Complete production roadmap: vault, peers, swarm, streams, ops

Ship remaining roadmap items: encrypted registry vault, peer invite/revoke,
Swarm/plugins behind flags, binary streams, engine create validation, deploy
rollback, schema validation, fleet/access UI, metrics, fuzz/load/soak tests,
systemd packaging, and release tooling. Mark ROADMAP fully complete.

server/server.js

@@ -6,6 +6,7 @@
  * Clients connect with the server public key (printed on start / stored as SERVER_PUBLIC_KEY).
  */
 import DHT from 'hyperdht'
+import b4a from 'b4a'
 import gracefulGoodbye from 'graceful-goodbye'
 import { loadOrCreateKeyPair } from './core/keys.js'
 import { peers } from './core/peer-registry.js'
@@ -13,6 +14,8 @@ import { PeerSession } from './rpc/session.js'
 import { registerAllHandlers, cleanupSession } from './rpc/register.js'
 import { startDockerEventStream, stopDockerEventStream } from './services/events.js'
 import { startStatsBroadcast, stopStatsBroadcast } from './services/stats.js'
+import { isPeerRevoked } from './core/peer-policy.js'
+import { recordPeerConnect, recordPeerDisconnect } from './services/metrics.js'
 import logger from './utils/logger.js'
 
 const { keyPair, publicKeyHex } = loadOrCreateKeyPair()
@@ -21,18 +24,36 @@ const dht = new DHT()
 const server = dht.createServer()
 
 server.on('connection', (socket) => {
+  const peerId = socket.remotePublicKey ? b4a.toString(socket.remotePublicKey, 'hex') : null
+  // Only hard-reject revoked peers here; allowlist + invite redeem run at handshake
+  if (peerId && isPeerRevoked(peerId)) {
+    logger.warn('Rejected revoked peer', { peerId: peerId.slice(0, 12) })
+    try {
+      socket.destroy()
+    } catch {
+      // ignore
+    }
+    return
+  }
+
   const session = new PeerSession(socket, {
     serverPublicKey: keyPair.publicKey,
     onClose: (s) => {
       cleanupSession(s)
       peers.remove(s.id)
+      recordPeerDisconnect()
       logger.info('Peer disconnected', { peerId: s.id.slice(0, 12) })
     },
   })
 
   registerAllHandlers(session)
   peers.add(session)
-  logger.info('Peer connected', { peerId: session.id.slice(0, 12), peers: peers.size })
+  recordPeerConnect()
+  logger.info('Peer connected', {
+    peerId: session.id.slice(0, 12),
+    role: session.role,
+    peers: peers.size,
+  })
 })
 
 await server.listen(keyPair)