feat(desktop): report private per-Desktop runtime capabilities

[loganj]

Summary

Adds read-only private per-Desktop capability details to Known Desktops. This is inventory, not agent readiness, presence, target signing access, or remote lifecycle controls.

• Kind 30182 is signed and NIP-44 self-encrypted, bounded to the existing private Desktop envelope, owner/community-scoped, author-only on reads/fanout, and excluded from FTS. A new additive migration preserves existing search policy (heap rewrite/ACCESS EXCLUSIVE, like the preceding private-kind migrations); no migration was run against a live database here.
• Native code calls the existing discover_acp_providers(false) authority and projects only built-in runtime ID, cached installation/adapter availability, external-CLI requirement, and configured parallelism cap. It never exports raw catalog paths, commands, environment, authentication, keys, models, or custom/preset definitions. A missing cap means “not configured,” not unlimited capacity.
• One exact signed report is persisted in the existing owner/community-local retention DB before publication. Fact equality reuses the original signature/ciphertext/time, including retry after failure/restart; changed facts atomically replace it only when a sampled real wall-clock second is later than the prior report. Equal/backward-clock changes return a retryable error without signing or overwriting; the existing 60-second pulse, reconnect and Refresh re-discover current facts. No future-dating or logical clock. Serial native preparation and post-discovery scope checks fence late completions.
• Startup, the existing 60-second pulse, reconnect and Refresh synchronize reports. Exact-coordinate reads avoid needless republish. Every async continuation and the shared delayed transport use cancellation/session-epoch fences. Failed reads retain prior cached reports; bounded results are labeled partial. Account/community query keys do not share decrypted rows.
• The mounted Known Desktops rows show native <details> with remote facts, signed report time, missing-report and future-clock states. Newest signed time/lower ID wins history/live ties. Same-second races and sender clock skew remain accepted advisory limitations.

Intent decisions / exclusions

Settings → Agents stays the local catalog/setup/Check again UI. This slice consumes its cached native discovery authority rather than introducing a second prober or forced auth checks every minute. The report time is when the projection changed, not a fresh installation probe; unchanged facts retain their original time. The UI explicitly calls these cached facts.

Capability reports, unlike freshness pulses, must survive delayed offline publication. Their past-age admission bound is waived alongside immutable Desktop profiles; the existing future-time bound, signature, envelope, owner and production-auth checks remain. Observation/presence windows are unchanged. No auth-policy redesign or pagination fix is included.

Stable agent keys must be provisioned out of band by the user. Neither these facts nor green CI prove signing access, an agent's readiness, or whole-Multiverse completion. No config-behavior rules in Agents AGENTS.md changed: catalog and command-keyed parallelism remain the authorities.

Stack / size

main → #7330 Desktop list → #7331 host freshness → this capability draft.
Base: feat/desktop-observations-9c2da321 at 7284ffb2adb20156cb72e9538c5d9ddabd68209f; parent #7330 at 329554051b04e3d9d46e009067dc7d58bcee7711. Closest related PR is #7331; no other capability draft existed at recovery. Optional pagination #7327 and deferred development-auth hardening are not ancestors/gates.

18 files, +869/-13 = 882 gross changed lines including tests. (Original 749-line slice plus the narrow stale-report correction and its regressions; no split or unrelated refactor.) This exceeds the ~600-line target. The tradeoff is keeping exact durable publication, privacy/FTS/admission, bounded authenticated ordering and a mounted UI in one useful end-to-end slice; no inventory-size exception is claimed. No unrelated refactor or protocol/lifecycle expansion is included.

Current verification — September 4

Exact-head CI SUCCESS: https://github.com/block/buzz/actions/runs/33895009372 . Docker run 33895009242 and DCO also succeed. Desktop Core executed 6,250 JS tests (all passed) and the full native suite 3,166 passed / 19 ignored, including the actual Tauri real-clock persistence regression. The actual PostgreSQL lane executed 382 selected tests (all passed), 1,447 skipped, including authenticated capability/profile/observation HTTP/WS reads/private storage and aged-profile retry. Relay-backed integrations and Desktop smoke pass.

Focused review of the real-clock correction is complete with no remaining blocking finding in that delta; unaffected earlier independent review is retained. This is not a GitHub code-owner approval. Detailed final evidence: #7333 (comment) . Live two-Desktop discovery/reconnect acceptance remains unperformed; no merge, live migration or deployment performed.

Historical local validation (superseded where current CI provides broader evidence)

Current candidate: 08fbf9c95bbd9107fcf196d14d5e677368879db6, tree b9e3466054a0d45e19ae3586ad0043f7644fd6d9. Base unchanged at 7284ffb2adb20156cb72e9538c5d9ddabd68209f.

Fresh correction evidence:

• 10/10 focused frontend tests passed, including mounted reconnect/60-second retries after native deferral, no publication while deferred, later publication, cancellation and scope fences.
• 1/1 native persistence-seam regression passed offline: an artifact harness compiles verbatim native prepare_report, profile preparation, retention DB functions and the committed regression against real SQLite and core NIP-44/signatures. Equal/backward samples preserve exact bytes; at real-clock sample 1001 the latest facts sign at exactly 1001 and win both history orders. Reopen, reverted facts, invalid-fact failure and unchanged exact retries are covered. Removing the guard makes the regression fail. This is not full Tauri compilation or live native discovery.
• 1/1 core codec regression passed on the correction; changed Rust formatting, frontend Biome and differential file-size checks passed.

Reused, unaffected evidence from the preceding candidate:

• 55/55 focused frontend tests passed at the pre-format candidate; 3/3 capability tests passed again on the final tree after the sole subsequent change (JSX text wrapping, formatter-only), including new capability retries/unchanged reports, continuation/transport epoch fences, partial/failed reads, mounted per-Desktop rendering, existing freshness/publication guards, and repaired parent reconnect source contract.
• Core report test passed: authenticated encryption, owner/community scope, tampered/unknown payload rejection, field bounds, newest-time/lower-ID history merge, bounded result rejection, private-kind registration.
• Rust/native formatting, changed frontend Biome, Desktop differential file-size check, and Postgres test discovery passed.
• TypeScript: only the same 8 inherited calendar/react-day-picker dependency errors. No installs or dependency/config edits performed.
• Relay author-only capability fanout passed 1/1; the separate production-auth Postgres fixture compiled but was ignored, not passed. Past-only/kind-specific timestamp admission regression passed 1/1, including capabilities. Embedded migrator/schema regression passed 1/1; this is not execution of the migration on Postgres.
• Full native application execution remains unverified locally (the previous offline native attempt reached the sherpa-onnx download/DNS blocker before application compilation; no redundant full-native attempt was made). The fresh extracted persistence-seam execution above is narrower. Production-auth HTTP/WS/private-storage and brownfield FTS regressions are included but Postgres tests were not run. No live two-Desktop/native/PG acceptance or just ci pass claimed. Normal publication CI is separate evidence.

Local receipts and exact patches: WORK_LOGS/MULTIVERSE_IMPLEMENTATION/PR4_55F1C888/ (original slice), WORK_LOGS/MULTIVERSE_IMPLEMENTATION/FIX_AC566621/ (correction, extraction script, source hashes, tests and guard-removal mutation evidence).

Publication-time snapshot (historical; current outcome above)

Current-head normal CI: https://github.com/block/buzz/actions/runs/33895009372 (pending at publication), https://github.com/block/buzz/actions/runs/33895009242 (Docker image, in progress). No current-head CI pass is claimed. The older CI run 33892214459 remains old-head evidence only (Desktop Core, Windows Rust and Rust Unit succeeded at recovery); it is not the correction's pass.

The complete resulting diff was freshly inspected after the correction. Independent review of the preceding candidate found this single stale-report issue; focused follow-up requested for real-clock deferral/signing and retry ownership, not a new whole-slice review gate. This bounds known prior local state, not unobserved competing writers. If the clock remains behind, publication keeps warning/retrying rather than asserting success or manufacturing time.

[loganj]

Exact-head validation and focused correction review complete

Reviewed b5738696..08fbf9c95bbd9107fcf196d14d5e677368879db6 against unchanged base 7284ffb2adb20156cb72e9538c5d9ddabd68209f. The earlier independent review's changed-facts precedence finding is resolved: native preparation retains previous exact bytes and returns immediately on equal/backward real clock; subsequent existing refreshes rediscover current facts and sign only at a later observed second. No logical clock, future dating, held projection, or new timer. Cancellation/scope fences and signed-time/lower-ID ordering remain intact. No additional blocking finding in this delta. This is a technical review result, not a code-owner approval.

CI is now successful on that exact head: https://github.com/block/buzz/actions/runs/33895009372

• Desktop Core: 6,250 JS tests pass; native suite 3,166 pass / 19 ignored. The actual Tauri changed_facts_defer_until_real_clock_advances_then_win_signed_order regression executed and passed, superseding the earlier extracted-harness-only limitation.
• Actual PostgreSQL lane: 382 selected tests pass / 1,447 skipped, including private capability, observation and profile authenticated HTTP/WS query/storage and aged-profile production-ingest retry. Skipped reusable-workflow placeholders are not this execution.
• Desktop smoke, relay-backed integrations, Rust and DCO checks succeed. Docker run 33895009242 succeeds.

Earlier local-only evidence in the PR body is historical; these CI results close its pending native/PG check gaps. A live two-Desktop discovery/reconnect walkthrough remains unperformed. Cached capability facts still do not establish agent readiness or signing access. No live migration/deployment or merge performed; the FTS migration's table-rewrite scheduling requirement remains.