feat(cli): add azureclaw ingress command for inter-agent access control

[johnsonshi]

Summary

Adds an operator-facing azureclaw ingress CLI command and corresponding router endpoints for managing which agents can communicate with a sandbox via the AGT mesh.

Motivation

Inter-agent communication controls (KNOCK trust threshold, per-agent block/allow, mesh:receive policy) exist in the router but are only configurable via env vars (AGT_TRUST_THRESHOLD, AGT_TRUSTED_PEERS) and policy YAML. There's no operator-friendly way to manage them at runtime — unlike azureclaw egress which has a full CLI.

Changes

Router (inference-router/src/ingress.rs):

• IngressAcl struct with per-agent block/allow sets and dynamic trust threshold
• 8 HTTP endpoints behind admin token auth:
  • GET /ingress/status — overview
  • GET /ingress/agents — all known agents with trust + ACL status
  • POST /ingress/block / POST /ingress/unblock — block/unblock agents
  • POST /ingress/allow — explicitly allow (bypasses threshold)
  • GET /ingress/blocked / GET /ingress/allowed — list ACL entries
  • POST /ingress/threshold — update trust threshold at runtime (0–1000)
• 3 unit tests for ACL logic

CLI (cli/src/commands/ingress.ts):

• Mirrors azureclaw egress UX (Docker + K8s auto-detection, admin token auth)
• Flags: --block, --unblock, --allow, --blocked, --allowed, --agents, --threshold, --status
• Default (no flags) shows status overview with available commands

Testing

• cargo test --package azureclaw-inference-router — 29 tests pass (26 existing + 3 new ingress)
• npx tsc --noEmit — typecheck clean
• npx oxlint --deny unused — 0 errors
• npx vitest run — 159 tests pass

Usage

# Show ingress status
azureclaw ingress my-agent

# Block an agent
azureclaw ingress my-agent --block malicious-bot

# Explicitly allow a trusted agent
azureclaw ingress my-agent --allow trusted-partner

# Set trust threshold
azureclaw ingress my-agent --threshold 700

# List all known agents with trust + ACL
azureclaw ingress my-agent --agents

[pallakatos]

Thanks for this @johnsonshi — the ingress CLI + router pattern mirrors egress nicely and the coverage is solid. A few items to address before merge:

CI failure

The Rust build is failing. Likely cause: state.governance.all_trust_scores() called in ingress_agents() handler doesn't exist on Governance. You'll need to either add that method to governance.rs or use a different approach to enumerate known agents.

TOCTOU race in IngressAcl

block() and allow() each take separate RwLocks for blocked and allowed sets. A concurrent call could interleave between the two writes, leaving an agent momentarily in both or neither set. Consider using a single RwLock<IngressAclInner> wrapping both sets, or at minimum document that the struct is not fully atomic.

Merge conflict

The PR conflicts with main on cli/package-lock.json (PR #22 just merged with npm 11 lockfile changes). A rebase onto current main should resolve it cleanly.

Nit: enriched vec moved after use

In ingress_agents(), enriched is moved into the count field calculation after being consumed by the JSON serialization — this will be a compile error. Consider computing the count first:

let count = enriched.len();
Json(serde_json::json!({ "agents": enriched, "count": count, ... }))

Overall

The design is clean — 8 endpoints, mirrors egress UX, proper admin auth on K8s. Once the build is green and the race is addressed, this is good to go. 👍