88a41bedd3
The fork shipped renamed binary/bundle but the product name "Zed" was still
shown everywhere in the UI. Rename the display name to "Joule" (tagline
"Energy-metered agentic coding") while preserving every load-bearing reference.
Display renames (105 .rs files): release_channel display_name, welcome +
onboarding + ai_onboarding, macOS app menu (About/Hide/Quit), window titles,
About panel, settings UI, notifications, update/collab messages, system specs.
Bundle display name (crates/zed/Cargo.toml) -> "Joule" so CFBundleName / the
menu-bar name and the .app are "Joule" (identifier science.transaction.AgentJoule
and the agent-joule binary are unchanged).
Docs (223 .md): product prose Zed -> Joule, fence-aware (code blocks untouched).
Embedded assets (12 JSONC): // comments only.
Legal (4 files): product -> Joule, entity "Zed Industries, Inc." -> "Transaction
Science, Inc.", domain zed.dev -> openie.dev. NOTE: these are structurally Zed's
inherited terms and need a real legal review, not just a rename.
Deliberately PRESERVED (renaming would break the app): font aliases ("Zed Plex
Sans"/".ZedMono" in text_system + assets), HTTP header names (X-Zed-Predict-*),
zed:: action ids, app/bundle identifiers (dev.zed.Zed*, Zed-Editor-* product ids),
zed.dev URLs, ZED_* env vars, crate/package names, "Zed Industries" in non-legal
attribution, and the {zed,Zed} config-dir glob.
Signed + notarized + stapled as Joule.app, installed to /Applications, verified
(Gatekeeper: Notarized Developer ID, FH93XC2VRR). Caveat: test-code string
literals were renamed too, so some `cargo test` assertions may need updating.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
3.7 KiB
agent-joule — Developer Inventory & Audit
Generated 2026-06-14 from a four-part audit of the fork. This is the internal inventory of what we built, what we gutted, what's actually live, and how it wires together — the map that keeps a 245-file divergence from a 1,000-crate editor maintainable.
agent-joule ("Joule Code") is a hard fork of Joule (zed@e2e7a67, baseline commit a084434) turned into an energy-metered, federated, no-phone-home agentic coding editor. Everything new lives in one crate, crates/agent_joule_panel (~10.9k LOC, 14 files); everything removed is upstream's native agent/telemetry/update surface.
The documents
| Doc | What it answers |
|---|---|
| ARCHITECTURE.md | How it wires together — cascade data flow (L0→L4), Joule integration seams, the 16 dep boundary, the subsystem graph, integration risks |
| MODULES.md | Function breakdown — per-file purpose + key functions/types, the AgentJoulePanel struct, a codebase review |
| STATUS.md | Fruition audit — what's actually live vs scaffold/aspirational, the claim-vs-reality table, the #[ignore]'d tests |
| UPSTREAM_DIVERGENCE.md | What was removed/modified vs upstream Joule, the privacy hardening, dangling-risk check |
| FINDINGS.md | The prioritized, actionable gaps the audit surfaced (the fix list) |
Executive summary
The shape. A small set of GPUI-free, pure, unit-tested substrate modules (sessions, hooks, cascade_gate, tool_gate, methodology, codebase_index, edit_blocks, fim_local, local_agent, mcp_client, sandbox_bridge) plus one GPUI-bound orchestrator (agent_joule_panel.rs, 5,335 LOC) that wires them into the editor. The spine is the cascade: submit_prompt → L0 cache → L1 deterministic → L2 retrieval → L3 on-device model → L4 ACP, each tier gated by authorize_tier and closing through a common metering+sealing path. Real crypto/energy/cascade work is delegated to open-standards git deps, not faked locally.
What's real (CI-tested). The enforcement-and-accounting machinery: the cascade dispatch, both JCP gates (cascade-tier + agent-tool), deny-capable hooks (PreTool/PreMerge), the hash-chained sealed ledger (with tamper detection), git-worktree sessions (with gated merge), the control protocol + MCP bridge + fleet relay, and the conformance harness. ~270 real assertions; the conformance test guards against a vacuous pass.
What's aspirational / unverified. Concentrated in one place: anything requiring a loaded local model (L2 embedding separation, L3 edit quality, codebase-index retrieval, FIM infill) is proven only by #[ignore]'d tests + manual runs, never in CI. The "live-verified" phrasing rests on manual drives.
The divergence. 245 files, +13.5k / −187.6k. We deleted the upstream agent (~75k LOC) and agent_ui (~74k) crates wholesale (replaced by agent_joule_panel), plus sidebar, skill_creator, auto_update*, acp_tools, eval_*. We neutralized telemetry/crash/sign-in/auto-update/registry-auto-fetch and added an egress backstop — all verified against PRIVACY_HARDENING.md. The fork compiles clean; no load-bearing danglers.
The top gaps (see FINDINGS.md): emitted CodingOps are author-anonymous ([0u8;32]) despite a real identity existing; L0 keys on intent only (blind to buffer state); L4 closes seal only if the ACP thread emits a diff event (can be silently lost); the release "ship door" is structurally un-passable today; a handful of load-bearing let _ = discards; JOULE_CODE.md is stale (says path deps, they're git deps); 8 gutting warnings + a broken visual-tests feature.