feat: optional privacy-preserving cloud sync (CF cloud backend) #3

New issue

Open

opened 2026-07-05 11:02:34 -07:00 by pyr0ball · 0 comments

pyr0ball commented

2026-07-05 11:02:34 -07:00

Collaborator

Context

The architecture notes plan a "future sync layer" and the design spec wishlist
includes "advanced sync." Focus Flow is currently SQLite-local only.

CF's infrastructure (menagerie.circuitforge.tech) and privacy architecture
provide a natural home for an optional sync backend.

Design constraints from Focus Flow's philosophy

Local-only must remain the default and fully functional path
Sync is opt-in, explicit, user-controlled
No behavioral profiling, no PII logging
User owns their data and can export/delete at any time

Proposed approach

End-to-end encrypted sync: SQLite snapshots encrypted on-device before upload
CF cloud acts as a dumb blob store — cannot read task content
Key derived from user passphrase, never leaves device
Conflict resolution: last-write-wins per task UUID (V1); CRDT later if needed
CF Paid tier feature; local sync (LAN, self-hosted) stays free

What CF contributes

Sync backend API (FastAPI, CF's standard stack)
E2E encryption layer (libsodium / age)
Forgejo-hosted package for the sync client adapter
Account/key management UI

What stays in Focus Flow core

SyncAdapter interface in packages/scheduler_persistence
SQLite export/import used as the sync payload
No sync logic in the scheduling core itself

Architecture notes: "MongoDB persistence adapter (planned later)" — sync backend
could serve the same role without requiring MongoDB on the client

## Context The architecture notes plan a "future sync layer" and the design spec wishlist includes "advanced sync." Focus Flow is currently SQLite-local only. CF's infrastructure (menagerie.circuitforge.tech) and privacy architecture provide a natural home for an optional sync backend. ## Design constraints from Focus Flow's philosophy - Local-only must remain the default and fully functional path - Sync is opt-in, explicit, user-controlled - No behavioral profiling, no PII logging - User owns their data and can export/delete at any time ## Proposed approach - End-to-end encrypted sync: SQLite snapshots encrypted on-device before upload - CF cloud acts as a dumb blob store — cannot read task content - Key derived from user passphrase, never leaves device - Conflict resolution: last-write-wins per task UUID (V1); CRDT later if needed - CF Paid tier feature; local sync (LAN, self-hosted) stays free ## What CF contributes - Sync backend API (FastAPI, CF's standard stack) - E2E encryption layer (libsodium / age) - Forgejo-hosted package for the sync client adapter - Account/key management UI ## What stays in Focus Flow core - `SyncAdapter` interface in `packages/scheduler_persistence` - SQLite export/import used as the sync payload - No sync logic in the scheduling core itself ## Related - Architecture notes: "MongoDB persistence adapter (planned later)" — sync backend could serve the same role without requiring MongoDB on the client