Why fail-closed serve?

A control plane that boots “mostly configured” is worse than one that refuses, operators think governance is on when it is not.

Decision

Production serve admits only when durable store, shared transport, runner tokens, client auth, and complete RUNNER_TENANTS_* allow-lists (when tokens + client auth are on) are present. Local dev stays open. Escape hatch is explicit and ugly on purpose.

Consequences

• Misconfig fails at boot, not at 2am under load.
• Create paths share one gate (createRunCtx) so “open” APIs cannot bypass admission.
• Tenant allow-lists cannot be forgotten once multi-tenant auth is enabled.

Rejected alternatives

• Warn-and-continue, warnings are ignored; prod looks healthy.
• Per-route half-wiring. N slightly different security postures.

Summary: design/create-run-ctx.html.