[schickling-assistant]

Problem

#6272 decides every write by a mission run against its authority, but only audits by default. The milestone requires enforcement.

Goal

Last PR of the M1.4 run-authority stack (stacked on #6272): [programs] authority defaults to enforce. A write outside a run's authority is refused with run-authority-denied. audit stays available so the factory landing canary in M2 can discover its grants first.

Decisions

• Change the default in two places: the config enum, and the store's process-wide mode before the daemon reads its config. A store opened without a daemon config enforces too.
• No other behaviour change.

Verification

Run on the Linux build host at 5494372, all pass:

fractal-kernel: run_authority_is_enforced_unless_the_config_asks_for_audit ok
fractal-store: run_authority/run_credential/barrier tests 9 passed
fractal-api-core: 4 passed (a_run_credential_binds_requests_to_its_run now runs under enforce; its fixture mission declares `write "custom/example/*"`)
fractal-missions-base: 3 passed; fractal (lib): 1 passed

Run on the Linux build host:

• fractal-kernel: run_authority_is_enforced_unless_the_config_asks_for_audit (absent table enforces, audit parses, an unknown value is refused).
• fractal-store: the Mission run authority: decide every write by a run, audited by default #6272 tests, plus the default asserted in writers_other_than_runs_are_untouched.

See above. Hosted CI at the exact head is the proof; pushed with ST_EVIDENCE_LOCAL=off.

Complexity

High risk by docs/review.md: a permission change. A program whose mission does not declare what its effects write is refused from now on. Nothing writes as a run until program dispatch carries run credentials.

Concerns

None beyond #6272's.

Friction & bottlenecks

Builds are serialized on the shared build host.

Follow-ups

None in this stack.

References

docs/st3/program-engine.md §3; #6272.

[schickling-assistant]

Review record: independent reviewer GO at 54943727 (round 1), then GO, delta at 510b2191a609bfe7c79faff2b20ab4a4ed42745c. The new head has only merges of the fixed stack; the two conflicts were resolved correctly, and the #6272 release note is corrected. Risk high (a permission default flips to enforce); its effect stays near zero until #6283. The owner pre-approved queueing this effort's high-risk pull requests on an independent GO plus green CI. Queue with or after #6272 and at or before #6283, with CI green at the head.

[schickling-assistant]

Delta review record for head 1bc725e882a23f5ae3e0382ebcf92e4b8bf48ca5.

• Independent reviewer: GO at 510b2191a6 (earlier rounds recorded above).
• Delta at 1bc725e882a23f5ae3e0382ebcf92e4b8bf48ca5: GO, no new findings. The only change is a clean merge of main (5bde948843, which contains Mission run authority: decide every write by a run, audited by default #6272). git show --remerge-diff is empty and the PR's diff against main matches its earlier diff against the authority-gate branch (6 files, +38/-13) apart from hunk offsets. Nothing main brought in writes with a mission-run/* actor in production; writers that are not runs are untouched because admission returns early for any actor that is not mission-run/*.
• Condition: land at or before Program engine: attempts act as their run (credential in effects, journal as the run) #6283, which adds the first production credential dispatch.
• Risk high by the rubric (a permission default flips), with close to no effect at merge since no production writer acts as a run yet. Queue alone.
• The owner pre-approved queueing this effort's high-risk pull requests on an independent GO plus green CI.
• Verdict: GO; queue alone on hosted CI green at this exact head.