Feature/p2p sync

.github/workflows/privacy.yml

@@ -137,3 +137,8 @@ jobs:
             # the Tauri updater's per-channel endpoint selection. See
             # docs/RELEASE-CHANNELS.md for the full pipeline.
             github\.com/diegorv/koko\.brain/releases
+            # P2P vault sync opens a direct TCP connection to a peer whose
+            # ip:port the user enters in Sync settings — no hardcoded address
+            # and no external server. The read-only listener side stays on the
+            # LAN. See docs/superpowers/specs/2026-07-03-p2p-sync-design.md.
+            sync/engine\.rs:.*TcpStream::connect

.github/workflows/security.yml

@@ -75,6 +75,14 @@ jobs:
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           working-directory: src-tauri
+          # This action does NOT read src-tauri/.cargo/audit.toml — the ignore
+          # list must be passed here. RUSTSEC-2026-0194/-0195: quick-xml 0.39.4
+          # DoS, transitive via plist <- tauri, patched only in >=0.41 which
+          # plist "^0.39.2" forbids. quick-xml here parses app-controlled
+          # .plist files, never untrusted network XML, so neither DoS is
+          # reachable. Keep in sync with src-tauri/.cargo/audit.toml (local
+          # `cargo audit`). Revisit when tauri ships a plist allowing >=0.41.
+          ignore: RUSTSEC-2026-0194,RUSTSEC-2026-0195
 
   supply-chain-quarantine:
     name: Supply Chain Quarantine

CLAUDE.md

@@ -62,7 +62,7 @@ src/lib/
                       #   file-icons, folder-notes, outgoing-links, properties, quick-switcher,
                       #   search, tags, tasks, type-definitions
   plugins/            # Optional modules: calendar, graph-view, kanban, one-on-one, periodic-notes,
-                      #   queryjs, quick-capture, table-of-contents, templates, word-count
+                      #   queryjs, quick-capture, sync, table-of-contents, templates, word-count
   utils/              # Pure shared utilities (no state, no side effects)
 ```