ADR-064: Independently pinned commit roster revisions

Status: Accepted Date: 2026-10-13 Task: SYN-261 (#249)

Context

The genuine SSHSIG verifier already checks exact Git bytes and the pinned caller key list, but that list has no explicit revision/freshness digest and Git author text is not an external subject. Retaining a fixture alone does not prove that current Git/OpenSSH implementations can generate an accepted signature.

Decision

Preserve the existing array roster and v1 result for compatibility. Add an explicit versioned roster snapshot with bounded revision, observation/expiry and unique canonical signing keys. Its domain-separated normative digest must match an independently supplied pin; changing a workspace roster cannot select a new trusted snapshot implicitly. Separate signing-time validity from currently eligible keys, administrative revocation and compromise timing. Claim-time remains signer-controlled without an independent timestamp witness.

CLI and MCP dispatch into the same typed core. Strict snapshot verification denies missing/wrong pins, stale observations, ambiguous keys, unknown/unsigned commits and malformed intervals. Current-key requirements are explicit; historical administrative revocation does not silently rewrite a prior signature. The snapshot remains local reviewed policy and grants no team publication permission. Authenticated bindings/current admission are still SYN-326/SYN-231.

Verification

Create real Git/OpenSSH Ed25519 signed commits in an isolated temporary repository in CI. Verify signature/tampered payload/wrong key/unsigned required commit, revision pin substitution, stale snapshot, rotation and administrative revocation versus compromise, with equal CLI/MCP canonical core results. Run native full checks, dependency denial, documentation and MSRV gates.