7a59f0ffc5
Brings over the uncommitted agent-mei work (Mac checkout, Sep 22) plus box follow-ups (Oct 17: agent_mei action namespace in keymap/zed.rs, MEI_BRIDGE.md, RENAME_AGENT_MEI.md, unmetered receipts report 0 uJ). joule_core, JOULE_CODE_* and JouleDB names unchanged. *.bak.* scratch files excluded.
3.7 KiB
agent-mei — Developer Inventory & Audit
Generated 2026-06-14 from a four-part audit of the fork. This is the internal inventory of what we built, what we gutted, what's actually live, and how it wires together — the map that keeps a 245-file divergence from a 1,000-crate editor maintainable.
agent-mei ("Joule Code") is a hard fork of Joule (zed@e2e7a67, baseline commit a084434) turned into an energy-metered, federated, no-phone-home agentic coding editor. Everything new lives in one crate, crates/agent_mei_panel (~10.9k LOC, 14 files); everything removed is upstream's native agent/telemetry/update surface.
The documents
| Doc | What it answers |
|---|---|
| ARCHITECTURE.md | How it wires together — cascade data flow (L0→L4), Joule integration seams, the 16 dep boundary, the subsystem graph, integration risks |
| MODULES.md | Function breakdown — per-file purpose + key functions/types, the AgentMeiPanel struct, a codebase review |
| STATUS.md | Fruition audit — what's actually live vs scaffold/aspirational, the claim-vs-reality table, the #[ignore]'d tests |
| UPSTREAM_DIVERGENCE.md | What was removed/modified vs upstream Joule, the privacy hardening, dangling-risk check |
| FINDINGS.md | The prioritized, actionable gaps the audit surfaced (the fix list) |
Executive summary
The shape. A small set of GPUI-free, pure, unit-tested substrate modules (sessions, hooks, cascade_gate, tool_gate, methodology, codebase_index, edit_blocks, fim_local, local_agent, mcp_client, sandbox_bridge) plus one GPUI-bound orchestrator (agent_mei_panel.rs, 5,335 LOC) that wires them into the editor. The spine is the cascade: submit_prompt → L0 cache → L1 deterministic → L2 retrieval → L3 on-device model → L4 ACP, each tier gated by authorize_tier and closing through a common metering+sealing path. Real crypto/energy/cascade work is delegated to open-standards git deps, not faked locally.
What's real (CI-tested). The enforcement-and-accounting machinery: the cascade dispatch, both JCP gates (cascade-tier + agent-tool), deny-capable hooks (PreTool/PreMerge), the hash-chained sealed ledger (with tamper detection), git-worktree sessions (with gated merge), the control protocol + MCP bridge + fleet relay, and the conformance harness. ~270 real assertions; the conformance test guards against a vacuous pass.
What's aspirational / unverified. Concentrated in one place: anything requiring a loaded local model (L2 embedding separation, L3 edit quality, codebase-index retrieval, FIM infill) is proven only by #[ignore]'d tests + manual runs, never in CI. The "live-verified" phrasing rests on manual drives.
The divergence. 245 files, +13.5k / −187.6k. We deleted the upstream agent (~75k LOC) and agent_ui (~74k) crates wholesale (replaced by agent_mei_panel), plus sidebar, skill_creator, auto_update*, acp_tools, eval_*. We neutralized telemetry/crash/sign-in/auto-update/registry-auto-fetch and added an egress backstop — all verified against PRIVACY_HARDENING.md. The fork compiles clean; no load-bearing danglers.
The top gaps (see FINDINGS.md): emitted CodingOps are author-anonymous ([0u8;32]) despite a real identity existing; L0 keys on intent only (blind to buffer state); L4 closes seal only if the ACP thread emits a diff event (can be silently lost); the release "ship door" is structurally un-passable today; a handful of load-bearing let _ = discards; JOULE_CODE.md is stale (says path deps, they're git deps); 8 gutting warnings + a broken visual-tests feature.