Module mutation 

Opt-in authorization for the server’s ten covered confirmed mutation services and the Channel writes an inbound WriteGroup makes (#1319).

This is local application policy, not authentication. The decision itself is ServerPolicy::authorize_mutation; this module holds its context, the MutationPolicy hardening switch and the decision counters. DCC/ReinitializeDevice, the other unconfirmed services, reads, and queries keep their own behavior. Direct handler calls and trusted local writes are not gated here.

Structs

MutationAuthorizationContext

Claimed source identity, verified ingress scope, and decoded target supplied to mutation policy.

MutationDecisionCounters

Fixed-shape local telemetry, not a durable audit log; no source history is retained. New servers start at zero. Each field is independently sampled and saturates at u64::MAX, so snapshots are not atomic aggregates. Counters never affect policy. WPM counts each element reaching its gate, not requests or an unvisited suffix, even one the policy was asked about ahead of the handler (#1321, #2032). An element whose object appeared between that ahead pass and the writes, so the policy never saw it, is denied and counted in deny_total. Pre-gate failures and duplicates do not count. In permissive mode without a policy, a decision allows without decoding, so a later handler failure still counts. An inbound WriteGroup counts once per Channel write it would make.

MutationServiceCounters

Saturating lifetime decision totals for one covered service. These count authorization decisions, not successful mutations or response delivery.

WriteGroupTarget

One Channel write an inbound WriteGroup would make: the Channel, and the change-list entry and priority that reach it (Clause 15.11).

Enums

MutationPolicy

Local authorization mode for the services represented by MutationTarget: ten confirmed services and inbound WriteGroup.

MutationService

The service a mutation decision is for.

MutationTarget

Decoded mutation target and parameters presented to local policy.

MutationTrust

Channel/relay scope derived from ingress provenance, mirroring RB-09 ControlTrust. Scope only, never leaf identity: a verified SC ingress asserts the channel/relay validation, not that a claimed SNET/SADR leaf is the authenticated peer. Provenance alone never authorizes; only the policy does (no static allowlist).

Type Aliases

DeviceWriteAuthorizer

The shared endpoint’s gate for writes to its local Device, given the same redacted context ServerPolicy::authorize_mutation sees, under the same calling rules. A full server uses its ServerPolicy instead.