docs+refactor(cni): fix stale package doc, promote hostconf/crdnames/nadpatch

docs/agents/ARCHITECTURE.md

@@ -466,10 +466,10 @@ any shared, per-attachment kernel/CRD state — see the `cmdDel` note in
 | `internal/metadata`           | every binary    | Build-time vars (`Version`, `GitCommit`, `GitTreeState`, `BuildDate`) stamped via `-ldflags`         | No         |
 | `internal/gc`                 | galactic-router | Collects orphaned `BGPAdvertisement`/`BGPVRFInstance` CRDs, stale kernel VRFs, and stale eBPF `vrf_table` entries; invoked by the GC controller's ticker | No |
 | `internal/cni`                | galactic-cni    | Veth master plugin: `cmdAdd`/`cmdDel`/`cmdCheck`/`cmdStatus`; PluginConf parsing; NAD annotation; host-device delegation; delegates kernel work to plumbing | No |
-| `internal/cni/hostconf`       | every CNI-chain binary | Shared `HostConf` schema + static-conflist loader, plus API-based node-name auto-detect          | No         |
+| `internal/hostconf`           | every CNI-chain binary | Shared `HostConf` schema + static-conflist loader, plus API-based node-name auto-detect          | No         |
 | `internal/cni/hostgw`         | galactic-cni, galactic-tap-cni | Host-side gateway address/route configuration for a VPC attachment's allocated IPAM addresses | No |
-| `internal/cni/crdnames`       | galactic-cni, galactic-bgp, galactic-router (gc) | Deterministic `BGPVRFInstance`/`BGPAdvertisement` CRD name + annotation-key derivation | No |
-| `internal/cni/nadpatch`       | galactic-cni, galactic-tap-cni | NAD annotation patch (host interface name) + pod-namespace parsing from `CNI_ARGS`          | No         |
+| `internal/crdnames`           | galactic-cni, galactic-bgp, galactic-router (gc) | Deterministic `BGPVRFInstance`/`BGPAdvertisement` CRD name + annotation-key derivation | No |
+| `internal/nadpatch`           | galactic-cni, galactic-tap-cni | NAD annotation patch (host interface name) + pod-namespace parsing from `CNI_ARGS`          | No         |
 | `internal/cni/ipam`           | galactic-ipam   | IPv6/IPv4 pool allocators + static IP allocator; on-disk marker-file persistence (flock-guarded, keyed by containerID) | Yes (pool allocations + marker files) |
 | `internal/cni/route`          | galactic-route  | Host-side static route add/delete via netlink                                                        | No         |
 | `internal/cni/tap`            | galactic-tap-cni | Tap interface create/delete for VM workloads (Kata, Firecracker, kraftlet/Unikraft)                   | No         |
@@ -576,7 +576,7 @@ Runs on every PR and push to `main`. Two tiers:
 |--------------------------------------------|--------------------------------------------------------------|
 | CNI master-plugin attach/detach flow (veth) | `internal/cni/ops_add.go:cmdAdd`, `internal/cni/ops_del.go:cmdDel` (`internal/cni/cni.go` only holds `RunPlugin`) |
 | CNI master-plugin attach/detach flow (tap) | `internal/cnitap/ops_add.go:cmdAdd`, `internal/cnitap/ops_del.go:cmdDel` (mirrors `internal/cni`) |
-| CNI runtime config resolution (conflist/env/API auto-detect) | `internal/cni/config.go:parseConf`, `loadHostConf`, `internal/cni/hostconf.DetectNodeNameFromAPI` |
+| CNI runtime config resolution (conflist/env/API auto-detect) | `internal/cni/config.go:parseConf`, `loadHostConf`, `internal/hostconf.DetectNodeNameFromAPI` |
 | IPAM delegation (master plugin side)       | `internal/cni/result.go:configureIPAM` (`ipam.ExecAdd`), `internal/cni/ops_del.go:cmdDel` (`ipam.ExecDel`) |
 | IPAM delegation protocol (delegate side)   | `internal/cniipam/ops.go:cmdAdd`/`cmdDel`, `internal/cniipam/allocate.go`                     |
 | Termination-route chain stage              | `internal/cniroute/ops_add.go:cmdAdd`, `internal/cni/route/route.go`                          |

internal/cni/config.go

@@ -17,8 +17,8 @@ import (
 	"github.com/containernetworking/cni/pkg/types"
 	type100 "github.com/containernetworking/cni/pkg/types/100"
 
-	"go.datum.net/galactic/internal/cni/hostconf"
 	"go.datum.net/galactic/internal/config"
+	"go.datum.net/galactic/internal/hostconf"
 )
 
 var ConfFile = config.DefaultConfFile

internal/cni/doc.go

@@ -2,21 +2,30 @@
 //
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
-// Package cni implements the Galactic CNI plugin for wiring containers into
-// SRv6-backed VPC networks.
+// Package cni implements galactic-cni, the veth master plugin for wiring
+// container workloads into SRv6-backed VPC networks. Tap-based workloads
+// (Kata, Firecracker, kraftlet/Unikraft) are galactic-tap-cni's own master
+// plugin (internal/cnitap) — interface kind is which binary is invoked now,
+// not a config field either binary branches on.
 //
-// On ADD the plugin creates a VRF, a veth or tap interface, installs
-// termination routes in the VRF table, allocates a pod subnet via IPAM,
-// and publishes BGPAdvertisement/BGPVRFInstance CRDs for route distribution.
-// On DEL it performs best-effort cleanup in reverse order. CHECK and STATUS
-// validate that managed kernel resources are intact.
+// On ADD the plugin creates a VRF, a veth pair, and patches the pod's NAD
+// with the host interface name. On DEL it performs best-effort cleanup in
+// reverse order. CHECK and STATUS validate that managed kernel resources are
+// intact. IPAM allocation, termination-route installation, and
+// BGPAdvertisement/BGPVRFInstance publish are no longer this package's
+// concern — they're galactic-ipam's, galactic-route's, and galactic-bgp's
+// own, chained after this plugin per the conflist (see
+// internal/cniipam, internal/cniroute, internal/cnibgp).
 //
 // Subpackages isolate kernel primitives:
 //
-//   - ipam: IPv6 subnet allocation from a CIDR pool or static address
-//   - route: VRF route add/delete for termination gateways
 //   - veth: veth pair creation for container workloads
-//   - tap: TAP device creation for VM workloads (Kata, Firecracker)
+//
+// internal/cni/ipam, internal/cni/route, and internal/cni/tap are the same
+// kind of kernel-primitive package, but are no longer used by this package
+// itself — they're used exclusively by internal/cniipam, internal/cniroute,
+// and internal/cnitap respectively, now that IPAM, termination routes, and
+// tap are each their own chain-invoked binary.
 //
 // Usage:
 //

internal/cni/ops_add.go

@@ -14,8 +14,8 @@ import (
 	"github.com/containernetworking/cni/pkg/types"
 	"github.com/vishvananda/netlink"
 
-	"go.datum.net/galactic/internal/cni/nadpatch"
 	"go.datum.net/galactic/internal/cni/veth"
+	"go.datum.net/galactic/internal/nadpatch"
 	"go.datum.net/galactic/internal/plumbing/intf"
 	"go.datum.net/galactic/internal/plumbing/vrf"
 )

internal/cni/types.go

@@ -7,8 +7,8 @@ package cni
 import (
 	"github.com/containernetworking/cni/pkg/types"
 
-	"go.datum.net/galactic/internal/cni/hostconf"
 	"go.datum.net/galactic/internal/cniipam"
+	"go.datum.net/galactic/internal/hostconf"
 )
 
 // PluginConf is the CNI plugin configuration passed via stdin on each

internal/cnibgp/bgp.go

@@ -29,8 +29,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 
-	"go.datum.net/galactic/internal/cni/crdnames"
 	"go.datum.net/galactic/internal/cniipam"
+	"go.datum.net/galactic/internal/crdnames"
 	"go.datum.net/galactic/internal/plumbing/ebpf/uformat"
 	"go.datum.net/galactic/internal/plumbing/ebpf/usidmap"
 	"go.datum.net/galactic/internal/plumbing/vrf"

internal/cnibgp/bgp_test.go

@@ -23,8 +23,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 
-	"go.datum.net/galactic/internal/cni/crdnames"
 	"go.datum.net/galactic/internal/cniipam"
+	"go.datum.net/galactic/internal/crdnames"
 	"go.datum.net/galactic/internal/plumbing/ebpf/uformat"
 	"go.datum.net/galactic/internal/plumbing/ebpf/usidmap"
 	bgpv1alpha1 "go.datum.net/network/api/v1alpha1"

internal/cnibgp/config.go

@@ -17,8 +17,8 @@ import (
 	"github.com/containernetworking/cni/pkg/types"
 	type100 "github.com/containernetworking/cni/pkg/types/100"
 
-	"go.datum.net/galactic/internal/cni/hostconf"
 	"go.datum.net/galactic/internal/config"
+	"go.datum.net/galactic/internal/hostconf"
 )
 
 var ConfFile = config.DefaultConfFile
@@ -31,7 +31,7 @@ var ConfFile = config.DefaultConfFile
 // are shared node-level settings, not domain-specific behavior the way
 // galactic-ipam's own enable-local-ipam flag is — every binary in the chain
 // resolves them from the same static conflist file (see
-// go.datum.net/galactic/internal/cni/hostconf's doc comment).
+// go.datum.net/galactic/internal/hostconf's doc comment).
 var cniConfig *config.CNIConfig
 
 // InitCNIConfig initializes the shared config resolver for CNI env var

internal/cnibgp/ops_check.go

@@ -20,8 +20,8 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
-	"go.datum.net/galactic/internal/cni/crdnames"
 	"go.datum.net/galactic/internal/config"
+	"go.datum.net/galactic/internal/crdnames"
 	"go.datum.net/galactic/internal/plumbing/ebpf/uformat"
 	"go.datum.net/galactic/internal/plumbing/ebpf/usidmap"
 	"go.datum.net/galactic/internal/plumbing/vrf"

internal/cnibgp/resource.go

@@ -16,7 +16,7 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
-	"go.datum.net/galactic/internal/cni/crdnames"
+	"go.datum.net/galactic/internal/crdnames"
 	bgpv1alpha1 "go.datum.net/network/api/v1alpha1"
 )
 

internal/cnibgp/resource_test.go

@@ -12,7 +12,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
-	"go.datum.net/galactic/internal/cni/crdnames"
+	"go.datum.net/galactic/internal/crdnames"
 	bgpv1alpha1 "go.datum.net/network/api/v1alpha1"
 )
 

internal/cnibgp/types.go

@@ -7,7 +7,7 @@ package cnibgp
 import (
 	"github.com/containernetworking/cni/pkg/types"
 
-	"go.datum.net/galactic/internal/cni/hostconf"
+	"go.datum.net/galactic/internal/hostconf"
 )
 
 // PluginConf is the CNI plugin configuration passed via stdin on each

internal/cniroute/config.go

@@ -17,8 +17,8 @@ import (
 	"github.com/containernetworking/cni/pkg/types"
 	type100 "github.com/containernetworking/cni/pkg/types/100"
 
-	"go.datum.net/galactic/internal/cni/hostconf"
 	"go.datum.net/galactic/internal/config"
+	"go.datum.net/galactic/internal/hostconf"
 )
 
 var ConfFile = config.DefaultConfFile
@@ -30,7 +30,7 @@ var ConfFile = config.DefaultConfFile
 // the chain — it never resolves NodeName or Kubeconfig. It uses
 // config.CNIConfig purely for LogFile/LogLevel's env-var > conflist >
 // default precedence, so logging behaves the same way here as everywhere
-// else in the chain (see internal/cni/hostconf's doc comment on the one
+// else in the chain (see internal/hostconf's doc comment on the one
 // static conflist file every binary shares).
 var cniConfig *config.CNIConfig
 

internal/cniroute/types.go

@@ -18,7 +18,7 @@ package cniroute
 import (
 	"github.com/containernetworking/cni/pkg/types"
 
-	"go.datum.net/galactic/internal/cni/hostconf"
+	"go.datum.net/galactic/internal/hostconf"
 )
 
 // Termination represents a network termination point with a destination

internal/cnitap/config.go

@@ -17,8 +17,8 @@ import (
 	"github.com/containernetworking/cni/pkg/types"
 	type100 "github.com/containernetworking/cni/pkg/types/100"
 
-	"go.datum.net/galactic/internal/cni/hostconf"
 	"go.datum.net/galactic/internal/config"
+	"go.datum.net/galactic/internal/hostconf"
 )
 
 var ConfFile = config.DefaultConfFile

internal/cnitap/ops_add.go

@@ -16,9 +16,9 @@ import (
 	"github.com/vishvananda/netlink"
 
 	"go.datum.net/galactic/internal/cni/hostgw"
-	"go.datum.net/galactic/internal/cni/nadpatch"
 	"go.datum.net/galactic/internal/cni/tap"
 	"go.datum.net/galactic/internal/cniipam"
+	"go.datum.net/galactic/internal/nadpatch"
 	"go.datum.net/galactic/internal/plumbing/intf"
 	"go.datum.net/galactic/internal/plumbing/vrf"
 )

internal/cnitap/types.go

@@ -12,8 +12,8 @@ package cnitap
 import (
 	"github.com/containernetworking/cni/pkg/types"
 
-	"go.datum.net/galactic/internal/cni/hostconf"
 	"go.datum.net/galactic/internal/cniipam"
+	"go.datum.net/galactic/internal/hostconf"
 )
 
 // PluginConf is the CNI plugin configuration passed via stdin on each