From 96227461ddd9466733c04f117afaebcd9220c69e Mon Sep 17 00:00:00 2001 From: Codex Date: Tue, 4 Aug 2026 11:55:17 +0300 Subject: [PATCH] docs(device-edge): record isolated ingress status --- device-plane/README.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/device-plane/README.md b/device-plane/README.md index 26f887c..06fde5c 100644 --- a/device-plane/README.md +++ b/device-plane/README.md @@ -4,7 +4,11 @@ It is intentionally separate from Foundry, Engine L2, External Data Plane and the preserved Gelios integration. -Current implementation status: local fail-closed foundation; not deployed. +Recorded runtime status: the private Synology foundation and the isolated Mini +IPvlan relay are running through their reviewed artifacts. Synology has no +public device listener; the Mini relay is LAN-addressable only and router/NAT +exposure remains a separate manual gate. The admission-gate source below is +prepared and staged, but has not yet been applied. - `packages/device-protocol-contract` owns safe discovery and presentation contracts. @@ -38,7 +42,9 @@ the Mini's single Ethernet link, so the host Amnezia full tunnel stays intact and Docker publishes no host port. The fixed relay address is `192.168.71.253`, explicitly outside the documented Deco DHCP pool `192.168.68.50`–`192.168.71.250`. See `docs/IMPLEMENTATION_BASELINE.md` for -the remaining activation gates. +the remaining activation gates. The staged admission update keeps the relay +opaque but requires a public IPv4 source and bounds its source table and bytes +per direction; it does not enable router/NAT exposure. The Foundry `Device Manager` is a canonical page template using a server-owned `device-plane-control` binding. It is not a service in this directory.