1# SYN-00123## Summary45SYN-001 is the Peach Sync blocker that kept desktop native sync dormant.67The original bug was that the Rust native host used an all-zero Noise NK static8private key on the responder path. That made every install present the same9responder identity, which defeats the peer-authentication property sync relies10on.1112That original all-zero-key bug has been fixed in the SYN-001 sprint. The host13now has a persisted per-install X25519 identity, advertises only the public key,14uses the real identity in responder and initiator Noise paths, and has Rust tests15for real-key handshakes and wrong-public-key rejection.1617## Completed So Far1819- Phase 0 baseline captured before implementation: version `2.13.2`, Koh head20 `636a946976ec`, and initial `cargo check` failure summary.21- Compile-only native-host baseline saved as `4b36429b213d`22 (`chore: Prepare native host compile baseline (v2.13.3)`).23- First sync security behavior change saved separately as `b49712298cc7`24 (`fix: Replace sync host static Noise identity (v2.13.4)`).25- Trusted-device store, identity rotation, and authentication proof layer added.26- Browser native-messaging framing added to the Rust host.27- Dormant TypeScript client aligned with the Rust host protocol.28- mDNS discovery events now flow back through the native-messaging output loop.2930## Current Safety Gate3132The risky path is still not shipped:3334- neither browser manifest includes `nativeMessaging`;35- no live background handler imports or calls `connectSyncHost()`;36- `src/background/sync.ts` is gated and documents that sync remains disabled37 until the audit/gate checklist passes;38- Android sync remains deferred to the later WebSocket/Capacitor phase.3940## Remaining Before Re-Enabling41421. Finish the native-host audit checklist: private-key handling/logging,43 identity file permissions, mDNS TXT contents, random-port behavior,44 trusted-device lifecycle, pairing flow, error surfaces, and rate limits.452. Build the real sync payload flow: length-prefixed encrypted JSON messages,46 vault manifest/diff exchange, merge rules, locked-vault cancellation, and47 Pro/background gates.483. Add native-host installer manifest generation and only then add49 `nativeMessaging` to the browser manifests.504. Add manual E2E coverage with two desktop installs before marking SYN-00151 resolved.5253Until those are complete, sync should remain gated and dormant.