SYN-001

Summary

SYN-001 is the Peach Sync blocker.

Peach Sync's native Rust host uses Noise NK for peer authentication, but the responder side currently creates its static private key with an all-zero placeholder:

• native/peach-sync-host/src/tcp.rs
• Marker: NoiseBridge::new_responder(&[0u8; 32])

That means every Peach install would present the same responder identity. Noise NK depends on the responder static key being real and device-specific, so with [0u8; 32] authentication is effectively broken and impersonation becomes trivial.

Why It Matters

Sync is a high-trust path. It can move encrypted vault state between devices and depends on device identity being meaningful.

If every responder uses the same static private key:

• a peer cannot reliably authenticate that it is talking to the intended Peach device;
• any attacker who knows the placeholder identity can impersonate a responder;
• mDNS discovery and local-network transport become dangerous to enable;
• re-adding nativeMessaging would expose a high-risk extension permission for a path that is not safe yet.

Why It Has Not Been Resolved Yet

It is not just a one-line replacement. A proper fix needs a small dedicated sync sprint:

1. Make native/peach-sync-host compile cleanly.
2. Generate a per-install X25519 keypair.
3. Persist the private key in the appropriate platform store or a clearly scoped native-host config file.
4. Advertise only the public key through mDNS.
5. Bind pairing and trusted-device records to the real public key.
6. Define key rotation and recovery behavior.
7. Add handshake tests for distinct identities, impersonation rejection, and paired-device acceptance.
8. Re-audit the native host before re-enabling any live code path.

Current project rules keep sync dormant until that work is done:

• .agent/Projects.md says nativeMessaging must not be re-added until SYN-001 is fully resolved.
• .agent/Projects.md also says not to wire any code path to connectSyncHost() and not to touch native/ except in a dedicated SYN-001 fix sprint.
• src/background/sync.ts is marked dormant and says not to import or re-enable sync without completing the SYN-001 fix sprint and full native-host re-audit.

Current State

The risky path is not shipped:

• neither browser manifest includes nativeMessaging;
• no live code path calls connectSyncHost();
• the Android wiring work intentionally did not enable sync or mDNS;
• the native host still needs compile fixes and a security pass before use.

Suggested Fix Plan

Treat SYN-001 as its own unit of work:

1. Create a Koh checkpoint before touching native/.
2. Fix the native host compile errors without changing protocol behavior.
3. Add persisted per-install Noise identity.
4. Wire the identity into advertise, discover, connect, and accept paths.
5. Add Rust tests around key generation, persistence, handshake success, and impersonation failure.
6. Add extension-side tests for sync gating.
7. Re-enable nativeMessaging only after the audit passes.

Until then, sync should remain dormant.