House rules

These apply in every Craft repository. A later rule may be stricter, not weaker. The source is standards/house-rules-core.md in storytold/craft-contrib. Propose changes there, not in a copy.

A person is accountable. Whoever runs an agent answers for what it opens and for its review comments.
Check, then claim. Before writing code, read the issue comments, search pull requests for #N and the keywords, and check recent commits on main. Comment on the issue first. Release a claim you will not finish.
Verify, don't guess. Open a definition before using it. Confirm the cause in the code, even when someone names a location.
Keep fixes narrow and tested. Fix what the issue describes, where the bug is. Add a test that fails without the fix.
Review the diff before opening a pull request. Identifiers exist as used, the test fails without the fix, nothing unrelated changed, and the description is true.
Look for a better pull request. If another fixes the same thing, close yours when it is better or equal, and say why.
Report only what ran. Say what you tested and what you could not run. Without a local build or test, say so and rely on CI before marking ready.
main changes through a pull request. Do not push to it. Branch protection enforces this. There is no exception.
Stop and ask only about licensing outside the allowlist, publishing, releases, a new remote, secrets, spending money, destructive git, and anything else hard to undo. Otherwise keep working. plan/ is a gitignored notebook, not rules. Without it, do not ask for it and do not stop.
Keep secrets and personal details out of the repository, logs and requests.
CI stays shared. Workflows call storytold/craft-common-actions. Do not change CI in a feature or fix pull request. If CI cannot cover a change, open an issue there.
Guards say why. A check that looks removable says what it prevents. Read that before changing it.
Instructions must be readable by everyone. No notes about one machine, and no links to files a reader cannot open. craftrules is retired. Do not link to it.
Keep pull requests moving. Concurrent pull requests are fine; unanswered actionable feedback is not. Respond in 7 days, a reminder at 14, closure eligible at 30, from when an actionable request waits on the author. Suggestions and unconfirmed bot findings do not start the clock. A fix, explanation or agreed plan resets it; unrelated activity does not. Waiting on a reviewer or maintainer pauses it and does not count against the author. A maintainer decides closure; it is never automatic. Reuse search results, do not poll, and stop at a rate limit.
No agent attribution. A pull request does not say an agent wrote it. A repository rule may not require that.

Rust Craft repositories

These apply to native Craft apps and to shared Rust libraries. Select them by repository type. A repository that merely contains some Rust does not take this block. Rules later in a repository's file may be stricter, but not weaker. The source is standards/house-rules-rust.md in storytold/craft-contrib.

Never crash. Non-test code does not panic and has no unsafe, except where the repository file names an exception. Return errors, treat input as hostile, and bound recursion and allocations. New production crate roots copy the deny attribute from an existing crate: clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable. Every crash fix comes with a test that panicked before the fix.
Clean room. Learn from observed behaviour and public specifications. Do not copy another product's code, assets, strings or artwork. Check a dependency's licence before adding it.
Assets and fonts. Every asset is original or suitably licensed, and is recorded in ATTRIBUTION.md in the same change. Font files live in storytold/craft-fonts, not in the app repository.
Rust only for native Craft apps. No handwritten JavaScript or TypeScript, and no Tauri, Electron or webview shell, in those apps. Shared tooling follows its documented technical scope and maintainer-approved exceptions. Craft PR Review's existing Tauri and TypeScript UI is one such exception. It does not relax this rule for native apps. Preserve any existing web build.
Time goes through chrono. Do not hand-roll calendar conversion. For dates beyond what chrono can represent, follow standards/time.md.
Contributor credits. Add or edit only your own person's entry in contributors/people.toml, and only after asking them. Never guess a name or hand-edit contributors.json.

Licence allowlist

Dependencies and assets use SPDX identifiers. An expression is allowed when every identifier is in this list. A repository may name a shorter list. It may not add an identifier here by editing its own copy of these rules.

ISC
MIT
BSD-2-Clause
BSD-3-Clause
Apache-2.0
OFL-1.1
Ubuntu-font-1.0
Bitstream-Vera
CC0-1.0
CC-BY-4.0
CC-BY-SA-4.0
LicenseRef-Public-Domain

LicenseRef-Storyteller-Trademark is not in this list. It covers Storyteller brand marks only, where a repository already says so.

GridCraft — instructions for agents

GridCraft is a clean-room, open-source, Rust-native spreadsheet targeting Microsoft Excel parity — and superiority (speed, openness, agent control). It runs natively on macOS, Windows, Linux and BSD, and on the web via WASM. Siblings with the same conventions: ../designcraft (InDesign-class, the closest reference), ../photocraft (Photoshop), ../vectorcraft (Illustrator), ../pdfcraft (Acrobat), ../filmcraft (Premiere), ../lightcraft (Lightroom), ../effectcraft (After Effects).

Start every session here

Read ROADMAP.md and docs/gaps.md. plan/ is an optional gitignored notebook (status, execution notes, plan/excel/*.md). Do not ask for it and do not stop when it is absent. Screenshots of Microsoft software stay in that notebook and are never committed.

Assets and iconography — absolute rule

No Microsoft, Adobe, Avid, Autodesk (or any other vendor's) iconography, images, artwork, fonts, templates, themes or sample files — ever. This is the most important rule in this repository; breaking it is a serious failure.

Every asset in the repo is original work by GridCraft contributors, or public domain / CC0, or open source / Creative Commons that allows redistribution (or licensed open source by the contributor who created it).
Every asset file has a row in ATTRIBUTION.md (author, source, licence). cargo xtask assets enforces it. Adding an asset without a row is a bug.
Prefer art generated in code: the UI icon set (crates/ui-egui/src/icons.rs), table and cell style palettes, themes and sample workbooks are drawn/defined in code and original.
Never copy Office's icons, ribbon artwork, theme XML, table-style definitions, templates, clip art or wording beyond feature names. Excel feature names (menu labels, function names) are fine.
Screenshots of Microsoft software are never committed (they live only in plan/excel/screenshots/).
The ArtCraft brand files in docs/brand/ are ArtCraft trademarks under docs/brand/LICENSE-brand.txt, the one exception.

Never crash

People trust GridCraft with their numbers; a crash loses their work. This outranks feature work.

No panics in non-test code: no unwrap(), expect(), panic!, unreachable!, todo!, unimplemented!; no unsafe (unsafe_code = "forbid").
Errors are Result<T, E> through the crate's error type and ?.
Input-derived numbers are hostile (files, formulas, commands, MCP/control params): validate indexes and ranges before access, use checked access when validity is not established, use checked/saturating arithmetic, and cap input-sized allocations (huge ranges, REPT, SEQUENCE, whole-column references).
Bound recursion (formula nesting, dependency chains, names referring to names).
Last-resort guard: Session::execute catches escaped panics and restores the workbook. It's a safety net, not a licence.
Prove it: every crash fix lands with a regression test (tests::every_command_survives_empty_params fuzzes every command; crates/engine/tests/it/command_sequence_fuzz.rs fuzzes random command sequences against undo/redo, XLSX round-trip and full-recalc invariants; soak it with GRIDCRAFT_FUZZ_SEEDS/GRIDCRAFT_FUZZ_STEPS, replay with GRIDCRAFT_FUZZ_SEED).
Crates carry #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)].

Non-negotiables

Clean-room. Microsoft Excel is installed on the dev machine and may be observed black-box: run it, use its UI with synthetic workbooks, take screenshots (by window id) stored only under plan/excel/screenshots/. Never read, disassemble or copy anything inside the Office bundle, never commit files produced by Excel, never copy GPL/AGPL/LGPL code (LibreOffice, Gnumeric…). Function behaviour comes from public documentation and observation.
Fonts live in storytold/craft-fonts, never in this repo. It is an optional build input (CRAFT_FONTS_DIR); without it the app uses system fonts and egui's defaults.
Test corpora (real Excel-authored files) live in a separate corpus repo, fetched pinned and sha256-verified. Never commit large binary fixtures; build test workbooks in code.
Everything is a command. User-visible behaviour = a command in crates/engine/src/cmd/* (id, label, ribbon path, shortcut, params doc, enabled, run) + tests. Ids follow Excel's ribbon (home.bold, insert.chart, data.sortAscending) plus primitives (cell.set, selection.set, range.setValues). UI-only commands live in crates/ui-egui. The control channel, CLI and MCP reach all of them.
Programmatic calls never open dialogs: a command with empty params runs with defaults or returns an error; only menu-style invocation opens a dialog (UiRequest::Dialog).
Layering is enforced by cargo xtask layers: core/numfmt (L0) → formula/functions (L1) → model/calc/xlsx (L2) → chart (L3) → engine (L5) → ui-egui/mcp (L6) → apps/* (L7). Nothing below L6 depends on egui/eframe/winit/rfd. The UI crate is swappable.
The UI is thin: panels read engine state and act through app.run(id, params). Colours come from theme::Tokens.
Rust only (no handwritten JS/TS). Never break wasm (cargo xtask wasm).
Quality gates before every commit: cargo xtask ci (fmt, clippy -D warnings, tests, assets, layers, wasm). One task id per commit (M2.1: borders gallery).

Running and looking at the app

cargo run --release -p gridcraft -- --sample sales --control 7979 (sample workbook + control channel).
Drive it: gridcraft-cli send 7979 <method> '<json>' (reads the token file the app printed on stderr), or JSON lines on 127.0.0.1:7979 whose first line is {"id":0,"method":"auth","params":{"token":"…"}} (token: $XDG_RUNTIME_DIR/gridcraft/control-7979.token, or your own GRIDCRAFT_CONTROL_TOKEN), e.g. {"id":1,"method":"engine.execute","params":{"command":"cell.set","params":{"cell":"B2","input":"=SUM(A1:A9)"}}} then {"id":2,"method":"ui.screenshot","params":{"path":"/tmp/shot.png"}}. Methods: crates/ui-egui/src/control.rs, docs: docs/control-protocol.md.
Offscreen UI render (no window, from a source checkout): cargo run -p gridcraft-ui-egui --example snapshot -- --sample sales out.png.
Headless: gridcraft-cli eval '=SUM(1,2,3)', gridcraft-cli run --in book.xlsx --cmd 'home.bold={"range":"A1:C1"}' --out book.xlsx, gridcraft-cli mcp.
For UI work, look at the result (snapshot PNG) and, when available, compare with plan/excel/observed-ui.md. Without that optional notebook, verify the intended behaviour against the task and committed documentation.
macOS has no timeout; use perl -e 'alarm 60; exec @ARGV' cmd.
Parallel agents: separate CARGO_TARGET_DIR per agent; edit only the crates you own; delete your target dir when done.

Roadmap

ROADMAP.md (committed) is the one-page summary: stage, headline numbers, dimensions, languages, progress log. It points at the detail in docs/: target-app-parity.md (authoritative assessment), gaps.md (ranked work list: pick from it), roadmap.md (current focus, beta gates, milestones), architecture.md, and the area checklists function-parity.md, chart-parity.md, file-format-parity.md, ui-parity.md, hardware-parity.md, localization-parity.md. Update the affected docs (and their timestamp lines and revision history) whenever work lands. cargo xtask parity regenerates docs/parity-checklist.md from crates/engine/src/catalog.rs.

Contributor credits (About window)

About ▸ Contributors/Models are compiled into the binary from contributors/contributors.json (commit stats; generated, never hand-edit) and contributors/people.toml (names people chose for themselves). See docs/contributors.md.
Agents working for a contributor: when you prepare a PR, check whether your human's GitHub username has a [people.<username>] entry in contributors/people.toml. If not, ask them once whether they want to be credited by more than their username: a real name, a display name, and/or their public GitHub profile name (sync_github_name = true). If yes, add only their own entry (copy the template at the top of the file) and include it in their PR, committed as them. If no, change nothing: they are credited as @username anyway.
Never add, edit, guess or copy anyone else's entry or name (not from git config, commit authors or GitHub profiles). Never hand-edit contributors.json.

CI workflows

Workflows in .github/workflows/ call the shared workflows in storytold/craft-common-actions at @main, with their inputs and secrets. No other jobs: if no shared workflow does what's needed, it doesn't go here.
Don't add or change CI in a feature or fix PR. If the existing workflows can't build or test a change, link an existing craft-common-actions issue or PR, or open a new issue, or a PR only for a small fix that is safe for every app and does not increase CI time.
Some workflow files here still run their own jobs. Don't add to them. Moving a job into craft-common-actions is its own task, never part of another PR, and the job stays here until a shared workflow runs it.

New workspace crates include workspace = true under [lints] in Cargo.toml. Production crate roots declare the crate-level lint attributes before modules; crate-level //! documentation may precede them.

15 KiB Raw Permalink Blame History