) {
+      if (combined.includes(forbidden)) {
+        throw new Error(`command_transport_boundary_violation:${forbidden}`);
+      }
+    }
+  }
 }
 
 function canonicalTarScript() {