P0: Mac connector can be actively granted to multiple customer scopes without explicit selection

[100yenadmin]

Problem

One installed Mac connector identity can currently remain actively granted to more than one customer/VM scope. Local connector state then cannot safely determine which customer route the signed-in Workbench user or agent intends.

Current sanitized reproduction on the prepared release Mac:

• 52 stored device rows total;
• 44 historical rows with no hardware-derived identifier;
• 8 rows with an identifier;
• exactly 2 rows match the installed Mac's hardware-derived connector identity;
• both matching rows are active;
• both have active grants correlated to the current local connector token and private connector host;
• the matches belong to two distinct customer scopes.

Selecting the newest row would be unsafe. One route passing must not imply the other route is ready.

Product behavior required

• If exactly one active correlated customer/grant exists, select it.
• If more than one exists, report multiple_active_customer_grants and do not claim connected.
• Workbench must bind Mac control to the authenticated customer/VM scope or require an explicit visible choice when multiple legitimate scopes exist.
• Agent tools must receive the selected customer/grant in session context and fail closed on missing, stale, mismatched, or ambiguous scope.
• The Mac & iPhone surface must show which connections are active and let the authorized user switch or revoke them without exposing secrets or infrastructure identifiers.

Acceptance criteria

• Regression fixture covers the same hardware identity with two active customers and active grants.
• UI readiness, broker authority, support smoke, and agent tools agree on the explicit selected scope.
• No global newest-row heuristic crosses customer boundaries.
• Pending/revoked rows remain historical and cannot win selection.
• Stop/revoke, replacement, expiry, offline transition, ACL denial, and kill switch invalidate the selected route immediately.
• Evidence contains safe booleans/reason codes only; no customer IDs, connector tokens, URLs, addresses, or raw logs.
• Existing single-customer stale-row behavior from P0: stale pending Mac connector rows can confuse active grant selection #656 remains intact.

Dependencies

• Priority 1 exit gate: P0: Mac & iPhone readiness can appear ready before end-to-end broker runtime control works #655
• Broker authority contract: P0: broker attest exact Mac control-plane and ACL readiness #667
• Mac-control tracker: Sprint: Mac Control Contract Unification + Matt-Style Reconciler #480
• Single-customer stale-row fix: P0: stale pending Mac connector rows can confuse active grant selection #656

Proof boundary

Discovery and route smoke were read-only. No customer, device, grant, connector, network, VM, or Matt state changed.

[coderabbitai]

🔗 Related PRs

#391 - Restore beta3 Mac pairing baseline [merged]
#403 - fix: recover Mac control installed app states [merged]
#416 - Fix Mac control connector-service ready reconciliation [merged]
#417 - Fix Mac pairing reconnect session gate [merged]
#465 - Fix Mac connector readiness probe [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!