refactor(squash): layered architecture simplification — extract sub-packages, fix races, add trace/trust-gate

- Extract tunnel sub-packages: envelope (L6), keyexchange (L5), udpio (L2), routing (L4)
- Extract plugins: handshake (port 444), gateway, webhook
- Extract internal utilities: trustedagents, skillinject, policy, dataexchange, eventstream, tasksfiles
- Split pkg/registry into client + server subpackages
- Add architecture enforcement tools: check-layers, check-bootstrap, check-globals
- CI: architecture-gates workflow (P1/P3/P4/P5/P6/P7/P9)
- Add build tags for optional components (no_gateway, no_nameserver, no_updater, etc.)
- Invert dependencies: networkSyncLoop via bus events, webhook → bus.Publish
- Fix data races: identity in beaconRefreshTick, RetxStop init order, registry shard.Lock
- Fix FIN-ACK ping-pong storm, IPC request-ID demux, beacon typed-nil
- Plug 48h memory leaks in daemon, handshake plugin, and registry
- Add panic boundaries across all layers (L1–L11)
- Add --trace flag to pilotctl ping/send-message/inbox with distributed path timing
- Add trust-gate UX: WaitForTrust IPC, auto-handshake, public/private gate
- Move black-box tests to tests/, tests/daemon, tests/plugins
- Add regression tests: rc5-storm, FIN-ACK, self-dial, port-leak, §4.8 stress harness
- Wire-format golden corpus (P6 invariance gate)
- IPC concurrent dispatch with request-ID demultiplexing
- regConn connection pool (4 conns) + Info/RotateKey race fix

Author: teovl

.dockerignore

@@ -1,6 +1,5 @@
 .git
 .github
-abpn
 node_modules
 **/node_modules
 *.log

.github/workflows/architecture.yml

@@ -0,0 +1,59 @@
+name: architecture-gates
+
+on: [pull_request, push]
+
+jobs:
+  gates:
+    name: Architecture gates
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.22'
+
+      - name: P1 - layer imports
+        run: go run ./tools/check-layers ./...
+
+      - name: P5 - test imports stay in layer
+        run: go run ./tools/check-layers --tests ./...
+
+      - name: Lock-graph race detection (sec 4.8)
+        run: go test -race -timeout 5m ./pkg/daemon ./pkg/registry ./pkg/secure
+
+      - name: Lock-graph stress harness (sec 4.8) — TestConcurrentDialEncryptDecrypt
+        # 1000 goroutines × 30 s × 3 reps = ~90 s wall time. Race-clean,
+        # no panic, no goroutine leak. Skipped by -short; run here without.
+        run: go test -race -count=1 -timeout 10m -run TestConcurrentDialEncryptDecrypt ./tests/...
+
+      - name: P4/P9 - goroutine reaping
+        run: go test ./tests -run "TestDaemonShutdown|TestStreamLifecycleGoroutines|TestPluginShutdown"
+
+  plugin-matrix:
+    name: Plugin matrix (no_${{ matrix.plugin }})
+    needs: gates
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        plugin:
+          - updater
+          - skillinject
+          - trustedagents
+          - nameserver
+          - dataexchange
+          - eventstream
+          - tasks
+          - gateway
+          - policy
+          - webhook
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.22'
+
+      - name: Build & test with plugin disabled
+        run: go test -tags=no_${{ matrix.plugin }} ./pkg/daemon/... ./pkg/coreapi/...

.gitignore

@@ -20,6 +20,7 @@ jetson
 /nameserver
 /gateway
 /updater
+/check-layers
 
 # Go workspace
 go.work
@@ -59,6 +60,22 @@ web/.wrangler/
 # Personal analytics scripts + their reports - never commit
 web/scripts/local/
 
+# =============================================================================
+# Private / ops — lives in web4-private, never commit here
+# =============================================================================
+OBSERVABILITY_PLAN.md
+SECURITY_PLAN.md
+abpn/
+mention-exporter
+k8s/gcp-vms/
+k8s/pilot-exporter/
+k8s/pilot-install-canary/
+k8s/pilot-probe/
+k8s/pilot-release/
+k8s/pilot-website/
+k8s/network/
+web/ANALYTICS.md
+
 # Root-level npm tooling (not the main module)
 /package.json
 /package-lock.json
@@ -108,14 +125,14 @@ tests/integration/k8s/preloaded/*.tar
 tests/integration/local/logs/
 tests/integration/local/results/
 tests/admin_cli_test.go
-cmd/spoof/
 
 # =============================================================================
 # Docs (allowlist — only track .tex, .pdf, SPEC.md, media/, ietf/, research/)
 # =============================================================================
 docs/*
 !docs/*.tex
 !docs/*.pdf
+!docs/*.md
 !docs/SPEC.md
 !docs/media/
 !docs/research/
@@ -129,13 +146,19 @@ AGENTS.md
 .mcp.json
 cmd/pilot-admin/
 cmd/console/
+cmd/netsim/
+cmd/wire-gen/
 console
 console-ui/
 pkg/console/
+pkg/netsim/
 newsletter/
 web/MESSAGING.md
 scripts/publish-worker/src/webhook.ts
 scripts/publish-worker/test/webhook.test.ts
+tools/check-bootstrap/
+tools/check-globals/
+RELEASE_NOTES*.md
 
 # =============================================================================
 # Web: stale Astro outputs (regenerated at build time)
@@ -166,6 +189,4 @@ k8s/
 tests/integration/local/logs.rerun*
 
 # Untracked sandboxes / personal scratch — never commit
-abpn/
 scripts/pilot-geo-exporter/
-/spoof