# Harness enhancements

The desktop harness (`apps/harness/harness.mjs`, 99-line zero-dep watcher) is the
"credentials stay on your machine" local capture path: watch a folder → POST images to
`/api/harness/ingest` → review queue. It's the cheapest high-volume on-ramp for a seller's
existing photo workflow. Enhancements, prioritized.

## Tier 1 — make it trustworthy at volume (pain #4 photo throughput)
- **Device + tenant identity.** Replace the static token with a real device/tenant
  registration through the **P9 gateway** (D33) — the current `h-auth` gap. Per-device keys,
  revocable.
- **Idempotent + dedup ingest.** Content-hash each image; idempotent replay so re-runs / re-copies
  don't create duplicate candidates (P5 source idempotency).
- **Reliable watch + retry queue.** Survive restarts, network drops, and large dumps: a durable
  local queue with backoff retry; resume where it left off.
- **HEIC/RAW support.** Sellers shoot on phones (HEIC) and cameras (RAW) — convert/normalize
  before upload.

## Tier 2 — privacy & safety (the whole point of "stays on your machine")
- **Path + EXIF redaction.** Hash/strip local paths and sensitive EXIF (GPS) before sending;
  metadata-only candidates, no canonical writes (the P5 guard).
- **Per-sale routing.** `--sale` + multi-folder watch so one machine handles several concurrent
  estates; auto-tag candidates by source folder.
- **Durable media handoff.** Copy originals to durable candidate storage before any
  canonical/public use (don't depend on the local file persisting).

## Tier 3 — operator experience
- **Status UI / system tray.** A small desktop status (queued / uploaded / failed / review-ready)
  instead of console-only; one-glance "is it working."
- **Mobile pairing / handoff.** Pair the harness with the mobile app so on-site phone captures
  and desktop folder captures land in the same review queue.
- **Throughput stats.** Images/min, pending, errors — mirrors the web throughput dashboard.
- **Packaging.** A signed installer + auto-update so non-technical sellers can run it (today it's
  `node harness.mjs …`).

## Tier 4 — reach
- **Local cloud-connector mode.** Optionally let the harness pull from a *local* Drive/Photos
  sync folder so cloud creds never leave the machine (complements the web connectors, D34).

## Sequencing
Identity + idempotency (Tier 1) align with **Wave 4** (P5 connectors / P9 API). Privacy guards
are the **P5 quarantine** condition for `/api/harness/ingest` (already tracked). Operator
experience + packaging are independent and can ship anytime once the contract path is live.