Brutal

Brutal-owned GPUI cockpit · detached terminals · durable provider-neutral agents · 7 slices · 5 shipped

Match the canonical prototype in a small owned shell → connect real PTYs and persistence → add agents, editor, and evidence → package and cut over.

EngineCockpitSessionsUXDistributionHosted product (optional)🔒 launch blocker

Now (0)

Next (4)

Rocks · load-bearing

LOWN3 · Detached native terminal surfaceSessions
Codex 5.6 Sol · primaryv0🔒

Render low-level terminal state directly in GPUI and connect it to Brutal's detached PTY runtime without terminal_view or workspace.

Done criteria

Two real PTYs accept pre/post-switch and pre/post-restart input; ANSI, Unicode, alternate screen, scrollback, resize, selection, copy/paste, search, mouse protocols, IME, shell integration, process exit, cleanup, reconnect, and replay execute. Switching projects or restarting the UI never terminates a live session, and stalled clients cannot block healthy sessions.

decorative terminal panes, workspace coupling, and project switches that kill processes
LOWN4 · Versioned projects, sessions, and restorationSessions
Codex 5.6 Sol · primaryv1🔒

Make Brutal state authoritative for projects, sessions, panes, runtime identity, drafts, events, and replay.

Done criteria

SQLite restores project order, selected project/session, accordion and rail state, pane tree and ratios, focus, terminals and scrollback, drafts, unread state, runtime attachment, remaining budgets, and recovery status after forced termination. Migration operates on copied legacy state; corruption, downgrade, backup, rollback, stale socket, and missing process fail safely without changing the source.

volatile cockpit state, duplicate panes after restart, and destructive legacy migration
LOWN5 · Provider-neutral agent panes and subscriptionsEngine
Codex 5.6 Sol · primaryv1🔒

Connect Brutal's owned agent loop and dynamically discovered signed-in or local provider adapters to durable peer panes.

Done criteria

At least one available signed-in Codex, Claude, Gemini, ACP, or local runtime completes a real repository task without requiring an API key or Zed account. Adapters normalize streams, reasoning, tools, usage, errors, cancellation, and resume; unavailable providers do not block others. Sessions survive project switches and restart with immutable cwd, model, endpoint, permission, and tool bindings.

vendor-owned product contracts, hardcoded model lists, and disposable chats

Pebbles · features

LOWN6 · Bounded native editor and Git diffEngine
Codex 5.6 Sol · primaryv1🔒

Ship the editor needed beside terminals and agents without importing Zed's workspace-bound editor surface.

Done criteria

Rope buffers and tree-sitter power open, edit, selection, multi-cursor, undo/redo, search, syntax, atomic save, external-change conflict, dirty recovery, and Git diff. Files open from the Files drawer into peer panes, context actions and shortcuts use the shared registry, and restart restores clean and dirty buffers safely.

a full IDE fork, a fake editor preview, and silent data loss

Later (3)

Rocks · load-bearing

LOWN7 · Evidence workflows and capability safetyEngine
Codex 5.6 Sol · primaryv2🔒

Connect graph workflows, human gates, observed evidence, budgets, permissions, and writer leases to the native cockpit.

Done criteria

Build-review executes planner, editable approval, one writer, deterministic tests, independent review, bounded retry, rejection, abort, and success. Every run persists remaining step/tool/token/time/cost budgets, terminal reason, shared state, node-local transcripts, and attributable evidence. Replay, no-progress, repetition, symlink escape, duplicate writers, untrusted tool output, and global stop pass.

workflow theater, auto-approved writes, runaway loops, and model narration treated as success
LOWN8 · Standalone package and daily-driver cutoverDistribution
Codex 5.6 Sol · primaryv2🔒

Package, migrate, measure, audit, and cut over the Brutal-owned app only after real-path parity.

Done criteria

Brutal.app, brutal-runtime, and brutal CLI launch from one immutable manifest; two repositories run concurrent terminals, agents, editors, and build-review through every prototype path and restart. Cold typeability p95 is at most 2.5s, input-to-paint p95 at most 16.7ms, one idle project at most 200MiB RSS, signed archive at most 110MiB, shell incremental rebuild at most 90s, identity and dependency audits pass, and crates/zed is no longer a default member or package dependency.

shipping another themed fork, an unverifiable migration, or a package that still launches Zed
MDIST0 · Standalone release supply-chain ownershipDistribution
Codex 5.6 Sol · primaryv2🔒

Own GPUI donor intake and the complete Brutal release chain without carrying the Zed application package.

Done criteria

The first release OS, architecture, and minimum-version matrix is explicit. The pinned Zed base has a documented update and conflict policy; advisories and dependencies are reviewed; SBOM, exact-source provenance, third-party notices, declared source/license obligations, signing, notarization inputs, Brutal update-feed verification, bad-release rollback, and clean-account offline install/uninstall paths are tested. Public notarization and distribution remain separately parked until external Apple credentials exist; this card proves the local release chain and notarization-ready inputs without pretending the public artifact shipped. Donor endpoints, credentials, mutable CI actions, and development-only capability switches are absent from the release configuration.

stale fork risk, donor release leakage, and a signed package without a maintainable update or rollback chain
✅ Shipped (5)
SSAFE0 · Minimum executable capability boundaryEngine
Codex 5.6 Sol · primaryv0🔒

Enforce process, filesystem, network, environment, and consent boundaries below Brutal's terminal and agent surfaces.

Done criteria

Terminal, Brutal agent, Git, login-shell bootstrap, task, language-server, extension, debugger, context-server, donor-model, ACP, REPL, dev-container, external-formatter, and remote-development surfaces each have an owner, default state, process/filesystem/network scope, visible consent rule, and test. Only direct terminals, Brutal agents, project-scoped Git, and shell bootstrap are enabled by default. A deny-by-default OS-enforced broker scopes filesystem roots, executables, child processes, network destinations, tools, and environment beneath provider- and donor-owned code. An authenticated out-of-band global stop remains available when the UI or agent loop is unhealthy. Table-driven packaged tests exercise every disabled initializer, direct process entry point, menu, and command route and prove rejection without child process, socket, network, or filesystem side effects. Adversarial files, shell output, MCP/context-server results, and fetched content cannot expand authority or rewrite policy. No prompt, label, working directory, or command-string filter is described as a security boundary.

executable donor capabilities becoming reachable before Brutal can constrain or explain them
LOWN2 · Pane tree, actions, overlays, and native interactionUX
Codex 5.6 Sol · primaryv0🔒

Make every shell control operate through one Brutal action registry and a durable mixed-pane model.

Done criteria

Project tabs and accordion sessions, grid/columns/rows/focus, pane focus/split/move/swap/resize/close/reopen, rail resize, menus, shortcuts, command palette, project launcher, drawers, settings, themes, notifications, toasts, context menus, drag/drop, accessibility, and narrow focus execute through production state. Pointer and keyboard routes invoke the same actions; disabled and destructive states are explicit.

a static prototype, duplicate command plumbing, missing mouse support, and hidden interaction states
MOWN1 · Standalone GPUI shell and prototype parityCockpit
v0🔒

Launch a small Brutal-owned GPUI application that renders the canonical shell with production components and honest pane states.

Done criteria

brutal_app launches without crates/zed and renders native macOS menus outside the window plus 42/36/flexible/28 content bands, a 252px navigator, 32px pane headers, 1px seams, explicit 12/11/10px type hierarchy, compact icons, canonical terminal/agent/editor/review panes, and narrow focused-pane behavior. The same production components drive deterministic visual fixtures. Packaged 1440×900 and 390×844 comparison has no geometry delta over 2px and masked SSIM is at least 0.98.

slow full-workbench iteration, fake fixture parity, and typography drift
SOWN0 · Recovery and Brutal-owned architecture lockDistribution
v0🔒

Preserve the incomplete Zed-shell work, create the standalone branch, lock donor boundaries, and keep the oracle recoverable without steering the product.

Done criteria

The Zed-shell WIP is committed, tagged, and pushed without lost work; the standalone branch contains the approved docs, roadmap/archive migration, dependency denylist, and pending evidence ledgers. Cargo metadata proves Brutal core crates remain GPUI-free and brutal_app/brutal_ui cannot import Zed workbench, workspace, client, sidebar, title-bar, agent-UI, or collaboration crates. The old executable remains identifiable and buildable as an oracle.

another destructive reset, ambiguous substrate, or accidental re-entry into the Zed workbench
MOPS1 · Bounded native build, evidence, and Brutal-only automationDistribution
v0🔒

Keep the Zed-scale Rust build inside a measured local storage budget, make acceptance evidence immutable and queryable, and prevent inherited donor automation from running in the private Brutal repository.

Done criteria

A build preflight proves projected peak growth plus a recovery reserve before broad Cargo work; ignored output has a bounded cleanup policy; a clean checkout builds both Brutal.app and brutal-runtime through the documented path; and a fresh non-incremental package build is tied to an exact source/toolchain/artifact manifest. Before BZ2 deepens the fork, a stripped release feasibility artifact measures archive size, cold launch, idle RSS, and focused input latency and records an explicit keep, trim, or revise-contract decision. Every active card has machine-readable atomic criteria with pending, executed, or failed status, command or interaction, source and artifact hashes, execution date, and residual; generated parent status cannot hide a failed child. Every inherited Zed workflow is archived outside .github/workflows; the sole active workflow is manual-only with bounded permissions, timeout, and concurrency; and an ownership manifest plus Rust-aware parsing makes the 300/200/50 gate fail for every unregistered Brutal-owned Rust file and every function form, including const, unsafe, extern, attributed, and multiline declarations.

disk exhaustion, late release infeasibility, unverifiable green cards, hidden compute spend, donor deployment jobs, and source files escaping the line-limit gate