# PCH-02-003 — Document the SAS peer-gate trust-model dependency (doc-only)

**Severity:** Informational
**Target file:** `src/shared/chirp-handshake.ts:125-154` (the SECURITY block)
**Report:** peach-code-review.md, Finding PCH-02-003

## Decision

Documentation only — no code change. The review itself calls the existing
comment "one of the better in-code threat statements in the codebase"; the
brief asks for the finding ID, the Android source pointer, and the explicit
"documented residual risk" framing to be added. The existing text is kept —
three surgical insertions rather than a rewrite, so the PCH-01-024 history in
the block stays intact.

## Exact edits

Edit 1 — tag the block with the finding ID (line 126):

```typescript
// BEFORE
// SECURITY — TRUST MODEL: the pairing handshake does NOT cryptographically

// AFTER
// SECURITY — TRUST MODEL (PCH-02-003): the pairing handshake does NOT cryptographically
```

Edit 2 — add the repository pointer to the OPEN ITEM paragraph (lines 146-149):

```typescript
// BEFORE
// OPEN ITEM (NOT verifiable from this repository): the Android/native client
// MUST surface and enforce the identical SAS gate before it persists the peer.
// If the app skips or auto-confirms the SAS, the channel is only as strong as
// the app's weakest end — confirm the app-side gate against the Android source.

// AFTER
// OPEN ITEM (NOT verifiable from this repository): the Android/native client
// MUST surface and enforce the identical SAS gate before it persists the peer.
// If the app skips or auto-confirms the SAS, the channel is only as strong as
// the app's weakest end — confirm the app-side gate against the Android source
// at kepr.uk/peach-android (verify the Noise NK SAS enforcement before any
// device is persisted). A MITM who intercepts the acoustic chirp and completes
// the handshake against a non-enforcing peer can pair without user awareness.
```

Edit 3 — close the block with the residual-risk framing (after line 153,
before the closing rule):

```typescript
// BEFORE
// (noise-js) so each side proves possession of the key it advertises, making
// authentication structural rather than dependent on the user's SAS comparison.
// ───────────────────────────────────────────────────────────────────────────

// AFTER
// (noise-js) so each side proves possession of the key it advertises, making
// authentication structural rather than dependent on the user's SAS comparison.
//
// This is documented residual risk in the cross-repo trust model, not a bug in
// this codebase: control (1) — the extension-side gateOnSAS — is enforced here
// (chirp-pair.ts) and regression-tested (PCH-01-024); control (2) — the peer-
// side gate — lives in the Android repository and must be re-verified there on
// every Android release that touches pairing.
// ───────────────────────────────────────────────────────────────────────────
```

No tests — comment-only change; the existing `gateOnSAS` regression test
(added in PCH-01-024) already pins the extension-side control.

## Save message (integration)

`docs: PCH-02-003 document SAS peer-gate trust model dependency with Android source reference`