Why fail-closed serve?

A control plane that boots “mostly configured” is worse than one that refuses — operators think governance is on when it is not.

Decision

Production serve admits only when durable store, shared transport, runner tokens, client auth, and complete RUNNER_TENANTS_* allow-lists (when tokens + client auth are on) are present. Local dev stays open. Escape hatch is explicit and ugly on purpose.

Consequences

• Misconfig fails at boot, not at 2am under load.
• Create paths share one gate (createRunCtx) so “open” APIs cannot bypass admission.
• Tenant allow-lists cannot be forgotten once multi-tenant auth is enabled.

Rejected alternatives

• Warn-and-continue — warnings are ignored; prod looks healthy.
• Per-route half-wiring — N slightly different security postures.

Skimmable story: design/create-run-ctx.html.