feat(device-plane): activate canonical outbound edge channel

device-plane/deployment/device-manager-release-v1.json

@@ -4,13 +4,16 @@
   "action": "upgrade",
   "predecessor": {
     "kind": "release",
-    "patchId": "device-manager-release-20260811-009",
-    "artifactSha256": "e0cc696e9387d26f005d342529f0e7c08be54113b9725271aecd9baf58b3726d"
+    "patchId": "device-manager-release-20260811-010",
+    "artifactSha256": "d4132993216eb674967dc6fc65d9670cfc2a9efdf46186ca019030f259de2d0e"
   },
   "service": "device-manager",
   "publicIngress": "reverse-proxy-only",
   "deviceCoreManagementApi": "file-token-authenticated",
   "launcherTrust": "file-token-scoped-to-device-core-handoff",
+  "edgeChannel": "core-initiated-pinned-mtls-enabled-zero-or-more-registered-edges",
+  "edgeChannelIdentity": "runner-managed-host-local-private-key-public-certificate-export",
+  "edgeChannelEgress": "dedicated-core-only-bridge-no-host-ingress-public-ipv4-tcp-8443-registration-policy",
   "healthGate": "bounded-container-grace+core-contract",
   "commandTransport": "disabled",
   "gelios": "untouched",

device-plane/docker-compose.device-manager.yml

@@ -3,6 +3,12 @@ services:
     environment:
       DEVICE_MANAGEMENT_API_ENABLED: "true"
       DEVICE_MANAGEMENT_CORE_TOKEN_FILE: /run/nodedc-secrets/management-core-token
+      DEVICE_EDGE_CHANNEL_ENABLED: "true"
+      DEVICE_EDGE_CHANNEL_CORE_KEY_FILE: /run/nodedc-secrets/device-edge-channel/core-private-key.pem
+      DEVICE_EDGE_CHANNEL_CORE_CERTIFICATE_FILE: /run/nodedc-secrets/device-edge-channel/core-certificate.pem
+      DEVICE_EDGE_CHANNEL_TRUST_ROOT: /run/nodedc-secrets/device-edge-channel/peers
+      DEVICE_EDGE_CHANNEL_MAX_EDGES: "32"
+      DEVICE_EDGE_CHANNEL_RECONCILE_INTERVAL_MS: "15000"
     volumes:
       - type: bind
         source: /volume1/docker/nodedc-device-plane/secrets/management-core-token
@@ -10,6 +16,26 @@ services:
         read_only: true
         bind:
           create_host_path: false
+      - type: bind
+        source: /volume1/docker/nodedc-device-plane/secrets/device-edge-channel/core-private-key.pem
+        target: /run/nodedc-secrets/device-edge-channel/core-private-key.pem
+        read_only: true
+        bind:
+          create_host_path: false
+      - type: bind
+        source: /volume1/docker/nodedc-device-plane/secrets/device-edge-channel/core-certificate.pem
+        target: /run/nodedc-secrets/device-edge-channel/core-certificate.pem
+        read_only: true
+        bind:
+          create_host_path: false
+      - type: bind
+        source: /volume1/docker/nodedc-device-plane/secrets/device-edge-channel/peers
+        target: /run/nodedc-secrets/device-edge-channel/peers
+        read_only: true
+        bind:
+          create_host_path: false
+    networks:
+      - device-plane-egress
 
   device-manager:
     image: nodedc/device-manager:local
@@ -71,6 +97,10 @@ services:
       start_period: 10s
 
 networks:
+  device-plane-egress:
+    name: nodedc-device-plane-egress
+    driver: bridge
+    internal: false
   platform-edge:
     external: true
     name: nodedc-platform_edge