BobSong-dev opened a new issue, #7952: URL: https://github.com/apache/shenyu/issues/7952
## Background P1-08 in the mentor-approved OSPP plan; parent #7949. Configuration-triggered publication alone does not provide a bounded production freshness/recovery policy. ## Existing capabilities and reuse At master `87c22dde7`, RemoteCatalogLifecycle supports ordered parallel refresh with concurrency 1-8; ManagedRemoteMcpCatalog constructs the default serial lifecycle and already has a bounded control queue, revision fencing, credential resolution and failure diagnostics. Reuse these mechanisms and the completed parallel-refresh work (#7648), not a replacement catalog. ## Implementation scope - Expose trusted refresh concurrency with Admin/runtime validation and Starter/managed-catalog wiring; preserve conservative defaults and hard bounds. - Add bounded refresh triggers/frequency, retry backoff and recovery without busy loops. Specify freshness/age thresholds, failure alarms, credential re-resolution and how changed/removed tool definitions are discovered. - Use protocol notifications only for explicitly supported versions/transports; otherwise define bounded polling/manual/config-triggered behavior. - Keep fail-closed default. Stale-snapshot retention or local-only fallback requires an explicit policy and cannot restore revoked authorization, removed tools or obsolete credentials. Fence concurrent refresh, disable and configuration replacement. ## Boundary with #7935 / non-goals #7935 owns stable contract snapshots, schema compatibility diffs, approval and pinning. This issue owns operational discovery freshness and recovery only; a catalog generation is not a public contract version. Expose a coherent publication boundary for future contract governance without implementing its UI/history/pinning here. No automatic tools/call replay. ## Acceptance criteria - [ ] Trusted concurrency reaches the managed runtime and invalid values fail consistently. - [ ] Temporary upstream outages recover with bounded attempts; catalog age/failure/recovery metrics remain accurate and secret-free. - [ ] Credential rotation, tool removal and permission revocation cannot be undone by late refresh results or stale policy. - [ ] Concurrent refresh/configuration deletion/close cannot publish mixed generations or leak sessions. - [ ] Default failure behavior and any optional stale policy are documented and tested. ## Tests Virtual-time scheduling/backoff tests; Admin-to-runtime validation tests; real MCP servers changing definitions/credentials and alternating outage/recovery; concurrent refresh/delete/revocation and shutdown races; extend existing ordering/cancellation/cleanup tests. ## Dependencies P0-01, P1-05 and P1-07. Coordinate publication semantics with #7935, but contract pinning is not a prerequisite for basic freshness. Supports P1-10 and P2-16. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
