tests: make the Docker integration suite build and boot again

tests/integration/local/Dockerfile.multi

@@ -1,10 +1,11 @@
 FROM golang:1.25-bookworm AS builder
 WORKDIR /workspace
 COPY . .
-RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o /bin/pilot-rendezvous ./cmd/rendezvous && \
+# The rendezvous server lives in its own module now; build the version
+# go.mod pins so the registry under test matches the daemon's dependency.
+RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o /bin/pilot-rendezvous github.com/pilot-protocol/rendezvous/cmd/rendezvous && \
     CGO_ENABLED=0 go build -ldflags="-s -w" -o /bin/pilot-daemon ./cmd/daemon && \
-    CGO_ENABLED=0 go build -ldflags="-s -w" -o /bin/pilotctl ./cmd/pilotctl && \
-    CGO_ENABLED=0 go build -ldflags="-s -w" -o /bin/pilot-gateway ./cmd/gateway
+    CGO_ENABLED=0 go build -ldflags="-s -w" -o /bin/pilotctl ./cmd/pilotctl
 
 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y --no-install-recommends \
@@ -20,7 +21,6 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 COPY --from=builder /bin/pilot-rendezvous /usr/local/bin/
 COPY --from=builder /bin/pilot-daemon /usr/local/bin/
 COPY --from=builder /bin/pilotctl /usr/local/bin/
-COPY --from=builder /bin/pilot-gateway /usr/local/bin/
 RUN mkdir -p /root/.pilot/inbox /root/.pilot/received
 COPY tests/integration/local/test_p2p.sh /tests/
 # Security-test injector + helpers (Chunk D). Kept alongside /tests so

tests/integration/local/QUICK.txt

@@ -1,6 +1,6 @@
 # QUICK integration tier — tests that finish in ≤30s under -j 10 and
 # genuinely exercise live cross-process behavior (multi-daemon networking,
-# docker networking, NAT, partition, gateway proxy, etc.) that cannot be
+# docker networking, NAT, partition, etc.) that cannot be
 # covered by pkg/ unit tests.
 #
 # Excludes:
@@ -44,34 +44,15 @@ test_size_message_10mb_reject.sh
 
 # Policy (short)
 test_policy_connect_deny.sh
-test_policy_connect_score.sh
 test_policy_connect_tag.sh
 test_policy_datagram_deny.sh
 test_policy_datagram_score.sh
 test_policy_join_allow.sh
-test_policy_join_score.sh
 test_policy_cycle_evict.sh
 test_policy_cycle_fill_trust.sh
 test_policy_cycle_webhook.sh
 
 # Networks (short shipped-net subset)
-test_net_high_trust_society_shipped.sh
-test_net_data_exchange_policy_shipped.sh
-test_net_cold_shoulder_shipped.sh
-test_net_cooling_off_shipped.sh
-test_net_meritocracy_shipped.sh
-test_net_stable_state_shipped.sh
-
-# Gateway (short — excludes gateway_http_message which takes 90s)
-test_gateway_file.sh
-test_gateway_lookup.sh
-test_gateway_message.sh
-test_gateway_ping.sh
-test_gateway_pubsub_pub.sh
-test_gateway_pubsub_sub.sh
-test_gateway_register.sh
-test_gateway_rotate_key.sh
-test_gateway_trust_grant.sh
 
 # Observability + security (short)
 test_obs_log_peer_rekeyed.sh

tests/integration/local/_lib.sh

@@ -7,8 +7,8 @@
 #   - wait_for — replaces the `for _ in $(seq 1 60); do ...; sleep 1; done`
 #     pattern scattered across ~120 tests with a single helper that reads
 #     WAIT_BUDGET from env (laptop=60, k8s Job sets 180 via values.yaml)
-#   - teardown — docker compose down -v --remove-orphans, plus pkill of
-#     any leaked pilot-daemon/gateway/rendezvous; auto-trapped at EXIT
+#   - teardown — docker compose down -v --remove-orphans; auto-trapped
+#     at EXIT
 #
 # Teardown is auto-installed via `trap teardown EXIT` on source.
 # If a test wants to manage its own teardown (multi-phase chaos runs),
@@ -47,7 +47,7 @@ _wait_budget() {
 # discarded so loops stay quiet.
 #
 # Usage:
-#   wait_for '[ "$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats | jq -r ".total_nodes // 0")" -ge 2 ]' \
+#   wait_for '[ "$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats | jq -r ".total_nodes // 0")" -ge 2 ]' \
 #     && log_pass "both agents registered"
 wait_for() {
   local pred="$1"
@@ -77,12 +77,10 @@ teardown() {
       # No $DC set — try the two most common compose files as a best
       # effort. Costs nothing if they're not up.
       docker compose -f docker-compose.multi.yml down -v --remove-orphans >/dev/null 2>&1 || true
-      docker compose -f docker-compose.gateway.yml down -v --remove-orphans >/dev/null 2>&1 || true
     fi
-    # Belt-and-braces: anything still holding the daemon sockets.
-    pkill -9 -f pilot-daemon 2>/dev/null || true
-    pkill -9 -f pilot-gateway 2>/dev/null || true
-    pkill -9 -f pilot-rendezvous 2>/dev/null || true
+    # No host-side pkill: every daemon under test runs inside a container
+    # that `down -v` just removed. A `pkill -f pilot-daemon` here matches
+    # the developer's own daemon on the host and kills it.
   ) || true
   return "$rc"
 }

tests/integration/local/bench_relay.sh

@@ -92,7 +92,7 @@ echo "==> bench: starting fresh stack on $PILOT_SUBNET_PREFIX/24"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "${COUNT:-0}" -ge 2 ] && break
     sleep 1
 done

tests/integration/local/docker-compose.multi.nat-cgn.yml

@@ -22,7 +22,7 @@ services:
       pilot-rendezvous -registry-addr 0.0.0.0:9000 -beacon-addr 0.0.0.0:9001
       -http 0.0.0.0:8080 -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10

tests/integration/local/docker-compose.multi.nat-dual.yml

@@ -21,7 +21,7 @@ services:
       pilot-rendezvous -registry-addr 0.0.0.0:9000 -beacon-addr 0.0.0.0:9001
       -http 0.0.0.0:8080 -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10

tests/integration/local/docker-compose.multi.nat-hairpin.yml

@@ -21,7 +21,7 @@ services:
       -http 0.0.0.0:8080
       -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10

tests/integration/local/docker-compose.multi.nat-ipv6.yml

@@ -14,7 +14,7 @@ services:
       pilot-rendezvous -registry-addr "[::]:9000" -beacon-addr "[::]:9001"
       -http "[::]:8080" -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://[::1]:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://[::1]:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10

tests/integration/local/docker-compose.multi.nat-multihomed.yml

@@ -17,7 +17,7 @@ services:
       pilot-rendezvous -registry-addr 0.0.0.0:9000 -beacon-addr 0.0.0.0:9001
       -http 0.0.0.0:8080 -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10

tests/integration/local/docker-compose.multi.nat.yml

@@ -49,7 +49,7 @@ services:
       -http 0.0.0.0:8080
       -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10

tests/integration/local/docker-compose.multi.policy.yml

@@ -17,7 +17,7 @@ services:
       -store /tmp/registry.json
       -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10

tests/integration/local/docker-compose.multi.yml

@@ -18,7 +18,7 @@ services:
       -store /tmp/registry.json
       -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 3s
       retries: 30

tests/integration/local/docker-compose.multi10.yml

@@ -15,7 +15,7 @@ services:
       -http 0.0.0.0:8080
       -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10

tests/integration/local/docker-compose.multi3.yml

@@ -16,7 +16,7 @@ services:
       ${PILOT_ADMIN_TOKEN:+-admin-token ${PILOT_ADMIN_TOKEN}}
       -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10

tests/integration/local/docker-compose.multi5.yml

@@ -15,7 +15,7 @@ services:
       -http 0.0.0.0:8080
       -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10

tests/integration/local/docker-compose.ring4.yml

@@ -14,7 +14,7 @@ services:
       -http 0.0.0.0:8080
       -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10

tests/integration/local/docker-compose.splitbrain.yml

@@ -14,7 +14,7 @@ services:
       -http 0.0.0.0:8080
       -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10
@@ -34,7 +34,7 @@ services:
       -http 0.0.0.0:8080
       -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10

tests/integration/local/docker-compose.star5hub.yml

@@ -14,7 +14,7 @@ services:
       -http 0.0.0.0:8080
       -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10

tests/integration/local/nat_test_common.sh

@@ -62,7 +62,7 @@ wait_registered() {
     local mult="${PILOT_TEST_WAIT_MULT:-1}"
     timeout=$((timeout * mult))
     for _ in $(seq 1 "$timeout"); do
-        reg=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null \
+        reg=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null \
             | jq -r '.total_nodes // 0')
         [ "${reg:-0}" -ge "$want" ] && { echo "$reg"; return 0; }
         sleep 1

tests/integration/local/network_helpers.sh

@@ -276,7 +276,7 @@ ensure_stack_up() {
     local count
     for _ in $(seq 1 60); do
         count=$($DC exec -T rendezvous curl -fsS \
-            http://127.0.0.1:8080/api/stats 2>/dev/null \
+            http://127.0.0.1:8080/api/public-stats 2>/dev/null \
             | jq -r '.total_nodes // 0')
         if [ "${count:-0}" -ge 2 ]; then
             return 0

tests/integration/local/policy_helpers.sh

@@ -240,7 +240,7 @@ wait_both_agents_registered() {
     local count=0
     for _ in $(seq 1 "$timeout"); do
         count=$($DC exec -T rendezvous \
-            curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null \
+            curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null \
             | jq -r '.total_nodes // 0')
         if [ "${count:-0}" -ge 2 ]; then
             return 0

tests/integration/local/run-all.sh

@@ -25,6 +25,14 @@
 
 cd "$(dirname "$0")" || exit 1
 
+# Many tests bound a host-side command with timeout(1), which macOS does
+# not ship. Without it each of those calls fails with "command not found"
+# and the test reports a product failure. Fall back to the bundled shim.
+if ! command -v timeout >/dev/null 2>&1; then
+    PATH="$PWD/shims:$PATH"
+    export PATH
+fi
+
 JOBS=8
 LIST_ONLY=0
 PATTERNS=""
@@ -68,9 +76,13 @@ $f"
     TESTS=$(printf '%s\n' "$TESTS" | sed '/^$/d' | sort -u)
 fi
 
-# Always exclude: the runner itself, the in-container p2p driver, and the
-# python SDK test.
-TESTS=$(printf '%s\n' "$TESTS" | grep -v '^run-all\.sh$' | grep -v '^test_p2p\.sh$' | grep -v '^test_sdk\.py$')
+# Always exclude: the runner itself, the in-container p2p driver, the
+# python SDK test, and test_cli.sh. test_cli.sh is the in-container driver
+# for the Dockerfile image: run on the host it launches a daemon on
+# /tmp/pilot.sock against the public network, and its cleanup runs
+# `pkill -9 -f pilot-daemon` and deletes /tmp/pilot.sock, which takes the
+# developer's own daemon down with it.
+TESTS=$(printf '%s\n' "$TESTS" | grep -v '^run-all\.sh$' | grep -v '^test_p2p\.sh$' | grep -v '^test_sdk\.py$' | grep -v '^test_cli\.sh$')
 
 if [ -z "$TESTS" ]; then
     echo "no tests matched" >&2
@@ -86,13 +98,11 @@ test_dur_steady_10min.sh
 test_dur_idle_10min.sh
 test_dur_steady_compressed_24h.sh
 test_sec_rekey_flood.sh
-test_cli.sh
 test_size_task_result_10mb.sh
 test_chaos_loss30_all_ops.sh
 test_size_file_100mb.sh
 test_force_relay_task.sh
 test_rendezvous_restart_midflight.sh
-test_gateway_http_message.sh
 test_nat_conntrack_timeout.sh
 test_splitbrain_heal.sh
 test_task_accept_expiry.sh