v0.3.7-pre.013

crates/ksp-app-backfill-desk/tests/desktop_security.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-app-backfill-desk/tests/desktop_security.rs
-// version: 15
+// version: 16
 
 //! Security and dependency-boundary checks for the Backfill Desk scaffold.
 
@@ -365,3 +365,31 @@ fn pre_012_program_id_autocomplete_exposes_only_public_registry_metadata_and_no_
     assert!(selection_source.contains("registryMatch"));
     assert!(!selection_source.contains("address.value"));
 }
+
+#[test]
+fn pre_013_final_frontend_and_ipc_surface_keeps_physical_and_checkpoint_material_backend_owned() {
+    let root = app_root();
+    let frontend = read_text(root.join("frontend/ts/main.ts").as_path());
+    for forbidden in ["http://", "https://", "localStorage", "sessionStorage", "indexedDB", "document.cookie", "privateKey", "secretKey"] {
+        assert!(!frontend.contains(forbidden), "final frontend contains forbidden marker {forbidden}");
+    }
+    let tauri = read_text(root.join("src/tauri.rs").as_path());
+    for forbidden in ["BackfillCheckpoint", "HttpTransportPool", "ksp_store_postgres_lib", "tokio_postgres", "reqwest", "tonic"] {
+        assert!(!tauri.contains(forbidden), "Tauri IPC shell owns forbidden physical/runtime marker {forbidden}");
+    }
+    let dto = read_text(root.join("src/dto_backfill.rs").as_path());
+    for marker in ["BackfillStartResponseDto", "BackfillCancelResponseDto", "BackfillResumeResponseDto"] {
+        let source = struct_source(dto.as_str(), marker);
+        assert!(!source.is_empty(), "missing DTO {marker}");
+        for forbidden in [
+            "pub(crate) checkpoint:",
+            "pub(crate) endpoint:",
+            "pub(crate) provider:",
+            "pub(crate) credential:",
+            "pub(crate) token:",
+            "pub(crate) payload:",
+        ] {
+            assert!(!source.contains(forbidden), "DTO {marker} leaks forbidden field {forbidden}");
+        }
+    }
+}