Match the canonical prototype in a small owned shell → connect real PTYs and persistence → add agents, editor, and evidence → package and cut over.
Render low-level terminal state directly in GPUI and connect it to Brutal's detached PTY runtime without terminal_view or workspace.
Two real PTYs accept pre/post-switch and pre/post-restart input; ANSI, Unicode, alternate screen, scrollback, resize, selection, copy/paste, search, mouse protocols, IME, shell integration, process exit, cleanup, reconnect, and replay execute. Switching projects or restarting the UI never terminates a live session, and stalled clients cannot block healthy sessions.
Make Brutal state authoritative for projects, sessions, panes, runtime identity, drafts, events, and replay.
SQLite restores project order, selected project/session, accordion and rail state, pane tree and ratios, focus, terminals and scrollback, drafts, unread state, runtime attachment, remaining budgets, and recovery status after forced termination. Migration operates on copied legacy state; corruption, downgrade, backup, rollback, stale socket, and missing process fail safely without changing the source.
Connect Brutal's owned agent loop and dynamically discovered signed-in or local provider adapters to durable peer panes.
At least one available signed-in Codex, Claude, Gemini, ACP, or local runtime completes a real repository task without requiring an API key or Zed account. Adapters normalize streams, reasoning, tools, usage, errors, cancellation, and resume; unavailable providers do not block others. Sessions survive project switches and restart with immutable cwd, model, endpoint, permission, and tool bindings.
Ship the editor needed beside terminals and agents without importing Zed's workspace-bound editor surface.
Rope buffers and tree-sitter power open, edit, selection, multi-cursor, undo/redo, search, syntax, atomic save, external-change conflict, dirty recovery, and Git diff. Files open from the Files drawer into peer panes, context actions and shortcuts use the shared registry, and restart restores clean and dirty buffers safely.
Connect graph workflows, human gates, observed evidence, budgets, permissions, and writer leases to the native cockpit.
Build-review executes planner, editable approval, one writer, deterministic tests, independent review, bounded retry, rejection, abort, and success. Every run persists remaining step/tool/token/time/cost budgets, terminal reason, shared state, node-local transcripts, and attributable evidence. Replay, no-progress, repetition, symlink escape, duplicate writers, untrusted tool output, and global stop pass.
Package, migrate, measure, audit, and cut over the Brutal-owned app only after real-path parity.
Brutal.app, brutal-runtime, and brutal CLI launch from one immutable manifest; two repositories run concurrent terminals, agents, editors, and build-review through every prototype path and restart. Cold typeability p95 is at most 2.5s, input-to-paint p95 at most 16.7ms, one idle project at most 200MiB RSS, signed archive at most 110MiB, shell incremental rebuild at most 90s, identity and dependency audits pass, and crates/zed is no longer a default member or package dependency.
Own GPUI donor intake and the complete Brutal release chain without carrying the Zed application package.
The first release OS, architecture, and minimum-version matrix is explicit. The pinned Zed base has a documented update and conflict policy; advisories and dependencies are reviewed; SBOM, exact-source provenance, third-party notices, declared source/license obligations, signing, notarization inputs, Brutal update-feed verification, bad-release rollback, and clean-account offline install/uninstall paths are tested. Public notarization and distribution remain separately parked until external Apple credentials exist; this card proves the local release chain and notarization-ready inputs without pretending the public artifact shipped. Donor endpoints, credentials, mutable CI actions, and development-only capability switches are absent from the release configuration.
Enforce process, filesystem, network, environment, and consent boundaries below Brutal's terminal and agent surfaces.
Terminal, Brutal agent, Git, login-shell bootstrap, task, language-server, extension, debugger, context-server, donor-model, ACP, REPL, dev-container, external-formatter, and remote-development surfaces each have an owner, default state, process/filesystem/network scope, visible consent rule, and test. Only direct terminals, Brutal agents, project-scoped Git, and shell bootstrap are enabled by default. A deny-by-default OS-enforced broker scopes filesystem roots, executables, child processes, network destinations, tools, and environment beneath provider- and donor-owned code. An authenticated out-of-band global stop remains available when the UI or agent loop is unhealthy. Table-driven packaged tests exercise every disabled initializer, direct process entry point, menu, and command route and prove rejection without child process, socket, network, or filesystem side effects. Adversarial files, shell output, MCP/context-server results, and fetched content cannot expand authority or rewrite policy. No prompt, label, working directory, or command-string filter is described as a security boundary.
Make every shell control operate through one Brutal action registry and a durable mixed-pane model.
Project tabs and accordion sessions, grid/columns/rows/focus, pane focus/split/move/swap/resize/close/reopen, rail resize, menus, shortcuts, command palette, project launcher, drawers, settings, themes, notifications, toasts, context menus, drag/drop, accessibility, and narrow focus execute through production state. Pointer and keyboard routes invoke the same actions; disabled and destructive states are explicit.
Launch a small Brutal-owned GPUI application that renders the canonical shell with production components and honest pane states.
brutal_app launches without crates/zed and renders native macOS menus outside the window plus 42/36/flexible/28 content bands, a 252px navigator, 32px pane headers, 1px seams, explicit 12/11/10px type hierarchy, compact icons, canonical terminal/agent/editor/review panes, and narrow focused-pane behavior. The same production components drive deterministic visual fixtures. Packaged 1440×900 and 390×844 comparison has no geometry delta over 2px and masked SSIM is at least 0.98.
Preserve the incomplete Zed-shell work, create the standalone branch, lock donor boundaries, and keep the oracle recoverable without steering the product.
The Zed-shell WIP is committed, tagged, and pushed without lost work; the standalone branch contains the approved docs, roadmap/archive migration, dependency denylist, and pending evidence ledgers. Cargo metadata proves Brutal core crates remain GPUI-free and brutal_app/brutal_ui cannot import Zed workbench, workspace, client, sidebar, title-bar, agent-UI, or collaboration crates. The old executable remains identifiable and buildable as an oracle.
Keep the Zed-scale Rust build inside a measured local storage budget, make acceptance evidence immutable and queryable, and prevent inherited donor automation from running in the private Brutal repository.
A build preflight proves projected peak growth plus a recovery reserve before broad Cargo work; ignored output has a bounded cleanup policy; a clean checkout builds both Brutal.app and brutal-runtime through the documented path; and a fresh non-incremental package build is tied to an exact source/toolchain/artifact manifest. Before BZ2 deepens the fork, a stripped release feasibility artifact measures archive size, cold launch, idle RSS, and focused input latency and records an explicit keep, trim, or revise-contract decision. Every active card has machine-readable atomic criteria with pending, executed, or failed status, command or interaction, source and artifact hashes, execution date, and residual; generated parent status cannot hide a failed child. Every inherited Zed workflow is archived outside .github/workflows; the sole active workflow is manual-only with bounded permissions, timeout, and concurrency; and an ownership manifest plus Rust-aware parsing makes the 300/200/50 gate fail for every unregistered Brutal-owned Rust file and every function form, including const, unsafe, extern, attributed, and multiline declarations.