SYN-001

Summary

SYN-001 is the Peach Sync blocker that kept desktop native sync dormant.

The original bug was that the Rust native host used an all-zero Noise NK static private key on the responder path. That made every install present the same responder identity, which defeats the peer-authentication property sync relies on.

That original all-zero-key bug has been fixed in the SYN-001 sprint. The host now has a persisted per-install X25519 identity, advertises only the public key, uses the real identity in responder and initiator Noise paths, and has Rust tests for real-key handshakes and wrong-public-key rejection.

Completed So Far

• Phase 0 baseline captured before implementation: version 2.13.2, Koh head 636a946976ec, and initial cargo check failure summary.
• Compile-only native-host baseline saved as 4b36429b213d (chore: Prepare native host compile baseline (v2.13.3)).
• First sync security behavior change saved separately as b49712298cc7 (fix: Replace sync host static Noise identity (v2.13.4)).
• Trusted-device store, identity rotation, and authentication proof layer added.
• Browser native-messaging framing added to the Rust host.
• Dormant TypeScript client aligned with the Rust host protocol.
• mDNS discovery events now flow back through the native-messaging output loop.

Current Safety Gate

The risky path is still not shipped:

• neither browser manifest includes nativeMessaging;
• no live background handler imports or calls connectSyncHost();
• src/background/sync.ts is gated and documents that sync remains disabled until the audit/gate checklist passes;
• Android sync remains deferred to the later WebSocket/Capacitor phase.

Remaining Before Re-Enabling

1. Finish the native-host audit checklist: private-key handling/logging, identity file permissions, mDNS TXT contents, random-port behavior, trusted-device lifecycle, pairing flow, error surfaces, and rate limits.
2. Build the real sync payload flow: length-prefixed encrypted JSON messages, vault manifest/diff exchange, merge rules, locked-vault cancellation, and Pro/background gates.
3. Add native-host installer manifest generation and only then add nativeMessaging to the browser manifests.
4. Add manual E2E coverage with two desktop installs before marking SYN-001 resolved.

Until those are complete, sync should remain gated and dormant.