feat(device-edge): open bounded tracker ingress

infra/deploy-runner/build-device-edge-vps-artifact.mjs

@@ -36,11 +36,12 @@ if (
     "relay",
     "core-channel",
     "tailscale-retirement",
+    "tracker-ingress",
   ].includes(phase)
   || !/^[A-Za-z0-9._-]{1,96}$/.test(patchId || "")
 ) {
   throw new Error(
-    "usage: build-device-edge-vps-artifact.mjs <foundation|runtime-reconciliation|backhaul|relay|core-channel|tailscale-retirement> <patch-id>",
+    "usage: build-device-edge-vps-artifact.mjs <foundation|runtime-reconciliation|backhaul|relay|core-channel|tailscale-retirement|tracker-ingress> <patch-id>",
   );
 }
 
@@ -96,6 +97,19 @@ const entriesByPhase = {
   "tailscale-retirement": [
     "deployment/device-edge-vps-tailscale-retirement-v1.json",
   ],
+  "tracker-ingress": [
+    "packages/device-adapter-runtime/package.json",
+    "packages/device-adapter-runtime/src",
+    "packages/device-adapter-catalog/package.json",
+    "packages/device-adapter-catalog/src",
+    "packages/arusnavi-b2-adapter/package.json",
+    "packages/arusnavi-b2-adapter/src",
+    "services/device-gateway/src/runtime.mjs",
+    "vps/edge-process/device-edge-runtime.mjs",
+    "vps/config/nftables-tracker-ingress.conf",
+    "vps/systemd/nodedc-device-edge-runtime.service",
+    "deployment/device-edge-vps-tracker-ingress-v1.json",
+  ],
 };
 const entries = entriesByPhase[phase];
 const ignoredBasenames = new Set([".DS_Store", ".git", "node_modules"]);
@@ -157,6 +171,8 @@ try {
       ? "tcp/9921"
       : ["core-channel", "tailscale-retirement"].includes(phase)
         ? "tcp/443-mtls-only"
+        : phase === "tracker-ingress"
+          ? "tcp/443-mtls+tcp/9921-telemetry"
         : "disabled",
     commandTransport: "disabled",
     gelios: "untouched",
@@ -314,6 +330,41 @@ async function assertBoundary() {
       }
     }
   }
+  if (phase === "tracker-ingress") {
+    for (const required of [
+      '"predecessorPatch": "device-edge-vps-tailscale-retirement-20260812-011"',
+      '"runtimeComposition": "single-process-core-channel-plus-universal-device-gateway"',
+      '"trackerIngress": "enabled:allowlisted-adapters-only"',
+      '"acknowledgementBoundary": "tracker-ack-only-after-core-durable-acceptance"',
+      '"initialAdapterProfile": "arusnavi.b2.internal.v1"',
+      "createDeviceGatewayRuntime",
+      "DEVICE_ADAPTER_CATALOG.registry",
+      "onDiscovery: (signal) => channel.submitDiscovery(signal)",
+      "onMessage: (message) => channel.submitAdapterMessage(message)",
+      "tcp dport 9921",
+      "User=nodedc-channel",
+      "MemoryMax=192M",
+      "MemorySwapMax=0",
+      "CPUQuota=75%",
+      "TasksMax=128",
+      "LimitNOFILE=1024",
+    ]) {
+      if (!combined.includes(required)) {
+        throw new Error(`tracker_ingress_boundary_missing:${required}`);
+      }
+    }
+    for (const forbidden of [
+      "LocalForward",
+      "tailscale-userspace",
+      "DEVICE_EDGE_RELAY_UPSTREAM",
+      'commandTransport": "enabled',
+      "device.dc.ru",
+    ]) {
+      if (combined.includes(forbidden)) {
+        throw new Error(`tracker_ingress_boundary_violation:${forbidden}`);
+      }
+    }
+  }
 }
 
 function canonicalTarScript() {