Preserve the programmable-harness prototype as a GPUI-free crate

[AnthonyRonning]

Draft, preservation only. This stacks on #897 (bundled CPython + CodeMode) and carries the concepts of the retired maple-gpui Developer Preview branch (benthecarman/maple-gpui PR #2, programmable-harness, head 653b959) into the monorepo so that repository can be deleted. Nothing here is wired into the running Agent and nothing was manually tested. It is meant to be cited by a later production design, not merged as a feature.

What is preserved

Piece	Origin	Status here
crates/maple-harness/src/{action,registry,policy,semantic,audit,keymap}.rs	the prototype's GPUI-free contract crate	carried over unchanged, 58 tests
crates/maple-harness/src/host.rs	app/src/harness/host.rs (2.4k lines, GPUI-bound)	rewritten from scratch as a headless single action host, 10 tests
crates/maple-harness/src/catalog.rs	app/src/harness/catalog.rs (3.3k lines)	43-action slice of the section 11.1 catalog as data, 6 tests
crates/maple-harness/src/controller.rs	maple-code-mode/controller.rs + app/src/harness/controller.rs	bounded bridge with the disposition and delivery fences, 6 tests
crates/maple-harness/src/discovery.rs	app/src/harness/{palette,which_key}.rs	palette index and which-key trie derived from registry + resolved keymap, 4 tests
docs/programmable-harness.md	design doc from the branch	unchanged apart from a preservation preface
docs/programmable-harness-distillation.md	new	module-by-module reconstruction of what was not ported, invariant checklist, tiered re-implementation order
docs/programmable-harness-preview-pr.md	the PR #2 description	archived verbatim

What is deliberately not here

The GPUI wiring (typed adapters, window provenance phases, root executor), the composer Vim engine, the shortcut settings UI and store, application Vim navigation, the semantic projection of live screens, the maple_gpui Python SDK, and the worker protocol. The distillation document records their invariants and algorithms so they can be rebuilt against the current apps/maple-agent and the CodeMode runtime from #897.

Invariants the tests pin

• One dispatch path; descriptor validation before authority; unknown or invalid calls are never audited as actions.
• Direct-user gestures bypass controller mode but not availability; model calls obey Off / Read Only / Full Access.
• Human Only stays Human Only through generic delegation (ui.activate_selected resolving to account.sign_out is denied for a model, allowed for a human).
• Any authority change bumps the policy epoch and stale leases fail closed; turning the controller off revokes the bridge queue.
• Stale compare-and-set preconditions are rejected before execution.
• app.quit returns accepted_terminal and the host stops admitting; the delivery barrier must settle before terminal shutdown commits.
• Bound actions must be able to infer their arguments (registry validation caught this during the rewrite, which is the design working as intended).

Verification

cargo test -p maple-harness            # 84 passed
cargo clippy -p maple-harness --all-targets -- -D warnings
cargo fmt --all -- --check
cargo metadata --locked

No manual or UI testing by design.

🤖 Generated with Claude Code