# Enterprise edge deployment contract

This directory is an engineering deployment contract, not an enterprise UAT
record. Its highest state is
`ENGINEERING_COMPLETE_ENTERPRISE_EDGE_UAT_BLOCKED`; enterprise source,
network, and security/legal evidence remain `TBD_EXTERNAL`.

The container initiates pull-only HTTPS/mTLS traffic. It exposes no inbound
control port. The network team must restrict egress to the exact control and
approved proxy origins in `edge.env`; DNS wildcard, direct HTTP, arbitrary
proxy, and arbitrary command execution are forbidden. Compose hardens the
runtime with a non-root UID, read-only root filesystem, all capabilities
dropped, no-new-privileges, bounded CPU/memory/PIDs/logs, and minimal mounts.

Private keys, control credentials, CA/CRL material, and Ed25519 task/release
public-key sets are mounted from operator-owned directories. Run `init` with
the approved numeric runtime UID/GID and set the same `EDGE_RUNTIME_UID/GID`
in the environment; Compose reuses those values for the process and writable
tmpfs. The client key is always `secrets/client.key`, with the complete secrets
directory mounted read-only at `/run/edge/secrets`. These materials are not
embedded in Compose or environment examples. Certificate and signing mounts
are read-only. Queue, local artifacts, and verified releases are the only
writable persistent mounts. 原始数据和近期明细 remain local; only the approved
数据分级 summaries leave the edge under 默认拒绝 policy.

## Local render check

Set temporary absolute directories and a syntactically valid immutable image,
then run `docker compose --env-file <operator-env> -f docker-compose.edge.yml
config`. This validates interpolation only. It does not start a real enterprise
source or prove firewall behavior.

Installation, CSR, 证书轮换, 证书撤销, v1-to-v2 migration, 断网/重连, 取消,
诊断, 备份/恢复, upgrade and 回滚 steps are in the
[edge operations runbook](../../docs/runbooks/EDGE_GATEWAY_OPERATIONS.md).
In the release archive the same file is at
`dataops-platform/docs/runbooks/EDGE_GATEWAY_OPERATIONS.md`. CRL
distribution and firewall approval are enterprise responsibilities.

`release-check` copies a fully verified manifest and artifact into the
fsync-backed `releases/verified/<manifest_digest>/` bundle. `rollback`
revalidates both current and target Ed25519 manifests and artifact hashes, then
atomically commits `releases/current.json`; an intent/history record supports
deterministic recovery if the process stops during the directory-fsync window.