Multi-user / team governance seam (spike, SYN-285 / #273)

Executive summary

Multiple writers sharing one governed workspace is the most plausible monetization wedge, and several v1.0 decisions already lean that way. The design that respects the invariants: git is the merge substrate, the bitemporal append-not-overwrite model (ADR-027) already turns most “conflicts” into coexisting facts, per-author audit segments (ADR-026) merge over git’s DAG without coordination, and identity is bound to signed commits (ADR-030). The MVP is therefore small in new mechanism but large in productization + support, so it belongs on the Commercial line, not open-core v1.x. STOP conditions respected: the design needs neither abandoning Markdown-in-git nor a network auth system for the MVP.

1. Context and premisses

Assumes v1.0 invariants shipped (they are the multi-user foundation). The substrate already built multi-user-aware: .synapse/audit/<author>.ndjson per-author segments (merge-safe, ADR-026), identity-fingerprint attribution and dedup (ADR-032), commit-signature posture (ADR-030/034). The gap is a committed design for concurrent writers, not missing primitives.

2. Analysis

2.1 Source of truth & merge model

The Markdown-in-git stays the truth. Concurrent edits resolve via git merge, and the bitemporal model does most of the work for free: a “correction” appends a new fact / closes an interval (ADR-027/046) rather than overwriting, so two authors editing the same entity usually produce coexisting facts, not a textual conflict. Genuine same-line conflicts (two authors set status to different values in the same commit window) fall back to a normal git merge conflict the human resolves: no CRDT, no Synapse-level auto-merge. Last-write- wins is explicitly rejected (it silently corrupts: off-brand).

What this means for Synapse: the merge model is “git + append-not-overwrite”; new mechanism required ≈ 0. The cost is productizing it (clear conflict UX).

2.2 Permission model for the gate

Minimal viable: the propose/accept gate stays per-clone (each author’s pending queue is local), and acceptance authority is expressed as who may sign an accepting commit (ADR-030). A shared workspace defines a set of non-revoked identities allowed to accept; verify/doctor already check commit signatures against known identities. So permissions = the signed-commit posture generalized to a team roster, not a new ACL engine.

What this means for Synapse: permission = “accepted writes must be signed by a roster identity”, verifiable offline. No network auth for the MVP.

2.3 Attribution + verify in multi-user

Already covered: per-author audit segments + witness checkpoints (ADR-026/037) give per-author, merge-safe, tamper-evident history; the remote is a witness (ADR-011). syn verify --since already proves append-only extension across a shared history. Cryptographic SSHSIG verify (SYN-261, deferred to Commercial) is the one piece that becomes load-bearing in multi-user and should ship with it.

What this means for Synapse: the audit/verify story is multi-user-ready by construction; the missing bit (SSHSIG verify) is already Commercial-scoped.

2.4 Which v1.0 invariants must hold unchanged

All of them: INV-1/2/3/5 are per-clone and unaffected; INV-12 (append-only extension) becomes more important; the gate (BR-12.3) stays absolute. Multi-user must add roster + signature enforcement, never relax an invariant.

3. Recommendation

Commercial-line MVP, git-merge model. Build order when pulled in: (1) a team roster of accepting identities in the shared config; (2) enforce accept-must-be-signed-by-roster (lift ADR-030 posture to enforcement, SYN-261); (3) conflict UX doc for the git-merge fallback. Do not add a CRDT, a network auth service, or a hosted gateway for the MVP, those are separate Commercial bets (SYN-230/231/235). Keep it out of open-core v1.x: the value is team/ compliance, not the single-user promise. STOP conditions respected (Markdown-in- git intact, no network auth for MVP).

4. Non-goals (explicit)

• No CRDT / operational-transform layer.
• No hosted multi-tenant service (that is SYN-235 / Commercial).
• No relaxation of the gate or any v1.0 invariant.
• No last-write-wins auto-merge.