Architecture

Shape

GTK GUI ─┐
         ├─ canonical core ─ transaction engine ─ adapters ─ files / IPC / D-Bus
CLI ─────┘                         └─────────────── plugin broker ─ sandboxed children

One helm-settings executable opens the GUI or dispatches CLI subcommands. There is no 0.1 daemon. The compositor-neutral core owns models, plans, policy, validation, history, and recovery.

Runtime

GTK objects remain on the GLib main context. A Tokio backend owns sockets, subprocesses, timeouts, cancellation, and plugin lifecycles. Immutable commands and results cross typed channels. Cohesive filesystem transactions run off the UI thread without splitting their atomic sequence.

Workspace

The Cargo workspace separates models, orchestration, transactions/config I/O, adapter crates, plugin protocol, public SDK, CLI, GUI, and the final application binary. Project-authored unsafe Rust is forbidden by default.

State

Readable TOML stores preferences, themes, and profiles. SQLite indexes transaction metadata and recovery state. Exact immutable snapshot payloads live beneath the XDG state directory. Runtime locks live beneath XDG_RUNTIME_DIR; disposable data uses the XDG cache directory.