Graduate the shell out of spikes/ into apps/lumbridge

The product was spikes/gpui-shell: a cargo workspace of its own, named in the root manifest's exclude list. It inherited neither unsafe_code = "forbid" nor clippy pedantic, and ./scripts/ci.sh never compiled it. Every test written into it silently never ran, and apps/lumbridge was an eleven-line stub printing a version string. Four separate research passes over the sidebar, settings, devices, and theme work independently discovered they were about to write substantial new code into that directory. Graduating first means writing it once. - apps/lumbridge is the product; spikes/ui-shell-model becomes crates/lumbridge-ui-fixture and joins the workspace. - scripts/ci.sh takes --headless and --ui. The headless pass excludes the two UI crates by name, so a contributor changing lumbridge-core does not wait on a window toolkit, and a runner that cannot carry GPUI still gates everything else. A new crate is headless by default rather than silently joining the slow job. - scripts/native-libs.sh replaces the ad-hoc symlink in the launcher, and says which apt package actually fixes the problem instead of working around it silently. The stale libxcb/libxkbcommon symlinks in the old spike target directory are gone; only libxkbcommon-x11.so was ever needed. - deny.toml and cargo deny check licenses. spikes/README.md called GPUI's licence closure a hard gate and the scorecard scored it pending; graduation makes it the product's closure, so it is enforced rather than described. Two rejections were reviewed and allowed with the reasoning recorded in the file: webpki-roots under CDLA-Permissive-2.0 (Mozilla's CA store, data not code, reached through ureq) and libfuzzer-sys under NCSA (reached only under all-features via gpui's image decoder; no shipped build links it). Clippy pedantic across both crates is clean at -D warnings. render was 353 lines; render_sidebar, render_tabs, and render_root come out of it, which the sidebar rework needed anyway. The remaining over-length functions are single declarative element trees and carry per-function allows with reasons, not a blanket suppression. Decision 0017 records the two calls this forces: published gpui 0.2.2 behind an accessibility adapter rather than an unpinned Zed revision and an MSRV bump, and Floem frozen rather than maintained in parity or deleted. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-31 23:05:12 -07:00
parent 834b73e831
commit 316fa32745
21 changed files with 9111 additions and 10660 deletions
@@ -8,6 +8,7 @@ members = [
    "crates/lumbridge-runtime",
    "crates/lumbridge-storage",
    "crates/lumbridge-terminal",
+    "crates/lumbridge-ui-fixture",
 ]
 exclude = ["spikes"]
 resolver = "2"
@@ -8,8 +8,15 @@ license.workspace = true
 repository.workspace = true

 [dependencies]
+gpui = "0.2.2"
 lumbridge-core = { path = "../../crates/lumbridge-core" }
+lumbridge-harness = { path = "../../crates/lumbridge-harness" }
+lumbridge-runtime = { path = "../../crates/lumbridge-runtime" }
+lumbridge-storage = { path = "../../crates/lumbridge-storage" }
+lumbridge-terminal = { path = "../../crates/lumbridge-terminal" }
+lumbridge-ui-fixture = { path = "../../crates/lumbridge-ui-fixture" }
+serde = { version = "1.0.228", features = ["derive"] }
+serde_json = "1.0.149"

 [lints]
 workspace = true
-
@@ -1,6 +1,6 @@
 use std::collections::BTreeSet;

-use lumbridge_spike_model::PaneId as FixturePaneId;
+use lumbridge_ui_fixture::PaneId as FixturePaneId;
 use serde::{Deserialize, Serialize};

 #[derive(Clone, Copy, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
@@ -238,11 +238,16 @@ impl PanelRegistry {
        let Some(position) = attached.iter().position(|id| *id == self.selected) else {
            return false;
        };
-        let next = position as isize + delta;
-        if next < 0 || next >= attached.len() as isize {
+        // checked_add_signed rather than a round trip through isize: the cast
+        // pair could wrap on a 32-bit target, and the bounds check that followed
+        // it was doing the work this does directly.
+        let Some(next) = position.checked_add_signed(delta) else {
            return false;
-        }
-        self.select(attached[next as usize])
+        };
+        let Some(id) = attached.get(next) else {
+            return false;
+        };
+        self.select(*id)
    }

    pub(crate) fn create(&mut self, kind: PanelKind) -> PanelId {
@@ -152,7 +152,7 @@ impl UsageFeed {
    /// when no adapter can run.
    fn start_codex_probe(&mut self, enabled: bool) {
        if !enabled {
-            self.probe_status = "codex probe disabled".to_owned();
+            "codex probe disabled".clone_into(&mut self.probe_status);
            return;
        }
        match CodexProbe::start(CodexProbeOptions::default()) {
@@ -165,7 +165,7 @@ impl UsageFeed {
                        .insert(profile.id().clone(), ProbeHealth::Starting);
                }
                self.probes.push(Box::new(probe));
-                self.probe_status = "codex probe starting".to_owned();
+                "codex probe starting".clone_into(&mut self.probe_status);
            }
            Err(error) => {
                self.probe_status = format!("codex probe unavailable · {error}");
@@ -183,7 +183,7 @@ impl UsageFeed {
            // Say so, rather than leaving whatever the Codex path last wrote.
            // A disabled probe that reports nothing about itself is
            // indistinguishable from one that failed to start.
-            self.probe_status = "claude probe disabled".to_owned();
+            "claude probe disabled".clone_into(&mut self.probe_status);
            return;
        }
        match ClaudeCodeProbe::start(ClaudeCodeProbeOptions::default()) {
@@ -0,0 +1,15 @@
+[package]
+name = "lumbridge-ui-fixture"
+description = "Deterministic shell fixtures shared by the native UI and its comparison spike"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+publish = false
+
+[lib]
+path = "src/lib.rs"
+
+[lints]
+workspace = true
@@ -200,7 +200,7 @@ pub const PANES: [PaneFixture; 6] = [

 /// The one footer string the frozen Floem shell renders.
 ///
-/// It replaces three that read like data — a pane census, "Codex · ChatGPT
+/// It replaces three that read like data — a pane census, "Codex · `ChatGPT`
 /// subscription · 62% window remaining", and "burn 8.4%/hr · resets in 2h 14m".
 /// Decision 0013 names that exact form as the thing that must never be shown,
 /// and a comparison shell rendering a fabricated quota beside a real one is
@@ -366,6 +366,10 @@ impl Default for ShellModel {
 }

 impl ShellModel {
+    /// # Errors
+    ///
+    /// Returns [`InvalidTerminalLineLimit`] when `limit` is zero: a terminal
+    /// that retains no lines is not a smaller scrollback, it is a broken one.
    pub fn with_terminal_line_limit(limit: usize) -> Result<Self, InvalidTerminalLineLimit> {
        if limit == 0 {
            return Err(InvalidTerminalLineLimit);
@@ -503,6 +507,15 @@ impl ShellModel {
        self.counters
    }

+    /// # Panics
+    ///
+    /// Panics if a pane reported as attached is absent from the attached-ID
+    /// list, which would mean the attachment grid and the pane table had
+    /// diverged. That is an invariant break in this fixture, not an input error.
+    #[allow(
+        clippy::too_many_lines,
+        reason = "one match over the action enum; splitting it hides the exhaustiveness"
+    )]
    pub fn dispatch(&mut self, action: ShellAction) -> ActionOutcome {
        self.counters.events_dispatched += 1;
        let mut changed = false;
@@ -510,7 +523,7 @@ impl ShellModel {
        match action {
            ShellAction::MoveFocus(direction) => {
                if let Some(next) =
-                    attached_focus_neighbor(&self.attached_panels, self.selected_pane, direction)
+                    attached_focus_neighbor(self.attached_panels, self.selected_pane, direction)
                {
                    self.selected_pane = next;
                    self.counters.focus_moves += 1;
@@ -677,7 +690,7 @@ pub const fn focus_neighbor(pane: PaneId, direction: FocusDirection) -> Option<P
 }

 fn attached_focus_neighbor(
-    attached: &[bool; GRID_ROWS * GRID_COLUMNS],
+    attached: [bool; GRID_ROWS * GRID_COLUMNS],
    pane: PaneId,
    direction: FocusDirection,
 ) -> Option<PaneId> {
@@ -732,7 +745,7 @@ mod tests {
                .panes()
                .iter()
                .filter(|pane| pane.needs_input())
-                .map(|pane| pane.id())
+                .map(super::PaneState::id)
                .collect::<Vec<_>>(),
            vec![PaneId::ClaudeUi]
        );
@@ -0,0 +1,57 @@
+# License policy for everything Lumbridge ships.
+#
+# Graduating the GPUI shell out of `spikes/` moved several hundred packages from
+# a spike's dependency tree into the product's. `spikes/README.md` called GPUI's
+# license closure "a hard gate" and the scorecard scored it `pending`; this is
+# where that gate is enforced rather than described.
+#
+#   cargo install cargo-deny && cargo deny check licenses
+[graph]
+all-features = true
+
+[licenses]
+# Permissive, plus two weak-copyleft licenses that are file-level and do not
+# reach Lumbridge's own sources.
+allow = [
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "BSL-1.0",
+    "CC0-1.0",
+    "ISC",
+    "MIT",
+    "MIT-0",
+    "MPL-2.0",
+    "Unicode-3.0",
+    "Unlicense",
+    "Zlib",
+
+    # Reviewed additions, each reached by exactly one path:
+    #
+    # CDLA-Permissive-2.0 is webpki-roots, which is Mozilla's CA root store —
+    # data, not code, under a permissive data licence with no copyleft and no
+    # attribution requirement on downstream distribution. It arrives through
+    # ureq, which the Claude usage endpoint needs (decision 0016).
+    "CDLA-Permissive-2.0",
+    # NCSA is libfuzzer-sys, a permissive BSD/MIT-style licence. It reaches the
+    # graph only as rav1e -> ravif -> image -> gpui and only under
+    # `all-features`; no shipped build links it. Allowed rather than excluded so
+    # the audit stays strict everywhere else.
+    "NCSA",
+]
+# A dependency whose license cannot be determined is not a licensing question to
+# settle later; it is a blocker now.
+unused-allowed-license = "allow"
+confidence-threshold = 0.9
+
+[bans]
+multiple-versions = "allow"
+
+[advisories]
+yanked = "deny"
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
@@ -43,7 +43,11 @@ messages should be real from the beginning.

 The scaffold currently contains `lumbridge-core`, `lumbridge-storage`,
 `lumbridge-buzz`, `lumbridge-pty`, `lumbridge-runtime`, `lumbridge-terminal`,
-`lumbridge-harness`, and the entry point. `lumbridge-core` also contains the
+`lumbridge-harness`, `lumbridge-ui-fixture`, and the `lumbridge` application
+itself. The GPUI shell was a spike in an excluded workspace until it graduated
+into `apps/lumbridge`; `scripts/ci.sh` now takes `--headless` and `--ui` so the
+non-UI crates still build in seconds, and `cargo deny check licenses` gates the
+dependency closure that graduation made the product's. See decision 0017. `lumbridge-core` also contains the
 first typed workspace command reducer and the usage ledger. Larger runtime
 crates are added after their architecture spikes pass.

@@ -128,7 +132,16 @@ details. The measured spike compares:
 1. GPUI for a Zed-like native model and excellent text-heavy interaction.
 2. Floem for an independent native Rust model with existing editor primitives.

-The winner must render six busy panes smoothly, keep input latency low, support
+Floem is frozen: the scorecard records it failing the accessibility hard gate
+with no AccessKit at its pinned revision, and comparability on the footer strip
+was already lost when the usage ledger landed. It is retained as evidence at the
+revision where the comparison was made, not maintained in parity. The product
+ships on published `gpui 0.2.2`, which has no AccessKit either, behind a narrow
+adapter that no-ops today and calls real roles on a Zed revision later — so that
+gate is knowingly unmet and staged rather than quietly dropped. See decision
+0017.
+
+The original comparison bar was that the winner must render six busy panes smoothly, keep input latency low, support
 IME/accessibility, package on macOS and both Linux targets, and avoid a license
 or upstream-stability trap. Current Zed GPUI is the provisional winner because
 its AccessKit semantics compile while the pinned Floem revision has no semantic
@@ -0,0 +1,69 @@
+# 0017: The product graduates on published GPUI, behind an accessibility adapter, and Floem is frozen
+
+Status: accepted. Supersedes the provisional direction in `UI_SPIKE_SCORECARD.md`.
+
+Until now the product was `spikes/gpui-shell`: a cargo workspace of its own,
+listed in the root manifest's `exclude`, so it inherited neither
+`unsafe_code = "forbid"` nor `clippy pedantic`, and `./scripts/ci.sh` never
+compiled it. Every test written into it silently never ran. That is the reason
+this record exists before any feature work: the sidebar, settings, and devices
+pages are all substantial new code, and writing them into an unlinted directory
+would mean writing them twice.
+
+## The GPUI dependency
+
+The product ships on published `gpui 0.2.2` from crates.io, not on a Zed git
+revision.
+
+The scorecard's provisional direction was "GPUI-first using current Zed GPUI
+behind a narrow Lumbridge UI adapter", and that is being inverted here, so the
+cost is stated plainly: **published 0.2.2 has no AccessKit dependency.** There
+is no `Role`, no `aria_label`. Every pane and every sidebar row ships
+screen-reader-silent, and `UX_VERTICAL_SLICE.md`'s hard gate — "the
+accessibility tree names each pane, selected state, execution target, and
+waiting state" — is knowingly unmet.
+
+It is chosen anyway because a git dependency on an unpinned upstream, plus an
+MSRV move from 1.94 to 1.97.1 across every crate in the workspace, is a large
+standing cost to carry for a capability we can stage.
+
+The mitigation is a narrow `a11y` adapter trait, introduced now while there are
+few call sites: it no-ops on 0.2.2 and calls real roles and labels on a git
+revision. The migration is then a swap rather than a rewrite.
+`spikes/gpui-accessibility-probe` (Zed revision `ce48461e`, toolchain 1.97.1) is
+retained, not deleted, as the standing proof that the semantics compile with
+stable IDs and roles. Reversing this decision means changing one dependency line
+and one adapter implementation.
+
+The scorecard's `pending` row for GPUI's dependency-license closure stops being
+a spike question the moment 746 lockfile packages enter the root workspace: it
+becomes the product's license closure. `deny.toml` and `cargo deny check
+licenses` land in the same change, and the result is pasted into that row.
+
+## Floem
+
+`spikes/floem-shell` is **frozen**. It is no longer described as a comparable
+candidate, and `ARCHITECTURE.md`'s "UI decision gate" and `TESTING.md`'s
+"identical GPUI/Floem action replay" line are corrected to match.
+
+Comparability was already gone and already conceded — the scorecard records that
+"the Floem shell still renders the static footer fixtures, so the two candidates
+are no longer comparable on that strip", which the usage ledger work caused. It
+also records Floem failing the accessibility gate outright, with no AccessKit at
+its pinned revision. Keeping true parity would mean theming it alongside every
+visual change forever, which is a recurring cost for a candidate that has
+already lost on a hard gate.
+
+Freezing rather than deleting keeps the evidence trail: if the GPUI bet ever
+needs revisiting, the comparison exists at the revision where it was made. What
+freezing does not license is leaving falsehoods on screen — its fabricated
+footer quota and its fixture worktree list naming a developer's machines were
+deleted in the same pass as the GPUI shell's.
+
+## The default theme and accent
+
+The UI accent stays cool blue. `BRAND.md` scopes Ember (`#FF6B35`) to the
+application icon and warns against low-contrast orange behind the mark;
+`UX_VERTICAL_SLICE.md` commits the UI to one cool-blue action accent. Ember is
+offered as a user-selectable accent rather than made the default, so neither
+document needs amending.
@@ -1,15 +1,70 @@
 #!/usr/bin/env bash
+# Lumbridge CI.
+#
+#   scripts/ci.sh              headless and UI
+#   scripts/ci.sh --headless   everything except the GPUI product
+#   scripts/ci.sh --ui         only the GPUI product and its fixture
+#
+# The split exists because the UI crates pull GPUI's dependency tree — several
+# hundred packages and a large target directory — while the headless crates
+# build in seconds. A contributor changing lumbridge-core should not wait for a
+# window toolkit, and a CI runner that cannot carry the UI job can still gate
+# everything else.
 set -euo pipefail

-cargo fmt --all --check
-cargo clippy --workspace --all-targets --all-features -- -D warnings
+run_headless=1
+run_ui=1
+case "${1:-}" in
+  --headless) run_ui=0 ;;
+  --ui) run_headless=0 ;;
+  "") ;;
+  *) echo "usage: $0 [--headless|--ui]" >&2; exit 2 ;;
+esac

-if command -v cargo-nextest >/dev/null 2>&1; then
-  cargo nextest run --workspace --all-features --profile "${NEXTEST_PROFILE:-default}"
+# The UI crates. Excluded from the headless pass by name so a new crate is
+# headless by default rather than silently joining the slow job.
+ui_packages=(lumbridge lumbridge-ui-fixture)
+
+cargo fmt --all --check
+
+# The product's licence closure. Graduating GPUI into the workspace made this
+# the product's problem rather than a spike's; deny.toml records which licences
+# were reviewed and why. Skipped rather than failed when the tool is absent, so
+# a contributor without it is not blocked.
+if command -v cargo-deny >/dev/null 2>&1; then
+  cargo deny check licenses
 else
-  echo "cargo-nextest not installed; using cargo test" >&2
-  cargo test --workspace --all-features
+  echo "cargo-deny not installed; skipping the licence gate (cargo install cargo-deny)" >&2
 fi

-# nextest deliberately does not run doctests on stable Rust.
-cargo test --workspace --all-features --doc
+test_runner() {
+  if command -v cargo-nextest >/dev/null 2>&1; then
+    cargo nextest run "$@" --all-features --profile "${NEXTEST_PROFILE:-default}"
+  else
+    echo "cargo-nextest not installed; using cargo test" >&2
+    cargo test "$@" --all-features
+  fi
+}
+
+if [ "$run_headless" = 1 ]; then
+  exclusions=()
+  for package in "${ui_packages[@]}"; do
+    exclusions+=(--exclude "$package")
+  done
+  cargo clippy --workspace "${exclusions[@]}" --all-targets --all-features -- -D warnings
+  test_runner --workspace "${exclusions[@]}"
+  # nextest deliberately does not run doctests on stable Rust.
+  cargo test --workspace "${exclusions[@]}" --all-features --doc
+fi
+
+if [ "$run_ui" = 1 ]; then
+  # shellcheck source=/dev/null
+  . "$(dirname "$0")/native-libs.sh"
+  selections=()
+  for package in "${ui_packages[@]}"; do
+    selections+=(-p "$package")
+  done
+  cargo clippy "${selections[@]}" --all-targets --all-features -- -D warnings
+  test_runner "${selections[@]}"
+  cargo test "${selections[@]}" --all-features --doc
+fi
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Makes GPUI's X11 backend linkable on distributions that ship
+# libxkbcommon-x11.so.0 without the unversioned development symlink.
+#
+# The real fix is installing libxkbcommon-x11-dev. When that package is absent
+# this creates the one symlink the linker needs in a cache directory and exports
+# LIBRARY_PATH, so a UI build works without root. Source it, do not run it.
+#
+#   source scripts/native-libs.sh
+
+lumbridge_native_libs() {
+  local runtime=/usr/lib/x86_64-linux-gnu/libxkbcommon-x11.so.0
+  local devlink=/usr/lib/x86_64-linux-gnu/libxkbcommon-x11.so
+  if [ -e "$devlink" ]; then
+    return 0
+  fi
+  if [ ! -e "$runtime" ]; then
+    echo "libxkbcommon-x11 is not installed; a UI build will fail to link" >&2
+    echo "  install it with: sudo apt install libxkbcommon-x11-dev" >&2
+    return 0
+  fi
+  local cache="${XDG_CACHE_HOME:-$HOME/.cache}/lumbridge-native-libs"
+  mkdir -p "$cache"
+  ln -sfn "$runtime" "$cache/libxkbcommon-x11.so"
+  export LIBRARY_PATH="$cache${LIBRARY_PATH:+:$LIBRARY_PATH}"
+  echo "using $cache for libxkbcommon-x11.so (install libxkbcommon-x11-dev to avoid this)" >&2
+}
+
+lumbridge_native_libs
@@ -4,8 +4,8 @@ set -euo pipefail
 repo_path=${LUMBRIDGE_REPO:-/home/metal/Desktop/Lumbridge Code/lumbridge}
 window_title='Lumbridge · GPUI workspace'
 bacon_title='Lumbridge · Bacon'
-manifest_path="$repo_path/spikes/gpui-shell/Cargo.toml"
-binary_path="$repo_path/spikes/gpui-shell/target/debug/lumbridge-spike-gpui"
+manifest_path="$repo_path/Cargo.toml"
+binary_path="$repo_path/target/debug/lumbridge"

 if [[ ! -d "$repo_path/.git" ]]; then
  echo "Lumbridge repository not found at $repo_path" >&2
@@ -34,14 +34,9 @@ if [[ ! -x "$binary_path" ]]; then
    echo "required command not found: cargo" >&2
    exit 1
  fi
-  xkb_runtime=/usr/lib/x86_64-linux-gnu/libxkbcommon-x11.so.0
-  if [[ -e "$xkb_runtime" ]]; then
-    native_libs="$repo_path/spikes/gpui-shell/target/native-libs"
-    mkdir -p "$native_libs"
-    ln -sfn "$xkb_runtime" "$native_libs/libxkbcommon-x11.so"
-    export LIBRARY_PATH="$native_libs${LIBRARY_PATH:+:$LIBRARY_PATH}"
-  fi
-  cargo build --locked --manifest-path "$manifest_path"
+  # shellcheck source=/dev/null
+  source "$repo_path/scripts/native-libs.sh"
+  cargo build --locked --manifest-path "$manifest_path" -p lumbridge
 fi

 # GPUI's X11 client sets WM_NAME but not _NET_WM_NAME, so wmctrl's window list
@@ -9,6 +9,6 @@ publish = false

 [dependencies]
 floem = { git = "https://github.com/lapce/floem", rev = "778bb5f2aa08429e579ee2e6ac97e84fbf18b618", default-features = false, features = ["editor", "vger"] }
-lumbridge-spike-model = { path = "../ui-shell-model" }
+lumbridge-ui-fixture = { path = "../../crates/lumbridge-ui-fixture" }

 [workspace]
@@ -11,7 +11,7 @@ use floem::{
    style::Position,
    window::WindowConfig,
 };
-use lumbridge_spike_model::{
+use lumbridge_ui_fixture::{
    FOOTER_FIXTURE_NOTICE, FocusDirection, PaneId, PaneState, ShellAction, ShellModel, SurfaceKind,
 };

@@ -1,21 +0,0 @@
-[package]
-name = "lumbridge-spike-gpui"
-description = "GPUI implementation of the Lumbridge native shell spike"
-version = "0.0.1"
-edition = "2024"
-rust-version = "1.94"
-license = "Apache-2.0"
-publish = false
-
-[dependencies]
-gpui = "0.2.2"
-lumbridge-core = { path = "../../crates/lumbridge-core" }
-lumbridge-harness = { path = "../../crates/lumbridge-harness" }
-lumbridge-runtime = { path = "../../crates/lumbridge-runtime" }
-lumbridge-spike-model = { path = "../ui-shell-model" }
-lumbridge-storage = { path = "../../crates/lumbridge-storage" }
-lumbridge-terminal = { path = "../../crates/lumbridge-terminal" }
-serde = { version = "1.0.228", features = ["derive"] }
-serde_json = "1.0.149"
-
-[workspace]
@@ -1,7 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 4
-
-[[package]]
-name = "lumbridge-spike-model"
-version = "0.0.1"
@@ -1,13 +0,0 @@
-[package]
-name = "lumbridge-spike-model"
-description = "Identical fixture data for Lumbridge native UI comparisons"
-version = "0.0.1"
-edition = "2024"
-rust-version = "1.94"
-license = "Apache-2.0"
-publish = false
-
-[lib]
-path = "src/lib.rs"
-
-[workspace]