enrollment & delegation: SAS pairing ceremony + chain-to-principal pinning (ceremony-contract §5.4/§2.1)

[hartsock]

Protocol-side companion to #65 and to agent-bridle's Ceremony Contract (bridle PR #229, v0.1.2 §2.1/§5.4/§5.5). The identity model: every participant — principal, agent, surface — is a fingerprint; a monolith is one fingerprint wearing all roles; a no-compute mobile surface is a keypair + renderer.

What already exists here (cite, don't rebuild)

• UserKey (principal root) → AgentKey::issue → CertChain::verify chaining to the user root, fail-closed (fix(protocol): fail-closed causal-generation enforcement in CertChain::verify (§9.1) #39, §9.1)
• Proof-of-possession required to certify an external pubkey (fix(protocol): require proof-of-possession to certify an external pubkey (§9.2) #40, §9.2)
• Handshake rejects cross-user pairs (different_users_rejected_by_handshake)

Delegation (newt → back-end worker) is therefore shipped in outline: both endpoints chain to a common pinned principal; the root key is involved at issuance only (headless fleets verify offline; revocation = generation bump).

What this issue adds

1. SAS enrollment ceremony for new devices/surfaces (incl. no-compute):
   commit-then-reveal, SAS derived from the full exchange transcript, human
   comparison on both screens as the authentic channel. (A naive
   phrase-echo — "new device shows abc-987, trusted device returns it
   encrypted" — is MITM-relayable; the commitment step is what forces the
   attacker to guess in advance.)
2. Parameterized paranoia: strength = (SAS entropy × rounds, distinct witnesses, presence); minima set by caveat ceiling — broad ceiling ⇒ multi-round + ≥2 previously-secured witnessing surfaces + hardware presence (attest).
3. Surface identities: remote surfaces sign their Decisions/AuditRecords; enrollment produces a PinRecord in the chain-store carrying the ceremony parameters (auditable).
4. External anchors as corroboration: GitHub-published keys / DNS / org CA / prior devices = candidate witnesses for a self-sovereign root — never load-bearing (floating-identity doctrine; docs/decisions/floating_identity.md); no-GitHub users enroll by ceremony alone.

Out of scope

• Rendering (newt-agent#1209 owns the consumer side; libraries stay TUI-free per design: mesh exposes decision surfaces (first-contact pinning, caveat grants) — no TUI in library crates #65)
• The bridle-side verdict/policy machinery (bridle #225/#229)

Refs: #65, #39, #40, bridle#229 (§2.1, §5.4, §5.5), bridle#225, newt-agent#1209.

[hartsock]

Scope additions from ceremony-contract v0.1.3 (bridle#229, 7f77cda):

• SAS transcript MUST include the long-term keys being enrolled — an SAS over only ephemeral session material is relay-able with key substitution. Checksum what is being pinned, not the channel.
• Quorum revocation: RevocationRecord (k-of-n designated signers; policy itself a principal-signed entry; last-root refusal without succession/tombstone). L2's upward direction: sub-quorum actors cannot shrink load-bearing identity structure — 'reset mesh' ≠ DoS surface.
• AnchorRecord: principal-blessed bindings for corroboration surfaces (GitHub-keys etc.); participate k-of-n; revocable via the same quorum path.
• Rollback resistance on chain-store sync: heads monotonic; AuditRecords double as witnessed freshness checkpoints.
• Full channel-by-channel adversary table: ceremony-contract §5.6.

[hartsock]

Directive (Shawn, 2026-07-16): multihash over any specific algorithm — "BLAKE3 is an implementation DETAIL, not a law"

Principle: identifiers are self-describing. Laws name properties (collision resistance, determinism, self-certification); profiles pin algorithms; multihash/multicodec carry the algorithm in the identifier so profiles can rotate under a running mesh.

Current gap (grounded): agent_mesh_protocol::Fingerprint(pub [u8; 32]) — raw BLAKE3 digest, no self-description (fingerprint.rs:15). The wire format must become multihash bytes (today: 0x1e blake3-256 + len + digest). The content-addressable crate is already CID-based (multihash-native) ✓; its blake3-pinned constructors are fine as profile helpers.

Semantics:

• Fingerprints compare as opaque bytes including the code — blake3-name(K) ≠ sha3-name(K); no silent cross-algorithm collision.
• The key is the identity; the fingerprint is its self-describing name. Hash migration = re-naming ceremony: the key signs a linkage record binding its new name (chain-store entry, quorum-free — it's not a revocation, the identity never moved). Re-keying remains the L5 full re-ceremony; re-naming is cheap by design.
• Keys and signatures get the parallel treatment: multicodec-tagged (ed25519: prefixes formalized as multicodec, not ad-hoc strings).

Profile v1 (pins, not laws): hash = blake3-256 (0x1e) · sig = Ed25519 (deterministic — required by the chain-store's reproducibility assumption) · canonical encoding = dag-cbor (0x71) · links = CIDv1.

Thursday code items: Fingerprint wire format → multihash; of_bytes becomes profile-parameterized; audit content-addressable crate API for blake3-hardcoding beyond profile helpers.

Spec-side (bridle#229, queued v0.1.4): L5's formula de-blake3'd to fingerprint = H(pubkey) with H's required properties stated; profile appendix added. Same move as attest-vs-passkey: the law names the property, never the implementation.