The dsse check orders acts by timestamp where the ssh check uses landing order (D6) #106

Source: the principal, 6 October, from the review of #104. Must land before any DSSE signature is relied on. Not implemented here.

The difference

In ledger-core/src/signing/check.rs, the two schemes pick the key a signature is judged under differently:

• ssh (ssh_key, verify_one). It orders an act against the key's opening and closing bindings by position: landing on the first-parent history, then at (D6, landing.rs). An act is before a close only if it is dated and landed before it.
• dsse (dsse_key). It pre-filters the signer's bindings by timestamp alone: k.at <= s.at for the opening, and c.at <= s.at for a close. Landing is not consulted.

So one store can get two verdicts:

• An act dated before a close but landed after it is outside the window for ssh (L011). For dsse, it can still match the binding in the pre-filter.
• A binding dated before an act but landed after it is excluded by ssh ("bound after the act"). For dsse, it can be included.

verify_one applies the key-level close check (#104, ruling 2) by position after dsse_key returns. That narrows the gap for closes, but the pre-filter still decides which keys dsse::verify is offered, by timestamp.

Scope

• dsse_key orders by D6 position, as ssh_key does: take the positions map, and use not_after / before instead of comparing at.
• Tests with a backdated act and a backdated binding under both schemes, asserting the same verdict.
• A migration note if any verdict can move; there is no format change. This repository's store carries no dsse sidecars.