[lance0]

Add an authenticated Operator action to extend the saved lifetime of a live ordinary enforced FlowSpec rule. Preserve the exact match, action, rule identity and creation history; refuse expired, withdrawn, blackhole, simulation, foreign-POP or unsafe intent. Fresh ownership, safelist, policy, binding and fence checks precede an atomic expiry/audit update. No speaker mutation or new quota slot is used.

The modal shows current/proposed expiry, the full rule and exact police bps, and requires a reason. An open modal retains precise refusals and uncertain-update warnings after eligibility changes; it blocks further submission until the operator closes it. Read-only preparation uses one five-second budget, server-side statement deadlines and discarded read connections; atomic mutation and COMMIT remain outside cancellation.

Validation on d56b8c4: all 575 library tests, 7 lifetime and 2 admission database tests, all 64 PostgreSQL lifecycle cases, both strict Clippy configurations and the Rust 1.89 all-target check pass. One-connection blocked-read tests recover before blocker release; the old preparation fails the negative control. Mutation SQL and UI preservation were verified. Pinned frontend lint/types, 574 tests and production build pass; both eligibility-loss races fail under the old dialog guard. Desktop/mobile browser checks pass in both themes with reduced motion. All 18 hosted checks pass on this exact head; the PR is clean and ready for review.

This PR targets #325 and contains only lifetime extension. Merge order: #323 → #327 → #322 → #324 → #325 → #326. Use merge commits; after the predecessor lands, retarget the next PR to main before merging.

[Copilot]

🔵 Needs a closer look

Unresolved lifetime monotonicity and lifecycle-lock risks require fixes and final human routing-safety review.

2 open issues

• Prevent clock skew from shortening extended expiries · New
• Bound mitigation preparation by timeout while holding the lifecycle lock · New

What changed in this PR

Adds an operator workflow to extend an existing FlowSpec rule’s saved lifetime without changing its match/action or sending speaker mutations.

Changes:

• Adds an authenticated extension endpoint with eligibility checks and atomic expiry/audit updates.
• Adds a confirmation dialog showing the complete rule, exact police rate and expiry estimate.
• Adds backend, PostgreSQL and frontend coverage, plus operator documentation.

File	Description
tests/​integration_lifetime.rs	Tests transactional updates, rollback and lock-wait safety.
src/​guardrails/​mod.rs	Separates reusable rule checks from creation quotas.
src/​domain/​mod.rs	Exports lifetime-extension types and logic.
src/​domain/​lifetime.rs	Implements extension eligibility, safety checks and domain tests.
src/​db/​traits.rs	Defines the atomic extension repository contract.
src/​db/​repository.rs	Implements PostgreSQL expiry and audit transactions.
src/​db/​mock.rs	Implements mock extension behavior and audit-failure simulation.
src/​api/​routes.rs	Registers the extension endpoint.
src/​api/​openapi.rs	Registers endpoint documentation and schemas.
src/​api/​handlers/​lifetime.rs	Handles authentication, requests and extension responses.
src/​api/​handlers.rs	Exports the lifetime handler and schemas.
frontend/​lib/​api.ts	Adds the extension client and error-status helper.
frontend/​components/​dashboard/​extend-lifetime-dialog.tsx	Adds preview, validation and confirmation controls.
frontend/​app/​(dashboard)/​mitigations/​[id]/​page.tsx	Integrates extension into mitigation details.
frontend/​__tests__/​extend-lifetime.test.tsx	Tests confirmation, eligibility, no-op and error states.
docs/​reference/​api.md	Documents the extension API contract.
docs/​README.md	Links the extension workflow.
docs/​how-to/​extending-mitigations.md	Explains operator steps and safety boundaries.
docs/​cookbook/​manual-mitigation.md	Links extension guidance and corrects documented port limits.
CHANGELOG.md	Records the lifetime-extension feature.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The concurrency-sensitive expiry, audit, and controller-fencing boundaries warrant human safety review, and hosted qualification remains pending.

No open issues 🎉

2 resolved since last review

• Prevent clock skew from shortening extended expiries
• Bound mitigation preparation by timeout while holding the lifecycle lock

_{Review effort: Balanced}

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

🟡 Changes recommended

Eligibility changes can remove an open confirmation dialog and hide refusal or ambiguous-outcome warnings.

1 open issue

• Preserve refusal warning when eligibility changes during request · New

_{Review effort: Balanced}