Writer: close a key in every namespace held, one change-set per namespace (issue 8)

[Hafeok]

Closes #151 — PRD ledger/prd/namespace-independence-prd.md §6 issue 8 (§3.2, §3.3; rulings 47 and 69; AC-47 third bullet).

Stacked on #161 (issue 7). Review the last commit alone, ccf8a0c3.

What lands

ledger identity revoke|rotate <binding> --everywhere closes the key in every namespace its principal holds it open in: one change-set per namespace, each the same act closing that namespace's binding with the same at, signed in its own namespace, filed namespace by namespace and gated as it lands, naming every file written, to land in one commit (LP-6.34, new). Without the flag a close ends the key in the namespace of the binding it names, as before, and the split is a notice (ruling 69). A key already closed everywhere is refused with nothing to close.

The other half of this issue already landed. The writer opening every namespace on its own genesis, roles, first policy and self-bound binding — join_genesis gone, --external-ref required every time — came with #159 (issue 5) and #160 (issue 6), for the reason those pull requests give: with authority and keys per namespace, the old writer could not open a second namespace at all. The genesis_key.rs rewrites §3.11 lists landed with #160. --without-key stays until issue 13.

Tests (AC-47, third bullet)

ledger-cli/tests/key_across_namespaces.rs (each failing before): a revoke everywhere files one change-set in A and one in B, both closes with one at, each naming its namespace's binding, named in the verb's output, landing in one commit; verify is conformant with no split notice and both allowed_signers lines end; closed everywhere, a second --everywhere is refused; a rotate everywhere closes the key and binds the new one in each namespace, the new key signs in B and the old one does not; the carried test now drives --everywhere too — no agent identity and no non-interactive session produces a key close. The notice for a close in one namespace alone is asserted by the tests #160 added.

Also: signers_per_namespace.rs (issue 7) pauses a second after opening its two namespaces, as its sibling key tests do — a close in the same second as the policies it closes under sat at their second for ssh-keygen, and the test was flaky (seen once in the full run).

Protocol

LP-6.34 (new); LP-6.32 loses its note; Appendix B row; no Appendix C note (the issue row says none). CLAUDE.md updated. No class added; no digest moves.

Checks

cargo build, cargo t, cargo clippy --workspace -- -D warnings -D clippy::unwrap_used, the quality scripts, and ledger verify --export on this repository (same output as on main).

🤖 Generated with Claude Code

https://claude.ai/code/session_01GgRcHXmnAu43hChNxhnqxU

---

Generated by Claude Code

[Hafeok]

CI, standing down on one step. The check job will fail at the contract-surface gate (ddd diff-contracts <base>..HEAD) for this PR's exposed-surface changes — identity_revoke and identity_rotate re-signed with everywhere, KeyArgs deriving Clone — as it does for #157–#161. Every other step of check passes locally.

The remedy the gate names is ddd bind claude/great-feynman-zcdsdd-step-07-signers..HEAD (with --verdict), which files seam declarations under .ddd/seams/. The session's instructions forbid me to edit .ddd/, and a declaration's verdict is the author's judgment, so I am not filing them. Please run ddd bind on this branch and push, or tell me to. Recorded in the close-out.

---

Generated by Claude Code