feat(device-plane): add core-initiated edge channel

device-plane/packages/device-protocol-contract/test/core-edge-channel-contract.test.mjs

@@ -12,6 +12,10 @@ const freezeUrl = new URL(
   "../../../deployment/superseded-vps-initiated-transport-v1.json",
   import.meta.url,
 );
+const sourceAcceptanceUrl = new URL(
+  "../../../deployment/device-edge-core-channel-source-v1.json",
+  import.meta.url,
+);
 const edgeBuilder = fileURLToPath(new URL(
   "../../../../infra/deploy-runner/build-device-edge-vps-artifact.mjs",
   import.meta.url,
@@ -62,6 +66,22 @@ test("requires Core acceptance before acknowledging tracker packages", async ()
   assert.ok(contract.pilotSlo.deadCoreDetectionHardCeilingSeconds <= 45);
 });
 
+test("records source acceptance without opening an Edge or tracker port", async () => {
+  const acceptance = await readJson(sourceAcceptanceUrl);
+
+  assert.equal(acceptance.status, "source-accepted");
+  assert.equal(acceptance.transport.initiator, "device-gateway-core");
+  assert.equal(acceptance.transport.tls, "TLSv1.3-mutual-authentication");
+  assert.equal(acceptance.identity.privateKeysInSource, false);
+  assert.equal(acceptance.identity.privateKeysInArtifact, false);
+  assert.equal(acceptance.runtime.mutationInThisTransition, false);
+  assert.equal(acceptance.runtime.edgePort8443Published, false);
+  assert.equal(acceptance.runtime.trackerPort9921Published, false);
+  assert.equal(acceptance.runtime.synologyPublicIngress, false);
+  assert.equal(acceptance.runtime.commandTransport, "disabled");
+  assert.equal(acceptance.runtime.gelios, "untouched");
+});
+
 test("freezes the VPS-initiated Tailscale and SSH backhaul", async () => {
   const freeze = await readJson(freezeUrl);