1# SYN-00123## Summary45SYN-001 is the Peach Sync blocker.67Peach Sync's native Rust host uses Noise NK for peer authentication, but the8responder side currently creates its static private key with an all-zero9placeholder:1011- `native/peach-sync-host/src/tcp.rs`12- Marker: `NoiseBridge::new_responder(&[0u8; 32])`1314That means every Peach install would present the same responder identity.15Noise NK depends on the responder static key being real and device-specific, so16with `[0u8; 32]` authentication is effectively broken and impersonation becomes17trivial.1819## Why It Matters2021Sync is a high-trust path. It can move encrypted vault state between devices and22depends on device identity being meaningful.2324If every responder uses the same static private key:2526- a peer cannot reliably authenticate that it is talking to the intended Peach27 device;28- any attacker who knows the placeholder identity can impersonate a responder;29- mDNS discovery and local-network transport become dangerous to enable;30- re-adding `nativeMessaging` would expose a high-risk extension permission for31 a path that is not safe yet.3233## Why It Has Not Been Resolved Yet3435It is not just a one-line replacement. A proper fix needs a small dedicated36sync sprint:37381. Make `native/peach-sync-host` compile cleanly.392. Generate a per-install X25519 keypair.403. Persist the private key in the appropriate platform store or a clearly41 scoped native-host config file.424. Advertise only the public key through mDNS.435. Bind pairing and trusted-device records to the real public key.446. Define key rotation and recovery behavior.457. Add handshake tests for distinct identities, impersonation rejection, and46 paired-device acceptance.478. Re-audit the native host before re-enabling any live code path.4849Current project rules keep sync dormant until that work is done:5051- `.agent/Projects.md` says `nativeMessaging` must not be re-added until52 SYN-001 is fully resolved.53- `.agent/Projects.md` also says not to wire any code path to54 `connectSyncHost()` and not to touch `native/` except in a dedicated SYN-00155 fix sprint.56- `src/background/sync.ts` is marked dormant and says not to import or re-enable57 sync without completing the SYN-001 fix sprint and full native-host re-audit.5859## Current State6061The risky path is not shipped:6263- neither browser manifest includes `nativeMessaging`;64- no live code path calls `connectSyncHost()`;65- the Android wiring work intentionally did not enable sync or mDNS;66- the native host still needs compile fixes and a security pass before use.6768## Suggested Fix Plan6970Treat SYN-001 as its own unit of work:71721. Create a Koh checkpoint before touching `native/`.732. Fix the native host compile errors without changing protocol behavior.743. Add persisted per-install Noise identity.754. Wire the identity into advertise, discover, connect, and accept paths.765. Add Rust tests around key generation, persistence, handshake success, and77 impersonation failure.786. Add extension-side tests for sync gating.797. Re-enable `nativeMessaging` only after the audit passes.8081Until then, sync should remain dormant.