ADR-067: Frozen native source candidates before shared review

Status: Accepted (native staging and portable witness component) Date: 2026-10-13 Tasks: SYN-231 (#222), SYN-325 (#310), SYN-326 (#311), SOMA-45

Problem and decision

A source record generated at installation has a new event ID, source preparation time and provenance bytes. It cannot equal a digest previously approved by a separate identity. Issuer acknowledgment before native prepare durability also leaves an interrupted limited bootstrap without its original resumable inputs.

Stage an immutable synapse.source-candidate/1 before requesting issuer review. Retain exact native record, complete observed/after source manifests, private content-addressed images and exact queued review guards under the writer lease. Persist the candidate before returning its independently selected digest. Release the lease and roll back SQLite without installing source or accepting the queue.

Shared review uses the public exact synapse.shared-change/1 metadata derived from the retained candidate; source body/private queue context do not enter the control plane. The reviewer resumes only an explicitly selected candidate. Project the same retained Markdown bytes into SQLite, check current source/head, queued bytes/context, current review policy and fresh scoped host authority, then commit source/index/original receipt/issuer evidence through the existing v4 journal. Never regenerate accepted timestamps or implicitly select latest data.

The preparation timestamp remains an untrusted historical source claim; current issuer permit issuance separately gates installation. An interrupted attempt retains the original candidate but receives a fresh current authorization. External source edits, changed heads/policies and missing input coverage refuse installation without repairing or overwriting the user’s edits.

Scope and evidence

The initial typed path covers built-in capture/status/link mutations and supported batches. Custom/NER mutation kinds remain pending with an explicit unsupported reason. Graph-only leaves use their exact guarded typed payload; no arbitrary serialized SQL replay or replacement of an entire live index is introduced. Exact original undo preimages join the queue/source transaction.

Native tests cover staged baseline retry, changed source/policy denial, frozen queued fact bytes, pending-to-accepted commit and exact reindex projection. Actual local Auth/PostgreSQL two-account proof kills the native child after issuer acknowledgment before native WAL prepare, resumes the same candidate with fresh authority, reviews incompatible API constraints at the same expected head, installs only the selected candidate and retains the conflicting proposal.

Finish complete SDK/Keychain host composition and issuer-produced checkpoints before closing the paired integration issues. Existing local owner knowledge contracts cannot claim owner authority over a configured shared source; generic scoped reads and the explicit shared bridge remain separate supported doors.

The portable witness and original public source-evidence codecs live in the pure synapse-evidence crate. Their byte order is checked against genuine native stored artifacts; a witness issuer compares those artifacts to its immutable decision store rather than signing an unchecked client hash. No signing key or source body is part of these portable inputs. Actual native SDK/Keychain baseline publication has passed in the paired Soma harness; the issuer checkpoint service and shared desktop review surface remain separate acceptance work.