Add network admin tooling: delete-network, admin-token on rendezvous

- Add -admin-token flag to cmd/rendezvous (was missing, network
  creation silently disabled on deployed rendezvous)
- Add DeleteNetwork to registry protocol (admin-gated, cannot delete
  backbone, cleans member node network lists, persists state)
- Add admin token bypass for backbone node listing
- Update ListNodes client to accept optional admin token
- Guard internal tooling build in Makefile

Author: teovl

.gitignore

@@ -90,6 +90,8 @@ web/.wrangler/
 
 # Internal tooling
 cmd/spoof/
+cmd/pilot-admin/
+tests/admin_cli_test.go
 
 # Blog messaging (internal)
 web/MESSAGING.md

Makefile

@@ -20,6 +20,7 @@ build:
 	go build -o $(BINDIR)/pilotctl ./cmd/pilotctl
 	go build -o $(BINDIR)/nameserver ./cmd/nameserver
 	go build -o $(BINDIR)/gateway ./cmd/gateway
+	@test -d cmd/pilot-admin && go build -o $(BINDIR)/pilot-admin ./cmd/pilot-admin || true
 	go build -o $(BINDIR)/webserver ./examples/go/webserver
 	go build -o $(BINDIR)/client ./examples/go/client
 	go build -o $(BINDIR)/echo ./examples/go/echo
@@ -70,6 +71,7 @@ build-linux:
 	GOOS=linux GOARCH=amd64 go build -o $(BINDIR)/pilotctl-linux ./cmd/pilotctl
 	GOOS=linux GOARCH=amd64 go build -o $(BINDIR)/nameserver-linux ./cmd/nameserver
 	GOOS=linux GOARCH=amd64 go build -o $(BINDIR)/gateway-linux ./cmd/gateway
+	@test -d cmd/pilot-admin && GOOS=linux GOARCH=amd64 go build -o $(BINDIR)/pilot-admin-linux ./cmd/pilot-admin || true
 	GOOS=linux GOARCH=amd64 go build -o $(BINDIR)/echo-linux ./examples/go/echo
 	GOOS=linux GOARCH=amd64 go build -o $(BINDIR)/client-linux ./examples/go/client
 	GOOS=linux GOARCH=amd64 go build -o $(BINDIR)/webserver-linux ./examples/go/webserver

cmd/rendezvous/main.go

@@ -29,6 +29,7 @@ func main() {
 	httpAddr := flag.String("http", "", "HTTP dashboard listen address (e.g. :3000)")
 	logLevel := flag.String("log-level", "info", "log level (debug, info, warn, error)")
 	logFormat := flag.String("log-format", "text", "log format (text, json)")
+	adminToken := flag.String("admin-token", "", "admin token for network creation (empty = creation disabled)")
 	flag.Parse()
 
 	if *configPath != "" {
@@ -53,6 +54,9 @@ func main() {
 
 	// Start registry
 	r := registry.NewWithStore(*beaconAddr, *storePath)
+	if *adminToken != "" {
+		r.SetAdminToken(*adminToken)
+	}
 	if *enableTLS {
 		if err := r.SetTLS(*tlsCert, *tlsKey); err != nil {
 			log.Fatalf("TLS setup: %v", err)

pkg/registry/client.go

@@ -310,17 +310,32 @@ func (c *Client) LeaveNetwork(nodeID uint32, networkID uint16, adminToken string
 	return c.Send(msg)
 }
 
+func (c *Client) DeleteNetwork(networkID uint16, adminToken string) (map[string]interface{}, error) {
+	msg := map[string]interface{}{
+		"type":       "delete_network",
+		"network_id": networkID,
+	}
+	if adminToken != "" {
+		msg["admin_token"] = adminToken
+	}
+	return c.Send(msg)
+}
+
 func (c *Client) ListNetworks() (map[string]interface{}, error) {
 	return c.Send(map[string]interface{}{
 		"type": "list_networks",
 	})
 }
 
-func (c *Client) ListNodes(networkID uint16) (map[string]interface{}, error) {
-	return c.Send(map[string]interface{}{
+func (c *Client) ListNodes(networkID uint16, adminToken ...string) (map[string]interface{}, error) {
+	msg := map[string]interface{}{
 		"type":       "list_nodes",
 		"network_id": networkID,
-	})
+	}
+	if len(adminToken) > 0 && adminToken[0] != "" {
+		msg["admin_token"] = adminToken[0]
+	}
+	return c.Send(msg)
 }
 
 func (c *Client) Deregister(nodeID uint32) (map[string]interface{}, error) {

pkg/registry/server.go

@@ -718,6 +718,8 @@ func (s *Server) handleMessage(msg map[string]interface{}, remoteAddr string) (r
 		return s.handleJoinNetwork(msg)
 	case "leave_network":
 		return s.handleLeaveNetwork(msg)
+	case "delete_network":
+		return s.handleDeleteNetwork(msg)
 	case "lookup":
 		return s.handleLookup(msg)
 	case "resolve":
@@ -1327,6 +1329,50 @@ func (s *Server) handleLeaveNetwork(msg map[string]interface{}) (map[string]inte
 	}, nil
 }
 
+func (s *Server) handleDeleteNetwork(msg map[string]interface{}) (map[string]interface{}, error) {
+	if err := s.requireAdminToken(msg); err != nil {
+		return nil, err
+	}
+
+	netID := jsonUint16(msg, "network_id")
+
+	// Cannot delete backbone
+	if netID == 0 {
+		return nil, fmt.Errorf("cannot delete the backbone network")
+	}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	network, ok := s.networks[netID]
+	if !ok {
+		return nil, fmt.Errorf("network %d: %w", netID, protocol.ErrNetworkNotFound)
+	}
+
+	// Remove network from all member nodes
+	for _, memberID := range network.Members {
+		if node, ok := s.nodes[memberID]; ok {
+			for i, n := range node.Networks {
+				if n == netID {
+					node.Networks = append(node.Networks[:i], node.Networks[i+1:]...)
+					break
+				}
+			}
+		}
+	}
+
+	name := network.Name
+	delete(s.networks, netID)
+	s.save()
+
+	slog.Info("deleted network", "network_id", netID, "name", name)
+
+	return map[string]interface{}{
+		"type":       "delete_network_ok",
+		"network_id": netID,
+	}, nil
+}
+
 func (s *Server) handleLookup(msg map[string]interface{}) (map[string]interface{}, error) {
 	nodeID := jsonUint32(msg, "node_id")
 
@@ -2028,9 +2074,36 @@ func (s *Server) handleListNetworks() (map[string]interface{}, error) {
 func (s *Server) handleListNodes(msg map[string]interface{}) (map[string]interface{}, error) {
 	netID := jsonUint16(msg, "network_id")
 
-	// Backbone (network 0) node listing is restricted to prevent enumeration
+	// Backbone (network 0) node listing is restricted to prevent enumeration.
+	// Admin token bypasses this restriction.
 	if netID == 0 {
-		return nil, fmt.Errorf("listing backbone nodes is not permitted (use lookup with a specific node_id)")
+		if err := s.requireAdminToken(msg); err != nil {
+			return nil, fmt.Errorf("listing backbone nodes is not permitted (use lookup with a specific node_id)")
+		}
+		// Admin-authenticated: list all registered nodes
+		s.mu.RLock()
+		defer s.mu.RUnlock()
+		nodes := make([]map[string]interface{}, 0, len(s.nodes))
+		for _, node := range s.nodes {
+			entry := map[string]interface{}{
+				"node_id": node.ID,
+				"address": protocol.Addr{Network: 0, Node: node.ID}.String(),
+			}
+			if node.Hostname != "" {
+				entry["hostname"] = node.Hostname
+			}
+			if node.TaskExec {
+				entry["task_exec"] = true
+			}
+			if node.Public {
+				entry["real_addr"] = node.RealAddr
+			}
+			nodes = append(nodes, entry)
+		}
+		return map[string]interface{}{
+			"type":  "list_nodes_ok",
+			"nodes": nodes,
+		}, nil
 	}
 
 	s.mu.RLock()