From 6f62765e27f1120493d916d0613e1b6e03a2b46a Mon Sep 17 00:00:00 2001 From: mirivlad Date: Fri, 17 Jul 2026 05:10:03 +0800 Subject: [PATCH] Document sync server hardening milestone --- 07_Full_Implementation_Roadmap.md | 44 ++++++++++++++++++++++--------- 1 file changed, 31 insertions(+), 13 deletions(-) diff --git a/07_Full_Implementation_Roadmap.md b/07_Full_Implementation_Roadmap.md index fd7e007..ff571bf 100644 --- a/07_Full_Implementation_Roadmap.md +++ b/07_Full_Implementation_Roadmap.md @@ -122,8 +122,8 @@ Verification: ### Phase 3 - Sync Hardening -Goal: make bounded cross-device file/workspace sync reliable without claiming -that the server owns vault state or that Blob transport already exists. +Goal: make local-first cross-device file/workspace sync reliable and harden the +optional self-hosted relay without making it the source of vault truth. Verified in the current implementation: @@ -146,24 +146,41 @@ Verified in the current implementation: - [x] add real two-vault smoke scenarios for external create/update/delete, scanner-based rename representation, no remote echo, and workspace lifecycle; - [x] document deployment and backup procedures for `verstak-sync-server`. +- [x] bind sync-server to loopback by default, set HTTP timeouts/graceful + shutdown, publish health/readiness/build data, and document nginx/Caddy + trusted-proxy deployment; +- [x] bound JSON/push fields and pull pages, return stable public error codes, + and make Desktop stop/persist cursor at the first failed page operation; +- [x] add streamed Blob transport with SHA-256/size verification, atomic local + apply, per-user/vault ownership references, file/quota limits, and immediate + revoked-device denial; +- [x] hash newly issued device, session, confirmation, and reset tokens; + persist sessions, require CSRF for browser mutations, and use transactions + for pairing, credential, blob, and multi-table user/device changes. Known limits in this phase: -- [x] File payloads remain bounded to the current 2 MB text / 8 MB byte Files - APIs. A larger or unsupported file is a persistent visible warning and is - deliberately not marked synchronized. +- [x] The Files plugin API remains bounded to 2 MB text / 8 MB byte reads; + core sync itself sends binary/larger files through the Blob API. Files over + configured Blob/quota limits remain persistent visible warnings and are not + marked synchronized. - [x] External rename is represented as delete + create; it is not a cross-device rename detector for ordinary files. -- [ ] There is no Desktop Blob transport, quota enforcement, pull pagination, - operation retention/compaction, or automatic conflict resolution. +- [ ] Automatic conflict resolution is intentionally absent. Operation-log + retention/compaction is also intentionally deferred: without a server + checkpoint/materialized state and proven device recovery cursors, pruning + operations could make a newly paired device unrecoverable. Safe cleanup is + limited to sessions/tokens/idempotency/audit/temp uploads/rate buckets. - [ ] Secrets, plugin settings, Todo, Journal, Activity, and Browser Inbox are not synchronized in this phase. Verification: -- sync server `go test ./...`; -- desktop real sync smoke; -- official Sync plugin settings/status tests. +- sync server `go test ./...`, `go vet ./...`, systemd validation and a local + release-package smoke; +- desktop unit/API tests and real two-vault smoke including a binary above the + former inline limit; +- SDK schema/type checks and official Sync plugin build/localization checks. ### Phase 4 - Preview, Search, Activity, Journal @@ -290,9 +307,10 @@ Verification: 2. [x] Status bar item host in `verstak-desktop`. 3. [x] External open public v2 API to replace Files fallback. 4. [x] Notes trash/delete UX in `verstak-official-plugins`. -5. [~] Bounded sync hardening pass with expanded real two-vault smoke. Blob - transport, quota/pagination/retention, and additional data domains remain - future work. +5. [x] Sync hardening pass: snapshots/reconciliation, workspace identity, + bounded pagination, Blob transport/ownership/quota, secure token/session + policy, and expanded real two-vault smoke. Checkpoint-based operation + retention and additional data domains remain future work. 6. [x] Browser inbox protocol design, extension scaffold, local receiver, minimal inbox plugin, and note/link/text-file/binary-file conversions are implemented.