68 lines
3.3 KiB
Markdown
68 lines
3.3 KiB
Markdown
# NDC Device Plane
|
||
|
||
`device-plane` is the provider-neutral runtime boundary for physical devices.
|
||
It is intentionally separate from Foundry, Engine L2, External Data Plane and
|
||
the preserved Gelios integration.
|
||
|
||
Recorded runtime status: the private Synology foundation and the isolated Mini
|
||
IPvlan relay are running through their reviewed artifacts. Synology has no
|
||
public device listener; the Mini relay is LAN-addressable only and router/NAT
|
||
exposure remains a separate manual gate. The admission-gate source below is
|
||
prepared and staged, but has not yet been applied.
|
||
|
||
- `packages/device-protocol-contract` owns safe discovery and presentation
|
||
contracts.
|
||
- `packages/arusnavi-b2-adapter` owns the first model-profile evidence and a
|
||
fail-closed framing boundary.
|
||
- `services/device-control-core` owns the initial PostgreSQL schema, health
|
||
boundary and disabled-by-default quarantine ingest.
|
||
- `services/device-gateway` owns a disabled-by-default, loopback-only TCP
|
||
evidence listener that sends no bytes and extracts no identifier until the
|
||
official framing contract is known.
|
||
- `docker-compose.device-plane.yml` publishes only loopback health endpoints
|
||
and keeps the raw TCP listener unpublished.
|
||
- No device command can be built or sent.
|
||
- No real IMEI, ICCID, password, packet or provider credential is stored in
|
||
this source tree.
|
||
|
||
The planned runtime services are:
|
||
|
||
- `device-control-core`: contours, discoveries, devices, bindings, policy and
|
||
audit;
|
||
- `device-gateway`: raw TCP sessions, bounded codecs and presence;
|
||
- `device-postgres`: private persistent state.
|
||
|
||
`services/device-edge-relay` is a separate, disabled-by-default runtime for the
|
||
dedicated Debian ingress host. It is an L4 byte relay: it neither decodes
|
||
ARUSNAVI B2, acknowledges a device nor holds a Core token, database credential
|
||
or command capability. The implemented backhaul forwards only through a
|
||
restricted outbound SSH path to the Synology Gateway loopback listener. The
|
||
reviewed ingress target gives only this container a fixed IPvlan L2 address on
|
||
the Mini's single Ethernet link, so the host Amnezia full tunnel stays intact
|
||
and Docker publishes no host port. The fixed relay address is
|
||
`192.168.71.253`, explicitly outside the documented Deco DHCP pool
|
||
`192.168.68.50`–`192.168.71.250`. See `docs/IMPLEMENTATION_BASELINE.md` for
|
||
the remaining activation gates. The staged admission update keeps the relay
|
||
opaque but requires a public IPv4 source and bounds its source table and bytes
|
||
per direction; it does not enable router/NAT exposure.
|
||
|
||
The standalone Hub application `Device Core` / `Device Manager` is the human
|
||
control-plane shell. Its server-owned BFF calls the disabled-by-default
|
||
management and query API in `device-control-core`; browsers never receive the
|
||
Core bearer token and never author actor, role, group or owner-scope headers.
|
||
Foundry remains a downstream consumer for project-approved device data and is
|
||
not the device registry or administration boundary.
|
||
|
||
Run the foundation tests:
|
||
|
||
```bash
|
||
npm test
|
||
```
|
||
|
||
See [IMPLEMENTATION_BASELINE.md](docs/IMPLEMENTATION_BASELINE.md) for the
|
||
placement, security and rollout contract.
|
||
|
||
The canonical runner registry and deterministic artifact builder live in
|
||
`../infra/deploy-runner`. The runner must be separately promoted and verified
|
||
before any Device Plane artifact is staged or planned.
|