ADR-060: Event-bound shared admission with an independently tracked head

Date: 2026-10-13 Status: Accepted (protocol component; integrated source publishing remains SYN-231) Author: Rômulo Febasi

Decision

The collaboration adapter accepts a bounded digest-only candidate through an authenticated, current, device-proved review. A proposal and its review are distinct operations. Their server-issued, one-use challenges bind the exact candidate, account/device/key, scope, issuer and policy digest. Device keys sign the canonical challenge bytes in their host; private keys never enter Synapse or the server.

The first Soma adapter uses an explicit conservative policy: current scoped writers may propose; a different current scoped administrator must review. Each candidate binds a stable event ID, expected accepted head, next sequence, transition digest, proposal/rule/context digests and resource identities. Accepting it atomically compares and advances the server head and retains a signed admission before HTTP success. Concurrent candidates from the same parent stay pending after a conflict. No last-write-wins and no offline acceptance.

A fresh login is insufficient by itself. Each consuming operation rechecks current membership and active device/key under database locks. Challenge policy changes, expiry, signature substitution, cross-scope use and replay for a new event deny. An exact successfully committed retry returns its original decision only after current authorization; it never repeats effects. The authority’s decision clock uses integer Unix microseconds. Account validation precedes the database transaction; the adapter cannot promise atomic revocation across independent identity services.

The initial remote head is an explicit scoped administrator acknowledgement of a limited baseline digest. It does not attest source contents or pre-baseline history. The shared service stores no paths, facts, prompts, bearer tokens or private keys. Search/citation ACL, actual source transfer, host prepare/sign/commit and retained independent witnesses remain required for the complete SYN-231 flow.

Portable evidence

synapse.shared-change/1, synapse.operation-challenge/1 and synapse.shared-admission/1 are owned by the pure evidence package. Fixed-order compact JSON, schema plus NUL, explicit nulls and strict Ed25519 follow ADR-059. The server grant covers the exact candidate, proposer, reviewer device proof, policy and observed role-input digest. A caller separately selects expected scope, subject, candidate and reviewed root pin. A historic admission proves the authority recorded that exact decision; it is not a reusable capability for a new publication. Later source changes still require a new event and current server admission.

Alternatives and limits

A reusable binding or five-minute roster cache cannot authorize a specific change.
A TTL-only permit cannot serialize two reviewers of the same accepted head.
Exporting the macOS Keychain key to a CLI file would weaken the existing device lifecycle. Sign public normative intent bytes through the host instead.
Server digest acceptance alone does not prove source installation, semantic truth or strict-team completeness. Keep incomplete verification visibly failing until the source receipt, binding, grant and witness are composed.
A database administrator controlling the issuer and all independently retained witnesses can rewrite evidence. This remains an explicit trust boundary.

Validation

Independent signing vectors, hostile mutations, real scoped PostgreSQL concurrency, two authenticated identities and real CLI/MCP verification exercise the protocol. Expiry, replay, role/device revocation, stale head, wrong tenant/scope and changed policy fail without advancing a head. A recovered response returns the same signed artifact. Human pilot results are tracked separately and are not synthetic tests.

References

SYN-231
ADR-051/052/059; Soma ADR-0051