feat(desktop): integrate Server discovery and operation compatibility #2101

Goal

Connect Desktop to existing and locally provisioned Servers through the public discovery contract, enable only compatible qualified operations, and keep deployment/Principal changes isolated from private results and submitted writes.

Parent: #2099. First-wave delivery: #2099. Work item: F1-01.

PR breakdown

• PR 01-A — Integrate existing Server discovery. Add the reviewed get_server_info operation, generated models, native adapter, and explicit compatibility results. Handle supported versions, missing handshake, authorization denial, unavailable service, and unknown required contracts. Preserve transport constraints and explicit qualified legacy-profile selection.

• PR 01-B — Apply identity isolation and qualify operations. Integrate deployment identity with existing Principal/context checks. Invalidate stale selections, cursors, and responses when identity changes; keep submitted writes bound to their original targets. Record independently verified product qualifications for the delivered operation set and reuse applicable feat(desktop): add macOS native preview support #2056 evidence without rewriting historical records.

Dependencies and coordination

• feat(installer): bootstrap a managed local PowerContext runtime #2115/feat(ops): expose structured personal Server lifecycle operations #2116 return the actual installation identity, selected endpoint, operation result, and config mode; feat(desktop): guide local Server setup and lifecycle management #2117 hands them off for validation. build(desktop): publish Desktop and local runtime installation artifacts #2112 pins supported runtime/resource versions. Coordinate this inside PR 01-A/01-B rather than treating setup success as compatibility proof.

• Coordinate result/state interfaces with feat(desktop): establish the shared application layout and navigation #2102 and feat(desktop): complete the connection-to-Scope journey #2103; native adapter work can begin before the UI is complete.

• Coordinate operation qualification with feat(desktop): visualize current-Scope inventory and usage #2106 when get_stats is added. Consume applicable feat(desktop): add macOS native preview support #2056 outputs; a successful build is not qualification of arbitrary Server versions.

• refactor(desktop): replace the custom OpenAPI-to-Rust schema mapping #1896 owns generator behavior. Agree on generated-file ownership and consume concrete supported schemas rather than waiting for that whole issue to close.

• Agree with feat(desktop): visualize health and processing observations #2105 on explicit readiness behavior. Existing connection checks and anonymous identity revalidation can invoke readiness; changing presentation alone does not prevent model/dependency probes.

Acceptance criteria

• Validate the actual endpoint and deployment/Principal after setup or repair; stale pre-repair identities cannot be reused. Personal loopback/no-token behavior follows RFC docs(rfc): define usability and agent workflows #1733 with reviewed profile qualification; remote authorization rules remain intact.

• Explicit setup consent may include the initial connection activation, with its effect disclosed. Normal application reopen/refresh never silently restores a private session or invokes model readiness.

• Supported discovery, handshake absence, 401/403/503, unknown product/required major, and missing optional features produce distinct actionable results. Successful health probes do not establish compatibility.

• Observation denial does not disable independently authorized Memory/statistics when compatibility can still be established through an explicitly supported policy. There is no anonymous downgrade or unverified fallback.

• Deployment or Principal changes invalidate private context and late responses; submitted writes are never silently retargeted or replayed.

• Incidental page refreshes and ordinary Memory actions do not silently trigger model/dependency readiness probes. Preserve identity/authorization checks; identify any public-contract gap before exposing the promised behavior.

• Normal product builds have matching qualification evidence for their supported operations; CI-fixture qualification remains separate. Exercise relevant real-Server flows and record Desktop/Server/contract identities.

• Existing transport, credential, TLS, endpoint allowlist, cancellation, and uncertain-write protections remain intact.

Delivery priority

Windows 11 x64 and macOS Apple Silicon/Intel are required for #2099. Linux #2110 and #2111 are optional, owner-driven work under #1428; missing Linux implementation, packaging, or qualification does not block this issue's first-wave acceptance or the Windows/macOS release. Any advertised Linux support requires its own actual qualification.

Non-goals

Do not redesign the Server handshake, add Desktop-private APIs, infer compatibility with every future Server, or introduce automatic connection/Scope restoration.

References and delivery rules

• Product scope and PR breakdown; static UI prototype. The prototype uses sample data, not production state logic.
• RFC docs(rfc): propose Tauri desktop control center #1455 and the Desktop delivery plan.
• Keep focused PRs independently reviewable and intermediate merges usable. An internal adapter may land before its page; do not expose incomplete features as operational. Close this issue only after its complete outcome is verified.
• Preserve the reviewed native transport, credential, public API, and context boundaries. Record actual backend/platform execution separately from mocks and CI-only fixtures.