Refactor: Separate proxy data-planes from a shared proxy shim layer

[huang195]

Summary

Rearchitect Cortex to cleanly separate the concrete proxy data-planes from a shared "proxy shim" layer. The shim owns the cross-cutting concerns so each proxy (Go proxy, Envoy, Praxies) becomes a thin data-plane implementation rather than a duplicate of the same plumbing.

The shim layer should handle

• TLS termination
• mTLS
• Session correlation
• Protocol bridging
• Support for both transparent and forward proxy modes

Motivation

Cross-cutting concerns (TLS/mTLS, session correlation, protocol bridging, transparent-vs-forward proxy handling) are currently entangled with the individual proxy implementations. Extracting them into a shim layer:

• makes adding a new proxy (e.g. Praxies) a matter of implementing a thin data-plane against the shim;
• gives one place for TLS/mTLS and session-correlation behavior across all proxies;
• unifies transparent + forward proxy support.

Related

• Part of epic: Cortex Phase 1 (epic: Cortex Phase 1 rossoctl#2244)
• Enables: Add Praxies as a third proxy (sibling issue)
• Related: transparent inbound interception — Feat: Transparent inbound interception for the Go proxy (proxy-sidecar) — SO_ORIGINAL_DST, no Envoy #330

Design to be expanded.

[huang195]

should also cover reverse proxy for inbound traffic

[huang195]

Adopted into the Cortex v0.9.0 release epic #962 as a P1 (stretch) item, with two notes:

The title and scope are stale. The shared-shim-layer approach described here was rejected in
favour of in-process policy plus a thin interception front. This needs rescoping before anyone
picks it up.

Hard merge cutoff 2026-09-19. A proxy data-plane refactor merging in the release's final week
is the single biggest threat to the v0.9.0 stability bar. If it has not merged by 2026-09-19 it
leaves the release.

Note: this issue stays a native sub-issue of #2244 (epic: Cortex Phase 1) — GitHub allows only
one parent — so #962 tracks it by reference in its stretch checklist rather than as a sub-issue.