Bundle 48: Tauri and authenticated Python sidecar proof

[nulleimy]

Goal

Prove the selected desktop architecture with the smallest buildable and security-testable shell before product UI implementation.

Schema Tree

minimal React renderer
  -> typed Tauri commands
  -> Rust desktop core
      -> native folder dialog
      -> opaque capability registry
      -> Python sidecar supervisor
          -> private startup payload
          -> loopback ephemeral port
          -> readiness nonce/protocol
          -> authenticated health
          -> graceful shutdown

Required proof

• exact pinned React/Tauri/Python packaging dependencies and committed lockfiles
• minimal Vite/React renderer with no direct sidecar URL or secret
• Tauri core with named commands only
• no generic renderer shell or filesystem authority
• packaged Python readiness sidecar
• startup secret read from private stdin/startup channel, not command line or logs
• loopback-only ephemeral port
• wrong secret and wrong readiness nonce fail closed
• native folder selection returns an opaque capability ID rather than a reusable host path
• desktop exit terminates the sidecar
• package layout verification
• Linux CI build for fast proof and macOS packaged proof artifact
• startup time, artifact size and process-state evidence

Safety

• no product library, analysis, composition or export screen
• no database migration
• no provider/authority switch
• no updater private key or production update endpoint
• no direct renderer-to-sidecar networking
• no broad Tauri shell/fs capability
• no unsigned release claim

Lockfile process

Initial bootstrap CI may generate npm and Cargo lockfiles as artifacts. Those exact files must be committed, and the final gate must use npm ci and cargo --locked before merge.

Acceptance

• Python 3.11 and 3.12 sidecar tests pass
• frontend TypeScript/build checks pass
• Rust format/clippy/test/build checks pass
• packaged sidecar starts and authenticates in CI
• Tauri package/build proof passes on declared runner targets
• negative security tests pass
• schema tree, operator guide, package evidence and rollback are documented
• merge only after final locked CI, PR Guard, review-thread and mergeability gates