ADR-065: Native shared source sealing through an authenticated host
Status: Accepted (native protocol foundation; paired runtime and strict-team profile pending) Date: 2026-10-13 Tasks: SYN-231 (#222), SYN-325 (#310), SYN-326 (#311)
Context
The authority currently admits exact digests, and Synapse verifies historical bindings/grants separately from source installation. That historical success must not become permission to publish after membership, policy or key changes. Soma keeps device keys in Keychain and authentication tokens in its SDK boundary; Synapse must not acquire either secret through Markdown or global configuration.
Decision
Use a bounded per-operation host bridge: Synapse stages native source/index changes under its writer lease and supplies the exact prospective source record and detached receipt bytes. Soma signs with the currently acknowledged device, obtains a fresh scoped operation decision from its Rust authority, and returns public signed evidence. Synapse verifies scope, exact candidate/receipt/policy, issuer roots, subject/device binding and decision lifetime before installation. The default transaction path refuses shared writes without that evidence.
Preserve the exact public seal in a new durable prepare version. Source, index, receipt and authority evidence recover from the same committed decision marker; recovery of an already committed decision does not request new permission or re-sign history. Uncommitted decisions roll back. A signed historical digest grant alone never satisfies the live publication door.
Explicit shared configuration pins an independent authority trust revision and resource identity. Initial shared bootstrap requires current administration, device possession and acknowledged limited source/history retention. Existing unsigned/local histories are not silently re-signed or relabeled as a team baseline. Ordinary independently selected local workspaces remain usable.
Scoped short-lived read evidence constrains shared retrieval, citations, pending review, retained evidence and impact fan-out. No source content, prompt, private key or bearer is sent to the metadata authority. Disconnected proposals can be retained locally; shared reads/publication require current host verification. Metadata signatures assert authenticated decisions about exact bytes, not truth, agent attention, trusted client clocks or instant revocation on disconnected machines. Finite operation leases must be visible in reports.
Strict-team assurance composes actual source/receipt inclusion with separately selected authority/binding/revocation and an independently retained witness. Every required unknown/missing/stale component denies; basic/v1 results remain explicitly partial and compatible. Git SSHSIG verification remains genuine and cannot be replaced by the presence of a signature header or an author email.
Verification
Two real local authenticated accounts submit conflicting API changes; a distinct current reviewer authorizes one candidate, source/index/evidence commit together, and the competing head fails. Test revoked account/device/key/policy after reconnect, scope/candidate/receipt substitution, all older mutation/read doors, missing/stale roots and witnesses, exact retry and crash recovery at each prepare, install, commit and publication boundary. Validate native Keychain-host signing without exporting private material or tokens to Synapse.
Implementation status
The native protocol and public current-operation types, prepare-v4 source/index/ receipt sealing, protected API reads and fixture-host crash/stdio proof are implemented. Actual Soma issuance/Keychain and independent shared-seal witnessing/ strict-team profile remain acceptance work; this component does not close them.