[privateip]

Summary

The MASQUE lab fixture now runs the provider adapter from #1151 behind a static test authorizer, so the lab tests the code both transports will use. The lab rows set up through requests, because the adapter claims routes only while a request is open. Three rows are new: two connectors sharing one attachment, garbage collection while connectors forward, and a provider process restarted in place. The docs now cover the adapter's setup, readiness, drain and cleanup.

This is the top of a GitHub stack, on #1151.

Compatibility and rollback

Test code, the lab fixture image and docs. Core behavior does not change. Revert the commit to roll back.

Test plan

• task build, task test:unit, task test:e2e, lint and task docs:check pass
• Not run: task verify:masque-conformance. The shared lab ran core images that could not be traced to a commit. This PR stays a draft until the lab rows pass
• CI passes

Fixes #975

[scotwells]

The isolation row still inherits a gap from #1140: the advertised routes cover only each client's own tenant, so connect-ip-go drops the cross-tenant probes before they reach the provider while the probe counts them as sent. Please allow both test destination ranges through the tunnel and verify the negative probes reach the provider before checking they never reach the other tenant. Otherwise, this test can pass without exercising isolation.

[ecv]

Approve.

The static authorizer cannot reach a production binary, and the suite keeps every isolation and unprivileged assertion from #1140 while the new rows check real outcomes.

• Authorizer reach: Config.Authorize lives in package main under tests/edgeconformance/masqueprovider, which nothing can import. Only that directory's Dockerfile and the lab Taskfile.yaml build it, and publish.yaml builds none of it. It ships in no image or manifest.
• Removed lines: the -762 are the hand-rolled provider.go (524 lines) and its tests, which the real adapter replaces. M16-unprivileged-provider, M07-isolation and nat-egress and their bodies are untouched. checkAdmission keeps its credential and VPC cases and only moves the outside-grant route check after them, because the adapter claims routes on request.
• The old end-of-row waitAcceptedFor for both tenants is gone from rowPartial and rowRecreation. Recreation replaces it with a live session per tenant through requireAnswered. After the partial kill only tenant 10 is checked.
• New rows assert outcomes: session status 200, assigned /96, at least 90% of probes answered, gap of one second or less, and no stray packets. shared-attachment-cancel also checks attachment UID and Ready, and the claim's Released flag. process-restart checks the pod UID, restart count, adopted attachment in the new container's log (emitted at adapter.go:190), unchanged attachment UIDs and a higher lease epoch. maintenance-during-use checks the VRF exists and a GC: kept VRF an edge attachment uses line (internal/gc/gc.go:536) for each VPC.

Follow-ups:

• TestMASQUE needs the containerlab dfw lab and is not in CI. The green checks do not exercise any of these rows, so run task verify:masque-conformance once before relying on them.
• maintenance-during-use matches the router's log text and the VRF name format G%09sV. A log rewording makes it fail rather than pass vacuously, but an exported counter would be sturdier.