Define a regime

Mints a world-phase. from/to attach a window (display only) and start: true puts it in force — separate records either way.

A regime is an exact, NAMED applicability context — a mission phase, a jurisdiction, a classification level, a retention window. Identity is the id, never the name: prod freeze and production freeze are two regimes if they were minted twice and no fold will ever discover they were meant to be one.

Membership is a SCOPE LINK somebody wrote down, never a timestamp: nothing joins a regime by having a valid_time inside its window. A window is documentation of intent.

Requires the coord:write scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an il_* machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying coord:write is still refused where the role does not permit it.

A credential with no scope record resolves to LEGACY_DEFAULT, which does NOT include coord:write — mint a key with it explicitly (POST /v2/workspaces/{id}/keys).