Validation run 2026-09-23¶
A same-network run of the Compose route with a laptop as the server: one Mac running the server and a desktop client, one iPhone on the same Wi-Fi, and nothing else. No tunnel, no VPN, no public name, no account with anybody. It records the V15 path end to end for 1.1.1, including the certificate install on the phone, and every step's screen is in Same network, step by step.
Operator¶
The user, with agent assistance. The user answered what only a person can: the host firewall setting, sending the certificate to the phone, the phone passcode during the profile install, and the certificate trust switch.
Route¶
The Compose route (deploy/compose, docs/validation.md V15 and
docs/server.md). The release image ran by digest after cosign verify, behind
the route's own TLS terminator and private certificate authority. The server
used the host computer's own multicast-DNS (.local) name and was published
only on the computer's Wi-Fi address. The host ports were 8080 and 8443,
because Docker Desktop on macOS refuses 80 and 443 unless its privileged-port
setting is on. The deployment's own name and addresses are private.
The reference route was not exercised in this run.
Devices¶
| Role | Platform | Obsidian | Plugin |
|---|---|---|---|
| server host and first desktop | macOS laptop, Docker Desktop | 1.13.4 | 1.1.1, copied into a new vault; its main.js is byte-identical to the 1.1.1 release asset |
| phone | iOS | 1.13.7 | 1.1.1 from the community directory (Browse, Install, Enable) |
Server: obsyncd 1.1.1, release commit f420d4d, image run by its verified
digest. The phone's iOS version is not recorded during the run. The desktop
instance was an isolated Obsidian profile beside the user's own, with a new
vault; its plugin was a file copy, so this run does not count as a desktop
production-path install.
Results¶
| # | Scenario | Outcome | Note |
|---|---|---|---|
| V15 | Compose from scratch on a second machine, root certificate installed, iPhone paired over the LAN | pass | Server up from the verified digest; the root exported with the guide's docker cp line; the phone trusted it and then read /readyz over Wi-Fi in Safari without a warning; pairing and sync over the LAN below |
| V1 | Setup on the first desktop; recovery phrase shown and confirmed | pass | First-time setup with the server's token; the 24-word phrase shown and three words confirmed. The dashboard half was not attempted |
| V2 | Pair the iPhone from the desktop | pass | Link opened in Safari, which offered to open it in Obsidian with the code filled in; the desktop asked Approve "ios" on ios (obsync 1.1.1)? and approval completed it. The Devices list was not opened |
| V3 | Type in a note on the iPhone | pass, timing not measured | The typed line was on the desktop within the six seconds before the first look; the 3 s bound was not timed |
| J1 | Create a note on the phone | pass | A daily note created on the phone appeared on the desktop under the same name |
| J2 | Create a note on the desktop | pass | The desktop's note arrived at first sync; a later desktop edit reached the phone within the five seconds before the first look |
| - | Host firewall with "Block all incoming connections" on | finding | Every connection from the phone was dropped, the server and Docker notwithstanding; turning that one setting off, with Docker allowed incoming connections, fixed it. Stealth mode stayed on and did not interfere |
| - | Certificate sent by AirDrop | finding | The file landed in the Files app and no install prompt appeared. Opening it there asked which device should install it; iPhone then showed "Profile Downloaded", and the install was under Settings, General, VPN & Device Management |
| - | Finding the plugin in the directory | finding | Searching "Private Sync" does not show it on the first screen; the full name "Self Hosted Private Sync" does |
No conflict copy was made on either device, and both ended at obsync: idle.
Part two: the 1.1.2 changes on two desktops¶
The same evening, the two 1.1.2 fixes were run on real Obsidian 1.13.4 and
1.13.7 desktop instances. The plugin was the 1.1.2 build of the release pull
request, copied into each vault, so this is not a production-path install. The
server was the same verified 1.1.1 image, because 1.1.2 changes no server code,
from a copy of deploy/compose on loopback.
| # | Journey | Outcome | Note |
|---|---|---|---|
| J-131 | Two new vaults that both start with the same Welcome.md; the first sets up, the second pairs |
pass | Each vault holds one Welcome.md and no conflict copy; both record the same file id and version; the server received versions from the first device only |
| J-129a | Start one device with the server stopped, then start the server | pass after a fix | Before: the status bar read obsync: idle for 96 s, then offline — retrying, then idle 33 s after the server returned. After the fix in the same pull request: offline — retrying 2 s after launch, and idle 44 s after the server returned, nothing pressed |
| J-129b | An edit made on the device that resumed | pass | It reached the other device |
The 44 s wait after the server returns is the transport's own backoff between attempts, which a network change does not yet cut short: issue #134.
What was not validated¶
- Android, Windows and Linux: no device of those classes took part.
- The phone leaving the network and coming back: automatic resume ships in 1.1.2 and was not on these devices.
- Two devices that already hold the same notes: that fix also ships in 1.1.2.
- A personal hotspot instead of a router, and every other setup row.
- V4 to V14, V16 to V28, J3 to J10, and the dashboard.