Remove the enterprise action hook

[TeoSlayer]

Why

The action hook was this plugin's boundary to the hosted control plane, which has been retired. The daemon stopped installing a hook in v1.14.0 (pilotprotocol#485), so every call has gone through the nil-hook branch since then and the rest is unreachable. This is also the last importer of common/actionhook, and one of three remaining importers of common/decision.

What is removed

• action_hook.go: ActionHook, SetActionHook, prepareTrustAction, trustActionAttempt.
• The actionHook field on Manager.
• The six prepareTrustAction call sites in handshake.go and their post-action bookkeeping (autoAllowed, autoExecuted, autoReason, granted, skipReason, and the handshake.control_blocked event, which was only published when a hook blocked an action).
• enterprise_action_hook_test.go.

Why behaviour without a hook is unchanged

prepareTrustAction returned (nil, nil) when no hook was attached, and (*trustActionAttempt)(nil).complete was a no-op. At each call site the kept code is exactly that branch:

Call site	With no hook	Now
handleRequest	autoAllowed is always true; deferred completion returns immediately	the four auto-accept conditions drop && autoAllowed
handleAccept	no early return; deferred completion is a no-op	block removed, rest unchanged
SendRequest	err is nil; completions are no-ops	block removed; err = hm.sendMessage(...) becomes err := ...
processRelayedRequest	as handleRequest	the four auto-accept conditions drop && autoAllowed
processRelayedApproval	as handleAccept	block removed, rest unchanged
ApproveHandshake	err is nil; completions are no-ops	block removed; the first pending lookup keeps its early return

The pre-checks that ran before the hook (already-trusted fast path, pending-queue caps in handleRequest and processRelayedRequest) run on every request and are untouched, including their log lines, which still say "before control hook". Auto-accept rules, the pending queue, replay protection, flood caps, relay handling and trust persistence are not changed. Apart from two reworded comments, every added line in handshake.go is one of the simplified conditions above.

Tests

zz_action_hook_flood_test.go asserted that the hook was not invoked for an already-trusted peer or for over-cap spam. It is now zz_precheck_flood_test.go and asserts the same outcomes directly: the trusted peer keeps its record and is not queued; over-cap direct and relayed requests are neither queued nor trusted. The caps themselves are also still covered by TestHandleRequestPendingQueueFullRejects and TestPendingQueuePerSourceCapPreventsSingleSourceExhaustion.

What I ran

With GOWORK=off:

• go build ./..., go vet ./...: clean.
• go test -race -count=1 ./...: pass.
• go mod tidy: no change to go.mod or go.sum; the go directive stays at 1.25.13.
• gofmt -l is clean for the files touched (four untouched test files are already unformatted on main).
• pilotprotocol, runtime and libpilot at their current main, each with a replace pointing at this branch: go build ./... and go vet ./... pass. None of them references SetActionHook or ActionHook.

Not run: pilotprotocol's ./tests integration suite.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!