feat(notify): add dormant diagnostics capability foundation

[psimaker]

What & why

Adds the M2 dormant helper foundation after merged M1. The Notify helper now compiles the three approved Decision 022-024 capability descriptors into an internal value-only catalog, but has no available/ready state and no activation transition.

The real configuration loader constructs only the dormant catalog. Existing zero-value Config literals continue to model a legacy helper. No app or external caller can currently reach, query, advertise, enable, or use this catalog.

Component(s)

• go (bridge / Syncthing)
• ios
• notify
• docs / CI

Dormant boundary

• Known capability on a new helper: local unavailable/disabled.
• Known capability on a legacy zero-value helper: local unavailable/helper-missing.
• Unknown capability/version: local unsupported/unknown, without reflecting the input.
• The runtime foundation has no imports and therefore no filesystem, network, listener, logging, encoding, credential, or persistence access.
• main.go contains exactly the private field declaration and dormant constructor assignment; no runtime path evaluates the catalog.
• There is no environment option, flag, listener, endpoint, pairing action, namespace action, probe, Syncthing mutation, Relay call, timer, background loop, or product UI.
• Trigger v1 and Cloud Relay v1 request bytes and behavior are unchanged.

Exact catalog

• eu.vaultsync.diagnostics.helper-pairing/1, protocol 1, suite 1.
• eu.vaultsync.diagnostics.namespace/1, protocol 1, suite 1.
• eu.vaultsync.diagnostics.correlated-roundtrip/1, protocol 1, suite 1, required flags 0x0f.
• Catalog access returns value copies; there is no mutable alias and no available state.

Testing

• cd notify && go test ./... -count=1 — passed
• cd notify && go vet ./... — passed
• cd notify && go test -race ./... -count=1 — passed
• cd notify && go test -run '^$' -fuzz=FuzzDiagnosticsContractCanonicalCBOR -fuzztime=10s — passed, 312,872 executions
• gofmt -l . — empty
• git diff --check — passed
• notify/scripts/tests/install-dry-run-test.sh — passed without privileged or mutating commands
• native Notify build — passed
• Linux amd64, Darwin arm64, and Windows amd64 cross-builds — passed
• govulncheck v1.6.0 ./... — no vulnerabilities
• GitHub Actions PR checks — passed on exact head b4c8435c1e749a9a2d4ddccec6e805644ef28a52
• Independent human review — not claimed

No signing, archive, production service, StoreKit, APNs, Trigger, status, probe, Relay, deployment, packaging publication, helper release, or rollout operation was performed.

Existing-user and compatibility impact

• Existing app × existing helper: unchanged Trigger v1 and passive/local evidence.
• Existing app × new dormant helper: unchanged Trigger v1; catalog is unreachable and dormant.
• Future capable test client × existing helper: capability unavailable; no fallback, artifact, namespace, probe, or v1 change.
• Future capable test client × new dormant helper: capability unavailable/disabled; no pairing or enablement path exists.
• App downgrade: no helper behavior change and no state to clean.
• Helper downgrade: catalog disappears and remains capability unavailable; Trigger v1 stays wire-compatible.
• Re-upgrade: returns to dormant disabled state; no operation can resume.

Security, privacy, migration, and rollback

• No credentials, keys, bindings, paths, Device IDs, folder IDs, nonces, hashes, signatures, bodies, or user data are added to logs or persistence.
• Unknown inputs are reduced to a fixed bounded category and never echoed.
• No state directory, namespace, file, ACL, mount, installer mutation, schema, or migration exists.
• Repository rollback is a revert of the two M2 commits.
• Binary downgrade to the prior helper removes only the dormant catalog; no data or credential rollback is required.
• The R0 Relay CI branch and Relay privacy PR remain separate and untouched.

Release gate

VaultSync 2.0 remains NO-GO. The strongest implemented proof remains a fresh successful local file ItemFinished apply after cursor, RFC3339-nanosecond time, and stable engine-generation baselines. Upload is not implemented or confirmed. Controlled download is not implemented or confirmed. Roundtrip is not implemented or confirmed. Authenticated correlation is not implemented. Helper-first rollout and rollback remain unproven.

Owner approval is required before merge.

[coderabbitai]

📝 Walkthrough

Walkthrough

Introduces an internal dormant diagnostics capability catalog with three fixed contracts, status evaluation, defensive catalog access, and legacy handling. loadConfig() installs the dormant foundation, while tests verify catalog contents, configuration behavior, and the absence of runtime activation paths.

Changes

Diagnostics capability foundation

Layer / File(s)	Summary
Capability contracts and dormant evaluation notify/diagnostics_capabilities.go	Defines three capability descriptors, unavailable/unsupported status outcomes, dormant initialization, identifier recognition, and defensive catalog copying.
Dormant configuration installation notify/main.go	Adds the internal diagnosticsCapabilities field to Config and initializes it from loadConfig().
Dormancy and activation-surface validation notify/diagnostics_capabilities_test.go, notify/diagnostics_contract_model_test.go	Verifies exact catalog behavior, legacy zero-value semantics, unknown inputs, config loading, and the absence of operational runtime carriers.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• psimaker/vaultsync#107: Updates diagnostics contract-model scanning to account for the dormant capability carrier.

Poem

Three quiet flags in a catalog sleep,
No runtime path can make them leap.
Config carries contracts, sealed and still,
Tests guard every dormant quill.
A calm foundation, precise by design.

🚥 Pre-merge checks | ✅ 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No Private Note Leakage	✅ Passed	The new diagnostics catalog is value-only, imports no I/O/network packages, and the added Config field is internal; no code path logs or transmits note contents or secrets.
Bounded Ios Background Work	✅ Passed	PASS: The PR only changes Go files under notify; no Swift/iOS background-execution code is touched, so this check is not applicable.
Bridge Contract Compatibility	✅ Passed	PASS: This PR only adds internal notify diagnostics catalog/tests; no go/bridge or Swift bridge-service files or JSON/empty-string bridge contracts changed.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title uses conventional-commit style and accurately summarizes the main change to add a dormant diagnostics capability foundation.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/m2-dormant-helper-foundation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}