# SYN-001

## Summary

SYN-001 is the Peach Sync blocker.

Peach Sync's native Rust host uses Noise NK for peer authentication, but the
responder side currently creates its static private key with an all-zero
placeholder:

- `native/peach-sync-host/src/tcp.rs`
- Marker: `NoiseBridge::new_responder(&[0u8; 32])`

That means every Peach install would present the same responder identity.
Noise NK depends on the responder static key being real and device-specific, so
with `[0u8; 32]` authentication is effectively broken and impersonation becomes
trivial.

## Why It Matters

Sync is a high-trust path. It can move encrypted vault state between devices and
depends on device identity being meaningful.

If every responder uses the same static private key:

- a peer cannot reliably authenticate that it is talking to the intended Peach
  device;
- any attacker who knows the placeholder identity can impersonate a responder;
- mDNS discovery and local-network transport become dangerous to enable;
- re-adding `nativeMessaging` would expose a high-risk extension permission for
  a path that is not safe yet.

## Why It Has Not Been Resolved Yet

It is not just a one-line replacement. A proper fix needs a small dedicated
sync sprint:

1. Make `native/peach-sync-host` compile cleanly.
2. Generate a per-install X25519 keypair.
3. Persist the private key in the appropriate platform store or a clearly
   scoped native-host config file.
4. Advertise only the public key through mDNS.
5. Bind pairing and trusted-device records to the real public key.
6. Define key rotation and recovery behavior.
7. Add handshake tests for distinct identities, impersonation rejection, and
   paired-device acceptance.
8. Re-audit the native host before re-enabling any live code path.

Current project rules keep sync dormant until that work is done:

- `.agent/Projects.md` says `nativeMessaging` must not be re-added until
  SYN-001 is fully resolved.
- `.agent/Projects.md` also says not to wire any code path to
  `connectSyncHost()` and not to touch `native/` except in a dedicated SYN-001
  fix sprint.
- `src/background/sync.ts` is marked dormant and says not to import or re-enable
  sync without completing the SYN-001 fix sprint and full native-host re-audit.

## Current State

The risky path is not shipped:

- neither browser manifest includes `nativeMessaging`;
- no live code path calls `connectSyncHost()`;
- the Android wiring work intentionally did not enable sync or mDNS;
- the native host still needs compile fixes and a security pass before use.

## Suggested Fix Plan

Treat SYN-001 as its own unit of work:

1. Create a Koh checkpoint before touching `native/`.
2. Fix the native host compile errors without changing protocol behavior.
3. Add persisted per-install Noise identity.
4. Wire the identity into advertise, discover, connect, and accept paths.
5. Add Rust tests around key generation, persistence, handshake success, and
   impersonation failure.
6. Add extension-side tests for sync gating.
7. Re-enable `nativeMessaging` only after the audit passes.

Until then, sync should remain dormant.