jackin❯ desktop — native macOS limits app

Status: Partially implemented

Current state: The in-repository native redesign is implemented for the macOS 26 production baseline. It uses provider-focused native popovers with centered product identity and a two-column Usage window whose native full-height sidebar is independent from the detail-owned jackin❯ desktop header and trailing Refresh. One stationary standard sidebar control, the generated jackin❯ by tailrocks sidebar signature, visible native recovery, retained window context, and system-owned Liquid Glass complete the shell. Rust remains authoritative for providers, accounts, quota semantics, refresh policy, and domain strings. Host Desktop discovery now reads global and every effective workspace/role account scope without writing config, deduplicates configured sources/accounts, and exports only sanitized diagnostics. Current discovery—not historical snapshots—owns active membership; OpenCode and GitHub remain outside the Desktop quota catalog. One host-only Rust broker now owns refresh generations, atomic last-good state, and shared provider backoff; Desktop and capability-scoped Capsule relays join the same generation and never fall back to local/filesystem probes.

The roadmap remains partially implemented because the first Developer ID publication/Homebrew proof and capture-gated Amp paid-plan work require external operator evidence. Those external gates are not substituted by a green PR.

Coordinator completion also requires a recorded Apple Silicon macOS 26 + OrbStack cargo xtask ci --e2e run. Capsules see only credential capabilities forwarded at launch; credentials created solely inside a Capsule remain out of scope pending a secure-enrollment design.

Decisions

• 2026-08-12 — Select focused native hierarchy. The operator selected a focused provider popover plus two-column Usage. Cross-provider comparison belongs in Usage, not a custom tab system inside the popover.
• 2026-08-12 — Approve identity and sidebar behavior. The generated jackin❯ by tailrocks wordmark belongs in the quiet sidebar footer. Exactly one native sidebar button remains in the leading toolbar slot while expanded or collapsed.
• 2026-08-12 — Confirm runnable native direction. The operator confirmed the native proof. Production implementation preserves its hierarchy, system-owned material, Rust/Swift ownership, and the two identity/sidebar decisions.
• 2026-08-13 — Center product identity. The operator required jackin❯ desktop centered in the Usage header and jackin❯ identity in the popover. A native detail split-item accessory and a non-interactive monogram/text row satisfy this without custom chrome or glass.
• 2026-08-14 — Restore native pane ownership. NSSplitViewController owns a full-height leading sidebar. Its standard toggle is the single visibility authority and remains stationary while the detail-only native accessory owns centered identity and trailing Refresh.
• 2026-08-14 — Unify account-first presentation. One atomic Rust projection now drives selected identity, activity, grouped Overview rows, status items, and exact provider/account handoff. Popover keeps Limits before Details; provider detail keeps Details before Limits.
• 2026-08-15 — Refine popover actions. The optional account picker moved to the trailing edge of the fixed footer. Separate adjacent native leading controls present Refresh and Open Usage as semantic icon-only SF Symbol buttons with hover help, keeping account identity in content and Liquid Glass ownership in system controls.

Implemented baseline

• macOS 26.0 deployment target; Xcode 26.6 release toolchain; arm64 static XCFramework app assembly.
• Native NSStatusItem provider items and a real transient NSPopover focused on the clicked provider.
• Centered, non-interactive generated monogram plus jackin❯ desktop popover identity; provider and selected account, one Rust-owned activity phrase, Limits before useful Details without repetition, and no cross-provider navigation. The fixed native footer has separate adjacent leading icon-only Refresh/Open Usage controls and a trailing account menu when multiple accounts exist.
• Retained native Usage NSWindow with NSSplitViewController, full-height sidebar, grouped hierarchical Overview table with selectable account children, account-first provider detail, detail-centered product identity, native toolbar/menu commands, no Usage title, and stable sidebar-button coordinates.
• One atomic Rust Desktop projection per broker generation; transient decode/bridge failures retain exact last-good rows and destination, and stale resumes cannot overwrite newer generations.
• Valid destination/account/sidebar/frame continuity across close/reopen; provider removal or disablement normalizes at PresentationStore.
• Generated responsive brand assets; adaptive phosphor for identity/healthy emphasis; textual state plus system semantic warning/danger color.
• Zero custom UI regions, explicit glass effects, glass containers, or app-owned materials in production sources.
• Deterministic F00–F14 visual-QA states isolated from bridge/network/real credentials.
• Real-host UI coverage for commands, routing, scrolling, recovery, focus/retained context, full-height pane geometry, fixed dynamically labeled sidebar control, detail-centered identity, and accessibility audits of popover, Overview, and provider detail.
• Secret-free release validation and fail-closed release-state reconciliation.

Operator behavior lives in jackin❯ desktop for macOS. Architecture and release boundaries live in ADR-011 and native/README.md.

Remaining work

Production activation and public proof

1. Provision the Developer ID Application certificate, App Store Connect notarization key, team id, and pinned certificate fingerprint in the protected release-macos environment.
2. Cut the first non-development release from main; sign, notarize, staple, Gatekeeper-validate, and publish the immutable ZIP plus SHA-256, Sigstore, SBOM, and GitHub attestation.
3. Advance the stable formula and jackin-desktop cask in one independently reviewed tap PR. The first cask must not auto-merge.
4. On Apple Silicon macOS 26+, install the public cask, run the status item, popover, Usage, and Settings surfaces, uninstall cleanly, and prove a completed-version release rerun performs no writes.
5. Verify the downloaded public artifact with cargo xtask release-verify and reconcile observed production behavior in durable release docs.

Operator-owned visual preference observation

macOS exposes no public API for reading the user's clear/tinted Liquid Glass preference. Final automated evidence can prove system-owned material under light/dark, active/inactive, Increase Contrast, Reduce Transparency, and Reduce Motion. A human observation of both clear and tinted preference choices remains operator-owned and must not be simulated with private defaults.

Capture-gated Amp work

Capture authenticated Amp Megawatt, Gigawatt, and linked-subscription displayText or userDisplayBalanceInfo responses. Add paid-plan/monthly parsing only from authentic operator-owned wire evidence; guessed shapes remain forbidden. Amp Free Daily behavior must not regress.

Deferred candidates

These remain separate product decisions, not unfinished redesign work:

• All Accounts Usage and Status & Sources destinations;
• incident metadata, reset-credit expiry, collapsible secondary metrics, or segmented capacity markers;
• additional providers or commercial actions;
• any new custom navigation/material system.

Completion gate

Do not retire this roadmap item until public Developer ID/cask proof, the capture-gated provider requirement, and the mandatory OrbStack usage-broker lane have authoritative evidence. The native implementation may be complete inside the repository while the broader delivery item remains Partially implemented.

Related work

• Auth health and operator visibility
• jackin❯ daemon — optional later focus support, not a desktop dependency
• Capsule usage overlay — another consumer of the same Rust presentation