Triple-C/docs/superpowers/plans/2026-09-22-app-manifest-lockdown.md

# AppManifest Lockdown Implementation Plan

> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.

**Goal:** Every app command in `generate_handler!` becomes ACL-gated per window — the `main` window may invoke exactly the 110 commands it uses today, a `file-viewer-*` window exactly its five `viewer_*` commands — and a command left out of a capability file fails `cargo check`, not a feature at runtime.

**Architecture:** `build.rs` parses the `generate_handler![ … ]` block, declares a Tauri `AppManifest` from it (which generates `allow-<cmd>`/`deny-<cmd>` permissions and makes tauri 2.11 enforce the ACL on app commands), and refuses to build unless every command has exactly one bare `allow-*` grant in the capability file its name says it belongs to. The parser and the rules live in one module, `src/command_census.rs`, compiled into both the build script and the test build, so they are unit-tested. A vitest test then proves the code that runs in each window only imports wrappers that window is granted.

**Tech Stack:** Rust (tauri 2.11.0, tauri-build 2.6.0, tauri-utils 2.9.0, serde_json), Vitest (Node `fs`), plain JSON capability files.

**Spec:** `docs/superpowers/specs/2026-09-22-app-manifest-lockdown-design.md` — read it first, in particular §2 (how tauri's mechanism actually behaves), §3 (the design), "Decisions made during review" and §7 (the spike that verified §2 in this environment).

## Global Constraints

- **Allow-lists only.** No bare `deny-*` anywhere (global in tauri 2.11.0), no bare `default`, no permission sets, no hand-written files under `app/src-tauri/permissions/`.
- **One file per window, decided by name.** `viewer_*` commands are granted only in `capabilities/file-viewer.json` (`windows: ["file-viewer-*"]`); every other command only in `capabilities/default.json` (`windows: ["main"]`). The rule is `command_census::expected_windows`; changing it is a design change.
- **Permission identifier = `allow-` + command name with every `_` replaced by `-`.** The command name inside stays snake_case. tauri-utils replaces only `_`.
- **The existing five plugin/core grants in `default.json` and four in `file-viewer.json` do not change.**
- **`browser-view-*` (the pop-out) stays in no capability file.** No `webviews` patterns anywhere.
- **`command_census.rs` may reference only `std` and `serde_json`** — it is compiled into the build script with `#[path]`.
- **`build.rs`, both capability files and the two existing census tests change in one commit (Task 2).** Bare grants without the manifest fail the build; the manifest without grants builds an app in which every command is denied.
- **Every `#[tauri::command]` stays in `generate_handler![]`, one fully-qualified path per line** — the parser is line-based.
- **`gen/schemas/*.json` are tracked and regenerated by every build; commit them.** Expect ~2,700 added lines across `desktop-schema.json` and `linux-schema.json`.
- **Use `--offline` for cargo** (the crate cache is complete; `serde_json` is already in `Cargo.lock`).
- **Commit after every task** with a `refactor:`/`feat:`/`test:`/`docs:` message ending in the line `Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>`. Do not push.
- **Out of scope** (controller rulings): adding `cargo test`/vitest steps to CI, `removeUnusedCommands`, argument scoping.

## What works in this environment (verified 2026-09-22)

| Command | Status |
|---|---|
| `cd app/src-tauri && cargo check --offline` | works; ~3 s when only `triple-c` recompiles. After a run that writes a `.toml`, the *next* run re-runs the build script once more, then it settles (spec §7.I). |
| `cd app/src-tauri && cargo test --offline [filter]` | works (baseline at `bf22910`: 652 tests, ~30 s to build) |
| `cd app/src-tauri && cargo clippy --offline --all-targets` | works |
| `cd app && npx vitest run [path]` / `npm run test` | works (baseline: 74 files, 969 tests, ~6 s) |
| `cd app && npx tsc --noEmit` / `npm run build` | works |
| `npx tauri dev` / `npx tauri build` | **not verifiable here** (no display). The manual checklist in Task 6 runs on the user's machine. |
| Fresh `git worktree` | needs `app/dist` to exist (`cd app && npm run build`) or `generate_context!` panics on `frontendDist` before any ACL code runs. |

A failed build-script check appears under `--- stderr` in cargo's `error: failed to run custom build command` output; tauri's own `Permission … not found` appears under `--- stdout`.

---

## File Structure

**Create:**
- `app/src-tauri/src/command_census.rs` — `registered_commands` (the handler-list parser, moved from the `lib.rs` test), `allow_permission`, `expected_windows`, `CapabilityFile` + `capability_file` (JSON → bare grants), `check` (every rule, returns all violations), and their unit tests.
- `app/src/test/capabilities.test.ts` — wrapper map from `lib/tauri-commands.ts`, viewer import closure, per-window set checks, exact plugin/core lists.

**Modify:**
- `app/src-tauri/build.rs` — read `src/lib.rs`, run `check`, prune stale `permissions/autogenerated/*.toml`, `try_build` with the `AppManifest`.
- `app/src-tauri/Cargo.toml` — `serde_json` under `[build-dependencies]` (`Cargo.lock` follows).
- `app/src-tauri/capabilities/default.json` — 110 bare `allow-*` grants; description.
- `app/src-tauri/capabilities/file-viewer.json` — 5 bare `allow-viewer-*` grants; description.
- `app/src-tauri/src/lib.rs` — `#[cfg(test)] mod command_census;`; `every_command_is_registered_exactly_once` uses the shared parser; `the_capability_grants_are_the_ones_that_were_reviewed` splits bare/prefixed; new `the_generated_app_manifest_matches_the_handler_list`.
- `app/src-tauri/src/file_viewer/mod.rs` — exact grant list in `the_viewer_capability_grants_exactly_the_reviewed_windows_and_permissions`; module doc.
- `app/src-tauri/gen/schemas/{acl-manifests,capabilities,desktop-schema,linux-schema}.json` — regenerated.
- `.gitignore` — `app/src-tauri/permissions/autogenerated/`.
- `CLAUDE.md` — Key Conventions bullet (lines 598-600) and Backend Structure (`file_viewer/` bullet lines 179-180, plus a `build.rs` bullet).

## Dependency and parallel map

```
Task 1 (census module + parser refactor)      — no behaviour change; safe alone
   └─► Task 2 (build.rs + grants + census tests + gen/schemas)   — THE atomic change
          ├─► Task 3 (embedded-manifest test, lib.rs)            ┐
          ├─► Task 4 (vitest capabilities.test.ts)               ├─ independent of each other; may run in parallel
          └─► Task 5 (descriptions, CLAUDE.md, mod.rs doc)       ┘   (disjoint files: lib.rs / src/test / json descriptions+md)
                 └─► Task 6 (full verification, negative checks, manual checklist hand-off)
```

Tasks 3, 4 and 5 touch disjoint files, so three subagents in the same worktree can run them concurrently as long as each commits only its own files (`git add <paths>`, never `git add -A`). Task 5 edits the `description` field of both capability files; Task 2 edits their `permissions` array — that is why 5 waits for 2.

---

## Interfaces (the contract every task codes against)

`app/src-tauri/src/command_census.rs` (Task 1), used by `build.rs` (Task 2) and the tests (Tasks 2, 3):

```rust
pub fn registered_commands(lib_rs: &str) -> Option<Vec<String>>;   // handler list, in order, duplicates kept; None = no block
pub fn allow_permission(command: &str) -> String;                   // "viewer_read_file" → "allow-viewer-read-file"
pub fn expected_windows(command: &str) -> &'static [&'static str];  // "viewer_*" → ["file-viewer-*"], else ["main"]
pub struct CapabilityFile { pub name: String, pub windows: Vec<String>, pub bare: Vec<String> }
pub fn capability_file(name: &str, json: &str) -> Result<CapabilityFile, String>;
pub fn check(commands: &[String], files: &[CapabilityFile]) -> Vec<String>;  // every violation; empty = pass
```

In `lib.rs` the module is `crate::command_census` (test builds only). In `build.rs` it is `command_census` via `#[path = "src/command_census.rs"]`.

The five viewer commands: `viewer_get_state`, `viewer_choose_file`, `viewer_read_file`, `viewer_poll_file`, `viewer_write_file`. Their grants: `allow-viewer-get-state`, `allow-viewer-choose-file`, `allow-viewer-read-file`, `allow-viewer-poll-file`, `allow-viewer-write-file`.

---

### Task 1: `command_census.rs` — the shared parser and rules, unit-tested

**Files:**
- Create: `app/src-tauri/src/command_census.rs`
- Modify: `app/src-tauri/src/lib.rs:1-12` (module list), `app/src-tauri/src/lib.rs:849-870` and `:895-920` (the parser and the duplicate loop inside `every_command_is_registered_exactly_once`)

**Interfaces:**
- Consumes: nothing.
- Produces: everything in "Interfaces" above.

- [ ] **Step 1: Write the failing tests**

Create `app/src-tauri/src/command_census.rs` with only the tests and stub signatures, so the tests compile and fail:

```rust
//! The command census shared by `build.rs` and the `cargo test` suite.
//!
//! `build.rs` pulls this file in with `#[path = "src/command_census.rs"]` and `lib.rs` with
//! `#[cfg(test)] mod command_census;`, so the parser that decides what the Tauri `AppManifest`
//! declares is the parser the tests exercise, and the rules that decide whether the build
//! passes have unit tests. Nothing here may reference the crate: only `std` and `serde_json`
//! (a dependency of both the crate and the build script).
//!
//! Spec: `docs/superpowers/specs/2026-09-22-app-manifest-lockdown-design.md` §3.2.

use std::collections::{BTreeMap, BTreeSet};

pub fn registered_commands(lib_rs: &str) -> Option<Vec<String>> {
    let _ = lib_rs;
    None
}

pub fn allow_permission(command: &str) -> String {
    command.to_string()
}

pub fn expected_windows(command: &str) -> &'static [&'static str] {
    let _ = command;
    &[]
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct CapabilityFile {
    pub name: String,
    pub windows: Vec<String>,
    pub bare: Vec<String>,
}

pub fn capability_file(name: &str, json: &str) -> Result<CapabilityFile, String> {
    let _ = (name, json, BTreeMap::<String, String>::new(), BTreeSet::<String>::new());
    Err("unimplemented".to_string())
}

pub fn check(commands: &[String], files: &[CapabilityFile]) -> Vec<String> {
    let _ = (commands, files);
    vec!["unimplemented".to_string()]
}

#[cfg(test)]
mod tests {
    use super::*;

    fn cmds(names: &[&str]) -> Vec<String> {
        names.iter().map(|n| n.to_string()).collect()
    }

    fn file(name: &str, windows: &[&str], bare: &[&str]) -> CapabilityFile {
        CapabilityFile {
            name: name.to_string(),
            windows: windows.iter().map(|w| w.to_string()).collect(),
            bare: bare.iter().map(|b| b.to_string()).collect(),
        }
    }

    /// The two files as they must look after the lockdown, for a three-command app.
    fn good_files() -> Vec<CapabilityFile> {
        vec![
            file("default.json", &["main"], &["allow-check-docker", "allow-open-file-viewer"]),
            file("file-viewer.json", &["file-viewer-*"], &["allow-viewer-read-file"]),
        ]
    }

    const THREE: &[&str] = &["check_docker", "open_file_viewer", "viewer_read_file"];

    #[test]
    fn the_parser_reads_the_handler_list_in_order_and_ignores_comments() {
        let lib_rs = r#"
            .invoke_handler(tauri::generate_handler![
                // Docker
                commands::docker_commands::check_docker,
                commands::docker_commands::build_image, // trailing comment is not a command
                url_open::open_url_external,

                // Viewer
                commands::file_viewer_commands::viewer_read_file
            ])
            .run(tauri::generate_context!())
        "#;
        assert_eq!(
            registered_commands(lib_rs).unwrap(),
            cmds(&["check_docker", "build_image", "open_url_external", "viewer_read_file"])
        );
    }

    #[test]
    fn the_parser_keeps_duplicates_so_the_caller_can_report_them() {
        let lib_rs = "generate_handler![\n a::x,\n b::x,\n])";
        assert_eq!(registered_commands(lib_rs).unwrap(), cmds(&["x", "x"]));
    }

    #[test]
    fn the_parser_returns_none_without_a_handler_block() {
        assert_eq!(registered_commands("fn main() {}"), None);
        assert_eq!(registered_commands("generate_handler![ a::b, "), None, "unterminated");
    }

    #[test]
    fn permission_identifiers_replace_only_underscores() {
        assert_eq!(allow_permission("check_docker"), "allow-check-docker");
        assert_eq!(allow_permission("viewer_read_file"), "allow-viewer-read-file");
        assert_eq!(allow_permission("aws_sso_refresh"), "allow-aws-sso-refresh");
    }

    #[test]
    fn viewer_commands_belong_to_the_viewer_windows_and_nothing_else_does() {
        assert_eq!(expected_windows("viewer_read_file"), ["file-viewer-*"]);
        assert_eq!(expected_windows("open_file_viewer"), ["main"]);
        assert_eq!(expected_windows("check_docker"), ["main"]);
    }

    #[test]
    fn a_capability_file_yields_its_windows_and_bare_grants_only() {
        let json = r#"{
            "identifier": "default",
            "description": "x",
            "windows": ["main"],
            "permissions": [
                "core:event:allow-listen",
                { "identifier": "fs:allow-read", "allow": [{ "path": "$APPDATA/*" }] },
                "allow-check-docker",
                { "identifier": "allow-list-projects" }
            ]
        }"#;
        let parsed = capability_file("default.json", json).unwrap();
        assert_eq!(parsed.name, "default.json");
        assert_eq!(parsed.windows, vec!["main"]);
        assert_eq!(parsed.bare, vec!["allow-check-docker", "allow-list-projects"]);
    }

    #[test]
    fn a_capability_file_without_windows_or_permissions_is_an_error() {
        assert!(capability_file("x.json", r#"{"permissions": []}"#).unwrap_err().contains("windows"));
        assert!(capability_file("x.json", r#"{"windows": ["main"]}"#).unwrap_err().contains("permissions"));
        assert!(capability_file("x.json", "not json").unwrap_err().contains("x.json"));
    }

    #[test]
    fn a_correct_census_has_no_problems() {
        assert_eq!(check(&cmds(THREE), &good_files()), Vec::<String>::new());
    }

    #[test]
    fn an_empty_command_list_is_refused_because_it_would_disable_the_acl() {
        let problems = check(&[], &good_files());
        assert_eq!(problems.len(), 1);
        assert!(problems[0].contains("no commands"), "{problems:?}");
    }

    #[test]
    fn a_command_without_a_grant_is_named_together_with_the_file_it_belongs_in() {
        let files = vec![
            file("default.json", &["main"], &["allow-check-docker"]),
            file("file-viewer.json", &["file-viewer-*"], &["allow-viewer-read-file"]),
        ];
        let problems = check(&cmds(THREE), &files);
        assert_eq!(problems.len(), 1, "{problems:?}");
        assert!(problems[0].contains("open_file_viewer"));
        assert!(problems[0].contains("allow-open-file-viewer"));
        assert!(problems[0].contains("[\"main\"]"));
    }

    #[test]
    fn a_grant_in_two_files_is_reported_once_naming_both() {
        let files = vec![
            file("default.json", &["main"], &["allow-check-docker", "allow-open-file-viewer"]),
            file("extra.json", &["main"], &["allow-check-docker"]),
            file("file-viewer.json", &["file-viewer-*"], &["allow-viewer-read-file"]),
        ];
        let problems = check(&cmds(THREE), &files);
        assert_eq!(problems.len(), 1, "{problems:?}");
        assert!(problems[0].contains("allow-check-docker"));
        assert!(problems[0].contains("default.json") && problems[0].contains("extra.json"));
    }

    #[test]
    fn a_grant_that_names_no_command_is_a_typo() {
        let mut files = good_files();
        files[0].bare.push("allow-check-dokcer".to_string());
        let problems = check(&cmds(THREE), &files);
        assert_eq!(problems.len(), 1, "{problems:?}");
        assert!(problems[0].contains("default.json: allow-check-dokcer"));
        assert!(problems[0].contains("no registered command"));
    }

    #[test]
    fn deny_grants_are_refused_with_the_reason() {
        let mut files = good_files();
        files[1].bare.push("deny-check-docker".to_string());
        let problems = check(&cmds(THREE), &files);
        assert_eq!(problems.len(), 1, "{problems:?}");
        assert!(problems[0].contains("file-viewer.json: deny-check-docker"));
        assert!(problems[0].contains("global"));
    }

    #[test]
    fn other_bare_identifiers_are_refused() {
        let mut files = good_files();
        files[0].bare.push("default".to_string());
        let problems = check(&cmds(THREE), &files);
        assert_eq!(problems.len(), 1, "{problems:?}");
        assert!(problems[0].contains("default.json: default"));
    }

    #[test]
    fn a_grant_in_the_wrong_file_is_refused_even_though_it_is_granted_exactly_once() {
        let files = vec![
            file("default.json", &["main"], &["allow-check-docker", "allow-open-file-viewer", "allow-viewer-read-file"]),
            file("file-viewer.json", &["file-viewer-*"], &[]),
        ];
        let problems = check(&cmds(THREE), &files);
        assert_eq!(problems.len(), 1, "{problems:?}");
        assert!(problems[0].contains("allow-viewer-read-file"));
        assert!(problems[0].contains("[\"file-viewer-*\"]"));
    }

    #[test]
    fn a_widened_windows_list_is_the_wrong_file_too() {
        let files = vec![
            file("default.json", &["main", "file-viewer-*"], &["allow-check-docker", "allow-open-file-viewer"]),
            file("file-viewer.json", &["file-viewer-*"], &["allow-viewer-read-file"]),
        ];
        let problems = check(&cmds(THREE), &files);
        assert_eq!(problems.len(), 2, "{problems:?}");
    }

    #[test]
    fn bad_names_and_duplicate_registrations_are_refused() {
        let commands = cmds(&["check_docker", "Check-Docker", "check_docker", "open_file_viewer", "viewer_read_file"]);
        let problems = check(&commands, &good_files());
        assert!(problems.iter().any(|p| p.contains("\"Check-Docker\"") && p.contains("[a-z0-9_]+")), "{problems:?}");
        assert!(problems.iter().any(|p| p.contains("check_docker is registered more than once")), "{problems:?}");
    }

    #[test]
    fn every_problem_is_reported_in_one_pass() {
        let files = vec![
            file("default.json", &["main"], &["allow-check-docker", "allow-nope", "deny-check-docker"]),
            file("file-viewer.json", &["file-viewer-*"], &[]),
        ];
        let problems = check(&cmds(THREE), &files);
        // typo, deny, open_file_viewer missing, viewer_read_file missing
        assert_eq!(problems.len(), 4, "{problems:?}");
    }
}
```

Register the module in `app/src-tauri/src/lib.rs`, after `mod browser_view;` (line 2):

```rust
mod browser_view;
#[cfg(test)]
mod command_census;
mod commands;
```

- [ ] **Step 2: Run the tests to verify they fail**

Run: `cd /workspace/triple-c/app/src-tauri && cargo test --offline command_census 2>&1 | tail -30`
Expected: compiles; `test result: FAILED` with every test except `the_parser_returns_none_without_a_handler_block` failing (the stubs return `None`/empty/error).

- [ ] **Step 3: Implement the module**

Replace the stub bodies in `command_census.rs` (keep the module doc, the `use`, the struct and the tests):

```rust
/// The command names inside `generate_handler![ … ])` in `lib.rs`, in registration order,
/// duplicates kept (the caller decides whether that is an error). `None` if the block is
/// missing or unterminated.
///
/// Line-based, not `split(',')`: the list is grouped under `// Docker` style comments, and
/// splitting on commas glues each comment to the command that follows it. A
/// `starts_with("//")` filter then drops that command — silently, and once per group.
pub fn registered_commands(lib_rs: &str) -> Option<Vec<String>> {
    let (_, rest) = lib_rs.split_once("generate_handler![")?;
    let (inside, _) = rest.split_once("])")?;
    Some(
        inside
            .lines()
            .map(str::trim)
            .filter(|l| !l.is_empty() && !l.starts_with("//"))
            .filter_map(|l| {
                // `a::b::name, // comment` → `name`
                let code = l.split("//").next().unwrap_or("").trim();
                code.trim_end_matches(',')
                    .rsplit("::")
                    .next()
                    .map(|n| n.trim().to_string())
            })
            .filter(|n| !n.is_empty())
            .collect(),
    )
}

/// `viewer_read_file` → `allow-viewer-read-file`. tauri-utils 2.9.0 (`acl/build.rs:290`)
/// replaces only `_`; permission identifiers may not contain `_`, but the command name inside
/// the generated permission stays snake_case.
pub fn allow_permission(command: &str) -> String {
    format!("allow-{}", command.replace('_', "-"))
}

/// The `windows` list of the one capability file that may grant `command`. A command that
/// must be callable from both windows is a design change: make it here, visibly, rather than
/// by widening a capability file.
pub fn expected_windows(command: &str) -> &'static [&'static str] {
    if command.starts_with("viewer_") {
        &["file-viewer-*"]
    } else {
        &["main"]
    }
}

/// One `capabilities/*.json`, reduced to what the census checks. Plugin and core grants
/// (anything with a `:`) are not this module's business; the exact-set tests in `lib.rs` and
/// `file_viewer/mod.rs` pin those.
pub fn capability_file(name: &str, json: &str) -> Result<CapabilityFile, String> {
    let value: serde_json::Value =
        serde_json::from_str(json).map_err(|e| format!("{name}: not valid JSON: {e}"))?;
    let windows = value["windows"]
        .as_array()
        .ok_or_else(|| format!("{name}: `windows` must be an array"))?
        .iter()
        .map(|w| {
            w.as_str()
                .map(str::to_string)
                .ok_or_else(|| format!("{name}: `windows` entries must be strings"))
        })
        .collect::<Result<Vec<_>, _>>()?;
    let mut bare = Vec::new();
    for grant in value["permissions"]
        .as_array()
        .ok_or_else(|| format!("{name}: `permissions` must be an array"))?
    {
        let id = match grant {
            serde_json::Value::String(s) => s.as_str(),
            serde_json::Value::Object(o) => o
                .get("identifier")
                .and_then(|i| i.as_str())
                .ok_or_else(|| format!("{name}: a scoped grant needs a string `identifier`"))?,
            _ => return Err(format!("{name}: a grant is a string or an object")),
        };
        if !id.contains(':') {
            bare.push(id.to_string());
        }
    }
    Ok(CapabilityFile { name: name.to_string(), windows, bare })
}

/// Everything that must hold between the handler list and the capability files. Returns every
/// violation rather than the first, so a batch of forgotten grants is one build failure; an
/// empty vector is a pass.
pub fn check(commands: &[String], files: &[CapabilityFile]) -> Vec<String> {
    let mut problems = Vec::new();
    if commands.is_empty() {
        problems.push(
            "no commands were parsed out of generate_handler! — an empty AppManifest would \
             silently leave every app command ungated"
                .to_string(),
        );
        return problems;
    }

    let mut seen: BTreeSet<&str> = BTreeSet::new();
    for c in commands {
        if !c.bytes().all(|b| b.is_ascii_lowercase() || b.is_ascii_digit() || b == b'_') {
            problems.push(format!("{c:?} is not a command name ([a-z0-9_]+)"));
        }
        if !seen.insert(c.as_str()) {
            problems.push(format!("{c} is registered more than once"));
        }
    }

    let known: BTreeMap<String, &str> =
        seen.iter().map(|c| (allow_permission(c), *c)).collect();
    for f in files {
        let windows: Vec<&str> = f.windows.iter().map(String::as_str).collect();
        for id in &f.bare {
            match known.get(id) {
                Some(command) => {
                    let want = expected_windows(command);
                    if windows.as_slice() != want {
                        problems.push(format!(
                            "{}: {id} must be granted in the capability file whose windows are \
                             {want:?}, not {windows:?}",
                            f.name
                        ));
                    }
                }
                None if id.starts_with("deny-") => problems.push(format!(
                    "{}: {id}: deny-* is global in tauri 2.11 — it would deny the command for \
                     every window, not just this one; use allow-lists only",
                    f.name
                )),
                None if id.starts_with("allow-") => problems.push(format!(
                    "{}: {id} names no registered command (the identifier is allow-<command> \
                     with every `_` replaced by `-`)",
                    f.name
                )),
                None => problems.push(format!(
                    "{}: {id}: only allow-<command> app grants are permitted as bare identifiers",
                    f.name
                )),
            }
        }
    }

    for c in &seen {
        let id = allow_permission(c);
        let holders: Vec<&str> = files
            .iter()
            .filter(|f| f.bare.iter().any(|b| b == &id))
            .map(|f| f.name.as_str())
            .collect();
        match holders.len() {
            0 => problems.push(format!(
                "{c} is registered but no capability file grants {id}; add it to the file \
                 whose windows are {:?}",
                expected_windows(c)
            )),
            1 => {}
            _ => problems.push(format!(
                "{id} is granted in more than one capability file: {holders:?}"
            )),
        }
    }
    problems
}
```

- [ ] **Step 4: Run the tests to verify they pass**

Run: `cd /workspace/triple-c/app/src-tauri && cargo test --offline command_census 2>&1 | tail -5`
Expected: `test result: ok. 18 passed`.

- [ ] **Step 5: Make `every_command_is_registered_exactly_once` use the shared parser**

In `app/src-tauri/src/lib.rs`, replace the block that begins `// The registration list, read from this file rather than from a macro` and ends with the `.collect();` of `registered` (currently lines 847-870) with:

```rust
        // The registration list, read from this file by the same parser `build.rs` uses to
        // declare the AppManifest — so if this test can see a command, the ACL can too.
        let ordered = crate::command_census::registered_commands(include_str!("lib.rs"))
            .expect("lib.rs should contain a generate_handler! list");
        let registered: BTreeSet<String> = ordered.iter().cloned().collect();
```

and replace the duplicate loop (currently the `let mut seen … for line in handler … assert!(duplicated.is_empty(), …)` block, lines ~895-920) with:

```rust
        // "exactly once" was in this test's name and not in its body: both
        // sides were sets, so registering the same command twice in a
        // hand-maintained 118-line list compiled, warned about nothing, and
        // passed here.
        let mut seen: Vec<&str> = Vec::new();
        let mut duplicated: Vec<&str> = Vec::new();
        for name in &ordered {
            if seen.contains(&name.as_str()) {
                duplicated.push(name);
            } else {
                seen.push(name);
            }
        }
        assert!(
            duplicated.is_empty(),
            "these are registered more than once: {:?}",
            duplicated
        );
```

Delete the now-unused `let this = include_str!("lib.rs");` and `handler` bindings.

- [ ] **Step 6: Run the census tests and clippy**

Run: `cd /workspace/triple-c/app/src-tauri && cargo test --offline every_command_is_registered_exactly_once 2>&1 | tail -5 && cargo clippy --offline --all-targets 2>&1 | grep -E "^(warning|error)" | head`
Expected: `1 passed`; no new warnings.

- [ ] **Step 7: Commit**

```bash
cd /workspace/triple-c && git add app/src-tauri/src/command_census.rs app/src-tauri/src/lib.rs
git commit -m "refactor(acl): shared command census module for build.rs and tests

Moves the generate_handler! parser out of the lib.rs test into
src/command_census.rs and adds the capability rules (one allow-* grant per
command, in the file its name says, no deny-*) with unit tests. No
behaviour change yet: build.rs does not use it until the next commit.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>"
```

---

### Task 2: `build.rs` declares the AppManifest; both capability files grant; census tests updated

This is the atomic change. Do every step before running `cargo check`; until Step 5 the build fails by design.

**Files:**
- Modify: `app/src-tauri/build.rs` (whole file), `app/src-tauri/Cargo.toml` (`[build-dependencies]`), `app/src-tauri/capabilities/default.json` (`permissions`), `app/src-tauri/capabilities/file-viewer.json` (`permissions`), `app/src-tauri/src/lib.rs:924-975` (`the_capability_grants_are_the_ones_that_were_reviewed`), `app/src-tauri/src/file_viewer/mod.rs:63-82`, `.gitignore`
- Regenerated: `app/src-tauri/gen/schemas/*.json`, `app/src-tauri/Cargo.lock`

**Interfaces:**
- Consumes: `command_census::{registered_commands, allow_permission, expected_windows, capability_file, check}` (Task 1).
- Produces: `permissions/autogenerated/<cmd>.toml` (ignored), `gen/schemas/acl-manifests.json` with an `__app-acl__` key (Task 3 reads it), the bare grants in both capability files (Task 4 reads them).

- [ ] **Step 1: Update the two census tests to expect the grants (red)**

In `app/src-tauri/src/lib.rs`, replace the body of `the_capability_grants_are_the_ones_that_were_reviewed` from `let mut sorted = listed.clone();` through the `assert_eq!(sorted, expected, …);` with:

```rust
        // Plugin and core grants: the exact reviewed list, unchanged by the lockdown.
        let (bare, prefixed): (Vec<String>, Vec<String>) =
            listed.iter().cloned().partition(|g| !g.contains(':'));
        let mut sorted = prefixed;
        sorted.sort();
        let mut expected = vec![
            "core:event:allow-listen",
            "core:event:allow-unlisten",
            "core:webview:allow-internal-toggle-devtools",
            "dialog:allow-open",
            "dialog:allow-save",
        ];
        expected.sort();
        assert_eq!(
            sorted, expected,
            "the plugin/core capability set changed. That is allowed — but it is the IPC \
             surface a compromised webview can call, so update this list \
             deliberately rather than to make the test pass."
        );

        // App commands: since build.rs declares the AppManifest, the bare `allow-*` grants
        // are the complete list of app commands the main window may call. `build.rs` already
        // fails the build when they disagree with generate_handler!; this keeps the reviewed
        // rule ("every non-viewer command, exactly") visible where the plugin census lives.
        let registered = crate::command_census::registered_commands(include_str!("lib.rs"))
            .expect("lib.rs should contain a generate_handler! list");
        let mut expected_bare: Vec<String> = registered
            .iter()
            .filter(|c| crate::command_census::expected_windows(c) == ["main"])
            .map(|c| crate::command_census::allow_permission(c))
            .collect();
        expected_bare.sort();
        let mut bare = bare;
        bare.sort();
        assert_eq!(
            bare, expected_bare,
            "default.json's app-command grants must be exactly the main-window commands"
        );
        assert!(bare.len() >= 100, "the census found {} app grants; the parser has stopped seeing the list", bare.len());
```

Leave the `for grant in &listed { … :default … store: … }` loop as it is.

In `app/src-tauri/src/file_viewer/mod.rs`, replace the `assert_eq!(permissions, vec![ … ]);` in `the_viewer_capability_grants_exactly_the_reviewed_windows_and_permissions` with:

```rust
        assert_eq!(
            permissions,
            vec![
                // App commands (bare): the five viewer commands, and nothing else — build.rs
                // refuses any other bare grant in this file.
                "allow-viewer-choose-file",
                "allow-viewer-get-state",
                "allow-viewer-poll-file",
                "allow-viewer-read-file",
                "allow-viewer-write-file",
                // Plugin/core grants, unchanged.
                "core:event:allow-listen",
                "core:event:allow-unlisten",
                "core:webview:allow-internal-toggle-devtools",
                "core:window:allow-destroy",
            ]
        );
```

(Sorted order: `a` < `c`.)

- [ ] **Step 2: Run the two tests to verify they fail**

Run: `cd /workspace/triple-c/app/src-tauri && cargo test --offline the_capability_grants 2>&1 | grep -E "^test |panicked" | head`
Expected: both `the_capability_grants_are_the_ones_that_were_reviewed` and `the_viewer_capability_grants_exactly_the_reviewed_windows_and_permissions` FAIL on the `assert_eq!` (no bare grants yet).

- [ ] **Step 3: Add `serde_json` to the build script and write `build.rs`**

`app/src-tauri/Cargo.toml`, `[build-dependencies]`:

```toml
[build-dependencies]
tauri-build = { version = "2", features = [] }
# build.rs reads capabilities/*.json to cross-check them against generate_handler!.
serde_json = "1"
```

Replace `app/src-tauri/build.rs` entirely:

```rust
//! Declares the Tauri `AppManifest`, so every app command is ACL-gated per window, and refuses
//! to build unless every registered command is granted in exactly one capability file — the
//! file whose `windows` the command's name says it belongs to. Without an app manifest, tauri
//! 2.11 skips the ACL for app commands entirely (`webview/mod.rs:1794`), so any local window
//! could call any command.
//!
//! The parser and the rules live in `src/command_census.rs`, which `cargo test` also compiles,
//! so they have unit tests. Spec: `docs/superpowers/specs/2026-09-22-app-manifest-lockdown-design.md`.

#[path = "src/command_census.rs"]
mod command_census;

use std::path::Path;

fn fail(problems: &[String]) -> ! {
    eprintln!();
    eprintln!(
        "capabilities do not match generate_handler! ({} problem{}):",
        problems.len(),
        if problems.len() == 1 { "" } else { "s" }
    );
    for p in problems {
        eprintln!("  - {p}");
    }
    eprintln!();
    eprintln!(
        "Every app command needs exactly one bare `allow-<command-with-dashes>` grant: \
         `viewer_*` commands in capabilities/file-viewer.json, everything else in \
         capabilities/default.json. See src/command_census.rs."
    );
    eprintln!();
    std::process::exit(1);
}

fn main() {
    // tauri-build already emits rerun-if-changed for `capabilities` and `permissions`.
    println!("cargo:rerun-if-changed=src/lib.rs");
    println!("cargo:rerun-if-changed=src/command_census.rs");

    let lib_rs = std::fs::read_to_string("src/lib.rs")
        .expect("build.rs runs with CWD = src-tauri, so src/lib.rs must be readable");
    let Some(commands) = command_census::registered_commands(&lib_rs) else {
        fail(&["src/lib.rs has no `generate_handler![ … ])` block to derive the AppManifest from"
            .to_string()]);
    };

    let mut files = Vec::new();
    for entry in std::fs::read_dir("capabilities").expect("capabilities/ must exist") {
        let path = entry.expect("readable entry in capabilities/").path();
        if path.extension().is_some_and(|e| e == "json") {
            let name = path
                .file_name()
                .expect("a file name")
                .to_string_lossy()
                .into_owned();
            let json =
                std::fs::read_to_string(&path).unwrap_or_else(|e| panic!("{name}: {e}"));
            match command_census::capability_file(&name, &json) {
                Ok(file) => files.push(file),
                Err(problem) => fail(&[problem]),
            }
        }
    }
    files.sort_by(|a, b| a.name.cmp(&b.name));

    let problems = command_census::check(&commands, &files);
    if !problems.is_empty() {
        fail(&problems);
    }

    prune_permissions(&commands);

    // `AppManifest::commands` takes `&'static [&'static str]` and the struct is `Copy`, so
    // there is no owned form; leaking is fine in a process that exits right after.
    let leaked: Vec<&'static str> = commands
        .into_iter()
        .map(|c| &*Box::leak(c.into_boxed_str()))
        .collect();
    let leaked: &'static [&'static str] = Box::leak(leaked.into_boxed_slice());
    let attributes = tauri_build::Attributes::new()
        .app_manifest(tauri_build::AppManifest::new().commands(leaked));
    if let Err(error) = tauri_build::try_build(attributes) {
        // Same shape as `tauri_build::build()`: message on stdout, then exit 1.
        println!("{error:#}");
        std::process::exit(1);
    }
}

/// tauri-build writes `permissions/autogenerated/<command>.toml` for every manifest command
/// and never deletes one, so a command removed from `lib.rs` would leave a permission a
/// capability could still reference (and the build would pass). Delete only the stale files:
/// tauri-build also emits `rerun-if-changed=permissions`, so regenerating everything would
/// touch every mtime and re-run this script — and recompile the crate — on every cargo
/// invocation. Anything else under `permissions/` is a hand-written grant the census cannot
/// see, so it is refused.
fn prune_permissions(commands: &[String]) {
    let root = Path::new("permissions");
    let Ok(entries) = std::fs::read_dir(root) else {
        return;
    };
    for entry in entries {
        let path = entry.expect("readable entry in permissions/").path();
        if path.file_name().is_some_and(|n| n == "autogenerated") && path.is_dir() {
            for file in std::fs::read_dir(&path).expect("readable permissions/autogenerated") {
                let file = file.expect("readable entry").path();
                let stem = file.file_stem().and_then(|s| s.to_str()).unwrap_or("");
                let live = file.extension().is_some_and(|e| e == "toml")
                    && commands.iter().any(|c| c == stem);
                if !live {
                    std::fs::remove_file(&file)
                        .unwrap_or_else(|e| panic!("cannot delete stale {}: {e}", file.display()));
                }
            }
        } else {
            fail(&[format!(
                "{} is not generated by build.rs; hand-written permissions are not allowed \
                 (every grant is a bare allow-* string in a capability file)",
                path.display()
            )]);
        }
    }
}
```

Add to `.gitignore` (after `app/src-tauri/target/`):

```
# Written by build.rs (tauri-build AppManifest); gen/schemas/acl-manifests.json is the
# tracked, reviewable form of the same information.
app/src-tauri/permissions/autogenerated/
```

- [ ] **Step 4: Add the grants to both capability files**

`app/src-tauri/capabilities/file-viewer.json` — `permissions` becomes:

```json
  "permissions": [
    "core:event:allow-listen",
    "core:event:allow-unlisten",
    "core:window:allow-destroy",
    "core:webview:allow-internal-toggle-devtools",
    "allow-viewer-get-state",
    "allow-viewer-choose-file",
    "allow-viewer-read-file",
    "allow-viewer-poll-file",
    "allow-viewer-write-file"
  ]
```

`app/src-tauri/capabilities/default.json` — `permissions` becomes the five existing grants followed by the 110 main-window commands in `generate_handler!` order (grouped like `lib.rs`; the build check does not care about order, reviewers do):

```json
  "permissions": [
    "core:event:allow-listen",
    "core:event:allow-unlisten",
    "core:webview:allow-internal-toggle-devtools",
    "dialog:allow-open",
    "dialog:allow-save",
    "allow-check-docker",
    "allow-check-image-exists",
    "allow-build-image",
    "allow-get-container-info",
    "allow-list-projects",
    "allow-add-project",
    "allow-remove-project",
    "allow-update-project",
    "allow-start-project-container",
    "allow-stop-project-container",
    "allow-rebuild-project-container",
    "allow-reconcile-project-statuses",
    "allow-list-notes",
    "allow-save-note",
    "allow-delete-note",
    "allow-get-container-staleness",
    "allow-migrate-project-to-base",
    "allow-confirm-migration",
    "allow-rollback-migration",
    "allow-get-migration-state",
    "allow-set-auth-bridge-enabled",
    "allow-get-auth-bridge-status",
    "allow-set-browser-view-enabled",
    "allow-get-browser-view-status",
    "allow-check-browser-view-support",
    "allow-install-browser-view-support",
    "allow-install-browser-view-browser",
    "allow-open-browser-view-popout",
    "allow-close-browser-view-popout",
    "allow-get-browser-view-popout-state",
    "allow-set-browser-view-popout-always-on-top",
    "allow-open-page-in-container-browser",
    "allow-set-container-page-viewport",
    "allow-get-container-page-state",
    "allow-close-container-page",
    "allow-set-browser-view-match-window",
    "allow-get-browser-view-match-window",
    "allow-acquire-claude-token",
    "allow-submit-claude-token-code",
    "allow-cancel-claude-token",
    "allow-has-claude-token",
    "allow-clear-claude-token",
    "allow-sweep-claude-token-snapshots",
    "allow-get-settings",
    "allow-update-settings",
    "allow-pull-image",
    "allow-detect-aws-config",
    "allow-inspect-ca-cert-path",
    "allow-list-aws-profiles",
    "allow-detect-host-timezone",
    "allow-export-settings",
    "allow-preview-settings-import",
    "allow-apply-settings-import",
    "allow-open-terminal-session",
    "allow-terminal-input",
    "allow-terminal-resize",
    "allow-close-terminal-session",
    "allow-paste-image-to-terminal",
    "allow-upload-host-file-to-terminal",
    "allow-start-audio-bridge",
    "allow-send-audio-data",
    "allow-stop-audio-bridge",
    "allow-list-container-files",
    "allow-download-container-backup",
    "allow-download-container-file",
    "allow-upload-files-to-container",
    "allow-read-container-file",
    "allow-rename-container-path",
    "allow-create-container-directory",
    "allow-open-file-viewer",
    "allow-aws-sso-refresh",
    "allow-get-app-version",
    "allow-check-for-updates",
    "allow-check-image-update",
    "allow-get-help-content",
    "allow-open-url-external",
    "allow-detect-install-options",
    "allow-run-docker-install",
    "allow-start-web-terminal",
    "allow-stop-web-terminal",
    "allow-get-web-terminal-status",
    "allow-regenerate-web-terminal-token",
    "allow-get-stt-status",
    "allow-start-stt",
    "allow-stop-stt",
    "allow-build-stt-image",
    "allow-pull-stt-image",
    "allow-transcribe-audio",
    "allow-get-gateway-status",
    "allow-start-gateway",
    "allow-stop-gateway",
    "allow-check-gateway-health",
    "allow-build-gateway-image",
    "allow-pull-gateway-image",
    "allow-set-gateway-api-key",
    "allow-clear-gateway-api-key",
    "allow-get-gateway-auth-token",
    "allow-regenerate-gateway-auth-token",
    "allow-list-claude-sessions",
    "allow-resume-session-command",
    "allow-list-container-capabilities",
    "allow-list-scheduled-tasks",
    "allow-add-scheduled-task",
    "allow-update-scheduled-task",
    "allow-get-scheduled-task-log",
    "allow-set-scheduled-task-enabled",
    "allow-run-scheduled-task-now",
    "allow-remove-scheduled-task",
    "allow-get-scheduler-notifications",
    "allow-clear-scheduler-notifications"
  ]
```

Do not trust the list above blindly — the build check is the authority. If `cargo check` in Step 5 reports a missing or unknown grant, the handler list has moved since this plan was written; fix the JSON to match `lib.rs`, not the other way round. This one-liner prints what the list must contain:

```bash
cd /workspace/triple-c/app/src-tauri && awk '/generate_handler!\[/,/^        \]\)/' src/lib.rs | grep -v '^\s*//' | grep '::' | sed 's/,$//; s/.*:://' | grep -v '^viewer_' | sed 's/_/-/g; s/^/    "allow-/; s/$/",/'
```

- [ ] **Step 5: Build, and confirm the manifest was embedded**

Run: `cd /workspace/triple-c/app/src-tauri && cargo check --offline 2>&1 | tail -3`
Expected: `Finished` (the first run compiles the build script with `serde_json`; a second `cargo check --offline` may re-run the script once because the `.toml` files are new, then it settles — run it a third time and confirm it prints only `Finished` with no `Compiling`).

Then:

```bash
cd /workspace/triple-c/app/src-tauri && ls permissions/autogenerated | wc -l   # 115
python3 -c "import json; m=json.load(open('gen/schemas/acl-manifests.json'))['__app-acl__']; print(len(m['permissions']), sorted(m['permissions'])[:3])"   # 230 ['allow-acquire-claude-token', 'allow-add-project', 'allow-add-scheduled-task']
python3 -c "import json; c=json.load(open('gen/schemas/capabilities.json')); print(len([p for p in c['default']['permissions'] if ':' not in p]), len([p for p in c['file-viewer']['permissions'] if ':' not in p]))"   # 110 5
git status --short   # M build.rs, Cargo.toml, Cargo.lock, capabilities/*.json, gen/schemas/*.json, src/lib.rs, src/file_viewer/mod.rs, .gitignore — and NOT permissions/
```

- [ ] **Step 6: Run the census tests to verify they pass**

Run: `cd /workspace/triple-c/app/src-tauri && cargo test --offline capability 2>&1 | grep -E "^test |test result"`
Expected: `the_capability_grants_are_the_ones_that_were_reviewed … ok`, `the_viewer_capability_grants_exactly_the_reviewed_windows_and_permissions … ok`, `the_default_capability_is_scoped_to_the_main_window_only … ok`.

- [ ] **Step 7: Prove the build check bites (then restore)**

Each of these must fail `cargo check --offline` with the message shown; restore the file after each (`git checkout -- capabilities/default.json` etc.):

```bash
cd /workspace/triple-c/app/src-tauri
# (a) forgotten grant
sed -i '/"allow-check-docker",/d' capabilities/default.json && cargo check --offline 2>&1 | grep -A3 "problem"; git checkout -- capabilities/default.json
#   expect: "check_docker is registered but no capability file grants allow-check-docker; add it to the file whose windows are [\"main\"]"
# (b) typo
sed -i 's/"allow-check-docker"/"allow-check-dokcer"/' capabilities/default.json && cargo check --offline 2>&1 | grep -A4 "problem"; git checkout -- capabilities/default.json
#   expect two problems: the typo "names no registered command" and check_docker "no capability file grants"
# (c) deny
sed -i 's/"allow-viewer-write-file"/"allow-viewer-write-file",\n    "deny-check-docker"/' capabilities/file-viewer.json && cargo check --offline 2>&1 | grep -A3 "problem"; git checkout -- capabilities/file-viewer.json
#   expect: "file-viewer.json: deny-check-docker: deny-* is global in tauri 2.11 …"
# (d) wrong file
sed -i '/"allow-viewer-read-file",/d' capabilities/file-viewer.json && sed -i 's/"allow-check-docker",/"allow-check-docker",\n    "allow-viewer-read-file",/' capabilities/default.json && cargo check --offline 2>&1 | grep -A3 "problem"; git checkout -- capabilities/
#   expect: "default.json: allow-viewer-read-file must be granted in the capability file whose windows are [\"file-viewer-*\"], not [\"main\"]"
# (f) empty parse → must not build an unguarded app
sed -i 's/let (inside, _) = rest.split_once("])")?;/let (inside, _) = rest.split_once("])")?; let inside = "";/' src/command_census.rs && grep -c 'let inside = "";' src/command_census.rs && cargo check --offline 2>&1 | grep -A2 "problem"; git checkout -- src/command_census.rs
#   expect: "no commands were parsed out of generate_handler! …"
# stale-file pruning
touch permissions/autogenerated/zzz_removed.toml && cargo check --offline >/dev/null 2>&1; ls permissions/autogenerated/zzz_removed.toml 2>&1
#   expect: "No such file or directory"
# hand-written permission refused
mkdir -p permissions/extra && echo '[[permission]]' > permissions/extra/x.toml && cargo check --offline 2>&1 | grep "hand-written"; rm -r permissions/extra
#   expect: "permissions/extra is not generated by build.rs; hand-written permissions are not allowed …"
cargo check --offline 2>&1 | tail -1   # Finished — the tree is back to green
git status --short                      # same list as Step 5, nothing else
```

- [ ] **Step 8: Commit (one commit, all of it)**

```bash
cd /workspace/triple-c && git add .gitignore app/src-tauri/build.rs app/src-tauri/Cargo.toml app/src-tauri/Cargo.lock app/src-tauri/capabilities/default.json app/src-tauri/capabilities/file-viewer.json app/src-tauri/src/lib.rs app/src-tauri/src/file_viewer/mod.rs app/src-tauri/gen/schemas
git commit -m "feat(acl): gate every app command per window via a Tauri AppManifest

build.rs now derives an AppManifest from generate_handler!, which makes
tauri 2.11 apply the ACL to app commands (it skips them entirely without
one). default.json grants the 110 main-window commands, file-viewer.json
the five viewer_* commands, and build.rs refuses to build on a missing,
misspelled, duplicated, misfiled or deny-* grant, or on a hand-written
permission file. Stale autogenerated permissions are pruned per build.

Closes the residual risk recorded by the terminal file viewer: a
compromised viewer window could invoke any app command.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>"
```

---

### Task 3: End-to-end test — the embedded manifest equals the handler list

**Files:**
- Modify: `app/src-tauri/src/lib.rs` (append a test after `the_capability_grants_are_the_ones_that_were_reviewed`)

**Interfaces:**
- Consumes: `gen/schemas/acl-manifests.json` written by `build.rs` (Task 2); `crate::command_census::{registered_commands, allow_permission}`.

- [ ] **Step 1: Write the test**

```rust
    /// `build.rs` derives the AppManifest from the handler list and this reads back what
    /// tauri-build actually embedded. `cargo test` runs the build script first, so
    /// `gen/schemas/acl-manifests.json` is fresh. Independent of the shared parser: if
    /// `registered_commands` ever lost half the list, `build.rs` would declare half a
    /// manifest and this would still compare it against… the same half. So the count is
    /// pinned too, from a source that is not the parser: the `#[tauri::command]` scan in
    /// `every_command_is_registered_exactly_once` guarantees definitions == registrations,
    /// and here the embedded set must match the number of registrations that scan found.
    #[test]
    fn the_generated_app_manifest_matches_the_handler_list() {
        use std::collections::BTreeSet;

        let path = concat!(env!("CARGO_MANIFEST_DIR"), "/gen/schemas/acl-manifests.json");
        let raw = std::fs::read_to_string(path)
            .expect("gen/schemas/acl-manifests.json is written by build.rs on every build");
        let manifests: serde_json::Value =
            serde_json::from_str(&raw).expect("acl-manifests.json must parse");
        let app = manifests.get("__app-acl__").expect(
            "build.rs must declare an AppManifest — without it tauri skips the ACL for every \
             app command",
        );
        let embedded: BTreeSet<String> = app["permissions"]
            .as_object()
            .expect("the app manifest has a permissions map")
            .keys()
            .cloned()
            .collect();

        let registered = crate::command_census::registered_commands(include_str!("lib.rs"))
            .expect("lib.rs should contain a generate_handler! list");
        let expected: BTreeSet<String> = registered
            .iter()
            .flat_map(|c| {
                let allow = crate::command_census::allow_permission(c);
                let deny = format!("deny-{}", &allow["allow-".len()..]);
                [allow, deny]
            })
            .collect();

        assert!(registered.len() >= 100, "the parser sees {} commands", registered.len());
        assert_eq!(
            embedded, expected,
            "the embedded app manifest and generate_handler! disagree: build.rs and \
             tauri-build should have produced the same list"
        );
        assert!(
            app["permission_sets"].as_object().is_some_and(|s| s.is_empty()),
            "no permission sets: every grant is a literal allow-* string in a capability file"
        );
        assert!(app["default_permission"].is_null(), "no app `default` permission set");
    }
```

If the last two assertions do not match the file's actual shape (check with `python3 -c "import json; m=json.load(open('gen/schemas/acl-manifests.json'))['__app-acl__']; print({k: type(v).__name__ for k, v in m.items()})"`), adjust them to assert the equivalent "empty / absent" condition for the shape that is there; do not drop them.

- [ ] **Step 2: Run it**

Run: `cd /workspace/triple-c/app/src-tauri && cargo test --offline the_generated_app_manifest 2>&1 | grep -E "^test |test result"`
Expected: `ok. 1 passed`.

- [ ] **Step 3: Verify it fails when the manifest is stale**

```bash
cd /workspace/triple-c/app/src-tauri
python3 - <<'EOF'
import json; p='gen/schemas/acl-manifests.json'; m=json.load(open(p)); del m['__app-acl__']['permissions']['allow-check-docker']; json.dump(m, open(p,'w'))
EOF
cargo test --offline the_generated_app_manifest 2>&1 | grep -E "^test |disagree" | head -3
```
Expected: FAILED, message contains `disagree`. Then `cargo check --offline` (rewrites the file) and `git status --short app/src-tauri/gen` must show it clean again.

- [ ] **Step 4: Commit**

```bash
cd /workspace/triple-c && git add app/src-tauri/src/lib.rs
git commit -m "test(acl): the embedded app manifest equals generate_handler!

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>"
```

---

### Task 4: Vitest — each window's code reaches only the wrappers it is granted

**Files:**
- Create: `app/src/test/capabilities.test.ts`

**Interfaces:**
- Consumes: `app/src-tauri/capabilities/{default,file-viewer}.json` with bare grants (Task 2); `app/src/lib/tauri-commands.ts` (`export const NAME = … invoke<T>("cmd", …)`, one literal per wrapper); `app/src/viewer/main.tsx` as the viewer entry.

- [ ] **Step 1: Write the test**

```ts
import { describe, it, expect } from "vitest";
import { existsSync, readdirSync, readFileSync, statSync } from "fs";
import { dirname, join, relative, resolve } from "path";

/**
 * The capability files are the IPC ACL. Since the AppManifest lockdown, a window can only
 * invoke the app commands its file grants; `build.rs` proves every command is granted in the
 * file its name says it belongs to. This proves the other half: the code that *runs* in each
 * window imports only wrappers that window is granted. A wrapper imported on the wrong side
 * fails here, not with `Command … not allowed by ACL` in a release build.
 *
 * It works on imports rather than `invoke(` literals because the viewer never calls invoke:
 * everything goes through `lib/tauri-commands.ts`, which is the only file allowed to import
 * `@tauri-apps/api/core` (that rule is what makes this test complete).
 */
const srcDir = resolve(__dirname, "..");
const capDir = resolve(srcDir, "../src-tauri/capabilities");
const WRAPPERS = resolve(srcDir, "lib/tauri-commands.ts");
const VIEWER_ENTRY = resolve(srcDir, "viewer/main.tsx");

const toPermission = (command: string) => `allow-${command.replace(/_/g, "-")}`;

function readCapability(file: string) {
  const cap = JSON.parse(readFileSync(resolve(capDir, file), "utf-8")) as {
    windows: string[];
    permissions: (string | { identifier: string })[];
  };
  const ids = cap.permissions.map((p) => (typeof p === "string" ? p : p.identifier));
  return {
    windows: cap.windows,
    bare: ids.filter((id) => !id.includes(":")).sort(),
    prefixed: ids.filter((id) => id.includes(":")).sort(),
  };
}

/** Every non-test .ts/.tsx under src/, excluding src/test. */
function sourceFiles(dir: string, out: string[] = []): string[] {
  for (const name of readdirSync(dir)) {
    const path = join(dir, name);
    if (statSync(path).isDirectory()) {
      if (name !== "test") sourceFiles(path, out);
    } else if (/\.tsx?$/.test(name) && !/\.test\.tsx?$/.test(name) && !name.endsWith(".d.ts")) {
      out.push(path);
    }
  }
  return out;
}

/** `export const NAME = … invoke<T>("command"` → NAME → command. Exactly one literal per wrapper. */
function wrapperCommands(): Map<string, string> {
  const text = readFileSync(WRAPPERS, "utf-8");
  const [head, ...chunks] = text.split(/^export const /m);
  expect(head.match(/\binvoke(?:<[^>]*>)?\(/g) ?? [], "invoke calls outside an export const wrapper").toHaveLength(0);
  const map = new Map<string, string>();
  for (const chunk of chunks) {
    const name = /^(\w+)/.exec(chunk)?.[1] ?? "";
    const calls = chunk.match(/\binvoke(?:<[^>]*>)?\(/g) ?? [];
    const literals = [...chunk.matchAll(/\binvoke(?:<[^>]*>)?\(\s*"([a-z_]+)"/g)].map((m) => m[1]);
    expect(calls, `${name} must call invoke exactly once`).toHaveLength(1);
    expect(literals, `${name} must invoke a string literal (a computed name cannot be audited)`).toHaveLength(1);
    map.set(name, literals[0]);
  }
  expect(map.size).toBeGreaterThan(100);
  return map;
}

function resolveRelativeImport(from: string, spec: string): string | null {
  if (!spec.startsWith(".")) return null; // a package
  const base = resolve(dirname(from), spec);
  if (/\.(css|svg|png|json)$/.test(base)) return null;
  for (const candidate of [base, `${base}.ts`, `${base}.tsx`, join(base, "index.ts"), join(base, "index.tsx")]) {
    if (existsSync(candidate) && statSync(candidate).isFile()) return candidate;
  }
  throw new Error(`${relative(srcDir, from)}: cannot resolve import "${spec}"`);
}

const IMPORT_SPEC = /^import\b[^;]*?\bfrom\s*["']([^"']+)["']|^import\s*["']([^"']+)["']/gm;
const WRAPPER_IMPORT = /import\s*(?:type\s*)?\{([^}]*)\}\s*from\s*["'][^"']*\/lib\/tauri-commands["']/g;

function importSpecs(file: string): string[] {
  const text = readFileSync(file, "utf-8");
  return [...text.matchAll(IMPORT_SPEC)].map((m) => m[1] ?? m[2]);
}

function wrapperNamesImportedBy(file: string): string[] {
  const text = readFileSync(file, "utf-8");
  return [...text.matchAll(WRAPPER_IMPORT)].flatMap((m) =>
    m[1]
      .split(",")
      .map((s) => s.trim().replace(/^type\s+/, "").split(/\s+as\s+/)[0].trim())
      .filter((s) => s.length > 0),
  );
}

/** Transitive relative-import closure from the viewer entry. */
function viewerClosure(): Set<string> {
  const seen = new Set<string>();
  const queue = [VIEWER_ENTRY];
  while (queue.length > 0) {
    const file = queue.pop()!;
    if (seen.has(file)) continue;
    seen.add(file);
    for (const spec of importSpecs(file)) {
      const target = resolveRelativeImport(file, spec);
      if (target && !seen.has(target)) queue.push(target);
    }
  }
  return seen;
}

describe("capability files match the code each window runs", () => {
  const defaultCap = readCapability("default.json");
  const viewerCap = readCapability("file-viewer.json");
  const files = sourceFiles(srcDir);

  it("only lib/tauri-commands.ts imports @tauri-apps/api/core", () => {
    const offenders = files
      .filter((f) => f !== WRAPPERS)
      .filter((f) => /from\s*["']@tauri-apps\/api\/core["']/.test(readFileSync(f, "utf-8")))
      .map((f) => relative(srcDir, f));
    expect(offenders).toEqual([]);
  });

  it("the windows lists are the reviewed ones", () => {
    expect(defaultCap.windows).toEqual(["main"]);
    expect(viewerCap.windows).toEqual(["file-viewer-*"]);
  });

  it("the plugin/core grants are the reviewed ones", () => {
    expect(defaultCap.prefixed).toEqual([
      "core:event:allow-listen",
      "core:event:allow-unlisten",
      "core:webview:allow-internal-toggle-devtools",
      "dialog:allow-open",
      "dialog:allow-save",
    ]);
    expect(viewerCap.prefixed).toEqual([
      "core:event:allow-listen",
      "core:event:allow-unlisten",
      "core:webview:allow-internal-toggle-devtools",
      "core:window:allow-destroy",
    ]);
  });

  it("the viewer window imports exactly the wrappers file-viewer.json grants", () => {
    const wrappers = wrapperCommands();
    const closure = viewerClosure();
    expect(closure.has(WRAPPERS), "the viewer reaches tauri-commands.ts").toBe(true);
    const viewerCommands = new Set<string>();
    for (const file of closure) {
      for (const name of wrapperNamesImportedBy(file)) {
        const command = wrappers.get(name);
        expect(command, `${relative(srcDir, file)} imports unknown wrapper ${name}`).toBeDefined();
        viewerCommands.add(command!);
      }
    }
    const granted = [...viewerCommands].map(toPermission).sort();
    expect(granted).toEqual(viewerCap.bare);
  });

  it("the main window imports only wrappers default.json grants, and none of the viewer's", () => {
    const wrappers = wrapperCommands();
    const closure = viewerClosure();
    const mainCommands = new Set<string>();
    for (const file of files) {
      if (closure.has(file)) continue;
      for (const name of wrapperNamesImportedBy(file)) {
        const command = wrappers.get(name);
        expect(command, `${relative(srcDir, file)} imports unknown wrapper ${name}`).toBeDefined();
        mainCommands.add(command!);
      }
    }
    expect(mainCommands.size).toBeGreaterThan(50);
    const ungranted = [...mainCommands].map(toPermission).filter((p) => !defaultCap.bare.includes(p)).sort();
    expect(ungranted, "main-window code imports wrappers default.json does not grant").toEqual([]);
    const crossed = [...mainCommands].filter((c) => viewerCap.bare.includes(toPermission(c))).sort();
    expect(crossed, "main-window code imports viewer-only wrappers").toEqual([]);
  });

  it("every wrapper's command is granted in exactly one capability file", () => {
    const wrappers = wrapperCommands();
    const both: string[] = [];
    const neither: string[] = [];
    for (const command of new Set(wrappers.values())) {
      const p = toPermission(command);
      const inDefault = defaultCap.bare.includes(p);
      const inViewer = viewerCap.bare.includes(p);
      if (inDefault && inViewer) both.push(command);
      if (!inDefault && !inViewer) neither.push(command);
    }
    expect(both).toEqual([]);
    expect(neither, "granted nowhere — cargo check would fail too, but you may not have run it").toEqual([]);
  });
});
```

- [ ] **Step 2: Run it**

Run: `cd /workspace/triple-c/app && npx vitest run src/test/capabilities.test.ts 2>&1 | tail -15`
Expected: 6 passed. If `resolveRelativeImport` throws on a path alias or an extension not listed, add the extension to the candidate list — do not swallow the error.

- [ ] **Step 3: Verify it fails on a wrapper crossing sides (then restore)**

```bash
cd /workspace/triple-c/app
sed -i 's/import { viewerChooseFile, viewerGetState } from "..\/lib\/tauri-commands";/import { listProjects, viewerChooseFile, viewerGetState } from "..\/lib\/tauri-commands";/' src/viewer/ViewerApp.tsx
npx vitest run src/test/capabilities.test.ts 2>&1 | grep -E "✓|×|FAIL|expected" | head
git checkout -- src/viewer/ViewerApp.tsx
```
Expected: "the viewer window imports exactly the wrappers file-viewer.json grants" FAILS (the granted list gains `allow-list-projects`). If `listProjects` is not the wrapper's name, pick any wrapper from `tauri-commands.ts` that invokes a main-window command.

- [ ] **Step 4: Run the whole frontend suite and tsc**

Run: `cd /workspace/triple-c/app && npm run test 2>&1 | grep -E "Test Files|Tests " && npx tsc --noEmit && echo tsc-ok`
Expected: all files pass (previous count + 1 file, + 6 tests); `tsc-ok`.

- [ ] **Step 5: Commit**

```bash
cd /workspace/triple-c && git add app/src/test/capabilities.test.ts
git commit -m "test(acl): each window's code imports only the wrappers it is granted

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>"
```

---

### Task 5: Documentation — the threat model of record says the risk is closed

**Files:**
- Modify: `app/src-tauri/capabilities/default.json` (`description` only), `app/src-tauri/capabilities/file-viewer.json` (`description` only), `CLAUDE.md:179-180` and `:598-600`, `app/src-tauri/src/file_viewer/mod.rs:1-5` (module doc)

**Interfaces:**
- Consumes: the behaviour delivered by Task 2. No code.

- [ ] **Step 1: `default.json` description**

Two edits inside the `description` string (it is one long JSON string; keep it valid JSON — escape nothing new, the text below contains no `"`):

(a) Replace `verified against tauri 2.11.0's \`PLUGINS\` table in \`build.rs\`, not assumed from a plugin's \`default\` set` with:

```
plugin and core grants verified against tauri 2.11.0's `PLUGINS` table in tauri's own `build.rs` rather than assumed from a plugin's `default` set, app-command grants (the bare `allow-*` entries) cross-checked by this crate's `build.rs` against `generate_handler!`
```

(b) Replace the sentence run from `App commands stay ungated by capability in both files` through `not yet built.` with:

```
App commands are gated by this file too. `build.rs` declares a Tauri `AppManifest` listing every command in `generate_handler!`, which is what makes tauri 2.11.0 apply the ACL to app commands at all (`webview/mod.rs:1794` skips it when no app manifest exists), and the bare `allow-<command>` entries below are the complete list of app commands the main window may call. `build.rs` refuses to build unless every registered command has exactly one such grant, in the file whose `windows` its name says it belongs to (`viewer_*` in `file-viewer.json`, everything else here), and unless every bare entry names a registered command — so a forgotten, misspelled, duplicated or misfiled grant is a failed `cargo check`, not a feature that dies at runtime with `not allowed by ACL`. `deny-*` is banned by the same check: in tauri 2.11.0 a deny matches regardless of window or origin, so a deny meant for the viewer would deny main too. Hand-written files under `permissions/` are refused for the same reason — they would be grants this census cannot see. The pop-out stays capability-less. The Rust label gates in `commands/file_viewer_commands.rs` remain, because the ACL says *which* window may call a command and the label says *whose* registry entry it acts on; they are not redundant. The rules live in `src/command_census.rs`, which is unit-tested, and `src/test/capabilities.test.ts` checks the other direction: that the code that runs in each window imports only the wrappers that window is granted.
```

- [ ] **Step 2: `file-viewer.json` description**

Replace `Same rules as \`default.json\`: app commands need no entry here and are gated by label inside \`commands/file_viewer_commands.rs\`; this file is the plugin-command surface a compromised viewer webview could reach, and it is the smallest one that lets the window work.` with:

```
Same rules as `default.json`. The five bare `allow-viewer-*` grants are the only app commands a viewer window can invoke: `build.rs` declares the AppManifest that makes tauri enforce that, and refuses any other bare grant in this file. The label gate inside `commands/file_viewer_commands.rs` is still what stops window A acting on window B's registry entry, because the ACL only decides which window may call. The rest of this file is the plugin-command surface a compromised viewer webview could reach, and it is the smallest one that lets the window work.
```

- [ ] **Step 3: `CLAUDE.md`**

Replace the Key Conventions bullet (lines 598-600):

```markdown
- `capabilities/default.json` grants permissions for **plugin** commands only (`core:`, `dialog:`,
  `store:`, `opener:`). Application commands registered through `generate_handler!` do **not**
  need an entry there — adding one is not required and none exists for any app command.
```

with:

```markdown
- **A new command needs three things:** `#[tauri::command]`, a `generate_handler!` entry in
  `lib.rs`, and a bare `allow-<name-with-dashes>` entry in the one capability file for the
  window that calls it — `viewer_*` commands in `capabilities/file-viewer.json`, everything else
  in `capabilities/default.json`. `build.rs` declares a Tauri `AppManifest` from the handler list
  (without one, tauri 2.11 does not apply the ACL to app commands at all) and fails `cargo
  check`/`tauri build` on a missing, misspelled, duplicated or misfiled grant, a `deny-*`, or a
  hand-written file under `permissions/`. `src/test/capabilities.test.ts` fails if code that runs
  in a window imports a `tauri-commands.ts` wrapper that window is not granted. Only `_` becomes
  `-` in the identifier; `permissions/autogenerated/` is generated and ignored, and
  `gen/schemas/*.json` is regenerated by every build and committed.
```

In Backend Structure, replace the end of the `file_viewer/` bullet (lines 179-180):

```markdown
  viewer command accepts a path. The residual risk that any local window can call any app command
  is deliberate and documented; the AppManifest lockdown spec closes it.
```

with:

```markdown
  viewer command accepts a path. Which window may *call* each command is the ACL's job: the
  `file-viewer-*` capability grants exactly the five `viewer_*` commands (see `build.rs`).
- **`build.rs` + `src/command_census.rs`** — the build declares a Tauri `AppManifest` from the
  `generate_handler!` list and refuses to build unless every command has exactly one bare
  `allow-*` grant in the capability file its name says it belongs to. The parser and rules are
  in `command_census.rs`, compiled into both the build script and the test build, so they are
  unit-tested; `the_generated_app_manifest_matches_the_handler_list` reads back what tauri
  embedded. Design: `docs/superpowers/specs/2026-09-22-app-manifest-lockdown-design.md`.
```

- [ ] **Step 4: `file_viewer/mod.rs` module doc**

After the line `//! the caller's own entry, which is why nothing here takes a path from a window.` add:

```rust
//!
//! `file-viewer-*` is also the `windows` glob of `capabilities/file-viewer.json`, which grants
//! exactly the five `viewer_*` commands and nothing else. Labels are minted only here; a window
//! created anywhere else with a matching label would inherit those grants.
```

- [ ] **Step 5: Verify**

Run: `cd /workspace/triple-c/app/src-tauri && cargo test --offline capability 2>&1 | grep "test result" && cd ../ && npx vitest run src/test/capabilities.test.ts 2>&1 | grep -E "Tests " && grep -c "do \*\*not\*\* need an entry" /workspace/triple-c/CLAUDE.md`
Expected: Rust `ok`, vitest `6 passed` (both files still parse), grep prints `0`.

- [ ] **Step 6: Commit**

```bash
cd /workspace/triple-c && git add app/src-tauri/capabilities/default.json app/src-tauri/capabilities/file-viewer.json CLAUDE.md app/src-tauri/src/file_viewer/mod.rs
git commit -m "docs(acl): threat model and conventions say app commands are ACL-gated

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>"
```

---

### Task 6: Full verification and hand-off

**Files:** none modified (unless something fails).

- [ ] **Step 1: The complete automated set**

```bash
cd /workspace/triple-c/app/src-tauri && cargo test --offline 2>&1 | grep -E "test result|FAILED|panicked"
cd /workspace/triple-c/app/src-tauri && cargo clippy --offline --all-targets 2>&1 | grep -cE "^(warning|error)"
cd /workspace/triple-c/app && npm run test 2>&1 | grep -E "Test Files|Tests "
cd /workspace/triple-c/app && npx tsc --noEmit && echo tsc-ok
cd /workspace/triple-c/app && npm run build 2>&1 | tail -3
cd /workspace/triple-c && git status --short
```
Expected: every `test result: ok`, with the Rust count = 652 + 18 (`command_census`) + 1 (manifest test) = 671 and the vitest count = 969 + 6 = 975 in 75 files; clippy `0`; `tsc-ok`; vite `built in`; `git status` clean (a `cargo` run must not dirty `gen/schemas` — if it does, something is nondeterministic; investigate before finishing).

- [ ] **Step 2: Settled rebuild check**

Run `cd /workspace/triple-c/app/src-tauri && cargo check --offline 2>&1 | tail -2` **twice**. The second run must print only `Finished` — no `Compiling triple-c`. If it recompiles every time, `prune_permissions` is touching live files; fix it, because that would make every `tauri dev` restart and every `cargo test` pay for a full crate rebuild.

- [ ] **Step 3: Hand-off note for the user (put this in the final report, not in a file)**

Manual verification runs on the user's machine, from spec §5 "Manual", and is the only thing not done here:
1. `npx tauri dev`: cold start renders projects, Docker status, settings, help; open a terminal and type/resize/paste/drop; Files tab list/view/rename/upload/save-to-host/backup; browser view enable/pop-out/close; file viewer click → open, choose, edit, save, conflict banner, live reload; settings export/import, gateway, STT, web terminal, scheduler — one action each.
2. Viewer devtools: `window.__TAURI_INTERNALS__.invoke("list_projects")` rejects with `not allowed on window "file-viewer-1"`; main devtools: `invoke("viewer_read_file")` rejects likewise; pop-out devtools: `invoke("list_projects")` rejects (no capability).
3. Watch the log for `not allowed` during the pass — any occurrence is a missed grant (it cannot be, per the build check, unless a window label other than `main`/`file-viewer-*` is invoking).
4. Recommendation (out of scope here): add `npm run test` and `cargo test` steps to `.gitea/workflows/build-app-preview.yml`; the build-time check runs in CI, the two test halves do not.

---

## Self-review against the spec

- §2 mechanism: reproduced by the spike (spec §7); nothing in the plan relies on an unverified claim.
- §3.1 grants: Task 2 Step 4 (110 + 5, exact lists; five plugin/core and four core unchanged).
- §3.2 build.rs (parse, fail-closed, selective prune, four rules, `Box::leak`, hand-written refusal): Task 1 (rules + tests), Task 2 Step 3 (wiring), Step 7 (negative proofs a–d, f, prune, hand-written).
- §3.3 vitest (core import rule, wrapper map, closure, `M ∩ V = ∅`, equality for viewer, subset for main, exact prefixed lists): Task 4.
- §3.4 tests (split census, viewer census, manifest read-back, shared parser, unit tests): Tasks 1, 2 Step 1, 3.
- §3.5 docs (both descriptions, CLAUDE.md conventions + backend, mod.rs doc, .gitignore): Task 5 and Task 2 Step 3.
- §3.6 not done: nothing in the plan enables `removeUnusedCommands`, writes `permissions/*.toml` by hand, or uses `webviews`.
- §4 risks: each row's "how it is caught" maps to Task 1 tests, Task 2 Step 7, Task 3 Step 3, Task 4 Step 3.
- §5 automated: Task 6 Step 1; negative (e): Task 4 Step 3; manual: Task 6 Step 3.
- Type consistency: `registered_commands → Option<Vec<String>>`, `check → Vec<String>`, `CapabilityFile { name, windows, bare }` used identically in Tasks 1, 2, 3; `toPermission`/`allow_permission` both replace only `_`.