[privateip]

Summary

MASQUE implementation needs shared decisions for connector identity, address retention and forwarding authority on the Galactic Edge foundation.

Define those contracts, including independent connector deadlines and replacement rules, and map the feature requirements and earlier review findings to acceptance checks.

The design sets qualification targets and follow-on work rather than claiming runtime acceptance.

Test plan

• Documentation links, anchors, tables and address examples pass consistency checks
• Repository checks pass (CI, and task docs:check locally)
• Review confirms that the design and acceptance coverage satisfy the connector milestone

Fixes #972

[polylane]

Note

This change is unlikely to harm production.

Documentation, test, or CI-only change; nothing that runs in production is affected.

_{Polylane analysed 3140dbd for production impact. You can ask follow-ups by mentioning @polylane in a comment.}

Did this help? React 👍 or 👎 so the next review is sharper.

Previous verdicts (1)

Head	Verdict	Analysis
1dee8e8	This change is unlikely to harm production

[ecv]

Approve.

Docs only: no code, manifest or deploy effect. The contract's links resolve and its numbers match docs/edge/provider-contract.md (15.53 s TakeoverWait, 15.5 s gate expiry, 2 s MaxSkew, 1024-route index, prefix-conflict rule), and the old gateway proposal is marked superseded rather than contradicted.

• Nothing unsafe is committed to: no host access, privilege or second route publisher for the provider, credentials are stored as digests only with a 24 h cap, and allocations are tombstoned and never reassigned.

Follow-ups:

• The 31 s revocation bound mixes a 28 s issuer window with node-side MaxSkew and drift. Worth one worked example, or a test in the acceptance matrix that derives 31 s, so the arithmetic is checkable.
• The grant authority is a single new component that every admission and renewal depends on. Its failure mode (existing sessions expire within 31 s, no new admissions) is stated. Its replica count and leader-election story are not.
• Tombstoned /96s are never reassigned and the ledger caps at 256 entries per VPC/cell, so churn can exhaust a VPC. Say who raises the cap or restores space, and what alert fires before exhaustion.
• A source-IP cap of 8 connections per source will constrain clients behind one NAT; it is flagged as a test-deployment policy, so record the production replacement as an open item.