Merge pull request #665 from openpacketcore/docs/662-selector-namespace-rfc-xpmzb1ce

docs(rfc): define durable GTP-U selector authority

Author: VerifiedOrganic

.github/workflows/ci.yml

@@ -46,6 +46,10 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          # PR whitespace validation compares the event's base and head, so
+          # retain enough history to resolve their exact merge-base.
+          fetch-depth: 0
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -61,7 +65,17 @@ jobs:
         run: cargo fmt --all --check
 
       - name: Check diff whitespace
-        run: git diff --check
+        env:
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          if [[ "${GITHUB_EVENT_NAME}" == "pull_request" ]]; then
+            merge_base="$(git merge-base "${PR_BASE_SHA}" "${PR_HEAD_SHA}")"
+            git diff --check "${merge_base}..${PR_HEAD_SHA}"
+          else
+            git diff --check
+          fi
 
       - name: Run management-plane policy gates
         run: |

docs/implementation-status.md

@@ -1086,6 +1086,22 @@ and
 
 ---
 
+## RFC 016 – Opaque Durable GTP-U Selector Namespace
+
+RFC 016 is **proposed** and experimental. The rows below are design
+requirements for issue [#662](https://github.com/openpacketcore/openpacketcore-sdk/issues/662),
+not implementation claims. Maintainer approval and merge of the RFC are
+required before an implementation PR can rely on it.
+
+| AC | Criterion | Crate(s) | Tests | Status | Known Gaps |
+|:---|:---|:---|:---|:---|:---|
+| 016-1 | SDK-minted opaque affine capability replaces caller-constructible `Fresh` provenance for a complete selector group. | `opc-gtpu-dataplane`, `opc-session-store` | Planned compile-fail and deterministic namespace tests | **not-implemented** | Proposed RFC requirement; no implementation is claimed. |
+| 016-2 | One device/pin-namespace durable ledger atomically binds all TEID/PAA/mark atoms, generation, nonce, and permanent tombstones. | `opc-gtpu-dataplane`, `opc-session-store` | Planned CAS, fault-injection, restart, and tombstone tests | **not-implemented** | Proposed RFC requirement; mixed provenance and same-group republish are excluded to #663. |
+| 016-3 | eBPF control binding and backend conformance fail closed across map/program loss, replacement, cancellation, and conflicting authority. | `opc-gtpu-dataplane`, `opc-gtpu-dataplane-ebpf` | Planned privileged isolated-eBPF and backend conformance tests | **not-implemented** | Proposed RFC requirement; traffic-proof authority rebind is excluded to #664. |
+| 016-4 | Public diagnostics and RFC 006 evidence remain bounded and identity-free. | `opc-gtpu-dataplane`, `opc-evidence`, `opc-redaction` | Planned redaction and evidence-mutation tests | **not-implemented** | Proposed RFC requirement; it does not establish product readiness or carrier acceptance. |
+
+---
+
 <a id="known-gaps"></a>
 
 ## Known Gaps Registry