Add native platform capability adapters

[robinbraemer]

Outcome

Expose genuinely native platform experiences through narrow typed capabilities while keeping shared interface state and workflows in the Effect application kernel.

Provide:

• the protected NativeHost Effect service and schema contracts;
• one real macOS capability implemented through the reviewed Tauri/Rust/Swift boundary;
• typed platform availability and authorization failures;
• lifecycle, interruption, and resource ownership;
• a documented adapter pattern for Windows, Linux, iOS, and Android; and
• browser fallback behavior when a native capability is unavailable.

Exclusions

• Letting capsules load Swift, Kotlin, Rust, native libraries, or executables.
• Moving shared interface state or business workflows into platform code.
• Pretending web components automatically become native controls.

Acceptance criteria

• The first Swift-backed capability is invoked only through an approved broker grant.
• Browser and unsupported-platform tests receive typed unavailable-capability results.
• Revocation and application shutdown release native resources.
• Platform adapters cannot read or write interface revisions, call Pi directly, or bypass Effect authorization.
• The shared capsule continues to render when the native enhancement is absent.

[robinbraemer]

Product-quality coverage: FQ-20.2 through FQ-20.6, FQ-21.6, and FQ-24.4.

[robinbraemer]

Pushed local-ready evidence — 2026-08-10

A real Swift/AppKit system-accent read now crosses a fixed C ABI and main-window-only Rust command, then a schema-decoded Effect service and explicit revocable broker grant. Browsers and unsupported hosts receive typed unavailability, and native authority cannot access workspace revisions or Pi.

The adapter and 26/26 Rust host tests are pushed on codex/flect-vision-complete. This issue remains open until integration.