A WAC mode for writing a derived partition

[tophcodes]

Sibling of #67. Both gate a capability that acl:Write does not describe; this one is the write, that one is the configuration.

What

A WAC mode that grants the right to write a derived partition of /.aux/{subject}.meta. An agent holding it may report extraction results about a subject; an agent holding plain acl:Write on the subject may not.

Why

ADR-10 (docs/decisions.md) makes an external extractor a first-class one, which means
.meta has to be writable by something other than the pod, and the something is an agent
that reached the pod over HTTP like any other. Plain acl:Write is the wrong gate: it is
the mode a client holds to edit its own documents, and extraction output is not the client's
document. Without a distinct mode, granting anyone write access to a subject also grants
them the right to fabricate what its bytes are claimed to mean.

The partitioning in #65 bounds the damage but does not gate it: partitions keep two extractors from overwriting each other, they do not decide who may be an extractor.

How

• Same two constraints A WAC mode for configuring extractors: name, namespace, status codes #67 already argues, for the same reasons: it cannot live in urn:quadpod: because a client has to be able to write it into an ACL document, and it needs a name that says what it grants.
• 401 for absent or bad credentials, 403 for authenticated-and-lacking. Same argument as A WAC mode for configuring extractors: name, namespace, status codes #67: the refusal is ordinary operation, not only attack.
• The same ceiling applies and should be stated once for both modes rather than twice: whoever holds acl:Control can grant themselves either. The value is delegation downward.
• Open: whether one mode covers both configuring and writing, or the two stay separate. Separate is the honest reading (an agent that runs OCR has no business editing the extractor config), but it costs a second reserved name in the same namespace, and the argument has not been made properly.
• Interaction with Provenance for derived partitions: what records it and where it lives #75: the mode says who may write a partition; the provenance says which partition a given write lands in. Neither substitutes for the other.