Architecture

Skryba Desktop is a SwiftUI executable with a narrow process boundary.

SkrybaRootView
  ↕ bindings
SkrybaModel ── validates draft / owns run state / holds the catalog as the CLI listed it
  ↓
SkrybaCLI actor ── resolves and spawns installed skryba
  ↓ stdin / ↑ stdout, stderr, status
skryba CLI ── Brama, detectors, cache, policy, style and language catalog
  ↓ spawn (writing-style train, rewrite --generator local)
ster ── checkpoint, gradient, adapter

Components

Source	Responsibility
SkrybaDesktopApp.swift	application entry and model lifetime
Views/SkrybaRootView.swift	sidebar, forms, command, loading/failure/result panels
Views/SkrybaInputForms.swift	text input and Rewrite options, including the catalog pickers
Catalog/SkrybaCatalogForm.swift	the Styles & languages form and its result panel
Command/SkrybaChoices.swift	the four workflow cases and the choices inside each form
Command/SkrybaCommand.swift	validation, argv and stdin construction, and the keep command
SkrybaModel.swift	one-run state machine, successful-output dispatch, and catalog listing
SkrybaCLI.swift	executable search, environment merge, process I/O
Command/SkrybaResults.swift	Codable mirrors of CLI JSON

What Desktop owns

• macOS presentation and workflow form ranges;
• exact argv construction for the four views and for writing-style keep;
• locating and spawning one installed CLI per run;
• preserving stdout, stderr, exit status, and displayed command;
• decoding successful Score, Rewrite, Writing style, and catalog JSON into views;
• a Copy action for final rewritten text.

What Desktop does not own

• model or subscription routing;
• detector credentials, provider adapters, normalization, cache, or rate limiting;
• chunking, generation, quality thresholds beyond passing the chosen value, source fallback, or candidate selection;
• the styles and languages a rewrite can require: the CLI's catalog holds them, the app lists and changes them only through skryba style and skryba language, and keeps no list of its own;
• policy training or persistence;
• the writing-style store, its schema, its deduplication, or the shapes it exports: the CLI owns them, and local training belongs to Ster. The app never spawns ster: Train adapter and a local rewrite spawn skryba, which spawns ster — the app neither locates that binary nor sees its progress before the run ends;
• commissioned human work: paying a person to rewrite text runs on the HandToHuman marketplace ledger (handtohuman market), never through this app.

Run state

Recording a preference is a second, independent invocation with its own isKeeping flag and its own status line, so it never replaces the rewrite result it was read from. Listing the catalog is independent too: it runs when the window opens and after every successful catalog change, and its failure is held apart from the run's own failure.

SkrybaModel.run() ignores re-entry while isRunning. A run clears prior result, raw output, and failure; records startedAt; then awaits one actor invocation. defer clears running state. Switching workflows clears result, raw output, failure, and command line but retains draft field values.

Trust boundary

The installed CLI is trusted to honor the command contract but its outputs remain fallible: nonzero stderr is displayed, and zero-status typed JSON is decoded strictly. Desktop never treats malformed successful output as an alternative result. Credentials remain outside SwiftUI fields and are only included in the child process environment.