[Skeyelab]

Closes #70

Summary

Router.route previously hid four unrelated policy concerns inline. This pulls the inbound gate into a named, testable stage and abstracts the disabled-state read behind a port.

• RuntimeFlags port + UserDefaultsRuntimeFlags — abstracts Jared's global disabled state away from direct UserDefaults.bool(forKey:) reads. Injectable.
• InboundFilterPolicy — concentrates self-message, body-type, and global-disabled + /enable bypass policy. Reads RuntimeFlags. Pure and unit-testable without mock routes.
• Router — now a thin pipeline runner: NotifyDelegates → FilterPolicy → MatchRoutes (MessageMatcher) → InvokeRoute. Takes RuntimeFlags injected (default UserDefaultsRuntimeFlags).
• Jared.send outbound disabled check now reads the same RuntimeFlags port, so runtime-flag reads live behind one abstraction.

Scope note

The issue lists NotifyDelegates/MatchRoutes/InvokeRoute as separate stage types. Those are one-liners and MessageMatcher already is MatchRoutes — extracting them into wrapper types would add shallow modules against the deep-module goal. The real depth (the four hidden policy checks) is now in InboundFilterPolicy; the rest stays as a readable loop in Router with stage comments.

Built with TDD

One behavior per red→green cycle: normal-allow (tracer) → self-message → body-type → disabled → /enable bypass (+ case-insensitive) → reaction → UserDefaultsRuntimeFlags → Router integration. Refactored Jared.send onto the port only after green.

Test plan

• bash ./.github/scripts/test-macos.sh — 117 tests, all pass
• InboundFilterPolicyTests — allow/block per policy stage, /enable bypass explicit + case-insensitive, reaction body
• UserDefaultsRuntimeFlagsTests — key set/unset via isolated suite
• RouterTests — new testDisabledFlagsSkipPluginRoutes, testEnableCommandRoutesEvenWhenDisabled; existing Router/MessageMatcher tests unchanged and green

Acceptance criteria

• Each pipeline stage independently testable (InboundFilterPolicy standalone)
• RuntimeFlags abstracts UserDefaults / disabled state
• /enable bypass preserved and explicitly tested
• Existing RouterTests and MessageMatcherTests pass

🤖 Generated with Claude Code