Prove CONNECT-IP interoperability over HTTP/3 and HTTP/2 #973

Parent: #970

Deliverable

A runnable protocol feasibility harness, pinned library/client selections and an interoperability report for both required transports.

Dependencies

None. Can begin immediately; coordinate findings with the other design and feasibility issues.

Galactic Edge integration (#992)

Implement this milestone as a consumer of the Galactic Edge provider contract. #992 owns provider authorization, host attachment lifecycle, shared-state fencing and maintenance, independently enforced forwarding expiry, prefix conflict arbitration/publication, and gVPC traffic policy. MASQUE owns client authentication, connector /96 assignment and retention, session packet checks, transport behavior and its provider adapter. Use the foundation's versioned contract and existing provider helpers; do not introduce a second host-networking controller, lease store or BGP publisher. Any required foundation change must be tracked and qualified under #992 before this milestone claims integrated acceptance.

Work

• Evaluate server libraries for RFC 9484 CONNECT-IP, HTTP Datagrams and capsules over HTTP/3 and HTTP/2 with TLS. Identify missing functionality and the concrete work needed to close it.
• Use independent existing test clients with a controlled packet backend to prove both transports. Test-only configuration and orchestration are in scope; developing a product client is not.
• Exercise Extended CONNECT negotiation, certificate validation, packet framing, concurrent requests, cancellation and bidirectional 1280-byte inner IPv6 packets.
• Block UDP/443 in the fixture and prove a separate HTTP/2 CONNECT-IP tunnel works over TCP/443. Do not require automatic fallback selection in a Datum client.

Acceptance criteria

• A clean checkout can run documented commands with pinned versions and reproduce packet round trips over each transport.
• The report includes actual negotiated HTTP versions, inner packet sizes, blocked-UDP evidence and pass/fail results; a generic QUIC handshake is not sufficient.
• Malformed framing and cancellation of one request do not corrupt another request.
• Both paths pass before dependent production protocol work starts; failed candidates require a revised selection or implementation and a passing retest.

Additional integration acceptance

• Inventory the existing internal/edge/connectip implementation from feat(edge): Serve CONNECT-IP with delegated prefix admission #954 before selecting or replacing libraries; retain a controlled packet backend for protocol feasibility.
• Document how both transports use the common Admission/Lease/PacketBackend boundary, with production adapters supplied by Integrate MASQUE with Galactic Edge provider attachments #975–Enforce delegated-prefix ownership and bidirectional traffic policy #979. This harness does not satisfy Galactic Edge Foundation #992 provider conformance or platform qualification.
• Carry CONNECT-IP server lacks overload limits and tenant isolation checks #991 protocol/framing and pre-admission findings into the implementation plan; no live foundation grant or privileged host setup is required for this standalone proof.

Scope follows #970: CONNECT-IP with HTTP/2 fallback; no public API development, plugin/portal integration, product-client development or production rollout.