Phase B: Send absolute-form requests to Praxis and remove the egress listener #1726

Part of #1714 · phase B · Section 7 (Phase B) · design in #1717 (docs/superpowers/specs/2026-11-07-praxis-mode-design.md)

Goal

When Praxis can dial the origin itself, remove the hairpin's throwaway parts.

Scope

• The hop sends absolute-form requests over HTTP/1 (Request.WriteProxy on its own connection, because Go's Transport sends CONNECT for https://).

• Remove the egress listener, X-Cortex-Dest and the catch-all router entry in gateway.yaml.

• The gateway is then the dialer: cortex_attribution refuses a request without a valid token (403) before any dial.

Done when

• Praxis mode passes the end-to-end tests with no egress listener.
• Users of upstream_ca_bundle and upstream_insecure still work.
• A tokenless absolute-form request never reaches the origin.

Depends on

Trigger: praxis-proxy/praxis#1479 and #1480 in a release. Also needed upstream first: a CA and verify option for forward-proxy origination, because #1480 uses the system roots only.

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com