Org membership: no member-cert expiry + no key rotation; write_trust not atomic

[laulpogan]

Grouped lower-urgency findings from the v0.15 identity-layer audit (org/SSO + trust persistence). Filed together; split if picked up separately.

1. Member certs never expire (audit F-5) — MED/HIGH

identity.rs::sign_did_cert produces a raw Ed25519 sig over the DID with no not_after; org_membership.rs::evaluate_card_membership has no time check. A revoked operator's member_cert verifies forever offline. RFC-001 open question O6 ("version-based expiry, decide v0.14-beta") was never resolved in the implementation.
Fix: add not_after to the signed cert payload + enforce in evaluate_card_membership. Breaking cert-format change.

2. No org key rotation / revocation path (audit F-6) — HIGH (escalated by #1)

No wire org rotate-key. RFC-001 T19 designed the bridging-signature rotation but it's unimplemented. Combined with #1: a leaked org key signs forged member_certs for arbitrary op_dids that verify forever.
Fix: implement T19 rotation; #1's expiry is the prerequisite that makes revocation meaningful.

3. SSO verification pipeline is absent (audit F-1..F-4, F-9) — informational until SSO ships

sso_provider.rs is claim-normalization only — no JWKS fetch, no iss byte-equal (Keycloak uses iss.contains("/realms/")), no exp/aud/nonce/receiver_did checks. So SSO→ORG_VERIFIED isn't reachable yet; these matter when the §B pipeline is wired. Generic adapter also accepts http:// issuers.
Fix: implement the amendment-sso §B verification stack before exposing the SSO channel; reject non-HTTPS sso_iss.

4. write_trust is neither atomic nor flocked (audit H-3) — MED

config.rs::write_trust does a raw fs::write while the sibling write_relay_state uses flock + tmp+rename. Concurrent daemon-pull + foreground wire accept can lose a pin or half-write trust.json.
Fix: copy the write_relay_state flock + tmp+rename pattern to write_trust (+ trust.lock).

5. Group introduce_pin doesn't verify member key ↔ DID (audit M-4) — MED

cli/group.rs::introduce_pin trusts roster-supplied key/did without checking sha256(key)[..4] == the DID's 8-hex suffix; dedups by key_id string only. A signed-but-malicious roster could pin a mismatched key.
Fix: verify did_commits_to_key (now available from #244) in introduce_pin; dedup by (key_id, key_bytes).

[laulpogan]

Reopening — only the atomic-write part landed in #288 (write_trust now flock + tmp+rename, matching write_relay_state). Still open under this issue:

• member-cert expiry (org membership certs have no expires_at)
• key rotation (no succession path for an org member's key)
• write_trust read-modify-write lost-update — fix(config): make write_trust atomic + lock-serialized (part of #246) #288 makes each write atomic, but two callers that each read_trust → modify → write_trust can still lost-update; needs an update_trust-style locked transaction like update_relay_state.

Closing-keyword on the squash auto-closed it; these three were never in scope of #288.

[laulpogan]

Status: the write_trust parts are done; the two identity-lifecycle items remain (keeping open).

• ✅ Atomic write (fix(config): make write_trust atomic + lock-serialized (part of #246) #288) — write_trust is flock + tmp+rename.
• ✅ Read-modify-write lost-update (fix(trust): atomic update_trust RMW transaction to close pin lost-updates (part of #246) #299) — new update_trust holds trust.lock across read+modify+write (mirrors update_relay_state); the concurrent pin sites (pair-invite, wire add/accept, sister-pair, MCP accept/dial) route through it. The last bullet of this issue is closed.
• ⏳ member-cert expiry — org membership certs still have no expires_at.
• ⏳ member key rotation — op/org key rotation via succession-cert shipped (feat(identity): op/org key rotation via succession-cert (RFC-001 §T19/§T20) #259, RFC-001 §T19/T20), but org-member key rotation has no succession path yet.

Both remaining items are additive on the v3.2 card → post-1.0 per ROAD_TO_1.0 §5 (the offline-minimal identity layer is the 1.0 line). Leaving open as the tracked identity-lifecycle follow-up.