Implement the HTTP/3 CONNECT-IP edge service #980

Parent: #970

Deliverable

A runnable edge service that accepts authenticated CONNECT-IP requests over HTTP/3 on UDP/443 and forwards packets through the gVPC attachment.

Dependencies

#973, #975, #976, #977, #978, #979; resolve the #991 exposure blockers and applicable #989 findings before wiring the externally reachable listener.

Galactic Edge integration (#992)

Implement this milestone as a consumer of the Galactic Edge provider contract. #992 owns provider authorization, host attachment lifecycle, shared-state fencing and maintenance, independently enforced forwarding expiry, prefix conflict arbitration/publication, and gVPC traffic policy. MASQUE owns client authentication, connector /96 assignment and retention, session packet checks, transport behavior and its provider adapter. Use the foundation's versioned contract and existing provider helpers; do not introduce a second host-networking controller, lease store or BGP publisher. Any required foundation change must be tracked and qualified under #992 before this milestone claims integrated acceptance.

Work

• Integrate the selected QUIC/HTTP/3 stack with TLS configuration, CONNECT-IP negotiation, HTTP datagrams and required control capsules.
• Wire requests to common admission, prefix assignment, ownership, packet policy and return-routing components.
• Support concurrent requests with bounded resources and independent cancellation; release request-owned resources without affecting other connectors.
• Provide buildable service artifacts, internal configuration and a runnable development fixture. Document startup and shutdown for engineering verification, without production rollout work.

Acceptance criteria

• Independent clients complete connect/send/receive/disconnect/reconnect against real gVPC workloads in both directions.
• Tests verify certificate/hostname validation, invalid credentials, denied gVPC selection and cancellation isolation.
• Assigned /96 addresses and subdivisions receive return traffic; expired ownership cannot continue forwarding.
• CONNECT-IP runs natively over HTTP/3/QUIC without requiring a proprietary backend transport.

Additional integration acceptance

• Ship the runnable service as a separate Edge provider using Integrate MASQUE with Galactic Edge provider attachments #975–Enforce delegated-prefix ownership and bidirectional traffic policy #979, with scoped registration/grant examples and container/device access verified by Prove MASQUE packet attachments on the Galactic Edge foundation #974. The core remains protocol-independent.
• Supply a foundation-backed Admission/Lease/PacketBackend path; the raw TUN adapter and cancellation-only Lease are insufficient forwarding authority. Do not expose an unfenced backend.
• Enforce pre-authentication connection/request/admission limits before exposure, authenticate before probes, and isolate full-device/backpressure failures per CONNECT-IP server lacks overload limits and tenant isolation checks #991. Enforce resource limits and qualify connector capacity #984 performs capacity qualification; it is not permission to defer these protections.
• Validate readiness, claim acceptance, grant loss, drain and process restart against real foundation artifacts; no direct host networking or BGP writes.

Scope follows #970: CONNECT-IP with HTTP/2 fallback; no public API development, plugin/portal integration, product-client development or production rollout.