Add reproducible end-to-end feature acceptance tests #985

Parent: #970

Deliverable

A checked-in integration suite and completed evidence matrix proving #970 against the real service and gVPC datapath on a staging edge node.

Dependencies

#984, #974; final integrated acceptance also requires the executed foundation evidence from #998, #1000, #1001 and #1002. Fixture/evidence preparation can proceed before those issues close.

Galactic Edge integration (#992)

Implement this milestone as a consumer of the Galactic Edge provider contract. #992 owns provider authorization, host attachment lifecycle, shared-state fencing and maintenance, independently enforced forwarding expiry, prefix conflict arbitration/publication, and gVPC traffic policy. MASQUE owns client authentication, connector /96 assignment and retention, session packet checks, transport behavior and its provider adapter. Use the foundation's versioned contract and existing provider helpers; do not introduce a second host-networking controller, lease store or BGP publisher. Any required foundation change must be tracked and qualified under #992 before this milestone claims integrated acceptance.

Work

• Package scoped test configuration, fixtures and commands to run the implemented service on Talos/Cilium with independent clients and real local/remote workloads.
• Combine transport lifecycle, /96 subdivision routing, overlapping-tenant isolation, policy, credential expiry/revocation, ownership replacement, API outages and MTU cases.
• Exercise HTTP/2 with UDP/443 blocked and the agreed reconnect/continuity behavior. Capture actual protocol and route observations.
• Integrate automatable tests into the appropriate repository checks; document and execute target-platform privileged checks that require a staging node.
• Collect versioned results and link each epic acceptance criterion to its test and evidence. Production deployment, public APIs and client product changes are excluded.

Acceptance criteria

• Every acceptance criterion in MASQUE Connector for gVPC #970 has an executed passing result with reproducible commands, pinned versions and measured bounds where applicable.
• Negative cases prove that denied traffic does not arrive at the workload or another connector; success is verified by packet exchange, not readiness alone.
• Privileged and target-platform checks are not silently skipped or replaced by mocks.
• The fixture cleans up its own test resources, and documentation lets another engineer reproduce the feature verification without a production rollout.

Additional integration acceptance

• Pin the foundation core/schema/manifests and MASQUE provider artifacts independently. Demonstrate MASQUE against the documented contract with no protocol-specific core changes, manual host programming or provider host privileges.
• Map Define the internal provider contract #993's complete failure matrix to reused executed Deliver independent-provider conformance #1000/Qualify the foundation on the target platform #1002 evidence and MASQUE-specific tests. Keep the independent provider's evidence distinct; a MASQUE test cannot replace foundation conformance.
• Require Implement authorized prefix routing #998 real-BGP/local/remote withdrawal evidence, Deliver foundation diagnostics #1001 exercised diagnostics and Qualify the foundation on the target platform #1002 target-platform results before epic completion. Harness work can run in parallel; final evidence collection is not a circular implementation dependency.
• Include forged pod/service references, unsupported capabilities, same-instance and cross-node transport replacement, credential revocation while unrelated sessions renew, agent/provider stalls, node reboot, GC during preparation, grant changes and same-node NAT-egress delivery.
• Capture denied-packet absence, old/new-owner packet intervals, clock assumptions and local cutoff/withdrawal/remote convergence separately; fail on skipped required checks or cleanup errors.
• Link fixes or evidence-backed dispositions for every Edge pod attachments: unchecked caller inputs and weak isolation tests #989/CONNECT-IP server lacks overload limits and tenant isolation checks #991 finding and each applicable Private service routes can fail silently after a roll or on IPv4 #986 finding. Record artifact revisions containing galactic-edge cannot create the TUN device for PacketAccess attachments #1064/Edge admission accepts a contract version core does not implement #1066/Workloads cannot reach a Galactic Edge attachment on their own node #1067 fixes and rerun affected acceptance rather than relying on their closed status.

Scope follows #970: CONNECT-IP with HTTP/2 fallback; no public API development, plugin/portal integration, product-client development or production rollout.