# NDC Device Plane

`device-plane` is the provider-neutral runtime boundary for physical devices.
It is intentionally separate from Foundry, Engine L2, External Data Plane and
the preserved Gelios integration.

Current implementation status: local fail-closed foundation; not deployed.

- `packages/device-protocol-contract` owns safe discovery and presentation
  contracts.
- `packages/arusnavi-b2-adapter` owns the first model-profile evidence and a
  fail-closed framing boundary.
- `services/device-control-core` owns the initial PostgreSQL schema, health
  boundary and disabled-by-default quarantine ingest.
- `services/device-gateway` owns a disabled-by-default, loopback-only TCP
  evidence listener that sends no bytes and extracts no identifier until the
  official framing contract is known.
- `docker-compose.device-plane.yml` publishes only loopback health endpoints
  and keeps the raw TCP listener unpublished.
- No device command can be built or sent.
- No real IMEI, ICCID, password, packet or provider credential is stored in
  this source tree.

The planned runtime services are:

- `device-control-core`: contours, discoveries, devices, bindings, policy and
  audit;
- `device-gateway`: raw TCP sessions, bounded codecs and presence;
- `device-postgres`: private persistent state.

The Foundry `Device Manager` is a canonical page template using a server-owned
`device-plane-control` binding. It is not a service in this directory.

Run the foundation tests:

```bash
npm test
```

See [IMPLEMENTATION_BASELINE.md](docs/IMPLEMENTATION_BASELINE.md) for the
placement, security and rollout contract.

The canonical runner registry and deterministic artifact builder live in
`../infra/deploy-runner`. The runner must be separately promoted and verified
before any Device Plane artifact is staged or planned.