Spec audit reports + conformance harness + responsive UI foundation

.claude/settings.local.json

@@ -98,7 +98,9 @@
       "Bash(git push *)",
       "Bash(rustup show *)",
       "Bash(echo \"exit: $?\")",
-      "Bash(claude plugin *)"
+      "Bash(claude plugin *)",
+      "Bash(cp \"/root/.claude/uploads/995af0a3-e865-5b96-b002-e90985880970/cc51b77a-spec01codebaseauditandarchitecture.md\" \"/home/user/loki/docs/adr/spec-01-codebase-audit-and-architecture.md\" && echo \"placed\" && ls -la docs/adr/spec-01-codebase-audit-and-architecture.md)",
+      "mcp__code-review-graph__list_graph_stats_tool"
     ]
   },
   "enableAllProjectMcpServers": true,

.github/workflows/rust.yml

@@ -21,10 +21,35 @@ jobs:
       with:
         components: rustfmt, clippy
     - uses: Swatinem/rust-cache@v2
+    - name: License-header gate (per-crate SPDX on line 1)
+      # loki-opc is MIT (released standalone); the rest of the suite is
+      # Apache-2.0. See docs/adr/0010-per-crate-licensing.md.
+      run: python3 scripts/check-license-headers.py
+    - name: Panic-guard gate (no panic!/todo!/unimplemented! in lib src)
+      # Spec 01 audit A-6. unreachable! with a message is permitted.
+      run: python3 scripts/check-no-panics.py
+    - name: Unsafe-policy gate (forbid, or deny + allow-list)
+      # Spec 01 audit A-7. Only the 3 Android cdylib crates may use deny+allow.
+      run: python3 scripts/check-unsafe-policy.py
+    - name: File-ceiling gate (300-line ratchet)
+      # Spec 01 audit A-2. New files <= 300 lines; baselined debt may not grow.
+      run: python3 scripts/check-file-ceiling.py
+    - name: TODO-format gate (TODO(<topic>) tags)
+      # Spec 01 audit A-11. No bare TODO / FIXME / HACK / XXX in production code.
+      run: python3 scripts/check-todo-format.py
+    - name: Dependency-direction gate (acyclic, downhill-only)
+      # Spec 01 audit A-13 / ADR-0009. Fails on any uphill internal edge.
+      run: python3 scripts/check-dependency-direction.py
+    - name: Viewport-dimension guard (no assumed screen sizes)
+      # Spec 01 audit A-1. No bare 1280-class literals in editor input/viewport paths.
+      run: python3 scripts/check-no-hardcoded-viewport-dims.py
     - name: Format check
       run: cargo fmt --all --check
     - name: Clippy (workspace, all features, warnings denied)
-      run: cargo clippy --workspace --all-features -- -D warnings
+      # `unwrap_used`/`expect_used` keep panicking calls out of library runtime
+      # code (audit A-5); clippy.toml exempts test code. Tooling (build.rs, the
+      # gen_templates bin) carries a scoped file-level allow.
+      run: cargo clippy --workspace --all-features -- -D warnings -D clippy::unwrap_used -D clippy::expect_used
 
   build-and-test:
     runs-on: ubuntu-latest
@@ -33,6 +58,11 @@ jobs:
     - name: Install toolchain
       uses: dtolnay/rust-toolchain@stable
     - uses: Swatinem/rust-cache@v2
+    - name: Install xmllint (libxml2)
+      # appthere-conformance's schema axis (Spec 02 M2) shells to xmllint; install
+      # it so those tests actually run instead of skipping. The harness fails
+      # loudly if it is absent, so this keeps the schema axis genuinely exercised.
+      run: sudo apt-get update && sudo apt-get install -y libxml2-utils
     # `--all-features` so the feature-gated format crates (pptx, xlsx) and their
     # integration tests actually compile and run — under the default feature set
     # `cargo test --workspace` silently skips `#![cfg(feature = ...)]` suites.

.gitignore

@@ -29,3 +29,19 @@ loki-opc/.DS_Store
 
 # cargo vendor output — dependencies are patched via patches/ not vendored
 vendor/
+
+# Stray debug/render dumps at the repo root (Spec 01 audit A-4). These are
+# generated by examples/benches (e.g. `render_to_png` writes ./output.png) and
+# must not be committed — keep them ignored so they can't drift back in.
+/scratch.rs
+/diff_flow.txt
+/output.png
+/iris*.png
+/iris*.log
+/test_output*.png
+/test_output*.txt
+/test_log*.txt
+
+# Python bytecode cache (from scripts/*.py gate helpers)
+__pycache__/
+*.pyc

CLAUDE.md

@@ -82,10 +82,21 @@ These conventions apply to all crates in the workspace.
 - **Error handling:** Use typed error enums with `thiserror`. Do not use `anyhow`
   in library crates. Do not use `.unwrap()` or `.expect()` in library code
   outside of `#[cfg(test)]` blocks.
-- **Unsafe:** `#![forbid(unsafe_code)]` must be present in `lib.rs` for all
-  `appthere-ui` and future library crates.
-- **License header:** Every `.rs` file must begin with:
-  `// SPDX-License-Identifier: Apache-2.0`
+- **Unsafe:** every crate root must carry `#![forbid(unsafe_code)]`. The sole
+  exception is the three Android `cdylib` binaries (`loki-text`,
+  `loki-presentation`, `loki-spreadsheet`): their `#[unsafe(no_mangle)]`
+  `android_main` FFI entry point makes `forbid` impossible, so they use
+  `#![deny(unsafe_code)]` + a scoped `#[allow(unsafe_code)]` (emitted by
+  `loki_app_shell::android_main!`) and are enumerated in
+  `scripts/unsafe-policy-allowlist.txt`. Enforced in CI by
+  `scripts/check-unsafe-policy.py` (Spec 01 audit A-7). New crates must `forbid`.
+- **License header:** Line 1 of every `.rs` file must be the SPDX identifier
+  matching that crate's `Cargo.toml` `license` field, line 2 the copyright.
+  The suite is Apache-2.0 (`// SPDX-License-Identifier: Apache-2.0`), **except
+  `loki-opc`, which is MIT** (`// SPDX-License-Identifier: MIT`) because it is
+  released as a standalone crate — see
+  [docs/adr/0010-per-crate-licensing.md](docs/adr/0010-per-crate-licensing.md).
+  Enforced in CI by `scripts/check-license-headers.py`.
 - **Annotations:**
   - `// COMPAT(dioxus-native): <explanation>` — marks any workaround for a
     Dioxus Native / Blitz CSS or API limitation, including unconfirmed CSS
@@ -132,13 +143,21 @@ lines). The full list and a proposed split strategy live in
 offenders are below. This is a dedicated split-pass backlog, not a per-change
 blocker — but do not *grow* these files or add new ones over the ceiling.
 
-The split pass is **in progress** — **11 of 43 files done** (≈32 remain). Two
-techniques:
+**The ceiling is now mechanically enforced** (Spec 01 audit A-2):
+`scripts/check-file-ceiling.py` (CI) ratchets against
+`scripts/file-ceiling-baseline.txt` — new files must be ≤300, baselined files
+may not grow, and a file split to ≤300 must be removed from the baseline. So the
+backlog can only shrink. When you split a file below the ceiling, drop its line
+with `scripts/check-file-ceiling.py --update` (review the diff).
+
+The split pass is **in progress** — current backlog is the **35** entries in the
+baseline file. Two techniques:
 1. *Inline-test extraction* (safest, no production-code change): move a file's
    `#[cfg(test)] mod tests { … }` into a sibling `<name>_tests.rs` referenced via
    `#[cfg(test)] #[path = "<name>_tests.rs"] mod tests;`. Done 2026-06-21 for
    `block.rs`, `docx/mapper/{paragraph,numbering,mod,table}.rs`, `odt/import.rs`,
-   `odt/mapper/lists.rs`, `layout/result.rs`, `renderer/render_layout.rs` — each
+   `odt/mapper/lists.rs`, `layout/result.rs`, `renderer/render_layout.rs`, and
+   2026-06-28 for `editing/hit_test.rs`, `xml_util.rs`, `pdf/src/page.rs` — each
    was over the ceiling only because of a large inline test module.
 2. *Directory split*: convert `foo.rs` → a `foo/` directory with section-cohesive
    submodules, re-export the public entry points from `foo/mod.rs`, and move the
@@ -153,15 +172,18 @@ techniques:
 
 | File | Current lines | Priority |
 |---|---|---|
-| `loki-layout/src/flow.rs` | 1612 | High |
-| `loki-odf/src/odt/reader/styles.rs` | 1441 | High |
-| `loki-odf/src/odt/reader/document.rs` | 1428 | High |
-| `loki-layout/src/para.rs` | 1278 | High |
-| `loki-spreadsheet/src/routes/editor/editor_inner.rs` | 1241 | High |
-| `loki-ooxml/src/docx/write/document.rs` | 1169 | High |
-| `loki-ooxml/src/docx/reader/document.rs` | 1126 | High |
-| `loki-text/src/routes/editor/editor_inner.rs` | 1040 | High |
-| … 24 more (300–600 lines) — see the audit (10 files split 2026-06-21) | | |
+| `loki-layout/src/para.rs` | 1979 | High |
+| `loki-layout/src/flow.rs` | 1953 | High |
+| `loki-odf/src/odt/reader/styles.rs` | 1554 | High |
+| `loki-odf/src/odt/reader/document.rs` | 1494 | High |
+| `loki-spreadsheet/src/routes/editor/editor_inner.rs` | 1244 | High |
+| `loki-ooxml/src/docx/reader/document.rs` | 1209 | High |
+| `loki-ooxml/src/docx/write/document.rs` | 1073 | High |
+| `loki-layout/src/resolve.rs` | 984 | High |
+| … 27 more (6 over 600, 21 in 300–600) — see `scripts/file-ceiling-baseline.txt` | | |
+
+*(Sizes above are from `scripts/file-ceiling-baseline.txt`, refreshed 2026-07-04;
+the earlier numbers were stale — several files grew since first baselined.)*
 
 (`odt/mapper/document.rs` (1094 lines) was split into the `odt/mapper/document/`
 directory on 2026-06-26 — each module is now under the ceiling.)
@@ -179,7 +201,7 @@ but are **not perfectly round-tripped through the Loro CRDT**.
 |---|---|---|
 | `tab_stops` | Written as unreadable Debug string; not read back. | Medium |
 | `background_color` (paragraph) | Written as Debug string; not decoded on read. | Low |
-| `DocumentMeta` / `DublinCoreMeta` | Round-trips **through the Loro CRDT** as a JSON snapshot (`loro_bridge::meta`), so Publish-tab edits are durable and undoable. Still **not** written back to DOCX/ODT on export (export drops the extended Dublin Core fields). | Low |
+| `DocumentMeta` / `DublinCoreMeta` | Round-trips **through the Loro CRDT** (`loro_bridge::meta`) **and is written back on export** — core properties + extended Dublin Core reach DOCX (`docProps/core.xml` + `custom.xml`) and ODT (`meta.xml`), tested by `metadata_round_trip.rs` / `extended_dublin_core_round_trips`. Remaining tail (not the Loro bridge): custom user properties, `meta:editing-duration`, and OOXML `docProps/app.xml` are still not written. | Low |
 
 ---
 
@@ -318,6 +340,18 @@ is documented in the Loki Text UI specification (v0.4).
 5. All interactive elements: 44×44 px minimum, documented in a doc comment.
 6. Mark Dioxus Native CSS limitations with `// COMPAT(dioxus-native): ...`
 
+### Conditionally-mounted panels are components (ADR-0013)
+
+A panel shown behind a condition must be a `#[component]` mounted **at the
+boundary** — `{open().then(|| rsx! { Panel { .. } })}` — never a plain function
+called inside `if cond { panel(..) }` with an early `return rsx!{}`. Only a
+component owns a hook scope, so only a component can call `use_breakpoint()` (or
+any hook) and adapt to the size class **without threading a `compact` flag**
+through the parent (which grows it). Prefer hosting the panel in
+`appthere_ui::AtPanelHost`, which reads the breakpoint and picks Compact-sheet vs
+Expanded-side-panel posture for you. See
+[docs/adr/0013-conditional-panels-are-components.md](docs/adr/0013-conditional-panels-are-components.md).
+
 ### Confirmed CSS properties (Dioxus Native 0.7.x / Blitz)
 
 These work in production code: