Define connector admission, addressing and ownership contracts #972

Parent: #970

Deliverable

A reviewed, repository-owned design and acceptance matrix that implementation issues can use without inventing incompatible lifecycle or authorization rules.

Dependencies

#993 and the current provider contract. Coordinate with #994–#1002 implementation and evidence; design can begin now. #973 runs independently.

Galactic Edge integration (#992)

Implement this milestone as a consumer of the Galactic Edge provider contract. #992 owns provider authorization, host attachment lifecycle, shared-state fencing and maintenance, independently enforced forwarding expiry, prefix conflict arbitration/publication, and gVPC traffic policy. MASQUE owns client authentication, connector /96 assignment and retention, session packet checks, transport behavior and its provider adapter. Use the foundation's versioned contract and existing provider helpers; do not introduce a second host-networking controller, lease store or BGP publisher. Any required foundation change must be tracked and qualified under #992 before this milestone claims integrated acceptance.

Work

• Define immutable connector identity, gVPC binding, attachment identity and per-connector forwarding ownership. Specify the internal interfaces and state transitions between admission, attachment, packet forwarding and route publication.
• Define credential validation, trust distribution, expiry and revocation inputs. Specify how engineers can provision authorized test connectors without a new public API or portal integration.
• Require one /96 per connector consistent with gVPC addressing, permitting local subdivision. Decide allocation lifetime, address retention and session continuity across reconnects and HTTP/2 fallback; distinguish prefix allocation from active forwarding authority.
• Adopt the foundation fencing mechanism and document its partition/restart assumptions. Record its numeric claim/renewal, forwarding-expiry and route-withdrawal bounds and define client-specific revocation bounds; distinguish local withdrawal from remote convergence.
• Set connector-count, throughput and resource-budget targets for each transport, with a defined benchmark workload and overload acceptance criteria.

Acceptance criteria

• The design records concrete decisions, numeric bounds, interface ownership and failure behavior; unresolved implementation choices do not prevent dependent issues from starting.
• The acceptance matrix maps every requirement in MASQUE Connector for gVPC #970 to an executable check or named follow-on deliverable.
• Review explicitly covers a partitioned owner that retains client/gVPC connectivity, delayed old-owner cleanup, prefix retention and QUIC-to-HTTP/2 reconnects.
• Link the design to the gVPC tenant addressing plan and the applicable protocol RFCs. Public API development and client implementation remain outside the contract deliverable.

Additional integration acceptance

• Record the exact resource/UID mapping: approved EdgeProvider and authority-owned EdgeService, one EdgeInstance/Lease per provider pod, one attachment per pod/service, one EdgeRoute per delegated /96. Identify authoritative connector-allocation storage separately from route lifetime.
• Design same-instance session generation/serialization as well as cross-instance route takeover. A shared instance epoch cannot distinguish two competing HTTP requests; late cancellation and queued return packets must not affect a replacement.
• Define how one connector's credential/grant expiry and revocation bounds remain enforced while unrelated sessions renew the instance. If the existing contract cannot enforce the selected authority model, link the required foundation extension and its acceptance gate before implementation; do not claim instance expiry solves per-client expiry.
• Adopt Define the internal provider contract #993 timing values and clock assumptions, separating guaranteed bounds from targets. Define numeric client-specific bounds and their outage/stall behavior without weakening foundation guarantees.
• Specify provider token/RBAC, capability compatibility, readiness ordering, restart/drain, packet-device access without host privileges, and operator-managed test grants. No provider may mint its own EdgeService authority.
• Map all Galactic Edge Foundation #992 milestones and Edge pod attachments: unchecked caller inputs and weak isolation tests #989/CONNECT-IP server lacks overload limits and tenant isolation checks #991/applicable Private service routes can fail silently after a roll or on IPv4 #986 findings into the MASQUE Connector for gVPC #970 evidence matrix.

Scope follows #970: CONNECT-IP with HTTP/2 fallback; no public API development, plugin/portal integration, product-client development or production rollout.