# SYN-001

## Summary

SYN-001 is the Peach Sync blocker that kept desktop native sync dormant.

The original bug was that the Rust native host used an all-zero Noise NK static
private key on the responder path. That made every install present the same
responder identity, which defeats the peer-authentication property sync relies
on.

That original all-zero-key bug has been fixed in the SYN-001 sprint. The host
now has a persisted per-install X25519 identity, advertises only the public key,
uses the real identity in responder and initiator Noise paths, and has Rust tests
for real-key handshakes and wrong-public-key rejection.

## Completed So Far

- Phase 0 baseline captured before implementation: version `2.13.2`, Koh head
  `636a946976ec`, and initial `cargo check` failure summary.
- Compile-only native-host baseline saved as `4b36429b213d`
  (`chore: Prepare native host compile baseline (v2.13.3)`).
- First sync security behavior change saved separately as `b49712298cc7`
  (`fix: Replace sync host static Noise identity (v2.13.4)`).
- Trusted-device store, identity rotation, and authentication proof layer added.
- Browser native-messaging framing added to the Rust host.
- Dormant TypeScript client aligned with the Rust host protocol.
- mDNS discovery events now flow back through the native-messaging output loop.

## Current Safety Gate

The risky path is still not shipped:

- neither browser manifest includes `nativeMessaging`;
- no live background handler imports or calls `connectSyncHost()`;
- `src/background/sync.ts` is gated and documents that sync remains disabled
  until the audit/gate checklist passes;
- Android sync remains deferred to the later WebSocket/Capacitor phase.

## Remaining Before Re-Enabling

1. Finish the native-host audit checklist: private-key handling/logging,
   identity file permissions, mDNS TXT contents, random-port behavior,
   trusted-device lifecycle, pairing flow, error surfaces, and rate limits.
2. Build the real sync payload flow: length-prefixed encrypted JSON messages,
   vault manifest/diff exchange, merge rules, locked-vault cancellation, and
   Pro/background gates.
3. Add native-host installer manifest generation and only then add
   `nativeMessaging` to the browser manifests.
4. Add manual E2E coverage with two desktop installs before marking SYN-001
   resolved.

Until those are complete, sync should remain gated and dormant.