Praxis mode 3/8: Supervise cortex-gateway as a sibling of cortex #1720

Part of #1714 · phase A, delivery step 3 · Section 4 (Supervision, gateway.yaml, Fail closed) · design in #1717 (docs/superpowers/specs/2026-11-07-praxis-mode-design.md)

Goal

Run the gateway in the process layout that survives to the end state: two siblings under cortex -supervise.

Scope

• cortex -supervise starts cortex and cortex-gateway as siblings, with the existing backoff rules. A Cortex restart does not restart the gateway.
• The supervisor creates ~/.cortex/gateway.token (0600) and writes ~/.cortex/gateway.yaml at each start. The file holds:
  • a forward_proxy listener and a loopback ip_acl.
  • the filter chain, ending with access_log.
  • the interim catch-all route and both private flags.
  • body limits that match direct mode: 32 MiB per request, and no cap on a response's total length (allow_unbounded_body), because direct mode caps only each frame and each buffered response.
• The gateway gets a clean env and exits when the supervisor goes away. A stale gateway on :47605 is stopped at start.
• cortex-gateway is added to cortexBinaries, install.sh --stop and agentop uninstall. In praxis mode, cortexPorts also probes 47605 and 47606.

Done when

• A Cortex restart does not restart the gateway, and a supervisor exit stops it.
• No orphan gateway is left after a SIGKILL of the supervisor.
• When praxis.enabled is false, the supervisor starts only cortex. It does not look for cortex-gateway, start it or need it. A test checks this.

Depends on

#1719.

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com