Design: break the Gateway/ALB tenant ceiling — swap the Gateway API implementation to an in-cluster data plane

Design record + actionable plan from the 2026-07-15 scaling analysis. **Not scheduled yet** — implementation to be considered in an upcoming iteration. All quota/product facts below were verified against official docs or the Service Quotas API on 2026-07-14/15.

## Problem

The shared Gateway/ALB is the platform's first binding ceiling (~85–100 tenants, see docs/scaling-limits.md): the AWS Load Balancer Controller materializes every tenant HTTPRoute as ~1 ALB listener rule + 1 dedicated target group, and **"Target Groups per ALB" (100) is a non-adjustable quota**.

## Key insight

The ceiling is a property of the Gateway API **implementation**, not of Gateway API or path routing. Swapping the implementation to an in-cluster data plane collapses ALB consumption to O(1) while **tenant HTTPRoutes stay untouched** — this portability is exactly what Gateway API's class/implementation split is for.

```
Today: CloudFront → ALB (per-tenant rules + TGs, LBC-managed) → tenant pods
Proposed: CloudFront → ALB (static, 1 rule / 1 TG, keeps WAF + CF-only SG) → Envoy fleet → tenant Services
```

## Proposed implementation: Envoy Gateway

- xDS dynamic config: tenant onboarding becomes an xDS push, not an AWS resource mutation (no reload, no connection drop)
- WebSocket/gRPC native (OpenClaw uses long-lived WS)
- Route-scale evidence: upstream control-plane scaling benchmarks (aigateway.envoyproxy.io/blog/benchmarking-control-plane-scaling)
- Fleet is declaratively tuned via the `EnvoyProxy` CR; supports merged/per-gateway deployment modes
- Ops model: one more controller of the same class this cluster already runs (LB controller, Karpenter, Argo CD, agent-sandbox) — standard HPA/PDB/topologySpread + GitOps
- HA: multi-replica fleet across AZs; control-plane outage freezes config but does NOT stop the data plane (xDS property)
- Upgrades: CRDs → controller → fleet; canary via a second GatewayClass

## Alternatives considered (verified)

| Option | Verdict |
|---|---|
| NGINX Gateway Fabric | Legitimate runner-up; younger implementation |
| Cilium Gateway | Rejected — requires replacing the Amazon VPC CNI (we just enabled its network policy agent, #11) |
| Istio | Rejected — full mesh for pure ingress is disproportionate |
| VPC Lattice | Rejected for internet ingress — service-to-service positioning; still needs a front door |
| AWS App Mesh | Rejected — end of support 2026-09-30 (official notice) |
| EKS Capabilities | No gateway capability exists today (GA 2025-11: Argo CD / ACK / KRO only) |
| ALB quota raise | Not possible — "Target Groups per ALB" is non-adjustable; "Rules per ALB" alone doesn't help |
| ALB sharding | Valid fallback (~50 ALBs/Region × ~85 ≈ 4,250/Region); documented in docs/scaling-limits.md as the cell-architecture prelude |

## Future watches

- **EKS Capabilities**: the product trajectory (managed Argo CD) makes a managed gateway capability plausible — if it ships, that is the migration point to hand the fleet back to AWS.
- **Upstream sandbox-router** (kubernetes-sigs/agent-sandbox, 1st-class router on roadmap; WebSocket proxy merged): evaluate during the v1beta1 migration (#13) — adopting the upstream router may supersede parts of this design.
- **Tenant credential path**: near the 5,000 Pod Identity association ceiling, the documented breakthrough is a token-vending-machine with dynamic session policies (AWS SaaS tenant-isolation whitepaper + prescriptive-guidance TVM pattern) — deliberately deferred, documented-only.

## Plan (when scheduled)

- [ ] ADR-0010: implementation swap decision (Envoy Gateway chosen, NGINX Gateway Fabric as alternative), edge-chain preservation (CloudFront + WAF + CF-only SG on the static ALB), rollback story
- [ ] Update docs/scaling-limits.md: quota adjustability table (ALBs/Region 50 adj., TG/Region 3,000 adj., Targets/TG 1,000 adj.), replace the "wildcard router" non-goal with this design, add TVM future path and EKS Capabilities watch
- [ ] CDK: static ALB (1 rule → Envoy fleet TG) preserving WAF + CloudFront-only SG; remove per-tenant TargetGroupConfiguration path
- [ ] Helm: flip `gatewayClassName`; drop LBC-specific annotations/CRDs from the tenant chart
- [ ] Load-test the route-scale envelope (target: validate ≥ 1,000 tenant routes) and record numbers in docs/scaling-limits.md
- [ ] Raise `gatewayTenantBudget` only after the E2E + conformance pass (scripts/conformance-runtime-tier.sh both tiers, NetworkPolicy positive/negative probes)

Part of #5-adjacent scaling track; relates to #13 (evaluate upstream router first), #14, #16, docs/scaling-limits.md.

Read docs/scaling-limits.md and inspect the CDK static-ALB path and tenant Helm chart; start by checking the current GatewayClass and per-tenant TargetGroupConfiguration behavior. Run scripts/conformance-runtime-tier.sh for both tiers with the stated NetworkPolicy probes, then record route-scale results in docs/scaling-limits.md. Done means ADR-0010, preserved edge-chain behavior, configuration updates, rollback coverage, and passing E2E, conformance, and load-test evaluation.

Written by the indexing model from the issue text.