Module mutation 

Opt-in authorization for the server’s ten covered confirmed mutation services and the Channel writes an inbound WriteGroup makes (#1319).

This is local application policy, not authentication. DCC/ReinitializeDevice, LifeSafety/Audit, the other unconfirmed services, reads, and queries retain their own behavior. Direct handler calls and trusted local writes are not gated here.

Structs

MutationAuthorizationContext

Claimed source identity, verified ingress scope, and decoded target supplied to mutation policy.

MutationDecisionCounters

Fixed-shape local telemetry, not a durable audit log; no source history is retained. New servers start at zero. Each field is independently sampled and saturates at u64::MAX, so snapshots are not atomic aggregates. Counters never affect policy. WPM counts each element reaching its gate, not requests or an unvisited suffix, even one the authorizer was asked about ahead of the handler (#1321). Pre-gate failures and duplicates do not count. In permissive mode an absent authorizer allows without decoding, so a later handler failure still counts. An inbound WriteGroup counts once per Channel write it would make.

MutationServiceCounters

Saturating lifetime decision totals for one covered service. These count authorization decisions, not successful mutations or response delivery.

WriteGroupTarget

One Channel write an inbound WriteGroup would make: the Channel, and the change-list entry and priority that reach it (Clause 15.11).

Enums

MutationPolicy

Local authorization mode for the services represented by MutationTarget: ten confirmed services and inbound WriteGroup.

MutationService

The service a mutation decision is for.

MutationTarget

Decoded mutation target and parameters presented to local policy.

MutationTrust

Channel/relay scope derived from ingress provenance, mirroring RB-09 ControlTrust. Scope only, never leaf identity: a verified SC ingress asserts the channel/relay validation, not that a claimed SNET/SADR leaf is the authenticated peer. Provenance alone never authorizes; only the callback does (callback-only, no static allowlist).

Type Aliases

MutationAuthorizer

Fast, nonblocking, side-effect-free mutation authorization callback.