Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

ADR-058: Recoverable native receipts and explicit local assurance

Date: 2026-10-13 Status: Accepted (local implementation; team authority remains SYN-326/SYN-231) Author: Rômulo Febasi

Context

A source hash chain authenticates neither its actor nor its original receipt metadata. Re-signing a receipt with the same transition can evade a source-only checkpoint. Optional signatures/skips must not become a universal green report.

Decision

Prepare-v3 binds the complete native receipt into the same exact SQLite decision as the source record. A strict-local signer is loaded/validated before source installation; missing keys/policy, unknown/revoked/expired signing keys or stale trust deny. After COMMIT, receipt publication precedes source record/head success and recovers from prepared bytes without needing the private key. V1/v2 prepare formats remain recoverable; older binaries refuse v3. Basic new records retain explicitly unsigned native receipts; old coverage holes remain holes.

Native receipt bytes are synapse.state-receipt/1 + NUL + fixed-order compact struct JSON, signature null while public key/key ID/public write profile/trust and policy hashes remain covered. Key ID is full SHA-256 of canonical raw Ed25519 public bytes. Verification is strict Ed25519. Public policy digest is synapse.receipt-write-policy/1 + NUL + compact JSON array [profile,trust_hash]; key paths/private material are excluded. The ordered receipt snapshot is SHA256("synapse.receipt-set/1" + NUL + [[transition_hash,receipt_or_null],...]). No floats/unknown fields/noncanonical base64 are accepted. Python independently computes the receipt/trust digest vectors used by native tests/stdio smoke.

V1 source witnesses remain byte-compatible. Opt-in witness v2 signs the source prefix and exact original receipt-set digest. Receipt changes/re-signing then fail the retained checkpoint. Strict-local requires its witness to cover the selected complete tip, all receipts, independently selected public trust/pin and reviewed freshness. Basic success permits explicit gaps. Strict-team fails closed until authority-issued subject/device scope and current admission exist; a local reviewed key is never represented as employee/team authority.

Explicit syn state verify --profile ... reports synapse.state-assurance/2. Storage/source, transitions, receipts, pinned trust, identity, witnesses and semantic diagnostics/exclusions are separate. Semantic diagnostics are explicitly not run by this source/receipt verifier; use the separate deterministic verifier. V1 syn verify still exists: INV-8 verifies stored signature round-trip when available, skips absent/unsigned evidence and fails invalid receipts. A v1 pass with skips is not complete assurance or independently authenticated identity.

Local strict policy is configured before baseline, with conditional replacement against an exact reviewed public policy digest for rotation/trust refresh. Retained original receipts/public trust revisions are never re-signed. An interrupted initial configuration can be retried explicitly; a missing active policy with retained strict configuration denies source writes. Policy pointer updates are atomic private evidence configuration, outside Markdown/index state. Their trust comes from separately reviewed verifier inputs, not file ownership.

Boundaries

  • Current new-signature approval differs from historical validity at a claimed time. Revoked-now can preserve earlier evidence; compromised-at can invalidate it. Both clocks and unsigned local trust reviews are operator assertions.
  • Offline freshness is the reviewed snapshot deadline and verifier clock; unobserved later revocations, trustworthy historical time and team grants require external authority evidence. Strict-team cannot pass this delivery.
  • Plaintext private history/manual retention, bounded Markdown scope and Unix durability remain ADR-056/057. A disk owner can replace all local artifacts; only separately retained pins/checkpoints constrain that adversary.
  • No global trust/account configuration is changed, and no public blockchain, key material or knowledge content is published. Native receipts are not an in-toto/DSSE standard envelope; that adapter remains SYN-320.

Verification

Signed/unsigned/missing/tampered receipts; wrong/stale trust pins; administrative revocation versus compromise; key rotation with stale-policy conflict; missing policy/key and private-file mode; independent receipt re-signing mismatch; legacy v2 COMMIT recovery and byte-compatible v1 witness; actual subprocess termination at prepare, SQLite, receipt, record, head and finalization. Recovery runs twice without the signing key. Actual CLI/stdio MCP assert equal evidence beyond verifier observation time and explicit strict-team failure.