refactor: remove leftovers from the orchestrator/gateway consolidation

Sweep for vestiges of the old combined-plane model and the pre-split shared
rootfs. Two are load-bearing, the rest are stale docs/comments:

- Bug: macOS `enumerate_active` only excluded the gateway container from the
  agent list, so after the split the orchestrator container
  (`bot-bottle-mac-orchestrator`, also `bot-bottle-`-prefixed) was enumerated as
  a phantom agent. Exclude both infra containers; test covers it.
- Dead code: the gateway `bootstrap.py` still carried an `orchestrator` daemon
  spec + `_OPT_IN_DAEMONS` + a signing-key/JWT env branch, all for the old
  combined container where the gateway process could also run the control plane.
  No backend ever requests it now — removed; the key-stripping stays as
  defense-in-depth.

Stale-comment reframes: "the/single infra container" -> the orchestrator +
gateway pair (or the specific plane); "shared rootfs / bb_role init / one
published rootfs" -> the per-plane rootfs + `role_init`; the deleted
Dockerfile.infra references in Dockerfile.orchestrator/.gateway; and the macOS
"one infra container ... same address" docstring + its now-false
share-one-address test (the planes are distinct containers with distinct
addresses).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/backend/macos_container/backend.py

@@ -101,10 +101,10 @@ class MacosContainerBottleBackend(
             yield bottle
 
     def ensure_orchestrator(self) -> str:
-        """Bring up the per-host infra container (control plane + gateway) and
+        """Bring up the per-host pair (orchestrator + gateway containers) and
         return its control-plane URL — the on-demand entry point operator tools
         (`supervise`) call when no control plane is running yet. Mirrors
-        firecracker's infra-VM bring-up."""
+        firecracker's infra bring-up."""
         from .infra import MacosInfraService
         return MacosInfraService().ensure_running().orchestrator_url
 

bot_bottle/backend/macos_container/consolidated_launch.py

@@ -15,8 +15,10 @@ caller has to start the agent in between. `ensure_gateway` runs first because
 the agent's proxy env needs the gateway's address at `container run` time; the
 agent's *own* address (the attribution key) only exists afterwards.
 
-The control plane and the gateway are one **infra container** here (see
-`infra`), so `gateway_ip` and the control-plane host are the same address.
+The control plane and the gateway are **separate containers** here (see
+`infra`): the orchestrator on the host-only control network, the gateway on the
+agent network — `gateway_ip` is the gateway container's agent-network address,
+distinct from the orchestrator's control-network host.
 
 The consequence for the identity token: it is minted by registration, i.e.
 *after* the agent container exists, so it cannot be baked into the run-time
@@ -54,9 +56,9 @@ class ConsolidatedLaunchError(RuntimeError):
 
 @dataclass(frozen=True)
 class GatewayEndpoint:
-    """What the agent `container run` needs to reach the shared gateway (the
-    infra container). `gateway_ip` is that container's host-only address, the
-    same host the control-plane URL points at."""
+    """What the agent `container run` needs to reach the shared gateway.
+    `gateway_ip` is the gateway container's agent-network address (the agent's
+    proxy target); `orchestrator_url` points at the separate control plane."""
 
     orchestrator_url: str
     gateway_ip: str         # the gateway's address — the agent's proxy target
@@ -80,10 +82,10 @@ class LaunchContext:
 def ensure_gateway(
     *, service: MacosInfraService | None = None,
 ) -> GatewayEndpoint:
-    """Ensure the per-host infra container (control plane + gateway) is up and
-    report how to reach it. Idempotent — one singleton, so N bottle launches
-    share it. Call before starting the agent container: the agent's proxy env
-    needs `gateway_ip` at run time."""
+    """Ensure the per-host pair (orchestrator + gateway containers) is up and
+    report how to reach the gateway. Idempotent — one singleton pair, so N bottle
+    launches share it. Call before starting the agent container: the agent's
+    proxy env needs `gateway_ip` at run time."""
     service = service or MacosInfraService()
     infra = service.ensure_running()
     endpoint = GatewayEndpoint(

bot_bottle/backend/macos_container/enumerate.py

@@ -6,17 +6,18 @@ import subprocess
 
 from ...bottle_state import read_metadata
 from .. import ActiveAgent
-from .infra import INFRA_NAME
+from .infra import INFRA_NAME, ORCHESTRATOR_NAME
 
 # The name every agent container carries: `bot-bottle-<slug>`. Exported
 # because callers that act on a running bottle (gateway-host rewrites,
 # registry reconciliation) have to map an enumerated slug back to a
 # container name.
 CONTAINER_NAME_PREFIX = "bot-bottle-"
-# The shared per-host infra container carries the same prefix as agent
-# containers but is infrastructure, not a bottle — one control plane + gateway
-# serves every agent, so listing it as an agent would invent one per host.
-_INFRA_NAMES = frozenset({INFRA_NAME})
+# The two shared per-host infra containers (orchestrator + gateway) carry the
+# same `bot-bottle-` prefix as agent containers but are infrastructure, not
+# bottles — one pair serves every agent, so enumerating either as an agent would
+# invent a phantom bottle per host.
+_INFRA_NAMES = frozenset({INFRA_NAME, ORCHESTRATOR_NAME})
 
 
 class EnumerationError(RuntimeError):

bot_bottle/backend/macos_container/gateway_hosts.py

@@ -1,7 +1,7 @@
 """Stable gateway name for macOS agents, via each bottle's `/etc/hosts`.
 
 The shared gateway's address is assigned by vmnet's DHCP and changes whenever
-the infra container is recreated — a source-hash bump, an image upgrade, a
+the gateway container is recreated — a source-hash bump, an image upgrade, a
 crash. Every agent-facing URL (egress proxy, git-http, supervise) embeds that
 address, and the proxy URL reaches the agent as **process environment** at
 `container exec` time. A running process's `environ` cannot be rewritten from