Three gates in this repository were decorative, and each was discovered by
being wrong rather than by failing.
A crate directory in neither members nor exclude is silently not built, which
is how lumbridge-devices shipped 1,127 lines that had never compiled.
scripts/workspace-guard.sh refuses that state, and asserts the gpui source
and version out of Cargo.lock rather than the manifest, because a manifest
states an intent while the lockfile states what would actually be compiled --
and a caret requirement accepts a version nobody reviewed. It needs no
compiler, so it runs first and in the headless job, which unlike the UI job
is not continue-on-error and can therefore actually fail a push.
deny.toml's source policy had never been executed: ci.sh ran `check
licenses` alone, and `check sources` failed immediately on the rev-pinned
buzz-sdk. The permitted Git sources are now named one by one and the check
runs, so a fourth is a decision rather than an accident.
cargo-deny and cargo-nextest being absent was a warning that let a run report
green having skipped the licence gate DISTRIBUTION.md depends on. Under
LUMBRIDGE_CI_STRICT=1 a missing tool now fails; locally it stays a warning so
a contributor is not blocked.
skills/lumbridge-development/SKILL.md told every agent that GPUI and Floem
live in spikes/ and that no framework may be selected until both pass the
hard gates. Decision 0017 settled that a month ago in the opposite direction.
The entry point an agent is meant to read was the least accurate document in
the repository.
Decision 0023 records where the GPUI dependency actually goes. Published gpui
has not been released since 2025-10-22, Zed's main still declares 0.2.2 with
no bump pending, the platform backends moved to crates that inherit
publish = false, gpui's own x11 and wayland features are now empty markers,
and 0.2.2 has no accesskit dependency at all -- so "published now, migrate
later" was never available. The adapter 0017 promised was never written and
the call sites grew from few to 147 against 20 identities, so the adapter is
written first, on 0.2.2, before the dependency moves.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SPYebLiN2w4TqnHUYGdECq
The product was spikes/gpui-shell: a cargo workspace of its own, named in the
root manifest's exclude list. It inherited neither unsafe_code = "forbid" nor
clippy pedantic, and ./scripts/ci.sh never compiled it. Every test written into
it silently never ran, and apps/lumbridge was an eleven-line stub printing a
version string.
Four separate research passes over the sidebar, settings, devices, and theme
work independently discovered they were about to write substantial new code into
that directory. Graduating first means writing it once.
- apps/lumbridge is the product; spikes/ui-shell-model becomes
crates/lumbridge-ui-fixture and joins the workspace.
- scripts/ci.sh takes --headless and --ui. The headless pass excludes the two UI
crates by name, so a contributor changing lumbridge-core does not wait on a
window toolkit, and a runner that cannot carry GPUI still gates everything
else. A new crate is headless by default rather than silently joining the slow
job.
- scripts/native-libs.sh replaces the ad-hoc symlink in the launcher, and says
which apt package actually fixes the problem instead of working around it
silently. The stale libxcb/libxkbcommon symlinks in the old spike target
directory are gone; only libxkbcommon-x11.so was ever needed.
- deny.toml and cargo deny check licenses. spikes/README.md called GPUI's
licence closure a hard gate and the scorecard scored it pending; graduation
makes it the product's closure, so it is enforced rather than described. Two
rejections were reviewed and allowed with the reasoning recorded in the file:
webpki-roots under CDLA-Permissive-2.0 (Mozilla's CA store, data not code,
reached through ureq) and libfuzzer-sys under NCSA (reached only under
all-features via gpui's image decoder; no shipped build links it).
Clippy pedantic across both crates is clean at -D warnings. render was 353
lines; render_sidebar, render_tabs, and render_root come out of it, which the
sidebar rework needed anyway. The remaining over-length functions are single
declarative element trees and carry per-function allows with reasons, not a
blanket suppression.
Decision 0017 records the two calls this forces: published gpui 0.2.2 behind an
accessibility adapter rather than an unpinned Zed revision and an MSRV bump, and
Floem frozen rather than maintained in parity or deleted.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The footer showed invented percentages. It now shows what two harnesses
actually report, or says it does not know.
lumbridge-core gains an append-only per-profile UsageLedger and a projection
that labels every derived value estimated, withholds a burn rate from a single
sample, withholds a window fraction with no reported ceiling, withholds an
exhaustion estimate that lands after the reset, and reports an expired window
as rolled over rather than freezing its last percentage. A missing fact renders
as missing, never as zero. (0012)
lumbridge-harness is the impure side: processes, clocks, and untrusted wire
text in, observations out. Three adapters:
- Codex's account/rateLimits/read over the app-server's JSON-RPC stdio. The
client cannot express a request outside a two-variant enum and answers every
server-to-client request with -32601, so a harness asking Lumbridge for a
credential is refused by construction. (0013)
- Claude Code's session transcripts, as a byte-offset tail follower that
reports nothing until the backlog is read to EOF — a partially-read backlog
is indistinguishable from a burst of spend, and the first run against 20 MB
reported forty-six billion tokens an hour. The parser models four counters,
so the conversations in those files are not representable. (0014)
- Claude Code's five-hour and seven-day subscription windows, via a bridge
installed as its statusLine command. 0014 had claimed no such surface
existed; it does, and the record is corrected in place rather than quietly
edited. Lumbridge does not read the OAuth credential to call the account
usage endpoint, which is what comparable tools do — AGENTS.md forbids it,
and 0015 says so rather than leaving the gap unexplained.
Also in here: a capability-check ordering fix in the workspace reducer, where
the applied-request replay table was consulted before the capability check and
so answered questions the caller had no right to ask; the GPUI spike wired to
the live probes with per-harness gauges and provenance chips; and a launcher
that matches its own window by PID, because GPUI sets WM_NAME but not
_NET_WM_NAME and a title match never succeeded.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
karti