[TaylorMutch]

Summary

Expose service discovery through the curated Go SDK so external infrastructure consumers use the same API as the sandbox proxy. Keep the example Kubernetes HTTPRoute controller on its separate POC branch.

Rebased onto main at 2c31ac7e6. Stacked on feat/4954-sandbox-proxy/TaylorMutch.

Related Issue

Closes #4955. Part of RFC 0017.

The linked issue has no state:accepted label; the author has verified repository ADMIN access.

Changes

• Add ServiceRoutes().Snapshot/Watch for one workspace and SnapshotFor/WatchFor for selected or all workspaces.
• Use protobuf-independent domain types with validated deep-copy conversions and scope containment checks.
• Define explicit Recv/Close, cancellation, EOF, and server-error behavior without hidden reconnects or prefetch.
• Add bufconn/converter tests, regenerated bindings, and SDK documentation.

Release Notes

Testing

• Latest main rebase (2c31ac7e6): 2,553 server tests passed (34 ignored), 211 supervisor + 310 Kubernetes driver tests, 8 proxy tests, full Go SDK CI, 431 gateway + 6 workspace + 6 proxy Helm tests, and full repository pre-commit checks passed. All eight rebased layers independently passed locked Rust compilation with test targets. Dedicated supervisor rendering also verifies destination-CA delivery with the app listener enabled and disabled. Signed-OIDC browser regression covers hashed-host login, single-use redemption, authenticated sessions, cross-installation rejection, and anonymous denial.
• After the internal RPC separation in feat(supervisor): advertise accepted application route installations #4940, this rebased layer independently passed locked Rust compilation with test targets.
• Updated stack tip: 2,494 server library tests passed (34 ignored), 306 Kubernetes driver tests, RPC tracing coverage, SDK binding regeneration, and full repository pre-commit checks passed. The public discovery schema and generated SDK bindings are unchanged by the internal RPC refactor.
• Earlier HA validation, before the internal RPC separation: 3,136 runtime library tests passed (34 ignored), 48 Rust SDK mock tests, 8 proxy tests, full Go SDK CI, and 412 gateway + 6 workspace + 6 proxy Helm tests passed.
• Combined stack: full repository pre-commit (including strict Clippy), strict docs, and navigation checks passed.
• Earlier live Kubernetes validation, before the internal RPC separation: two gateways, shared supervisors, and proxy replicas; direct/proxy TLS and HTTP/WebSockets, abrupt owner-process loss/recovery, populated 2→1→2→1 scaling, route renewal/withdrawal, and discovery grant narrowing/regrant passed. Workload Pod identity, PID, and in-memory state survived owner handoff.

Qualification limits

Live HA validation exercised supervisor process/Pod loss on a local k3d cluster. Whole-node failure, real network partitions, metric-driven HPA, sustained production load, and published release artifacts remain unqualified. Grant-file projection contributes to revocation propagation time. Main now includes #4842 for gateway-mediated hashed hostnames. Direct application-listener/discovery hostnames remain readable; extending hashed naming to that path and installation-status presentation (#4670) remain separate work.

The example Kubernetes HTTPRoute controller is a deferred compatibility POC outside this stack.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Relevant implementation, configuration, and API documentation updated

PR dependency order: #4936 → #4940 → #4941 → #4956 → #4963 → #4964 → #4957 → #4958.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.