feat(device-plane): accept core edge transport ADR

2026-08-10 16:40:48 +03:00
parent 07224c6f0d
commit bf0bc50abb
27 changed files with 5034 additions and 26 deletions
@@ -0,0 +1,98 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import test from "node:test";
+
+const contractUrl = new URL(
+  "../../../deployment/device-edge-core-channel-v1.json",
+  import.meta.url,
+);
+const freezeUrl = new URL(
+  "../../../deployment/superseded-vps-initiated-transport-v1.json",
+  import.meta.url,
+);
+const edgeBuilder = fileURLToPath(new URL(
+  "../../../../infra/deploy-runner/build-device-edge-vps-artifact.mjs",
+  import.meta.url,
+));
+const enrollmentBuilder = fileURLToPath(new URL(
+  "../../../../infra/deploy-runner/build-device-plane-backhaul-vps-enrollment-artifact.mjs",
+  import.meta.url,
+));
+
+async function readJson(url) {
+  return JSON.parse(await readFile(url, "utf8"));
+}
+
+test("pins a Core-initiated mutually authenticated Edge channel", async () => {
+  const contract = await readJson(contractUrl);
+
+  assert.equal(contract.status, "accepted-design");
+  assert.equal(contract.direction, "device-gateway-core-initiated");
+  assert.equal(contract.transport.tls, "TLSv1.3-mutual-authentication");
+  assert.equal(contract.transport.genericTcpForwarding, "forbidden");
+  assert.equal(contract.networkBoundary.synologyPublicIngress, false);
+  assert.equal(contract.networkBoundary.vpsInitiatedSynologyConnection, false);
+  assert.equal(contract.networkBoundary.subnetRoutes, false);
+  assert.equal(contract.networkBoundary.exitNode, false);
+  assert.equal(contract.identity.privateKeysInArtifacts, false);
+});
+
+test("requires Core acceptance before acknowledging tracker packages", async () => {
+  const contract = await readJson(contractUrl);
+
+  assert.equal(
+    contract.acknowledgement.trackerPackageAck,
+    "only-after-bounded-core-acceptance",
+  );
+  assert.equal(
+    contract.acknowledgement.coreUnavailable,
+    "do-not-acknowledge-tracker-package",
+  );
+  assert.equal(contract.acknowledgement.deliverySemantics, "at-least-once");
+  assert.equal(contract.pilotLimits.durableEdgeSpool, false);
+  assert.ok(contract.pilotLimits.maxBufferedBytesPerTrackerSession <= 262144);
+  assert.ok(contract.pilotLimits.maxAggregateBufferedBytes <= 33554432);
+  assert.equal(contract.pilotSlo.trackerAckBeforeDurableCoreAcceptance, 0);
+  assert.equal(contract.pilotSlo.lossOfCoreAcceptedPackages, 0);
+  assert.ok(
+    contract.pilotSlo.edgeReceiveToCoreAcceptanceP99Milliseconds <= 5000,
+  );
+  assert.ok(contract.pilotSlo.deadCoreDetectionHardCeilingSeconds <= 45);
+});
+
+test("freezes the VPS-initiated Tailscale and SSH backhaul", async () => {
+  const freeze = await readJson(freezeUrl);
+
+  assert.equal(freeze.status, "frozen");
+  assert.equal(freeze.successor, "nodedc.device-edge.core-channel.v1");
+  assert.equal(freeze.runtimeMutationInPhase0, false);
+  assert.ok(freeze.forbiddenForNewPlanOrApply.includes(
+    "nodedc.device-plane.backhaul-vps-enrollment.v1",
+  ));
+  assert.ok(freeze.forbiddenForNewPlanOrApply.includes(
+    "tailscale-userspace-key-only-ssh-local-forward",
+  ));
+});
+
+test("superseded artifact builders fail closed outside test-only reconstruction", () => {
+  const environment = { ...process.env };
+  delete environment.NODEDC_ALLOW_SUPERSEDED_TRANSPORT;
+
+  const edge = spawnSync(
+    process.execPath,
+    [edgeBuilder, "backhaul", "superseded-backhaul-unit"],
+    { encoding: "utf8", env: environment },
+  );
+  assert.notEqual(edge.status, 0);
+  assert.match(edge.stderr, /vps_initiated_transport_frozen:ADR-0001/);
+
+  const enrollment = spawnSync(
+    process.execPath,
+    [enrollmentBuilder, "superseded-enrollment-unit"],
+    { encoding: "utf8", env: environment },
+  );
+  assert.notEqual(enrollment.status, 0);
+  assert.match(enrollment.stderr, /vps_initiated_transport_frozen:ADR-0001/);
+});