Enforce delegated-prefix ownership and bidirectional traffic policy #979

Parent: #970

Deliverable

Packet-path policy enforcement that confines a connector to its delegated /96 and authorized gVPC traffic in both directions.

Dependencies

#977, #978, foundation #999.

Galactic Edge integration (#992)

Implement this milestone as a consumer of the Galactic Edge provider contract. #992 owns provider authorization, host attachment lifecycle, shared-state fencing and maintenance, independently enforced forwarding expiry, prefix conflict arbitration/publication, and gVPC traffic policy. MASQUE owns client authentication, connector /96 assignment and retention, session packet checks, transport behavior and its provider adapter. Use the foundation's versioned contract and existing provider helpers; do not introduce a second host-networking controller, lease store or BGP publisher. Any required foundation change must be tracked and qualified under #992 before this milestone claims integrated acceptance.

Work

• Integrate connector session policy with the existing gVPC policy boundary using the accepted internal interfaces.
• Validate inner source addresses before admitting client traffic into the gVPC and enforce destination/protocol/port policy as applicable.
• Apply return-direction policy before selecting and writing to a connector tunnel. Never use another tenant as a fallback for missing state.
• Handle malformed IPv6 packets, extension headers, fragments and required control traffic with bounded parsing and explicit rules; policy updates must affect active sessions.

Acceptance criteria

• Tests reject spoofed sources outside the /96, cross-connector impersonation, cross-tenant traffic and traffic denied in either direction.
• Identical addresses in two tenant contexts never select the other tenant's route or tunnel.
• Policy updates affect established sessions, and malformed or unevaluable packets cannot bypass enforcement.
• Required CONNECT-IP control and ICMP behavior remains functional under the enforced policy; denial reasons are available to observability.

Additional integration acceptance

• Consume Integrate gVPC traffic policy #999 attachment policy binding and updates; keep only connector/session-specific restrictions in MASQUE, and never bypass a closed foundation gate or missing/invalid policy.
• Key packet demultiplexing by explicit VPC/attachment context plus connector prefix and session generation. A destination prefix alone is not a global tenant identity.
• Validate IPv6 source ownership and authorized route/destination use in both directions, including malformed packets/fragments/extension headers and required control traffic; explicitly reject unsupported IPv4 rather than implying IPv4 support.
• Prove denied packets arrive at neither workload nor other connector, including same-instance connectors, overlapping tenants and live policy updates. Verify the relied-on library checks rather than assuming them; cover Edge pod attachments: unchecked caller inputs and weak isolation tests #989/CONNECT-IP server lacks overload limits and tenant isolation checks #991 findings.

Scope follows #970: CONNECT-IP with HTTP/2 fallback; no public API development, plugin/portal integration, product-client development or production rollout.