design: mesh exposes decision surfaces (first-contact pinning, caveat grants) — no TUI in library crates

[hartsock]

Design directive (make true over time)

agent-mesh is a library for other projects (plus the in-tree amesh
reference consumer). Library crates SHALL NOT contain TUI components.
Instead they expose STRUCTS and API seams that demand the creation of a
GUI/TUI/API surface by the consumer. (Workspace-wide agent-* directive;
canonical contract lives in agent-bridle's issue — this one scopes it to
the mesh.)

Audited 2026-07-15: library crates are currently TUI-free (the stdin use in
agent-mesh-cli/src/mcp.rs is MCP stdio transport, not interactive UI).
This issue is a ratchet to hold plus the demand-side design below.

The mesh's decision surfaces

Where the mesh's own semantics demand a human decision, expose the struct —
never the prompt:

1. First-contact key pinning (the TOFU ceremony). The Zero-Trust /
   floating-identity research pass confirmed exactly one top failure mode
   for pubkey-as-identity systems with a primary source: RFC 7401's own
   admission that keyless first contact is a "leap of faith… subject to
   man-in-the-middle." The mesh must expose an introduction struct —
   { fingerprint, pubkey, channel-of-introduction, proposed caveats } —
   and a DecisionSurface-style seam for the pin/reject choice. newt can
   render it as a matrix chooser with an audit escalation into a rich
   trust-management TUI; hermes as a flat allow/deny list; a daemon
   consumer as a pre-pinned-keys policy file. The library never asks.
2. Caveat grants on introduction (what a newly-pinned peer may do) —
   same seam, composed with agent-bridle's verdict contract (bridle #220).
3. Quiet-peer disclosure (any future "reveal this quiet identity to X"
   affordance) — same seam.

Alignment with the floating-identity doctrine

docs/decisions/floating_identity.md: identities are durable; locations
are fungible candidates. This directive is the same law one layer up:
decision semantics are durable (library); presentation surfaces are
fungible candidates (consumers). newt's matrix chooser, hermes's flat
list, a policy file, a GUI — all candidate renderings of one decision
struct. No consumer's layout may become load-bearing for mesh semantics.

Laws

1. No TUI deps (ratatui/crossterm/cursive/dialoguer/inquire/console/…) in
   any agent-mesh-* library crate; CI deny-list enforces.
2. The library defines the decision SPACE; the consumer defines LAYOUT.
   Escalations (e.g. audit) are optional-to-render — grants must be
   complete without them.
3. Headless is fail-closed: no surface bound → no pin, no grant.
4. amesh (in-tree consumer) may render prompts, but only through the same
   public seam any external consumer would use — it is the reference
   implementation, not a privileged backdoor.

Acceptance

• Introduction/pinning struct + decision seam published from the bus or
  protocol crate (design doc first; see floating_identity.md)
• CI deny-list for TUI deps in library crates
• amesh first-contact prompt (when built) routes through the seam
• floating_identity.md gains a first-contact law citing RFC 7401's
  TOFU admission (doctrine PR follow-up)

Related: docs/decisions/floating_identity.md (PR #63), #61/#64 (identity
dialing), agent-bridle #220 (verdict/policy contract).

[hartsock]

Consumer side filed: newt-agent#1209 (HIGH — first-contact pinning ceremony, fail-closed headless, pinned-store with provenance). newt lands its chooser wiring behind its own trait now and binds this issue's introduction struct when the seam ships — neither blocks the other. Doctrine law 5 + prior-art citations landed on the docs branch (f07aa62, PR #63).