From 378e3eb0eb3f725d94140dce3da14e3557178efe Mon Sep 17 00:00:00 2001 From: Metal Agent Date: Tue, 1 Sep 2026 13:17:27 -0700 Subject: [PATCH] Name the Git sources the framework arrives through Stage 3 of decision 0023. cargo deny reports these as unmatched today, which is correct: nothing depends on them yet. Landing the allowance before the dependency means the swap in the next commit fails on a compiler error if it fails at all, rather than on a policy the same change would have had to edit. zed-industries/font-kit is the one worth reading twice. gpui_wgpu reaches font-kit through a Git source rather than crates.io, so adopting GPUI brings two Git sources, not one -- and an allowance discovered while debugging a failed build is an allowance nobody reviewed. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01SPYebLiN2w4TqnHUYGdECq --- deny.toml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/deny.toml b/deny.toml index 9e42d46..899f025 100644 --- a/deny.toml +++ b/deny.toml @@ -66,4 +66,14 @@ allow-registry = ["https://github.com/rust-lang/crates.io-index"] # block/buzz is the upstream Buzz SDK, rev-pinned in crates/lumbridge-buzz. # It has no crates.io release; BUZZ_INTEGRATION.md records why we use its signed # protocol semantics rather than inventing a dialect. -allow-git = ["https://github.com/block/buzz"] +allow-git = [ + "https://github.com/block/buzz", + # The UI framework, pinned by decision 0023 to a full revision because + # crates.io publishing of gpui stopped in October 2025 and the platform + # backends now live in crates Zed does not publish at all. + "https://github.com/zed-industries/zed", + # Not optional and not obvious: gpui_wgpu reaches font-kit through a Git + # source of Zed's own, so adopting the framework brings two Git sources + # rather than one. Naming it here is what stops that arriving unnoticed. + "https://github.com/zed-industries/font-kit", +]