[schickling-assistant]

Problem

#6263 binds a request carrying a live run credential to mission-run/RUN, but the engine (#6265) mints none. Program effects therefore still run as an unbound local person, and the journal is written with no actor (docs/st3/program-engine.md §3).

Goal

The program-specific wiring of M1.4, stacked on the engine branch (#6265):

• each start or resume of an attempt mints a credential and puts it in the effects' environment;
• the engine writes program.step journal claims as the run.

Decisions

• ProgramEngine::dispatch mints ST_RUN_CREDENTIAL at the point it sends start, once per start or resume. It goes into the start message's env only, never into Dispatch (which derives Debug) or the journal.

• The host spreads the run env last (Program engine M1.1b: run program steps on a supervised Bun host #6265), so an effect's options.env cannot replace the credential.

• Lifetime is a 7-day backstop. The credential binds only while its attempt is the step's live attempt.

• write_journal sets the actor to the step run's run.

• The idempotency keys are unchanged.

• Review fixes: the credential is minted inside the lock after ensure_host, only on the Started path (a refused, running or host-down dispatch mints nothing), and has no expiry of its own; it binds only while its attempt is the live attempt. Merged Program engine M1.1b: run program steps on a supervised Bun host #6265's tip 3ba3725.

Verification

Run on the Linux build host at f9ce40b (Bun 1.3.13 on PATH), all pass:

fractal-reconcile program_engine: a_programs_effects_and_journal_act_as_its_run ok, a_program_resumes_from_its_journal_after_its_host_is_killed ok, a_step_that_leaves_its_attempt_stops_its_program_and_effects_at_once ok, an_unresponsive_worker_fails_only_its_own_step ok (4 passed)

fractal-reconcile test a_programs_effects_and_journal_act_as_its_run, with a real Bun host:

• an effect reports its ST_RUN_CREDENTIAL, which resolves to the run, step run and attempt 1 while the attempt runs;
• after the program completes, the credential no longer binds (run-credential-ended);
• every journal claim's actor is the run.

Hosted CI at the exact head is the proof; pushed with ST_EVIDENCE_LOCAL=off.

Complexity

High risk by docs/review.md: a trust boundary, since program effects gain a bound identity, and the journal claims' actor changes. Small diff in the engine.

Concerns

Until #6260 and #6263 land on main, this branch merges them, so the diff against #6265's branch includes them.

Friction & bottlenecks

Shared build host, serialized.

Follow-ups

M1.2 swaps its child-run call to create_program_child_mission_run (#6272).

References

docs/st3/program-engine.md §3; #6263, #6265, #6272.

[schickling-assistant]

Review record: independent reviewer round 1 at f9ce40b209 returned CHANGES (the credential had a fixed 7-day expiry, and rows were minted on Running/HostDown). Round 2 at 40f0af6309755e488a1484d512fae2a2f5122282 returned GO, delta: the credential now lives exactly as long as its attempt (run_binding liveness, no expiry) and is minted only on Started inside the lock after ensure_host, with a test that 5 passes mint one credential. Risk high (trust path). The owner pre-approved queueing this effort's high-risk pull requests on an independent GO plus green CI. Queue after #6265 and the #6260/#6263/#6272 stack, with CI green at the head.