When the authority is SyncNow, the canonical source is a repository on the SyncNow control plane and your hosting is only a deploy target. Otherwise the files on your hosting are the project: agents read and change them through SyncNow's tools, and the SyncNow server carries out those operations directly on your hosting, not on a copy on your PC.
A site becomes SyncNow-authority only through a deliberate cutover: SyncNow walks the hosting, commits a snapshot, and switches only if a second, independent walk of the hosting matches that snapshot exactly. Secrets are kept out of the repository: recognized secret values inside source files become __SYNCNOW_SECRET_ placeholders that a deploy turns back into the real values, and files such as .env or wp-config.php are only referenced. Runtime data such as uploads, caches, logs, sessions and backups stays on the hosting.
After the cutover, every difference SyncNow finds between the hosting and the deployed version is either a change made through SyncNow, recorded into the repository with who made it, or a change made outside SyncNow, which is reported and never absorbed silently: see What happens if someone changes my site by FTP, outside SyncNow?. An agent sees which model applies to each project in the authority field returned by list_projects.