feat(desktop): Tauri v2 kiosk shell — maximized window, prod right-click block, auto-update + code-signing

Add apps/desktop, a thin Tauri v2 shell wrapping the SAME @parking/web SPA so
the desktop and browser UIs never drift: dev loads the Vite dev server (HMR),
prod bundles the web app's dist/. No business logic in the shell (device/auth/
ledger stay in @parking/server); deny-by-default capabilities.

apps/web (single UI source of truth):
- lib/origin.ts: centralize the backend origin (API_BASE/apiUrl/wsUrl from
  VITE_API_BASE); no-op in the browser, lets the desktop build target Fastify.
- lib/kiosk.ts: block the right-click context menu in PROD only (dev keeps it +
  devtools).
- lib/desktop-updater.ts: prompt-on-update auto-update (no-op in browser/offline)
  → downloadAndInstall + relaunch; i18n update.* keys (sq+en).
- .env.production: VITE_API_BASE wired to the Fastify origin for the bundle.

Desktop:
- window starts maximized (not fullscreen — operator keeps OS access).
- auto-update via tauri-plugin-updater + -process; self-hosted endpoint is a
  PLACEHOLDER to fill in. Updater keypair: pubkey embedded in tauri.conf.json;
  private key + password kept OUTSIDE the repo (~/.parking-updater-keys) and as
  TAURI_SIGNING_* build secrets.
- Turbo build is a no-op; the real signed bundle is `pnpm --filter
  @parking/desktop bundle` (verified → .deb/.rpm/.AppImage + .sig signatures).

Verified: cargo check clean; turbo run build lint 14/14 green; i18n parity holds;
no key/sig/bundle artifacts in the repo.

Wiki (security + desktop analysis recorded alongside):
- new concepts/tpm.md (TPM 2.0: how it works, sealed-LUKS auto-unlock + non-
  extractable signing key, limits — live-root, bus-sniff — TPM-vs-ATECC608 by
  platform).
- new decisions/desktop-shell-tauri.md (Tauri v2 over Electron; best-case Ubuntu
  26.04 LTS, worst-case Windows+WSL → kiosk browser; full as-built).
- pull-the-disk attack trace on append-only-event-chain; ATECC608 not-in-a-PC
  caveat; cross-links from disk-os-hardening / threat-model.
- open-questions #11 (appliance WebKitGTK), #12 (TPM hardening impl), #13
  (startup verifyChain self-check); index/overview/log/standing-decisions.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/decisions/desktop-shell-tauri.md

@@ -0,0 +1,164 @@
+---
+type: decision
+tags: [parking, decisions, desktop, frontend]
+sources: []
+updated: 2026-06-21
+status: settled
+---
+
+# Desktop shell — Tauri v2 (chosen over Electron)
+
+The operator UI ([[react-vite-spa]]) needs to ship as a **desktop application** on the
+appliance (kiosk-style), with a **mobile app possible later** but out of scope now. The choice
+was **Tauri v2 vs. Electron**. **Decision: Tauri v2.** _(Settled with the user, 2026-06-21.)_
+
+## The thin-shell architecture (why this choice is low-risk)
+
+The desktop shell is a **thin kiosk wrapper around the existing SPA**, nothing more. All
+privileged logic — device drivers ([[device-adapter-pattern]]: reader/printer/relay/serial),
+[[local-jwt-auth|auth]], the [[append-only-event-chain|signed ledger]], [[tariff]]/[[subscription]]
+pricing — **stays in the [[fastify]] server** (settled with the user, 2026-06-21). The shell only
+loads the SPA, which talks to the local Fastify server over localhost. Consequences:
+
+- **No device/serial logic is ported into the shell** (no Rust device code for Tauri; no Node
+  main-process drivers for Electron). The "logic lives in the server" invariant holds.
+- If a WebView quirk ever bites, the **blast radius is presentation only** — the server and its
+  signed ledger are untouched.
+
+This is what neutralizes Tauri's main weakness (host-WebView fragmentation, below): the shell's
+job is fullscreen chrome, autostart, and kiosk lockdown — not correctness-critical rendering of
+financial truth.
+
+## Why Tauri v2 fits *this* project specifically
+
+- **Threat-model alignment ([[threat-model]]).** The primary adversary is the operator at the
+  booth. Tauri's **deny-by-default capability/permission model** means the renderer literally
+  cannot reach the filesystem, shell, or any native command unless we hand it a named, allowlisted
+  command. That is defense-in-depth that matches "don't trust the booth." Electron's equivalent
+  hardening (`contextIsolation`, `nodeIntegration:false`, `sandbox:true`, strict CSP) is **opt-in
+  and easy to misconfigure** into giving the renderer Node access — exactly what this threat model
+  can't afford.
+- **Small footprint / smaller CVE surface.** Tauri uses the **OS WebView** (WebKitGTK on Linux) —
+  ~3–10 MB bundles, tens of MB RAM, and **no bundled Chromium** to patch. Electron ships and pins
+  its own Chromium (100+ MB, hundreds of MB RAM) and makes us **own Chromium's CVE treadmill** on a
+  long-lived appliance. On a [[disk-os-hardening|hardened]] single-purpose box maintained for
+  years, less to patch is a real operational win.
+- **License.** Tauri is **MIT / Apache-2.0** — clears the hard MIT/Apache/BSD constraint
+  ([[technology-stack]]). (Electron is also MIT; not a differentiator.)
+- **Rust core** is available if device access ever *did* move shell-side — but per the decision
+  above it does not, so this is latent upside, not a current cost.
+
+## What Electron would have bought (the rejected upside)
+
+- **Version-pinned bundled Chromium** → identical rendering everywhere regardless of host. The most
+  predictable option on a locked-down appliance image, and the reason this isn't a slam-dunk.
+- Largest, most battle-tested kiosk/appliance ecosystem.
+- Node in the main process → trivial code-sharing with the Fastify/Node device drivers — but we
+  explicitly **keep drivers in the server**, so this advantage doesn't apply here.
+
+Rejected because the heavy footprint, the Chromium CVE-patching obligation, and the opt-in (easy
+to get wrong) security posture all cut against the appliance + threat-model constraints, while its
+one real advantage (bundled Chromium) is only conditionally needed — see the open question.
+
+## Target deployment — best case vs. worst case
+
+The decision's risk collapses to **which OS the appliance actually runs** (user, 2026-06-21):
+
+- **Best case — Ubuntu 26.04 LTS desktop (the intended appliance).** Ships a **current,
+  distro-maintained WebKitGTK** (`webkit2gtk-4.1` / GTK4), patched by Canonical for the LTS
+  lifetime. This **closes** the WebView risk below — no ancient-WebView problem, no CVE-patching
+  burden on us. A native, hardened, single-purpose box that matches the [[disk-os-hardening]]
+  platform decision. **Tauri belongs here; the decision is unconditional in this world.**
+- **Worst case — Windows 11 + WSL + Docker.** This is **not** a "use Electron instead" fallback —
+  it **contradicts the [[standing-decisions|standing platform decision]]** (explicitly *"a
+  dedicated, hardened Linux appliance, **not Windows/WSL**"*) and undermines
+  [[disk-os-hardening|Secure Boot / LUKS / tamper resistance]] against the booth operator
+  ([[threat-model]]). Moreover a **desktop GUI shell does not naturally live inside WSL/Docker**
+  (both are headless Linux). The realistic shape there is **no native shell at all**: run
+  [[fastify]] + the SPA in the WSL/Docker backend, and open the SPA in a **kiosk browser** on
+  Windows (`msedge`/`chrome --kiosk --app=http://localhost:PORT`). Electron is warranted **only**
+  if a self-contained installable Windows `.exe` (no system browser) is a hard requirement.
+
+The **thin-shell architecture makes the worst-case fallback cheap**: because all logic lives in
+[[fastify]], dropping the shell for a kiosk browser costs only the native window wrapper, not any
+functionality.
+
+| Deployment | Desktop shell |
+| --- | --- |
+| **Ubuntu 26.04 LTS** (best, intended) | **Tauri v2** — current WebKitGTK, native, hardened. Decision stands unconditionally. |
+| **Windows 11 + WSL + Docker** (worst, conflicts with platform decision) | **No native shell — kiosk browser** at the local Fastify-served SPA. Electron only if a standalone Windows installer is required. |
+
+## The one thing to verify (procurement / image gate)
+
+Tauri's rendering correctness depends on the **WebKitGTK version that ships on the target
+appliance OS image**. On a hardened/pinned image this can be old and cause rendering quirks — pin
+it and test the built SPA against that **exact** WebView. **On the intended Ubuntu 26.04 LTS this
+is effectively resolved** (current distro-maintained WebKitGTK); the concern only bites on an
+unexpected image with an ancient/unavailable WebView, which would point to the kiosk-browser path
+(or Electron) above. Tracked as an [[open-questions|open question]].
+
+## Invariants this decision must preserve
+
+1. **Server owns all privileged logic.** The shell is presentation only; device/auth/ledger/pricing
+   stay in [[fastify]]. Don't let "convenient native access" pull driver logic into the shell.
+2. **Deny-by-default native surface.** Expose Tauri commands one at a time, allowlisted; never open
+   a broad filesystem/shell capability to the renderer ([[threat-model]]).
+3. **[[offline-first]].** The shell, its updater, and any WebView must work air-gapped; no decision
+   here may introduce a network dependency in core operation.
+4. **Mobile later, not now.** A future mobile app is a separate target; don't pre-build for it.
+
+## As-built (scaffolded 2026-06-21)
+
+`apps/desktop` — a Tauri v2 shell, its own pnpm/Turbo package, wrapping the **same** `apps/web`
+SPA so the desktop and browser UIs **cannot drift** (one UI codebase; requirement from the user):
+
+- **Dev:** `tauri dev` loads `http://localhost:5173` (the `@parking/web` Vite dev server) →
+  editing a component in `apps/web` updates the desktop window via HMR live. `beforeDevCommand`
+  starts the web dev server.
+- **Prod:** `frontendDist: ../../web/dist` bundles the built SPA into the binary;
+  `beforeBuildCommand` rebuilds it first.
+- **Backend origin:** the SPA used relative `/api` + a `window.location.host` WS URL — fine in a
+  browser, broken from `tauri://localhost`. Centralized into `apps/web/src/lib/origin.ts`
+  (`API_BASE`/`apiUrl`/`wsUrl`), read from **`VITE_API_BASE`** (empty in the browser = unchanged;
+  set to the Fastify origin for the desktop build). The `tauri.conf.json` CSP `connect-src`
+  whitelists `127.0.0.1:3000`/`localhost:3000` http+ws; the backend's `WS_ALLOWED_ORIGINS` must
+  include the Tauri origin.
+- **Thin shell, enforced:** the Rust crate (`parking_desktop_lib::run`) registers **no commands**;
+  the capability set is `core:default` only — no fs/shell/device access to the renderer
+  (invariants 1–2). All logic stays in [[fastify]].
+- **Turbo:** `build` is a **no-op** (so `turbo run build` stays fast); the real bundle is a
+  deliberate `pnpm --filter @parking/desktop bundle` (the vision-shim pattern).
+- **Verified:** `cargo check` + a full `tauri build` compiled the Rust/WebKitGTK/wry stack and
+  produced working `.deb`/`.rpm`/`.AppImage` bundles; `pnpm turbo run build lint` → 14/14 green
+  (was 12). All Linux prereqs present (Rust 1.93, WebKitGTK 4.1, libsoup-3, WSLg display).
+### Window / kiosk, auto-update, env (added 2026-06-21)
+
+Per the user's choices — the operator **keeps OS access** (no fullscreen lockdown):
+
+- **Window:** starts **maximized** (`maximized: true`), not fullscreen, resizable. No OS-key
+  blocking, no always-on-top — the booth PC stays usable as a PC.
+- **Right-click:** the context menu is blocked in **prod only** (`apps/web/src/lib/kiosk.ts`,
+  guarded on `import.meta.env.PROD`); dev keeps right-click + devtools. Applies to both the browser
+  prod build and the desktop build (same SPA).
+- **`VITE_API_BASE` wired to the environment:** `apps/web/.env.production` (committed, non-secret,
+  allow-listed in `.gitignore`) sets `VITE_API_BASE=http://127.0.0.1:3000`, auto-loaded by
+  `vite build` (which the desktop bundle runs). So the desktop build targets Fastify with no manual
+  export; the browser-served-by-Fastify build should override to `""`.
+- **Auto-update (prompt-on-update, self-hosted):** `tauri-plugin-updater` + `tauri-plugin-process`.
+  On launch the SPA checks the endpoint (`apps/web/src/lib/desktop-updater.ts`, no-op in browser /
+  offline), prompts the operator (i18n `update.prompt`), then `downloadAndInstall()` + `relaunch()`.
+  Accepts that the appliance may be **offline** day-to-day and brought online (phone hotspot) only
+  when an update is wanted — consistent with [[offline-first]] (no network dependency in *core*
+  operation; updates are out-of-band). Endpoint in `tauri.conf.json` is a **placeholder**
+  (`https://UPDATES.EXAMPLE.invalid/...`) to fill in once the self-hosted update URL exists; the
+  server must serve `latest.json` + the signed installer + its `.sig`.
+- **Code-signing (updater):** an Ed25519 **updater keypair** was generated. The **public key is
+  embedded** in `tauri.conf.json` (`plugins.updater.pubkey`); the **private key + password live
+  OUTSIDE the repo** at `~/.parking-updater-keys/` (0600) and as the build-time secrets
+  `TAURI_SIGNING_PRIVATE_KEY` / `TAURI_SIGNING_PRIVATE_KEY_PASSWORD`. Losing them means no future
+  signed updates — back them up. **Verified:** a signed `pnpm --filter @parking/desktop bundle`
+  produced `.deb`/`.rpm`/`.AppImage` **plus their `.sig` updater signatures**; full `turbo run build
+  lint` 14/14 green. *(This is the **updater** signing — distinct from OS-installer signing for
+  Windows/macOS "unknown publisher", and from the [[atecc608]]/[[tpm]] **event** signing.)*
+- **Still deferred:** the actual update-hosting URL, OS-level installer signing
+  (Windows/macOS publisher trust), and the Windows kiosk-browser fallback path.

wiki/decisions/open-questions.md

@@ -2,14 +2,14 @@
 type: decision
 tags: [parking, decisions, open]
 sources: [parking-system-architecture]
-updated: 2026-06-15
+updated: 2026-06-21
 status: open
 ---
 
 # Open Questions / Next Steps
 
-**Not yet decided**, and they drive everything else — settle before procurement. (See
-[[parking-system-architecture]] §10.)
+**Not yet decided** (or decided-but-not-yet-built), and they drive everything else — settle before
+procurement. (See [[parking-system-architecture]] §10.)
 
 1. **Lane topology.** One host per lane, or one central host driving networked devices in each
    lane? Decides how many controllers, printers, UPSs, and [[sqlite]] instances exist, and the
@@ -62,3 +62,36 @@ status: open
     reclaim deleted-blob pages without `VACUUM`. **Undecided:** pruning policy (age-based vs.
     total-size cap), VACUUM cadence, and how this interacts with the #5 backup strategy (blobs
     bloat every backup). Until decided, snapshots accumulate unbounded. See [[entry-exit-points]].
+11. **Appliance OS image → WebKitGTK version (Tauri dependency).** _(Raised by
+    [[desktop-shell-tauri]], 2026-06-21; narrowed same day.)_ The chosen
+    [[desktop-shell-tauri|Tauri v2 desktop shell]] renders through the **host's WebKitGTK**, not a
+    bundled browser. The risk reduces to which OS the appliance runs:
+    - **Best case — Ubuntu 26.04 LTS desktop (intended):** ships a current, distro-maintained
+      WebKitGTK → this question is **effectively resolved**; just confirm the built SPA renders on
+      the actual image and pin it.
+    - **Worst case — Windows 11 + WSL + Docker:** this **conflicts with the standing platform
+      decision** (Linux appliance, *not* Windows/WSL — see [[standing-decisions]],
+      [[disk-os-hardening]]) and a GUI shell doesn't live inside headless WSL/Docker. Fallback is
+      **no native shell — a kiosk browser** at the local [[fastify]]-served SPA (Electron only if a
+      standalone Windows installer is mandated). See [[desktop-shell-tauri]] for the decision table.
+    Close this once the appliance OS image is fixed and the SPA is verified against its WebView.
+    (Ties to #1 lane topology / image standardization.)
+12. **TPM 2.0 hardening — implementation (to build).** _(Recorded 2026-06-21; analysis in [[tpm]].)_
+    On the Ubuntu 26.04 LTS appliance, harden using the host **TPM**: (a) **sealed-LUKS auto-unlock**
+    (`systemd-cryptenroll --tpm2-device`) so the encrypted disk auto-unlocks only on an untampered
+    boot → unattended reboot after power loss; (b) optionally hold the **non-extractable host
+    event-signing key** in the TPM (a new `Signer` impl — no `EventLog` change; mirrors the
+    [[atecc608]] swap), defeating the offline pull-the-disk-and-re-sign attack. **Must include:**
+    require **TPM 2.0** (reject 1.2), **prefer fTPM** + a per-op **PIN/auth policy** (not PCR-only —
+    bus-sniff), a **LUKS recovery passphrase**, and a **re-seal-on-update runbook** (kernel/GRUB/BIOS
+    updates change the PCRs and lock the disk). TPM **complements, never replaces**, [[reconciliation]];
+    it does nothing against a rooted live host or the operator. Moot in the Windows + WSL fallback. See
+    [[tpm]], [[disk-os-hardening]]; relates to #6 (host secure-element by platform) and #13.
+13. **Startup chain-integrity self-check (to build).** _(Raised by the pull-the-disk trace,
+    2026-06-21.)_ `verifyChain()` exists and pinpoints any tamper, but **nothing invokes it on
+    boot** — a tampered DB loads and serves normally (detectable but undetected). Wire a **startup
+    self-check** that runs `verifyChain()` and, on a break, **flags degraded state / writes a signed
+    `anomaly` + alarms** (surfaced to the booth footer / next reconciliation). Open: refuse-to-serve
+    vs. serve-degraded — lean **serve-degraded + loud alarm** (fail-open on exit still governs;
+    refusing to boot could strand a lane). Software-only, independent of the TPM/[[atecc608]] hardware.
+    See [[append-only-event-chain]].

wiki/decisions/standing-decisions.md

@@ -2,7 +2,7 @@
 type: decision
 tags: [parking, decisions]
 sources: [parking-system-architecture]
-updated: 2026-06-14
+updated: 2026-06-21
 status: settled
 ---
 
@@ -20,6 +20,11 @@ The decisions treated as settled in the design notes. (See [[parking-system-arch
     [[vision-service]].
 - **Platform:** a **dedicated, hardened Linux appliance** (LUKS + GRUB password + Secure Boot),
   **not Windows/WSL** — see [[disk-os-hardening]].
+- **Desktop shell:** the operator UI ships as a **[[desktop-shell-tauri|Tauri v2]]** kiosk wrapper
+  (chosen over Electron, 2026-06-21) — small footprint, no bundled Chromium to patch, and a
+  deny-by-default native surface that fits [[threat-model|the booth-operator threat model]]. The
+  shell stays **thin**: all privileged logic remains in [[fastify]]. One open dependency — the
+  appliance's WebKitGTK version (see [[open-questions]] #11).
 - **Integrity:** append-only, hash-chained, [[atecc608]]-signed event log
   ([[append-only-event-chain]]); **[[reconciliation]] is the anti-fraud control**; encryption
   protects only at-rest (see [[threat-model]]).