VerseVDI-Data-Plane/openspec/changes/phase-3d-macos-native-mvp/proposal.md

Why

Phase 3C has frozen the gateway and Connection Server image-engineering baseline, so the first native VerseVDI endpoint can now be built against an immutable gateway-only authority model. Phase 3D must add the user-facing macOS workspace, exact display negotiation, safe native input, and streaming core without exposing Apollo/provider details or weakening the existing control and transport boundaries.

What Changes

• Build the Apple-Silicon SwiftUI/AppKit client and platform-neutral Rust Streaming Core behind one sized/versioned C ABI (P3D-001–P3D-031).
• Implement the reviewed native workspace, bounded adaptive 300...360 pt 16:10 preview cards with 16 pt spacing and natural columns, Favorites, search/sort, settings, accessibility, and privacy-bounded desktop previews (P3D-032, P3D-037). Screenshot pixels are behavioral evidence, not authoritative geometry constants.
• Add feature-gated requested/effective display modes, Server-owned policy clamping, client display detection/disclosure, and explicit reconnect-on-display-change behavior (P3D-033–P3D-034).
• Add provider-neutral absolute pointer and high-resolution scroll input while preserving relative input, release-all, reserved local escape chords, letterbox exclusion, and scoped keyboard mapping (P3D-035–P3D-036).
• Keep authentication, manifests, media, input, and clipboard on the authenticated gateway-only route. The client receives no provider endpoint, provider credential, or Windows credential outside normal encrypted input.
• Defer remote apps, manual PC/direct-provider connections, live display renegotiation, multi-monitor remote topology, HDR, microphone, file/folder redirection, image clipboard, macros, Intel, public release, and provider-specific client UI.

Capabilities

New Capabilities

• macos-native-foundation: Platform baseline, Swift/Rust/C ABI ownership, authentication, resource/broker authority, gateway-only manifest validation, and fake-core-first delivery.
• macos-media-presentation: Registered media dispatch, hardware video presentation, audio, bounded queues, and observable quality without media persistence.
• macos-input-control: Provider-neutral keyboard, pointer, scroll, controller, text clipboard, mappings, reserved local chords, and release-all behavior.
• macos-lifecycle-quality: Interruption, reconnect, accessibility, privacy, diagnostics, packaging, rollback, uninstall, and candidate qualification behavior.
• macos-workspace: Screenshot-backed workspace/card/settings interactions, Favorites, search/sort, and privacy-bounded previews.
• session-display-mode: Feature-gated requested/effective display mode, Server policy clamping, client detection/disclosure, and owner Apollo IDD acceptance.

Modified Capabilities

None. Existing Phase 3C gateway capabilities remain unchanged; this change consumes and extends their separately owned Protocol surfaces without redefining their requirements.

Impact

• Protocol repository: additive strict JSON display objects, feature identifiers, VGI1 absolute/scroll grammar, cross-language bindings, fixtures, and compatibility tests.
• Connection Server: additive broker-session migration/query fields, request identity, allocation transaction/clamp, manifest disclosure, and provider-work projection.
• Data Plane: Protocol pin update, Go gateway input validation/Apollo translation, Rust core/C ABI/XCFramework, SwiftUI/AppKit client, tests, documentation, and private build configuration.
• Provenance and license boundary: Apollo, Moonlight, Microsoft Windows App, and Omnissa material remains reference evidence only. No proprietary Server or Planning content is copied into the GPLv3 Data Plane.
• Hard stops: unknown provider packet semantics, incompatible legacy response behavior, direct-provider routing, secret/media/input persistence, unsupported platform safety, or a failed deterministic gate blocks the affected capability. Live Apollo/macOS/firewall interoperability remains deferred-owner-e2e until the owner runs the frozen candidate.