Metal AgentandClaude Opus 5
9a29e8e335
Three gates in this repository were decorative, and each was discovered by being wrong rather than by failing. A crate directory in neither members nor exclude is silently not built, which is how lumbridge-devices shipped 1,127 lines that had never compiled. scripts/workspace-guard.sh refuses that state, and asserts the gpui source and version out of Cargo.lock rather than the manifest, because a manifest states an intent while the lockfile states what would actually be compiled -- and a caret requirement accepts a version nobody reviewed. It needs no compiler, so it runs first and in the headless job, which unlike the UI job is not continue-on-error and can therefore actually fail a push. deny.toml's source policy had never been executed: ci.sh ran `check licenses` alone, and `check sources` failed immediately on the rev-pinned buzz-sdk. The permitted Git sources are now named one by one and the check runs, so a fourth is a decision rather than an accident. cargo-deny and cargo-nextest being absent was a warning that let a run report green having skipped the licence gate DISTRIBUTION.md depends on. Under LUMBRIDGE_CI_STRICT=1 a missing tool now fails; locally it stays a warning so a contributor is not blocked. skills/lumbridge-development/SKILL.md told every agent that GPUI and Floem live in spikes/ and that no framework may be selected until both pass the hard gates. Decision 0017 settled that a month ago in the opposite direction. The entry point an agent is meant to read was the least accurate document in the repository. Decision 0023 records where the GPUI dependency actually goes. Published gpui has not been released since 2025-10-22, Zed's main still declares 0.2.2 with no bump pending, the platform backends moved to crates that inherit publish = false, gpui's own x11 and wayland features are now empty markers, and 0.2.2 has no accesskit dependency at all -- so "published now, migrate later" was never available. The adapter 0017 promised was never written and the call sites grew from few to 147 against 20 identities, so the adapter is written first, on 0.2.2, before the dependency moves. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SPYebLiN2w4TqnHUYGdECq
132 lines
7.1 KiB
Markdown
132 lines
7.1 KiB
Markdown
# 0023: The GPUI dependency moves to a pinned Zed revision, and the accessibility adapter is written before it moves
|
|
|
|
Status: accepted. Supersedes the dependency choice in decision 0017; that
|
|
record's disposition of Floem, its account of the licence closure, and its
|
|
reasoning about accent colour all stand.
|
|
|
|
Decision 0017 chose published `gpui 0.2.2` from crates.io over a Zed git
|
|
revision, accepted a known-unmet accessibility gate as the price, and described
|
|
the way back: "Reversing this decision means changing one dependency line and
|
|
one adapter implementation." Both halves of that sentence have since been
|
|
falsified. The published crate is not a release line that can be migrated from
|
|
later, and the adapter that was supposed to make the migration cheap was never
|
|
written.
|
|
|
|
## The published crate is not a channel
|
|
|
|
Measured against the crates.io API and Zed's `main` on 2026-09-01:
|
|
|
|
- `gpui`'s newest version is `0.2.2`, published **2025-10-22**. Every non-yanked
|
|
release was published in a seventeen-day window in October 2025, and nothing
|
|
has been published in the ten months since.
|
|
- Zed's `main` still declares `version = "0.2.2"` in `crates/gpui/Cargo.toml`.
|
|
Ten months of development, no version bump: nobody upstream is preparing a
|
|
publish.
|
|
- The platform layer has since been split into `gpui_platform`, `gpui_linux`,
|
|
`gpui_macos`, `gpui_windows`, `gpui_wgpu`, `gpui_web` and `gpui_apple`. All of
|
|
them inherit `publish = false` from Zed's workspace; only `crates/gpui` sets
|
|
`publish = true`. On `main` the `x11` and `wayland` features of `gpui` itself
|
|
are now empty markers, because the backends they used to select live in
|
|
`gpui_linux`.
|
|
- Published 0.2.2 has no `accesskit` dependency at all, and
|
|
`docs.rs/gpui/0.2.2/gpui/enum.Role.html` is a 404. At `ce48461e`,
|
|
`crates/gpui/Cargo.toml:50` carries `accesskit.workspace = true`.
|
|
- Published 0.2.2 renders through `blade-graphics`. Upstream rendering has moved
|
|
to `gpui_wgpu`.
|
|
|
|
So the choice was never "0.2.2 now, a newer published version later". Even if
|
|
Zed published tomorrow, the publishable crate no longer contains a Linux
|
|
platform backend. Staying means freezing permanently on an October-2025
|
|
artifact, and permanently failing the hard gate in `UX_VERTICAL_SLICE.md` that
|
|
says the accessibility tree must name each pane, its selected state, its
|
|
execution target, and its waiting state.
|
|
|
|
## A pinned revision is not an unpinned upstream
|
|
|
|
Decision 0017's objection was "a git dependency on an unpinned upstream". That
|
|
is not what is adopted here. With a full-SHA `rev`, a committed `Cargo.lock`,
|
|
and `deny.toml` naming the permitted Git sources, a git dependency is *more*
|
|
pinned than `gpui = "0.2.2"`, which is a caret requirement that would silently
|
|
accept a `0.2.3` nobody reviewed. The real cost is that bumping the revision
|
|
becomes a deliberate scheduled act. That cost is accepted and named here rather
|
|
than avoided.
|
|
|
|
The target revision is `ce48461eaadd16c65c31f835511ab96bd3b6e746`
|
|
(2026-08-31), which is the revision `spikes/gpui-accessibility-probe` already
|
|
pins and already proves compiles with stable accessibility IDs, workspace/pane
|
|
roles, selected state, and real `EntityInputHandler`/`ElementInputHandler`
|
|
implementations. Its toolchain is Rust 1.97.1, moving the workspace from 1.94.1.
|
|
|
|
## The adapter comes first, and it does not exist yet
|
|
|
|
Decision 0017 said the mitigation was "a narrow `a11y` adapter trait, introduced
|
|
now while there are few call sites", so that the migration would be "a swap
|
|
rather than a rewrite". No such trait, module, or file exists anywhere in the
|
|
workspace. The only trace is `apps/lumbridge/src/sidebar/model.rs`, where
|
|
`describe()` produces the screen-reader sentence, is tested, is called by
|
|
nothing, and carries an `#[allow(dead_code, reason = "wired up with the
|
|
accessibility adapter, decision 0017")]`.
|
|
|
|
Meanwhile the call sites stopped being few: `apps/lumbridge/src` now builds 147
|
|
elements and gives only 20 of them a stable identity.
|
|
|
|
Writing the adapter is therefore the first step and happens **before** the
|
|
dependency changes, on 0.2.2, where its bodies are no-ops. That keeps the
|
|
dependency swap a swap, as 0017 intended, instead of paying for the swap and
|
|
the wiring in one unreviewable change. The `#[allow(dead_code)]` is deleted by
|
|
that step rather than carried.
|
|
|
|
## Order, and why each step is alone
|
|
|
|
Each stage lands separately because each fails differently, and a combined
|
|
failure is unattributable:
|
|
|
|
1. **The `a11y` adapter, still on 0.2.2.** No-op bodies; wire the elements that
|
|
carry identity; give `describe()` a caller.
|
|
2. **The toolchain, still on 0.2.2.** Move `rust-toolchain.toml`, the workspace
|
|
`rust-version`, and the toolchain named in `.gitea/workflows/ci.yml` — which
|
|
hardcodes it twice rather than reading the file — to 1.97.1. Three minor
|
|
versions of new `clippy::pedantic` lints arrive as hard errors under
|
|
`-D warnings`. Isolating this stage is what stops a lint avalanche being
|
|
mistaken for a GPUI API break.
|
|
3. **`deny.toml`.** Add `zed-industries/zed` and `zed-industries/font-kit` to
|
|
`allow-git`. The second is not optional: `gpui_wgpu` reaches `font-kit`
|
|
through a Git source, so the move brings two Git sources, not one.
|
|
4. **The dependency swap.** `gpui` and `gpui_platform` at the pinned rev;
|
|
`wayland`/`x11` requested on `gpui_platform`, where they still mean
|
|
something; and `Application::new()` — which does not exist at that revision —
|
|
becomes `gpui_platform::application()`.
|
|
5. **Real semantics in the adapter**, and the probe's AccessKit tree test ported
|
|
into `apps/lumbridge`.
|
|
6. **The probe changes job**: it stops proving AccessKit exists and starts
|
|
proving the next revision still compiles.
|
|
|
|
The renderer swap from blade to wgpu in stage 4 is the least characterised risk.
|
|
`scripts/native-libs.sh` addresses one missing `libxkbcommon-x11` symlink and
|
|
says nothing about a Vulkan or GL loader, and the Gitea job installs no wgpu
|
|
dependency. Expect to learn something here.
|
|
|
|
## What is knowingly still unmet
|
|
|
|
A passing unit test over an AccessKit `TreeUpdate` is not an assistive-technology
|
|
claim. The gate is not met until AT-SPI/Orca on Linux and VoiceOver on macOS
|
|
have been driven by hand. Stage 5 makes the semantics real; it does not close
|
|
the gate, and nothing in this record should be read as closing it.
|
|
|
|
## Enforcement
|
|
|
|
This record is not self-enforcing, and the previous one was not obeyed. Three
|
|
mechanical checks carry it instead:
|
|
|
|
- `scripts/workspace-guard.sh` asserts the gpui source and version in
|
|
`Cargo.lock` — the lockfile, because a manifest states an intent while the
|
|
lockfile states what would actually compile. It runs in the fast headless job,
|
|
which is not `continue-on-error`, so it gates every push.
|
|
- `deny.toml`'s `unknown-git = "deny"` plus an explicit `allow-git` list makes a
|
|
fourth Git source a CI failure. `scripts/ci.sh` now actually runs
|
|
`cargo deny check sources`; it previously ran only `check licenses`, and the
|
|
source policy had never once been executed.
|
|
- `AGENTS.md` names the gpui dependency, `rust-toolchain.toml`, the workspace
|
|
`rust-version`, and `deny.toml` as things a contributor or agent may not
|
|
change without a decision record.
|