Native shared source bridge, protocol foundation

This is the staged Synapse side of SYN-231/325/326. It introduces current scoped permits, protected reads and a recoverable host signing port. It does not yet prove the complete Soma issuer/Keychain runtime or strict-team dashboard profile; those issues remain open until the paired real-account integration is verified.

An existing local/unsigned ledger cannot be silently relabeled as a shared origin. Use an explicitly selected fresh workspace/policy and acknowledge unknown preceding history and plaintext retention before creating its limited baseline. Shared configuration pins a scope and reviewed authority-root digest independently of returned device/issuer artifacts. Ordinary local workspaces remain usable.

shared-source takes request schema 1 from a bounded --input file or one stdin line. describe returns public configuration metadata. configure requires the explicit operator door and an independent policy hash/CAS. An MCP agent can inspect metadata but cannot configure/bootstrap/accept; a self-declared role or model confidence cannot manufacture approval or an issuer signature.

For commit_candidate (or the retained limited bootstrap spelling), the explicit --operator-bridge holds the native writer lease while staging source/index state. It emits one bounded synapse.source-seal-required/1 frame with the exact prospective record, unsigned native receipt and its normative signing bytes in base64. The parent must enforce a finite child deadline/cancellation, validate exact scope/actor/key, and return a synapse.shared-source-seal/1 public envelope on stdin. No daemon, key file, private key or bearer/M2M credential is part of this bridge.

The native verifier requires genuine detached device receipt integrity, independently selected issuer roots, complete device bindings/key observations, current writer/key eligibility, exact historical review where needed and a fresh operation-specific issuer permit. That permit binds actual scope/policy/context, source event/sequence/head/record and complete signed receipt digest. Read, limited bootstrap and publication purposes are disjoint. Issuance before the native transaction start, wrong purpose/receipt/policy/actor/scope, missing trust or expired authority denies before installation. The lifetime is explicitly at most fifteen seconds; it is not an instant-revocation or trusted-client-clock promise. Publication also checks expiry/policy immediately before SQLite COMMIT.

Prepare-v4 retains the original public policy/actor/receipt/permit/binding/review bytes with the same exact-digest native source/index decision. An uncommitted crash restores preimages; a committed crash replays original public evidence before source record/head success without a host, private key or new signature. Older prepares 1/2/3 remain recoverable. Unsupported older binaries reject v4. A retained historical admission never authorizes another native transaction.

Shared content/read/receipt/resource/prompt and federation API doors require a fresh read-purpose capability in an explicit SYNAPSE_SHARED_READ_PROOF file supplied by the authenticated host. Keep that public capability owner-private outside Git, renew it per SDK-authenticated request/reconnect, and retain its finite expiry. It permits only the configured registered scope, not another project or publication. There is no silent local fallback. API controls do not sandbox a privileged host’s direct disk access.

Current proof: genuine Ed25519 fixture-root/device signatures through an actual native two-frame process; exact CLI/MCP metadata parity, 42-tool surface and operator denial; current scope/read expiry and old write-door denial; and eight actual process-death prepare/commit/evidence/head recovery boundaries, reopened twice without a signing host. The fixture-only test is separate from the real Soma SDK/Keychain proof below and from a consenting human adoption pilot.

See ADR-065 and SOMA-45. Independent witness coverage must include original shared-seal metadata as well as original receipts before strict-team assurance can report complete required coverage.

Exact staged handoff

Use the operator shared-source stage_baseline or stage_pending operation before requesting an issuer decision. Stage results contain candidate_sha256, original source event/sequence/record and, for queued facts, the exact public shared change. Staging retains original source images and releases the writer lease without installing source or accepting the queue. ReviewPending requires current scoped read authority and exposes the actual queued bytes with their review commitment.

CommitCandidate resumes only the explicitly selected candidate digest. The native record, original preparation observation and Markdown bytes are reused; the live index projects those same bytes. Current source/head/context/review policy and a fresh source permit are still required. A death after issuer acknowledgment before native WAL preparation leaves a durable candidate for explicit retry. Missing or changed source refuses installation instead of overwriting external edits.

Built-in capture/status/link mutations and supported batches are covered. Custom and NER mutations remain pending with an explicit unsupported result. The original operational queue row must remain available for the queued review guard; candidate retention does not promise automatic recovery of a separately destroyed index. Frontmatter/preparation timestamps remain untrusted claims, distinct from original issuer observation and current authorization time. See ADR-067.

The local-owner knowledge process contract explicitly refuses configured shared sources. Generic current-scoped reads and the shared operator bridge remain usable; no shared source is relabeled as a local owner grant. Portable original receipt and seal-set codecs support an independent checkpoint issuer without source body or private signing material crossing the process boundary.

Offline provisional notes

queue_note accepts only bounded caller-supplied note fields and a reason. It needs no network or read capability and enqueues a provisional local claim; it returns only the new pending ID and explicit unverified/pending facets. No source content is read, installed or attested. Queue inspection, staging and publication still require current scoped read/review/operation authority. An authenticated actor cannot be self-declared in this offline request, and no path, external target, private-key or authorization slot exists in its capture shape. Both CLI and MCP use the same core behavior. Generic shared-source reads retain their capability checks.

The legacy accept spelling fails with an explicit requirement to use stage_pending and then the independently selected commit_candidate. A retry cannot silently choose a new random candidate after an issuer acknowledged an older event. Ordinary account-free local-owner acceptance remains available.

Real Soma integration now includes two local Febasi SDK accounts and actual Keychain device keys, distinct review of immutable conflicting notes, native source publication and a backend-issued v3 checkpoint verified by the native strict-team verifier against an independently selected issuer key. Later device revocation preserves historical evidence and denies current reconnect/publication. This proof is separate from a consenting human workflow pilot, which remains outstanding.