syndeo

Syndeo is an open-source browser project that reimagines the traditional web browser architecture by prioritizing the cache as the core product. Its design philosophy centers on strict process separation and security boundaries, aiming to convert trust into truth through verifiable interactions. **Architecture and Process Model** The system is built around three load-bearing boundaries: 1. **Renderers never talk to the network:** Rendering processes (Servo or WebKit) do not open sockets. They send `NetRequest` objects to a separate network process (`syndeo-net`), which handles DNS, TLS, and caching. This ensures that the renderer cannot bypass security policies or leak information via network timing. 2. **The agent never talks to the keystore:** The agent process, which can execute WebAssembly tools, is sandboxed from the keystore. It cannot access keys directly, reducing the attack surface for malicious scripts or agents. 3. **The keystore exposes exactly one operation:** It can only sign a payload if the shell confirms the user's intent. This confirmation includes a MAC over the origin, purpose, and payload hash, ensuring that consent is explicit and bound to specific actions. **Key Components** - **`syndeo-cache`:** Implements RFC 9111 policies with a redb index and BLAKE3-addressed blob store. It supports Subresource Integrity (SRI) and is partitioned by top-level origin to prevent cross-site tracking via cache timing. - **`syndeo-net`:** The network process handling HTTP/1.1, HTTP/2, and HTTP/3 (QUIC). It integrates with the cache and provides a fetch API for the rest of the system. - **`syndeo-peer`:** Enables peer-to-peer content fetching using libp2p. Peers are asked only for content already named by hash in the page, preserving some privacy while allowing decentralized content distribution. - **`syndeo-keystore`:** Manages cryptographic keys with a sealed root secret. It uses Argon2id for passphrase sealing and integrates with OS-level credential stores (Keychain on macOS, Secret Service on Linux). It supports per-signature consent and automatic forgetting of seeds after inactivity or lock. - **`syndeo-dom`:** A headless DOM implementation used by the agent to read pages without full rendering, focusing on prose, links, and forms. - **`syndeo-ui`:** A windowed shell built with winit, wgpu, and egui, providing a graphical interface with accessibility support. **Privacy and Security** Syndeo enforces several privacy defaults: - **Partitioned Cache:** The cache is keyed by the top-level document's origin, preventing cross-site tracking via cache hit/miss timing. Content is deduplicated at the blob level to save space despite partitioning. - **DNS over HTTPS (DoH):** Enabled by default (Cloudflare), with options for Google, Quad9, or system resolver. - **No Telemetry:** The codebase contains no analytics, crash reporting, or update pings. - **Credential Stripping:** `Authorization` and `Cookie` headers are dropped when redirects cross origins. **Usage and Tools** - **Installation:** Available for macOS (Apple Silicon) and Linux (x86_64/arm64) via a shell script that verifies checksums. No `sudo` is required. - **CLI:** `syndeo browse` fetches pages and reports cache status. `syndeo agent` runs tasks like reading or crawling pages. `syndeo sign` performs cryptographic signing with user confirmation. - **Proxy Mode:** `syndeo-proxy` can run as an intercepting proxy to measure cache efficiency on real traffic from other browsers like Chrome. - **Rendering:** Supports Servo (headless/feature-gated) and WebKit (macOS only, for video playback). WebKit integration uses a local proxy to enforce network boundaries since WebKit does not support custom scheme handlers for HTTP/HTTPS. **Development and Status** - **Build:** Requires Rust, with specific dependencies for Linux (D-Bus, Wayland/X11). Servo integration is feature-gated due to large compile times. - **Testing:** Includes RFC 9111 conformance, memory measurement scripts, and release verification tools. - **Gaps:** Windows and ChromeOS support are pending. The project is in active development, with a focus on verifying the cache-first model's viability and security properties.