[knqiufan]

Which issue or RFC does this PR close?

Related issue: #2116 — PR 11-B: Constrained Desktop native bridge.

This PR completes the remaining 11-B implementation scope after 11-A merged in #2190. #2116 is already closed; this PR records completion of its remaining bridge work and does not reopen or close it again. Installed Windows/macOS lifecycle qualification remains tracked under #2108/#2109.

Parent: #2114. Installer contract: #2115 / #2203; database admission integration: #2286. Candidate resources: #2112 / #2288. Mutation/setup UI remains under #2117.

Rationale for this change

Desktop needs a constrained native connection to independent Ops for approved local configuration and service operations, including progress, cancellation and recovery after a lost reply. The merged 11-A producer does not provide this Desktop bridge.

What changes are included in this PR?

• Add eight typed native commands and renderer bindings for references, inspection, configuration validation, preflight, apply, status, cancellation and resume. Preflight returns a native-owned, one-shot approval reference with a 10-minute lifetime.
• Keep executable paths, trusted resource pins and complete approved plans native-owned. Verify the complete independently provisioned Ops bundle against packaged pins before launch; use its fixed interpreter/entry with a cleared environment. Renderer inputs cannot select executables, filesystem paths, URLs or raw plans.
• Persist operation references before dispatch and use the Ops journal as the authoritative outcome and recovery record.
• Bound process communication and preserve unknown outcomes across timeout or Desktop exit; reserve capacity for status and cancellation. Preflight allows 180 seconds for the database-admission budget introduced by feat(ops): admit existing managed SQLite databases with target Server checks #2286. Binding includes operation identity and the requested attempt, even when an accepted event is absent.
• Add native/protocol regressions, actual Ops subprocess compatibility coverage and bilingual security/operation documentation.

Are there any user-facing changes?

The native bridge becomes available to the Desktop setup flow when a distributor provisions trusted Ops resources. Missing resources remain explicitly unavailable. The installation wizard, formal packaging/publication and clean-machine platform qualification remain separate work.

How was this change tested?

• Broken-progress regression: the Intel lost-response test could close stdout during interpreter startup, causing the synthetic helper to exit before recording a terminal result. The fixture now mirrors real Ops by persisting failed/progress_unavailable when accepted/progress delivery fails before work. The 200ms timeout assertion is retained and permits only success or that specific durable pre-mutation failure at attempt 1. A deterministic closed-pipe case verifies the native durable reference and queryable failure without replay. Explicit Rust 1.95.0 full suite: 99 top-level tests passed, 2 opt-ins ignored; all-target Clippy (-D warnings), formatting and make check (61 manifest tests) passed. This is a test-fixture correction; production sources were not changed. Open Code Review delegate independently reviewed the final one-file fix with no blocking findings.

• Integration against master b9f824e1: explicit pinned Rust 1.95.0 full suite passed 98 top-level tests, 2 optional integration tests ignored; frontend 118 tests, typecheck/lint, all-target Clippy (-D warnings), formatting and generated IPC verification passed. make check passed including 61 integration-manifest tests. All three session-observation commands, state initialization and permissions coexist with all eight Ops commands; both complete IPC boundary test functions and both shutdown paths are retained. All Ops module bytes match the prior reviewed version, so earlier real Ops/bundle evidence retains its original scope. Independent Open Code Review delegate rechecked all nine files affected by master integration and found no blocking issues.

• make check: passed lock validation, all pre-commit hooks, both Python type-check scopes and 61 integration-manifest tests.

• From desktop/, with explicit Rust 1.95.0, SDKROOT=/Library/Developer/CommandLineTools/SDKs/MacOSX26.5.sdk and a task-local Cargo target directory: cargo +1.95.0 test --locked --manifest-path src-tauri/Cargo.toml passed 89 top-level tests, with 2 opt-in integration tests ignored by default. Both opt-ins were then explicitly executed and passed.

• cargo +1.95.0 clippy --locked --manifest-path src-tauri/Cargo.toml --all-targets -- -D warnings, cargo +1.95.0 fmt --manifest-path src-tauri/Cargo.toml --check, and the export_ipc -- --check example passed.

• corepack pnpm test, corepack pnpm typecheck, corepack pnpm lint, and production build passed; frontend suite: 118 tests. Final generated IPC changes were rechecked.

• Actual source Ops subprocess inspection/preflight passed with a missing Server runtime. A separately produced independent bundle ran through native pin/inventory verification, read-only invocation and tamper refusal. The final candidate from feat(ops): produce pinned managed runtime candidates #2288 passed this opt-in in 36.48s, using independently supplied Ops manifest pin cf707c6fa209dabf5576a0250569aaf7269e71b2b667adb815e66c72b69a2373. This tests the target-file bridge path, not real managed installation/apply.

• New regressions cover requested-attempt binding without accepted, all four controller maintenance phases, missing-resource classification, non-UTF-8 path normalization, bounded fixture coordination and precise rejection through all eight IPC handlers. A reviewer reproduced the maintenance/path issues against real current Ops output and verified the fixes independently.

• Open Code Review remote review completed all 17/17 selected files. Confirmed runtime findings were fixed, including asynchronous references dispatch. The plugin delegate workflow reviewed the final 22/22 changed files, reconciled all remote comments and independently reran native/IPC regressions; no blocking findings remain. Final reviewed file hashes are verified before commit.

• Local native execution is macOS arm64 with disposable targets and read-only manager inspection. The Windows ACL module was cross-type-checked, but full Windows runtime behavior, Intel/macOS installed-platform acceptance, real service mutations, signed Desktop provisioning, login/reboot and the installation wizard are not established by these tests. Full-bundle rehashing is intentional; integration duration is not a qualified per-operation latency measurement.

AI usage statement

Implemented with Codex using GPT-6 Astra, with earlier GPT-6 Luna investigation and a primary agent coordinating integration. Open Code Review was required before submission; the final review outcome and repairs are recorded in validation above.

[hidb4ai]

resolve conflicts