Connect native GPUI desktop workflows (ANLG-320)

[devin-ai-integration]

Summary

Intent: Connect the fresh native GPUI implementation to concrete Anarlog services and make its workspace, editor, meeting and product workflows reachable. Keep Tauri/React as the shipping default while the remaining parity and validation gates in ANLG-320 are open.

This remains a draft, not a release candidate. The five completion lanes were integrated after e15c91f9d7854e6d779bcfe2a29b04eb6042887d; final integration and measured source: f404735b01079d76815a20969fd2696967ba3222. No GPUI implementation was transplanted from #7683. Canonical SQLite schema, TipTap/ProseMirror JSON and shipping defaults remain unchanged.

Reachable native behavior

• Recording and recovery use ProviderServices::{start_resolver,recovery_resolver}; meeting AI receives concrete provider/context/tool services. Secure account and API-key resolvers, subscription refresh and running local STT/LLM models feed these consumers. Native provider settings save keys to the system keyring and provider/model/base-URL choices through atomic CAS.
• Account, billing, teams, CloudSync and sharing mount concrete cloud views. Onboarding, permissions, import/export, models, calendar, developer tools and storage mount concrete local views. Auth/account identity and scope changes propagate to views, automations and provider access.
• Workspace routes reach folder/contact/template/automation edits, provider calendar reconciliation, bounded search, note windows and authenticated shared-note previews. Main and standalone windows share capture/playback ownership; each editor receives the attachment vault. Saved-note and finalized-capture events reach automation execution.
• The editor supports canonical JSON preservation, remote document watches with dirty-draft protection, rich clipboard conversion, nested structures, table/task controls and local attachment import/preview/open. Shared input supports bounded multiline text, UTF-16 composition ranges and logical-line navigation.
• Native menus, tray, global shortcuts, deep-link inbox, updater checks and standalone-window events are connected to application consumers. Explicit quit/close flushes note windows and product/workspace state, finalizes capture, stops playback/models/cloud services and drains runtime/database work. Failed draft saves keep windows open; forced OS termination is outside this guarantee.
• Source-derived shell/timeline/tab geometry and current repository assets/fonts are used. No visual parity claim follows from source inspection.

The native normal/build dependency graph contains no Tauri, Wry, WebKit or WebView packages. The default native profile is isolated at $HOME/.anarlog-gpui-sandbox/library.sqlite; pin storage uses its own app_settings key and does not import the shipping application's file-based pin store. Cloud setup needs the documented Supabase deployment configuration; model executables/resources must be bundled or supplied through ANARLOG_NATIVE_RESOURCES.

pnpm dev:desktop-gpui --profile /absolute/path/to/isolated-profile
pnpm check:desktop-gpui

Remaining user-visible gaps and validation gates

Area	Remaining work / evidence
Appearance and interaction	Recorded Linux comparisons now cover local editing, title conflicts, navigation, import/export, attachments and shared-field undo/redo, word editing and mouse selection. Typography, spacing and navigation chrome still differ. Complete focus/menu, drag/drop, rich clipboard and cross-platform IME/CJK parity remain unverified. Shared inputs still lack soft wrapping and grouped typing undo; masked inputs intentionally retain no history.
Editor and attachments	Cloud upload/download/E2EE transfer and published shared-attachment hydration are incomplete. MIME-specific cards, image-resize handles and spellcheck need work. Tables and giant single textblocks remain atomic projection targets; automatic remote merge is capped at 2,000 top-level blocks and preserves conflicts.
Settings and providers	Several native side-effect settings remain guarded: autostart, device lock, app/dock appearance, analytics and crash reporting. Full provider enrollment/model discovery, localization and community-template parity remain incomplete. Search has explicit indexing/result bounds.
Accessibility and platform	Published GPUI 0.2.2 lacks integrated native accessibility hooks. Screen-reader support, a Wayland shortcut portal and per-window close-to-hide require further implementation/framework work. macOS/Windows builds and live native dialogs/keychains/notifications/permissions have not been validated.
Live services and hardware	Hosted OAuth/account/billing/team/device/sync/share/calendar mutations, provider credentials, real microphone/system audio/playback, local-model hardware/licensing and macOS Foundation Models were not exercised. Contract fixtures do not replace these checks.
Lifecycle and release	OS/session-forced termination, signed packaging/notarization, installer/relaunch/update application and shipping native-platform regressions remain open. GPUI's generic shutdown callback has a 100 ms timeout; explicit app quit uses the longer application drain path.
Performance	Uncached canonical library queries still scan/sort. Release-build ABAB process-tree CPU/memory observations are below; WebKit activity persists after its caret disappears. Stack profiling is blocked by VM permissions. Native caret parity is being corrected before further comparison. Launch, first-paint, key-to-paint, frame timing and wakeups remain unmeasured.

Demo

Recorded comparison uses isolated GPUI and Tauri profiles. Neither appearance parity nor a whole-application speedup has been established.

Recorded regression coverage

The comparison exposed and drove fixes for dialog focus leaking into the editor, stale content after deletion, font variants, empty imports, shortcut collisions, first-load caret reveal, title commit/restoration and search sizing. Earlier valid passes cover Move/Delete dismissal, local CRUD and import/export, bold/italic rendering, pin/tab transitions, overflow menus, and main/standalone attachment persistence.

At 135d481114, search fits and filters at full width and 800px. CAS Retry retains the draft without overwriting a second writer; Restore refreshes both the header and sidebar, including filtered results, while preserving body, attachments and undo history. Enter/blur/Escape, rapid edits, long-title restoration, reopening/restart and first-load Ctrl+End/Home passed.

A controlled failed body save then exposed a blank editor canvas with “Draft retained.” Recovery on the preserved process successfully saved the unsaved marker and both attachments, and reopening retained them; data loss was not observed. At 99f3e893dd, the failed body-save → title Restore → refused navigation flow retained readable title/body/attachments at both 800×1100 and maximized sizes. Retry cleared the error, and reopening plus a fresh process retained every marker and attachment. The blank-canvas symptom was not reproduced. Search, first-load Ctrl+End/Home and narrow long-title Escape also passed.

Failed save retains the draft	Saved content after restart

Equivalent rich memos were compared maximized and at 800px. Their first three rows align vertically; native text remains visibly narrower, with different font shapes and chrome. Deterministic asynchronous Restore/newer-draft races and successful queued busy-title completion remain untested.

At 8975da5359, native title/search undo/redo, word movement/deletion, cut/paste, double-click/Shift+click and bidirectional dragging outside the field passed. Undo restored reversed selection; committed-title undo worked after refocusing. Search filtering and long-title scrolling/Escape passed at 800×1100. A multiline template covered empty-placeholder clicks, Unicode paste, document boundaries, line selection and drag/undo; exact Unicode text survived navigation and restart (UI copy-back). CJK/emoji glyphs were missing in that original-font pass. Focused input actions left the memo unchanged.

Reversed drag outside title	Multiline template after restart

Native typing undo remains character-granular; pasted replacement is one transaction. In the unchanged Tauri reference, Ctrl+Z did not undo the tested title edits and Escape navigated away. One rapid reference retyping attempt displayed an unexpected substring; cause and reproducibility are inconclusive. Actual OS IME, masked-input history and history-limit eviction were not tested through the UI; model tests cover composition and history limits. macOS/Windows bindings and Tauri process-restart persistence remain untested.

A separate 8975da5359 pass restarted both applications with the same isolated packaged-font inventory: 53 face entries across 27 files, using DejaVu core/extra 2.37-2build1, Noto CJK 1:20220127+repack1-1 and Noto Color Emoji 2.047-0ubuntu0.22.04.1. Japanese and emoji rendered and copied back exactly; plain/bold/italic/bold-italic bodies and multiline text persisted in both apps. Memo row spacing was 28px in both; horizontal raster bounds and navigation/template controls still differ. Font provisioning changed the QA environment only.

At fc40ecdc72, a rebuilt native binary passed the recorded sidebar regression comparison. Long Unicode titles truncate to one line with timestamps visible at 200/280/360px; copy-back preserves the entire title. The default stays 200px at 800×1100 and maximized. A manually dragged 280px width scales to the 360px cap and returns to 280px. Collapse/reopen restores it; Templates stays fixed at 200px with resizing disabled. Leaving Templates restores the prior timeline width and expansion, intentionally avoiding the reference's observed route-only reset. Releasing a drag outside the window stops resizing. Search, title undo/redo/Escape and saved body/attachment persistence passed again, including a fresh process. Lower-cap recovery below 800px is covered by state tests but remains untested through the UI.

800px comparison after sidebar fixes	Maximized native at the 360px cap

Revision references for these UI passes: 0293770fb5892efbb5298d23a9c308ad25b04d3c, aa0247712489ebd687c62f0ad4a059f950ad4bbd, 8902b27745, 797ad1c622, 0b1fc3bd58, ab4b20ca30, 752fd106cf, 135d481114, 99f3e893dd, 8975da5359, fc40ecdc72. Earlier recordings describe their tested revision, not full validation of the latest head.

Cross-client note identities

Performance setup exposed a compatibility failure: Tauri reads the memo with session_documents.id = sessions.id, while the shared Rust reader also accepts an independent document ID. At d83aceb754, native-created notes, onboarding and generated imports use the session ID for the primary note. Summaries retain independent IDs; canonical archive imports preserve original row IDs and opaque bodies. Existing sandbox rows are not automatically rewritten.

The actual Tauri SESSION_SELECT_SQL returned an empty native memo before the fix. New regression tests now verify this read, external edits, stale-save rejection, restart persistence, generated-import/onboarding IDs and archive identity preservation. The release UI pass also verified a native-created Unicode bold/italic memo in production-bundled Tauri, a Tauri edit back in native after exact checkpointed database transfers, and native Markdown import visibility in Tauri. The welcome-note UI path was not reached. Tauri's Close action hid its window; autosave/reopen was checked before process termination, so this is not graceful-quit evidence.

Tauri reads the native-created memo	Native reopens the returned Tauri edit

Linux rendering uses an isolated process-local Mesa/LLVM/Vulkan setup; system graphics libraries were not replaced. This VM has no physical audio input device. Original-font and common-packaged-font comparisons are separate evidence; both apps use the same packaged fontconfig for the latest sidebar pass. Actual OS IME and cross-platform behavior remain unverified.

Verification

Local environment: Ubuntu 22.04, repository Rust toolchain, local PipeWire 1.0.5 SDK. The focused native workflow uses Ubuntu 24.04 and now installs GTK/AppIndicator development dependencies.

CI follow-up at dfeef8bbb23c2b368abd9ef57b8439260a865673: the native link failed on missing -lxdo (job 106217308583), so the native workflow now installs libxdo-dev. The branch incorporates current main and formats its multiline CSS transition, resolving the formatting failure in job 106217308290. Full branch-diff dprint checks, diff whitespace checks, license-boundary checks and all 136 Node CI tests pass locally. Hosted checks are rerunning. These follow-up commits change CI and web formatting, not either desktop application's source.

Native checks

export PKG_CONFIG_PATH="$HOME/.local/pipewire-1.0.5/lib/x86_64-linux-gnu/pkgconfig"
cargo check --locked -p desktop-gpui
cargo build --locked -p desktop-gpui
cargo test --locked -p desktop-runtime -p desktop-gpui
cargo clippy --locked -p desktop-runtime -p desktop-gpui --all-targets --no-deps -- -D warnings
find apps/desktop-gpui/src crates/desktop-runtime/src crates/desktop-runtime/tests -name '*.rs' -print0 | xargs -0 rustfmt --edition 2024 --check
rustfmt --edition 2024 --check apps/desktop-gpui/build.rs crates/db-app/src/session_ops.rs
git diff --name-only --diff-filter=ACMR e15c91f9d7854e6d779bcfe2a29b04eb6042887d | xargs pnpm exec dprint check --allow-no-files
git diff --check e15c91f9d7854e6d779bcfe2a29b04eb6042887d
cargo tree --locked -p desktop-gpui --edges normal,build --target all
target/debug/desktop-gpui --help

Check/build/strict Clippy/formatting passed at d83aceb754. Native tests: 214 passed, 3 optional benchmarks ignored. Local fixtures cover provider transport/configuration, secure-store boundaries, stale provider-choice rollback, recording/recovery and failed provider startup/retry, AI streaming/tools, cloud account/sync/share contracts, import/export/model adapters, standalone lifecycle helpers, sidebar proportion/route restoration, input composition, bounded undo/redo, Unicode boundaries and horizontal scrolling, canonical persistence/CAS, cross-client note identity and external-write page-cache invalidation. Full branch-diff dprint and whitespace checks passed again. Both license checks, desktop/mobile version checks and all 136 Node CI tests passed at d83aceb754.

cargo test --locked -p calendar -p db-app -p db-sync -p e2ee -p export-core -p meeting-import -p model-downloader reached 255 passed / 6 failed in db-app: all six failures initialize CloudSync and report native loader/Sqlx(WorkerCrashed) errors. The bundled extension requires GLIBC_2.38, while this VM supplies 2.35; the same loader limitation was reproduced on the untouched exact base. The new session-query equivalence test passed. The remaining domain packages were run separately and passed. Full CloudSync/db-core native suites require a compatible environment; this is not full domain-suite validation.

Shipping frontend/common regression checks passed: shared UI build; desktop typecheck; 491 files / 4,699 tests; Oxlint (0 errors, 210 warnings); i18n checks; both license-boundary checks; desktop/mobile version consistency; and all 136 Node tests in the repository CI command.

pnpm -F ui build
pnpm -F desktop typecheck
pnpm -F desktop test
pnpm exec oxlint --quiet --format=github apps/desktop/src/
pnpm -F desktop i18n:check
python3 .github/scripts/test_check_license_boundary.py
python3 .github/scripts/check_license_boundary.py
node scripts/release-version.mjs --check
node scripts/release-version.mjs --mobile --check
node --test scripts/dev.test.mjs scripts/pr-description.test.mjs scripts/release-version.test.mjs scripts/notarize-dmg.test.mjs scripts/changelog-bundle.test.mjs scripts/verify-release-candidate.test.mjs scripts/desktop-release-provenance.test.mjs scripts/publish-anarlog-skill.test.mjs scripts/repack-linux-appimage.test.mjs scripts/verify-linux-audio-qa-run.test.mjs scripts/verify-linux-audio-qa-evidence.test.mjs scripts/update-apt-repository.test.mjs scripts/verify-apt-repository.test.mjs scripts/update-aur-pkgbuild.test.mjs

Zizmor 1.30.1 completed offline: 154 errors, 81 warnings, 117 notes. Normalized findings match the exact-base workflow scan; no introduced findings were observed. Authenticated online audits were unavailable. Generator-produced OpenAPI key-order drift was verified semantically identical and excluded. Native shipping-platform builds were not run.

Release application resource observations

Report · Raw samples and provenance · Aggregate

Native d83aceb75458e6b7e60da694c6de515be18d20c8 and unchanged production-bundled Tauri fc40ecdc72612447b7b8d2aac567c4e9adea11d0 ran in fresh Native-1 → Tauri-1 → Native-2 → Tauri-2 order. Twelve 30-second windows included all application descendants, verified geometry and constant 15 fps recording. The Tauri fingerprint confirms default,direct-distribution, no dev/devtools and empty Rust flags; its earlier literal build invocation/full inherited environment was not independently recovered. This is a Linux VM/software-renderer observation, not deployment hardware evidence.

Each entry below is run 1 / run 2. PSS is the window median in MiB; CPU is the window mean where 100% equals one core.

State	Native PSS	Tauri PSS	Native CPU	Tauri CPU
Small memo, 800×1100	137.71 / 137.77	614.81 / 839.07	0.40 / 0.40	72.49 / 74.59
Small memo, 1600×1156	141.54 / 141.59	500.22 / 867.20	0.33 / 0.40	83.85 / 85.51
500 paragraphs, 800×1100	138.71 / 138.09	634.27 / 709.89	0.33 / 0.33	83.85 / 83.22

WebKitWebProcess accounted for 64.93–79.69% CPU. Its anomalous activity, memory drift and visible caret despite attempted chrome-based blur require a controlled follow-up; caret-free matching was not established. Do not interpret this table as a whole-app speedup. Search/open, typing/undo/reopen and document endpoints were exercised in both apps. Input and resize transitions needed corrections before sampling; all 1,002 synthetic note bodies match the seed structurally after each run. Welcome generation, archive-import UI, launch, first usable paint, input/frame latency and wakeups remain outside this evidence.

Focus diagnostic on the same unchanged binaries

Diagnostic report · Evidence · Aggregate

Fresh 800×1100 runs held the required provider panel and 15 fps recording constant. Empty Tauri measured 0.23% tree CPU; focused memo measured 66.16%. Explicit desktop focus removed Tauri's caret but left tree CPU at 68.26% over 90 seconds, including 61.62% in WebKit, predominantly its main thread. WebKit's network child was approximately idle; the Tauri host's VBlankMonitor used ~0.20%. PSS ranged 603.49–612.60 MiB without monotonic growth; this bounded interval neither establishes nor excludes a leak.

Native empty/focused/unfocused CPU was 0.43% / 0.47% / 0.48%, but its caret stayed continuously visible in both focus states. That is a parity defect, not evidence of equivalent blinking efficiency. Native PSS was 125.87 MiB empty and 129.38 MiB with the memo open. All 1,002 bodies and original ABAB evidence remain intact.

Tauri: desktop active, caret absent	Native d83: desktop active, caret remains

Notification suppression did not remove the condition-bound provider panel; the setting was restored. perf_event_paranoid=4, denied GDB attachment and denied kernel-stack reads prevent causal attribution. JavaScript, GC, paint, animation and graphics explanations remain unverified. Further attribution requires a permitted symbolized sampling environment; any inspector build must remain separate from production measurements. No whole-application speedup claim.

Native focus corrections after the diagnostic

The shared caret controller in 21600196f8 blinks only while the eligible field is focused in an active window, resets after interaction, and cancels its timer on blur/deactivation. Recorded editor, title, picker, search, provider and multiline-field checks passed; these were functional checks, not new resource measurements.

The follow-up exposed a separate focus-routing failure: removing the focused note left its unrendered focus handle outside workspace key dispatch. 9a446d348e restores workspace focus through GPUI's focus-lost callback, guarded against product panels, shutdown and paused writers. Two recorded Ctrl+End → Ctrl+W → Ctrl+Shift+T cycles and focused-title close/restore passed, including editing/undo and restored caret activation.

209dd215cd prevents the tab close control's default mouse-down focus transfer. Recorded independent body/title marker-and-undo checks after inactive-tab closure passed, as did repeated focused body/title close/restore, Ctrl+T/N/K and product/back field checks. All 1,002 functional fixture bodies remained exact.

Body input after inactive close	Title input after inactive close

Corrected blinking-state resource comparison — 209dd21

Raw observations and provenance · Aggregate

Twelve accepted windows at 800×1100 used 31 observations over approximately 30 seconds each, stable process trees, canonical fixtures and continuous 15fps recording. Native binary SHA256: ac3fa272b57b02a90a145839dd74298c9479f44208537d91b8ec02e7b1a78c84; unchanged production Tauri fc40 binary: 26daed37bd7ec10845f64b3ce94eb4f0d8e0ac549c64b90e3d43e20abb2e9d69.

State	Native CPU %	Tauri CPU %	Native median PSS MiB	Tauri median PSS MiB
Empty	0.40 / 0.43	0.57 / 1.33	125.39 / 125.77	661.10 / 579.21
Focused memo	55.92 / 53.99	69.73 / 66.99	128.76 / 128.85	719.16 / 556.13
Deactivated memo	0.53 / 0.43	76.02 / 66.76	128.76 / 128.85	758.55 / 563.59

CPU is percent of one core; paired values are the two runs. Correct blinking exposes substantial native CPU use on this software-rendered VM. Native llvmpipe workers account for 55.09% / 53.13%, while its main thread is 0.67% / 0.60%. Earlier low-CPU nonblinking native results are not equivalent evidence. Repaint/timer/renderer attribution is the next investigation; no optimization claim.

One Tauri attempt added an empty paragraph by clicking below existing text; integrity checks excluded it, and a fresh canonical copy was repeated. Accepted order is Native-1 → Tauri-1-clean → Native-2 → Tauri-2, with the excluded attempt preserved. Every accepted profile retains all 1,002 exact bodies and IDs.

External desktop clicks deactivated the measured client and hid its caret, but the WM selected a legacy SIGSTOP-paused native window, not Plasma; that target was consistent across accepted deactivated windows. Provider chrome still differs. Tauri's high WebKit activity remains unexplained. Maximized/large-note windows were not repeated; launch, first paint, key-to-paint, frame timing and wakeups remain unmeasured.

Library performance evidence

Release fixture source: f404735b01079d76815a20969fd2696967ba3222. Raw samples, query plans, fixture hashes and environment.

These historical service samples used independent note IDs. The fixture now uses canonical note IDs and fingerprints the document identity and timestamps as well as its body; the old raw results retain their original source and hashes. Preliminary GUI samples from the noncanonical fixture were rejected because Tauri displayed an empty memo.

Each isolated fixture contains 1k/10k/50k sessions, ten 1 MiB documents and 256-byte documents otherwise. It records 30 library requests and 20 saves/watch deliveries, using warm OS cache. Library requests advance by 31 rows with a 100-row limit, so the runtime distribution includes cold aligned-page loads and cache hits. Reference and optimized result IDs are checked for equivalence. Values below are milliseconds, nearest-rank p50/p95/p99.

Sessions	Runtime cache + prefetch	Uncached new SQL	Original SQL
1,000	0.221 / 4.471 / 4.899	1.854 / 3.441 / 3.457	1.729 / 1.962 / 1.969
10,000	0.225 / 13.555 / 13.568	9.810 / 10.946 / 11.742	9.823 / 10.523 / 10.631
50,000	0.213 / 55.283 / 64.614	48.273 / 80.600 / 90.453	47.269 / 79.721 / 87.505

At 50k, save p50/p95/p99 was 3.850 / 5.389 / 12.434 ms, and enqueue-to-document-watch delivery 24.016 / 26.118 / 32.536 ms. These are service microbenchmarks, not editor key-to-paint or recording latency.

The materialized ID page bounds final row projection and uses the existing primary-key index, but both SQL plans still report SCAN sessions and USE TEMP B-TREE FOR ORDER BY. The uncached results do not demonstrate a speedup. Removing the scan/sort needs a separately reviewed canonical expression index, which is outside this no-schema change.

The runtime cache holds at most eight aligned pages of 456 rows and an 8 MiB estimated payload. A read-only observer checks PRAGMA data_version, invalidates on committed external writes, and avoids retaining a page changed during its query. Library work is serialized on the bounded database queue; superseded reads cancel. Runtime limits: 64 database jobs, 16 service jobs, four concurrent service workers, two Tokio workers.

for rows in 1000 10000 50000; do
  ANARLOG_BUILD_SHA="$(git rev-parse HEAD)" \
  ANARLOG_FIXTURE_ROWS="$rows" \
  ANARLOG_FIXTURE_DOCUMENT_BYTES=1048576 \
    cargo test --locked --release -p desktop-runtime --test performance -- --ignored --nocapture
done

Link to Devin session: https://app.devin.ai/sessions/be66b7c3585d4985940bb9d2035abed9
Open in Devin Desktop: https://app.devin.ai/desktop/session/be66b7c3585d4985940bb9d2035abed9?variant=devin
Requested by: @ComputelessComputer

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access that start with 'DevinAI' or '@devin'.

• Disable automatic comment, CI, and merge conflict monitoring