feat(device-edge): add canonical core channel deployment

infra/deploy-runner/build-device-edge-vps-artifact.mjs

@@ -29,11 +29,11 @@ const runtimeCache = resolve(
 const [phase, patchId, ...extra] = process.argv.slice(2);
 if (
   extra.length
-  || !["foundation", "backhaul", "relay"].includes(phase)
+  || !["foundation", "backhaul", "relay", "core-channel"].includes(phase)
   || !/^[A-Za-z0-9._-]{1,96}$/.test(patchId || "")
 ) {
   throw new Error(
-    "usage: build-device-edge-vps-artifact.mjs <foundation|backhaul|relay> <patch-id>",
+    "usage: build-device-edge-vps-artifact.mjs <foundation|backhaul|relay|core-channel> <patch-id>",
   );
 }
 
@@ -72,6 +72,17 @@ const entriesByPhase = {
     "services/device-edge-relay/src",
     "deployment/device-edge-vps-relay-v1.json",
   ],
+  "core-channel": [
+    "packages/device-protocol-contract/package.json",
+    "packages/device-protocol-contract/src",
+    "packages/device-edge-channel-contract/package.json",
+    "packages/device-edge-channel-contract/src",
+    "services/device-edge-channel/package.json",
+    "services/device-edge-channel/src",
+    "vps/config/nftables-core-channel.conf",
+    "vps/systemd/nodedc-device-edge-channel.service",
+    "deployment/device-edge-vps-core-channel-v1.json",
+  ],
 };
 const entries = entriesByPhase[phase];
 const ignoredBasenames = new Set([".DS_Store", ".git", "node_modules"]);
@@ -129,7 +140,11 @@ try {
     size: bytes.length,
     component: "device-edge-vps",
     entries,
-    publicIngress: phase === "relay" ? "tcp/9921" : "disabled",
+    publicIngress: phase === "relay"
+      ? "tcp/9921"
+      : phase === "core-channel"
+        ? "tcp/8443-mtls-only"
+        : "disabled",
     commandTransport: "disabled",
     gelios: "untouched",
   }, null, 2));
@@ -221,6 +236,34 @@ async function assertBoundary() {
       }
     }
   }
+  if (phase === "core-channel") {
+    for (const required of [
+      "\"runtimeUser\": \"nodedc-channel\"",
+      "\"trackerIngress\": \"disabled\"",
+      "User=nodedc-channel",
+      "node --jitless",
+      "tcp dport 8443",
+      "MemoryMax=128M",
+      "MemorySwapMax=0",
+      "CPUQuota=50%",
+      "TasksMax=64",
+      "LimitNOFILE=1024",
+    ]) {
+      if (!combined.includes(required)) {
+        throw new Error(`core_channel_boundary_missing:${required}`);
+      }
+    }
+    for (const forbidden of [
+      "tcp dport 9921",
+      "LocalForward",
+      "tailscale-userspace",
+      "DEVICE_EDGE_RELAY_UPSTREAM",
+    ]) {
+      if (combined.includes(forbidden)) {
+        throw new Error(`core_channel_boundary_violation:${forbidden}`);
+      }
+    }
+  }
 }
 
 function canonicalTarScript() {