Phase 8: Production readiness — failover tests, security hardening, sandboxing, deployment docs

- WP-1-3: Central/site failover + dual-node recovery tests (17 tests)
- WP-4: Performance testing framework for target scale (7 tests)
- WP-5: Security hardening (LDAPS, JWT key length, no secrets in logs) (11 tests)
- WP-6: Script sandboxing adversarial tests (28 tests, all forbidden APIs)
- WP-7: Recovery drill test scaffolds (5 tests)
- WP-8: Observability validation (structured logs, correlation IDs, metrics) (6 tests)
- WP-9: Message contract compatibility (forward/backward compat) (18 tests)
- WP-10: Deployment packaging (installation guide, production checklist, topology)
- WP-11: Operational runbooks (failover, troubleshooting, maintenance)
92 new tests, all passing. Zero warnings.

src/ScadaLink.Communication/CommunicationService.cs

@@ -5,6 +5,7 @@ using ScadaLink.Commons.Messages.Artifacts;
 using ScadaLink.Commons.Messages.DebugView;
 using ScadaLink.Commons.Messages.Deployment;
 using ScadaLink.Commons.Messages.Health;
+using ScadaLink.Commons.Messages.InboundApi;
 using ScadaLink.Commons.Messages.Integration;
 using ScadaLink.Commons.Messages.Lifecycle;
 using ScadaLink.Commons.Messages.RemoteQuery;
@@ -143,6 +144,32 @@ public class CommunicationService
 
     // ── Pattern 8: Heartbeat (site→central, Tell) ──
     // Heartbeats are received by central, not sent. No method needed here.
+
+    // ── Inbound API Cross-Site Routing (WP-4) ──
+
+    public async Task<RouteToCallResponse> RouteToCallAsync(
+        string siteId, RouteToCallRequest request, CancellationToken cancellationToken = default)
+    {
+        var envelope = new SiteEnvelope(siteId, request);
+        return await GetActor().Ask<RouteToCallResponse>(
+            envelope, _options.IntegrationTimeout, cancellationToken);
+    }
+
+    public async Task<RouteToGetAttributesResponse> RouteToGetAttributesAsync(
+        string siteId, RouteToGetAttributesRequest request, CancellationToken cancellationToken = default)
+    {
+        var envelope = new SiteEnvelope(siteId, request);
+        return await GetActor().Ask<RouteToGetAttributesResponse>(
+            envelope, _options.IntegrationTimeout, cancellationToken);
+    }
+
+    public async Task<RouteToSetAttributesResponse> RouteToSetAttributesAsync(
+        string siteId, RouteToSetAttributesRequest request, CancellationToken cancellationToken = default)
+    {
+        var envelope = new SiteEnvelope(siteId, request);
+        return await GetActor().Ask<RouteToSetAttributesResponse>(
+            envelope, _options.IntegrationTimeout, cancellationToken);
+    }
 }
 
 /// <summary>