Make the gate structural, and correct what it tells an agent

Three gates in this repository were decorative, and each was discovered by
being wrong rather than by failing.

A crate directory in neither members nor exclude is silently not built, which
is how lumbridge-devices shipped 1,127 lines that had never compiled.
scripts/workspace-guard.sh refuses that state, and asserts the gpui source
and version out of Cargo.lock rather than the manifest, because a manifest
states an intent while the lockfile states what would actually be compiled --
and a caret requirement accepts a version nobody reviewed. It needs no
compiler, so it runs first and in the headless job, which unlike the UI job
is not continue-on-error and can therefore actually fail a push.

deny.toml's source policy had never been executed: ci.sh ran `check
licenses` alone, and `check sources` failed immediately on the rev-pinned
buzz-sdk. The permitted Git sources are now named one by one and the check
runs, so a fourth is a decision rather than an accident.

cargo-deny and cargo-nextest being absent was a warning that let a run report
green having skipped the licence gate DISTRIBUTION.md depends on. Under
LUMBRIDGE_CI_STRICT=1 a missing tool now fails; locally it stays a warning so
a contributor is not blocked.

skills/lumbridge-development/SKILL.md told every agent that GPUI and Floem
live in spikes/ and that no framework may be selected until both pass the
hard gates. Decision 0017 settled that a month ago in the opposite direction.
The entry point an agent is meant to read was the least accurate document in
the repository.

Decision 0023 records where the GPUI dependency actually goes. Published gpui
has not been released since 2025-10-22, Zed's main still declares 0.2.2 with
no bump pending, the platform backends moved to crates that inherit
publish = false, gpui's own x11 and wayland features are now empty markers,
and 0.2.2 has no accesskit dependency at all -- so "published now, migrate
later" was never available. The adapter 0017 promised was never written and
the call sites grew from few to 147 against 20 identities, so the adapter is
written first, on 0.2.2, before the dependency moves.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SPYebLiN2w4TqnHUYGdECq

skills/lumbridge-development/SKILL.md

@@ -27,20 +27,61 @@ Preserve these product boundaries:
   not cross-platform proof.
 - Usage and quota values always retain provenance and uncertainty.
 
+## The UI framework is decided
+
+GPUI graduated out of `spikes/` into `apps/lumbridge` and is part of the product
+workspace, its lints, and its licence closure. `spikes/floem-shell` is frozen
+evidence at the revision the comparison was made; it is not maintained in parity
+and is not a candidate. Do not reopen the comparison, do not add Floem to the
+workspace, and do not read `UI_SPIKE_SCORECARD.md`'s provisional wording as a
+live question. See `docs/decisions/0017-*` and any record superseding it.
+
+## The dependencies that are not an agent's decision
+
+Do not change the `gpui` (or `gpui_platform`) source, revision, or version. Do
+not edit `rust-toolchain.toml` or the workspace `rust-version`. Do not run
+`cargo update`, or relax `deny.toml`, to make a UI build succeed. Each of these
+is fixed by a decision record and checked mechanically in the fast headless CI
+job; a change to any of them requires a new decision record, not a commit.
+
+If a UI build fails, the failure is the finding. Report it.
+
+## Every crate is a workspace member
+
+A crate directory that appears in neither `workspace.members` nor
+`workspace.exclude` inherits no lints, is not built, and its tests never run --
+silently. This has happened twice in this repository, and both times the code
+looked finished and was not. When you add a crate, add it to `members` in the
+same change, and never move code into an excluded directory to make a build
+pass.
+
 ## Development loop
 
-Before editing, inspect Git status and preserve unrelated work. Use:
+Before editing, inspect Git status and preserve unrelated work.
+
+`cargo` is installed at `~/.cargo/bin` and is put on `PATH` by an interactive
+shell profile. A non-interactive shell -- which is what an agent, an `ssh`
+command, and a hook all get -- does not source that profile and will fail with
+`cargo: command not found`. Export it explicitly:
 
 ```bash
-bacon
-cargo xtest
-./scripts/ci.sh
+export PATH="$HOME/.cargo/bin:$PATH"
 ```
 
-Root CI must remain independent from experimental UI dependencies. GPUI and
-Floem live in separate workspaces under `spikes/` and consume the same
-`ui-shell-model` fixture. Record only observed results in the scorecard; do not
-select a framework until both pass the hard gates.
+Then:
+
+```bash
+bacon               # continuous check; t tests, c lints, v the full gate
+cargo xtest         # fast isolated tests with nextest
+./scripts/ci.sh     # format + strict Clippy + tests + doctests + cargo deny
+```
+
+`scripts/ci.sh --headless` skips the GPUI crates and finishes in seconds;
+`--ui` runs only them. A headless pass is not a product pass: it deliberately
+excludes `apps/lumbridge`. Never report the gate as green from `--headless`
+alone, and never conclude a gate passed from an exit code you obtained through
+a pipe -- a pipeline reports the exit status of its last command, which has
+already hidden a failing gate here once.
 
 For Buzz integration, use its Apache-2.0 Rust SDK and signed protocol semantics
 rather than inventing a webhook dialect. Test against a local relay and fixture
@@ -48,6 +89,6 @@ identity. Pane screenshots or transcripts require a visible preview, redaction,
 explicit destination, and user confirmation before upload.
 
 Add tests at the lowest deterministic layer first, then platform or rendered
-tests where behavior crosses a real boundary. Before handoff, run the relevant
-spike build plus `./scripts/ci.sh`, `git diff --check`, and report anything not
-validated on all target systems.
+tests where behavior crosses a real boundary. Before handoff, run
+`./scripts/ci.sh`, `git diff --check`, and report anything not validated on all
+target systems.