The product was spikes/gpui-shell: a cargo workspace of its own, named in the
root manifest's exclude list. It inherited neither unsafe_code = "forbid" nor
clippy pedantic, and ./scripts/ci.sh never compiled it. Every test written into
it silently never ran, and apps/lumbridge was an eleven-line stub printing a
version string.
Four separate research passes over the sidebar, settings, devices, and theme
work independently discovered they were about to write substantial new code into
that directory. Graduating first means writing it once.
- apps/lumbridge is the product; spikes/ui-shell-model becomes
crates/lumbridge-ui-fixture and joins the workspace.
- scripts/ci.sh takes --headless and --ui. The headless pass excludes the two UI
crates by name, so a contributor changing lumbridge-core does not wait on a
window toolkit, and a runner that cannot carry GPUI still gates everything
else. A new crate is headless by default rather than silently joining the slow
job.
- scripts/native-libs.sh replaces the ad-hoc symlink in the launcher, and says
which apt package actually fixes the problem instead of working around it
silently. The stale libxcb/libxkbcommon symlinks in the old spike target
directory are gone; only libxkbcommon-x11.so was ever needed.
- deny.toml and cargo deny check licenses. spikes/README.md called GPUI's
licence closure a hard gate and the scorecard scored it pending; graduation
makes it the product's closure, so it is enforced rather than described. Two
rejections were reviewed and allowed with the reasoning recorded in the file:
webpki-roots under CDLA-Permissive-2.0 (Mozilla's CA store, data not code,
reached through ureq) and libfuzzer-sys under NCSA (reached only under
all-features via gpui's image decoder; no shipped build links it).
Clippy pedantic across both crates is clean at -D warnings. render was 353
lines; render_sidebar, render_tabs, and render_root come out of it, which the
sidebar rework needed anyway. The remaining over-length functions are single
declarative element trees and carry per-function allows with reasons, not a
blanket suppression.
Decision 0017 records the two calls this forces: published gpui 0.2.2 behind an
accessibility adapter rather than an unpinned Zed revision and an MSRV bump, and
Floem frozen rather than maintained in parity or deleted.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The footer was rebuilt on a real ledger two commits ago. The rest of the shell
was never audited the same way, and a multi-agent pass over it found the same
class of defect everywhere else:
- A sidebar card reading "Buzz · lumbridgecode / connected · signed identity"
in the success colour. lumbridge-buzz is not a dependency of this binary.
- A saved host "amd-server", and a WORKTREES section with five entries and a
working selector, backed by a lumbridge-git crate that does not exist.
- A first-run workspace of six panes announcing "Codex · runtime / metal ·
Tailscale SSH", "Claude Code · UI / MacBook Air · local" and a Pi pane on a
saved host. Every one of them was a /bin/sh, and the machine names were this
developer's.
- A declared "Pi · spark-1 · laguna-s-2.1" usage profile with no probe of any
kind behind it. Declaring a profile promises the gap is real; that one could
never be filled.
- FOOTER_CENTER = "Codex · ChatGPT subscription · 62% window remaining",
rendered by the Floem shell. Decision 0013 names that exact form as the thing
that must never be shown.
- The header's PTY count painted green unconditionally, so "0/5 LIVE PTYS" read
as success. runtime_rows already had the right rule three hundred lines away.
- A browser panel describing itself as "An isolated system-web-engine surface"
on the chooser screen where you pick it. There is no web engine in this build.
First run is now three real local shells, and a pane claims a harness when one
has actually been launched into it. The seed mapping stays for when that is
possible.
Also removes the only unsafe block in the shell: a test set LUMBRIDGE_*_PROBE
through the environment, which needs unsafe under edition 2024 and silently
disabled both probes for every other test in the binary. Replaced with
UsageFeedOptions passed to start_with.
Clippy pedantic on the spike goes 79 -> 15 against root CI's -D warnings, so
graduating it into the workspace is not gated on a warning cleanup. The four
remaining too_many_lines are the render split, which the sidebar work needs to
do anyway.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
karti