VerseVDI-Data-Plane/openspec/changes/archive/2026-07-29-apollo-transport-gateway/proposal.md

Why

The Data Plane is an empty gateway boundary. Phase 3C-G needs a pure-Go QUIC process that admits only Connection Server authority, adapts one Apollo/GameStream provider profile, and relays encoded bytes without exposing the provider or decoding media.

What Changes

• Add bounded QUIC/TLS streams and DATAGRAM framing with authenticated admission.
• Add a native-Go Apollo profile, deterministic fixtures, a bounded fake provider, lifecycle cleanup, input release, capability intersection, pacing, telemetry, and packaging.

Provenance

Provider behavior is independently implemented from the exact Apollo pin adc5c5a0bd80831ce495434bb16aee2cd4175fb8 and the Planning Hub's recorded public Moonlight/common-C protocol evidence. Only the used source paths are recorded; no source tree or proprietary capture is copied.

Non-goals

No cgo, native sidecar, decoder/encoder/transcoder/render path, direct provider route, database credential, provider plugin framework, or live Apollo qualification.