[TaylorMutch]

Summary

Expose service discovery through the curated Go SDK so external infrastructure consumers use the same API as the sandbox proxy. Keep the example Kubernetes HTTPRoute controller on its separate POC branch.

Based on main at d7b616895. Stacked on feat/4954-sandbox-proxy/TaylorMutch.

Related Issue

Closes #4955. Part of RFC 0017.

Changes

• Add ServiceRoutes().Snapshot/Watch for one workspace and SnapshotFor/WatchFor for selected or all workspaces.
• Use protobuf-independent domain types with validated deep-copy conversions and scope containment checks.
• Define explicit Recv/Close, cancellation, EOF, and server-error behavior without hidden reconnects or prefetch.
• Add bufconn/converter tests, regenerated bindings, and SDK documentation.

Release Notes

Testing

• Hostname integration: 111 standalone application-URL-layer tests and 120 combined-stack routing/schema regressions passed, including shared shutdown fencing and ingress URL stability. Go SDK CI, strict Clippy for affected crates, protobuf/docs/Mermaid lint, and lockfile checks passed.
• 40 focused combined-stack Rust regression tests cover listener routing, route-limit concurrency, shutdown fencing, advertisements, discovery, and proxy behavior.
• Local k3d validated the Service removal with dedicated push/poll, abrupt shared-owner takeover, HTTP/WebSockets, network-policy denial, freshness/withdrawal, outage recovery, and disabled-listener gateway access. Workload identity and memory survived owner changes.
• Real Go SDK snapshots/watches and workspace-restricted discovery credentials drove two proxy replicas; both followed Pod-IP endpoints, graceful owner handover, and route withdrawal without per-sandbox app Services.
• Helm lint/unit/parser/coherence/scaling checks, Python lint/format/type checks, and topology assertions passed.

Live Kubernetes validation preceded integration of the latest listener hardening;
focused Rust regressions validate that final integration. New-head CI is pending.

Qualification limits

Live HA validation exercised supervisor process/Pod loss on a local k3d cluster. Whole-node failure, real network partitions, metric-driven HPA, sustained production load, and published release artifacts remain unqualified. Grant-file projection contributes to revocation propagation time. Both ingress paths now share the gateway hostname format and label generator. The same installation identity and public HTTPS domain/port preserve service URLs when switching ingress. Installation-status presentation (#4670) remains separate work. Live Kubernetes runs above preceded hostname integration; the naming and shutdown-fence integration is validated by focused Rust regressions.

The example Kubernetes HTTPRoute controller is a deferred compatibility POC outside this stack.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Relevant implementation, configuration, and API documentation updated

PR dependency order: #4936 → #4940 → #4941 → #4956 → #4963 → #4964 → #4957 → #4958.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[rhuss]

Heads-up: the Go SDK moves to ai-openshell/sdk-go on 2026-11-03 (details in #5031). This PR depends on server-side work that has not shipped yet, so its SDK layer is ported once that work is in a core release the new repository pins. Until then it stays here as is.