Phase C: Let Praxis core accept CONNECT and decrypt, and remove the Go front door #1728

Part of #1714 · phase C · Section 7 (Phase C) · design in #1717 (docs/superpowers/specs/2026-11-07-praxis-mode-design.md)

Goal

Remove the last Go process: the front door.

Scope

• The binary takes :47600. The Go front door, the hop, the probe, gateway_unavailable, the supervisor's second child and the token go away.

• cortex_attribution reads the client address from the connection (praxis#1447).

• The CONNECT-time decisions move into Rust filters: self-traffic, passthrough (the per-program skip set), the client-trust prediction and the unread report.

• cortex_record adds CONNECT rows. skip_hosts, the misdirected-Host check and the egress allow list (as allow_destinations) move into filters.

• Keep existing IP-literal entries of egress_allow_hosts working: a host-and-port check in cortex_attribution, or IP-literal support in Praxis's allow_destinations.

Done when

• One process serves agents and agentop, and agentop sees no change.

Depends on

Trigger: praxis-proxy/praxis#782 and #1447 in a release, after phase D. If upstream lands first, this waits for phase D, so no attribution service is built.

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com