ADR-066: Historical team assurance and original seal witnesses

Status: Accepted (verifier component; shared host staging and issuer checkpoint service pending) Date: 2026-10-13 Tasks: SYN-325 (#310), SYN-326 (#311), SYN-231 (#222)

Decision

Compose strict-team verification from actual native source manifests/images, original detached receipts and original source/issuer evidence. Select current issuer roots, their normative pin, exact resource scope and fresh complete historical-device observations explicitly outside the workspace. A retained embedded key, policy or actor claim cannot select its own verifier trust.

Assess historical device validity at original issuer permit issuance in Unix microseconds, separately from the source preparation observation in seconds. A historical source decision has a distinct result type with authorizes_new_operation:false. Expiry and later administrative retirement preserve preceding decisions; compromise at or before the original decision, stale current observations, wrong scope or missing coverage fail. New source publication still requires fresh current account/key/role/policy admission.

Retain byte-compatible witnesses v1 and v2. Add opt-in v3 with ordered original receipt-set and complete original SharedCommitEvidence-set commitments. A signed replacement of old issuer/binding metadata changes the retained seal commitment and fails against an independently retained checkpoint, even if its individual signatures remain valid. Independent witness pins remain external inputs.

Strict-team requires every retained transition from the acknowledged limited shared baseline, original receipt/seal/admission composition, fresh selected identity evidence and a v3 witness covering the selected tip. Report storage, transitions, receipts, identity, witness, semantic diagnostics and exclusions separately. Basic and strict-local behavior remain available; no automatic account dependency is added to local owner workflows.

Evidence and limits

Pure tests distinguish expired historical decisions from new operation permits and exercise administrative retirement versus compromise. Native tests cover full strict-team baseline composition, missing actors, scope substitution, current revocation preserving history, compromise and authentic rewritten metadata invalidating the seal witness. Actual CLI/MCP38 parity covers positive team assurance and root-pin denial. Real local febasi-api-auth/PostgreSQL with two accounts supplies issuer/device evidence for a native limited baseline and strict-team v3 verification; device signing uses an isolated OpenSSL fixture.

This component does not complete the SDK/Keychain/UI proposer/reviewer handoff, interrupted-baseline reconciliation, issuer-produced checkpoint service or conflicting shared API update loop. Those remain explicit SYN-231/SYN-326 and SOMA-45 acceptance work. No blockchain, semantic truth, independently trusted source-installation time, hidden agent behavior or instantaneous disconnected revocation guarantee is inferred from successful cryptographic checks.