Prove CONNECT-IP interoperability over HTTP/3 and HTTP/2 #973

Parent: #970

Deliverable

A runnable protocol feasibility harness, pinned library/client selections and an interoperability report for both required transports.

Dependencies

None. Can begin immediately; coordinate findings with the other design and feasibility issues.

Work

• Evaluate server libraries for RFC 9484 CONNECT-IP, HTTP Datagrams and capsules over HTTP/3 and HTTP/2 with TLS. Identify missing functionality and the concrete work needed to close it.
• Use independent existing test clients with a controlled packet backend to prove both transports. Test-only configuration and orchestration are in scope; developing a product client is not.
• Exercise Extended CONNECT negotiation, certificate validation, packet framing, concurrent requests, cancellation and bidirectional 1280-byte inner IPv6 packets.
• Block UDP/443 in the fixture and prove a separate HTTP/2 CONNECT-IP tunnel works over TCP/443. Do not require automatic fallback selection in a Datum client.

Acceptance criteria

• A clean checkout can run documented commands with pinned versions and reproduce packet round trips over each transport.
• The report includes actual negotiated HTTP versions, inner packet sizes, blocked-UDP evidence and pass/fail results; a generic QUIC handshake is not sufficient.
• Malformed framing and cancellation of one request do not corrupt another request.
• Both paths pass before dependent production protocol work starts; failed candidates require a revised selection or implementation and a passing retest.

Scope follows #970: CONNECT-IP with HTTP/2 fallback; no public API development, plugin/portal integration, product-client development or production rollout.