Desktop.AppServices

Why this package exists

The product host must not parse CLI text, call domain modules directly, or implement stale-write rules in controls. NexusScholar.Desktop.AppServices gives the desktop typed requests, projections, previews, results, and status categories while keeping Avalonia outside the workspace and scientific authority layers.

It depends on Kernel, ResearchWorkspace, and UiContracts only. ResearchWorkspace already depends on AppServices, so this separate outward facade also avoids a dependency cycle.

Operational command lifecycle

initialize / import / analyze request
              |
              v
immutable DesktopWorkspaceCommandPreview
  workspace + expected revision
  source path/digest where applicable
  expected effects + explicit nonclaims
  canonical confirmation token
              |
         explicit confirm
              |
 revalidate token, workspace, revision,
 source bytes, target state, and lock
              |
 Succeeded | Attention | Failed |
 Stale | RecoveryRequired

OpenWorkspace and VerifyWorkspace are read operations. Initialize, import, and analyze require preview and confirmation. Source paths are execution references only; source digests and workspace authority identities provide the durable binding.

Human-authorized deduplication review

LoadDeduplicationReviewQueue exposes only targets and actions admitted by the current verified FE-01 policy. Actor id and role are command inputs, not login claims. Authorization still comes from exact policy assignment.

The review preview binds workspace revision, authority generation and manifest, decision-set digest, source result, source snapshot, target, policy, request, actor, role, action, reason, rationale, superseded decision, candidate membership, invalidations, expected effects, and nonclaims. Changing any field changes the confirmation token. Commit reconstructs authority again and fails stale if the current workspace no longer matches.

A target with an active decision cannot receive another fresh decision. A correction must select and supersede the exact active decision. Cancellation writes nothing.

Screening, Full Text, and export workflow facades

InspectScreeningAuthority projects ready, unavailable, stale, invalid, or recovery-required state from the durable ResearchWorkspace package. The desktop sees immutable identifiers and digests, not verified Protocol or Screening domain objects.

DesktopScreeningReviewFacade previews and confirms title/abstract decisions. DesktopScreeningResolutionFacade handles correction, adjudication, and handoff closure. DesktopFullTextWorkflowFacade preserves candidate-local intake/review bindings. DesktopReviewExportFacade routes deterministic report, Bundle v2, export-ledger, and verification operations.

Each facade returns immutable product contracts while ResearchWorkspace reconstructs and revalidates the exact domain authority before commit. None can author a Protocol or criteria, complete work from display state, or bypass a stale/recovery outcome.

Key contracts and failure semantics

• DesktopWorkspaceCommandStatus: Ready, Succeeded, Attention, Failed, Stale, and RecoveryRequired.
• DesktopWorkspaceOverview: safe product projection of imports, warnings, skipped records, review work, attention items, and nonclaims.
• DesktopDeduplicationReviewQueue: current policy, actor-role assignments, targets, evidence ids, and active decisions.
• DesktopDeduplicationReviewPreview: the complete immutable confirmation material for the one admitted scientific action.
• DesktopScreeningAuthorityReadiness: a non-mutating readiness projection with authority ids and digests.
• DesktopScreeningReviewPreview and resolution previews: exact candidate, actor/role, criteria, policy, journal, decision, supersession, and handoff bindings.
• DesktopFullTextIntakePreview and DesktopFullTextReviewPreview: candidate-local artifact, criteria, extraction, conduct, and expected-generation bindings.
• DesktopReviewExportPreview: deterministic report, Bundle v2 inventory, export actor/role, ledger, and replay material.

Stale means the preview is no longer the command the user reviewed. Recovery-required means the facade cannot safely classify the state as an ordinary validation problem. Neither is rendered as success.

Tests and accepted evidence

Desktop.AppServices tests cover command previews, token/source/revision drift, deduplication, Screening review and resolution, candidate-specific Full Text routing, report/export actor bindings, and stale/recovery result mapping.

The product boundary is defined by ADR 0035, ADR 0036, ADR 0037, and ADR 0038. See the Slices 5–9 completion evidence.

Dependencies and extension points

The facade depends on Kernel, ResearchWorkspace, and UiContracts; it has no Avalonia reference. A new desktop mutation should add an immutable request and preview, canonical confirmation material, exact stale bindings, structured result states, and a ResearchWorkspace operation that owns reconstruction and commit. Scientific commands also require an accepted ADR defining actor authority and the exact records bound by confirmation.

Explicit nonclaims

No authentication, identity provider, user-session authority, provider/network access, Protocol or criteria authoring, AI, plugin runtime, database, API, cloud, telemetry, or production-security boundary is implemented. A typed facade is not a security sandbox.