feat(gateway): add node capability negotiation foundation

src/config/schema.test.ts

@@ -138,6 +138,33 @@ describe('configSchema — server', () => {
     expect(result.server.discovery.txt).toEqual({});
   });
 
+  it('defaults node policy settings', () => {
+    const result = configSchema.parse(minimalConfig);
+    expect(result.server.nodes.enabled).toBe(false);
+    expect(result.server.nodes.allowed_roles).toEqual(['companion']);
+    expect(result.server.nodes.feature_gates).toEqual({});
+  });
+
+  it('accepts custom node policy settings', () => {
+    const result = configSchema.parse({
+      ...minimalConfig,
+      server: {
+        nodes: {
+          enabled: true,
+          allowed_roles: ['companion', 'observer'],
+          feature_gates: {
+            'ui.canvas': true,
+            'fs.sync': false,
+          },
+        },
+      },
+    });
+    expect(result.server.nodes.enabled).toBe(true);
+    expect(result.server.nodes.allowed_roles).toEqual(['companion', 'observer']);
+    expect(result.server.nodes.feature_gates['ui.canvas']).toBe(true);
+    expect(result.server.nodes.feature_gates['fs.sync']).toBe(false);
+  });
+
   it('accepts custom discovery settings', () => {
     const result = configSchema.parse({
       ...minimalConfig,

src/config/schema.ts

@@ -79,6 +79,15 @@ const serverDiscoverySchema = z.object({
   txt: z.record(z.string(), z.string()).default({}),
 }).default({});
 
+const serverNodePolicySchema = z.object({
+  /** Enable node registration/capability RPC surface. */
+  enabled: z.boolean().default(false),
+  /** Allowed node roles for node.register. */
+  allowed_roles: z.array(z.string().min(1)).default(['companion']),
+  /** Optional feature gates exposed via system/node capability APIs. */
+  feature_gates: z.record(z.string(), z.boolean()).default({}),
+}).default({});
+
 const serverSchema = z.object({
   tailscale: tailscaleSchema,
   localhost: z.boolean().default(true),
@@ -97,6 +106,8 @@ const serverSchema = z.object({
   ws_rate_limit: wsRateLimitSchema,
   /** Per-session gateway lane queue behavior. */
   queue: laneQueueSchema,
+  /** Optional companion-node registration/capability settings. */
+  nodes: serverNodePolicySchema,
   /** Optional Bonjour/mDNS advertisement settings. */
   discovery: serverDiscoverySchema,
 });