[privateip]

Summary

The MASQUE provider refused a connector's second request while its first was open, and it could not refresh or revoke one connector's grant. A reconnect or an HTTP/2 fallback failed until the old stream closed, and every request would have ended at the grant's 30 second ceiling.

A new request now replaces the open one only after the old one stops, and the route claim is held at the same epoch throughout.

Open grants are refreshed every 5 seconds, and revoking one connector ends only its request.

Compatibility

The provider's authorizer interface gains a refresh call and a retire call. The test fixture implements both, and nothing else implements the interface yet. No core component, CRD or manifest changes, so rollback is a revert.

Not covered

• The five new lab rows (replacement, provider stall, agent stall, API partition and single-connector revocation, with cutoff and withdrawal measured separately) have not run. The one attempt was invalid because another run changed the shared lab partway through.
• HTTP/2 reconnects wait on Implement HTTP/2 CONNECT-IP fallback over TLS #981, and cross-node replacement waits on the retire flow in Implement admission, credential expiry and access revocation #977. Node reboot has no lab harness, and the lab cannot read compute-node routes, so remote convergence is not measured.

Test plan

• Build, lint, unit and Kind end-to-end pass, and the adapter suite passes under the race detector against the real core controllers
• A replaced request stops forwarding before its successor starts, and a request that does not stop within 1 second fails the replacement and retires the grant
• Revoking or expiring one connector stops it while another connector keeps the shared instance renewing
• Lab rows pass against the lab with their recorded thresholds

Related to #976

[privateip]

Both first-pass reviews returned merge on head dbe8191.

pr-conventions-reviewer: "VERDICT: merge. Nothing here ships on reconcile. The PR changes only the MASQUE adapter, its tests and docs, nothing under config/ changes, and no open PR touches the same files."

pr-adversary: "VERDICT: merge. No correctness defect in the replace, refresh and retire logic. The only open item is the unrun lab rows, which the author disclosed."

The five new lab rows in tests/edgeconformance/masque_ownership_test.go have not run yet. The lab could not be run during review, so this merge rests on unit and envtest evidence. The user chose to mark the PR ready on that basis.

No findings were applied. The nits were left as they are: the commit subjects are within the 72-character limit, and rewriting pushed commits is not worth it. The title is kept. Adapter.Revoke is kept as the API the grant authority in #977 will call.

CI on the head: Build, Lint, Unit Tests, Unit Tests (root), E2E Tests and the publish jobs all passed. publish-service-api was skipped by its workflow condition.

Auto-merge is enabled with a merge commit, the only method the base branch ruleset allows. The ruleset requires one code-owner approval and dismisses approvals on push, so auto-merge waits for a human approval.

[ecv]

Approve.

Replacement is ordered correctly: replace() ends the old request and blocks on s.closed, which is closed only after the packet registration is closed and the route and attachment references dropped, and only then does newSession register the new one. A stalled old request fails the replacement after 1s and retires the grant, so there is no window with two forwarding requests. It fails closed.

• Grant refresh cannot cross VPCs or change authority: sameAuthority requires the same connector, principal, VPC, VPC UID and ID, service, /96 and routes, and validate is re-run against the original VPC. Only the deadline moves.
• Revoke is per connector, via revokedAt/revokeSeq, and also refuses an admission that began before the revoke (TestRevokeDuringAdmission). A refresh result arriving after the request ended cannot rearm the timer (setDeadline checks ended), and forwarding() checks ended first.
• Closes from #1151: one-request-per-connector blocking reconnects (replacement), and no Refresh/Retire (both added to Authorizer). The route claim stays at the same epoch across the handoff.
• Retire is only called on the stalled-replacement path, and nothing in the adapter retires a grant on normal teardown, so teardown relies on the authority's own expiry.
• Adapter.Revoke has no non-test caller in this diff, so nothing triggers revocation yet. The revocation bound is still the authority's NotAfter plus the 5s refresh interval.

Follow-ups:

• Still open from #1151: the adapter trusts Grant.NotAfter with no cap (for example now plus a maximum grant lifetime) and no MaxSkew margin. A refresh returning a distant NotAfter is accepted as long as validate passes, so the 30s ceiling lives only in the authorizer implementation, which is not in this repo.
• Still open from #1151: two connectors with one /96 are only handled by the existing claim-moving behavior (TestClaimMovingAttachmentEndsRequests), and this PR adds no check that refuses the second.
• A refresh failing for a whole partition keeps the request alive to its last NotAfter. The new lab rows that measure this have not run (PR body), so the bound is unverified.
• replace waits for the transport to call Close after end. Document that contract on connectip.Lease since a transport that never closes turns every reconnect into a 1s failure plus a retired grant.