feat: publish fleet dev builds as update tracks

[azooz2003-bit]

Green merges can now produce a fleet dev build that installs and updates through a dedicated Sparkle track.

The cmux side adds:

• com.cmuxterm.app.dev as the stable identity for signed team dev builds.
• /cmux-dev/<track>/appcast.xml feed classification and manual recovery routing.
• Fleet-only build-time overrides for bundle ID, feed URL, public key, and numeric Sparkle version.
• A publisher that uploads immutable classic and next archives, signed appcasts, per-track indexes, and https://files.cmux.com/cmux-dev/index.html to the existing cmux-binaries R2 bucket.
• A lightweight Dev build request workflow on main and feat-cmux-next; native compilation stays on the managed fleet.

Validation:

• bash -n scripts/reload.sh scripts/publish-dev-build.sh scripts/verify-app-bundle-channel-metadata.sh
• python3 -m py_compile scripts/ci/upload-r2-object.py
• git diff --check
• Native Swift tests and builds were not run on Big Red due to the documented OOM constraint; they remain required on fleet/CI.

Operator setup before enabling publication is documented in the HQ PR and build-fleet/AGENT-BUILDS.md: create a dedicated Sparkle EdDSA key pair, expose only its public key to the controller, and install the mode-0600 worker secret file with the existing R2 write credentials.

— Paperkite g1 🧩

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Green merges on main and feat-cmux-next now produce fleet dev builds that install and update through a dedicated Sparkle track, replacing local-only builds and public release channels.

• Signed dev builds use com.cmuxterm.app.dev, resolve the new /cmux-dev/ feed, and route manual download recovery to the per-track dev archive (classic/next); the track is excluded from the local DEV/staging gating predicate so Sparkle updates apply.
• scripts/publish-dev-build.sh uploads immutable classic and next archives, signed appcasts, per-track indexes, and a localized cmux-dev/index.html dev index page to the cmux-binaries R2 bucket, and keeps track-agnostic latest.zip recovery aliases per track.
• reload.sh gains fleet-only overrides for bundle ID, feed URL, public key, and numeric Sparkle version.
• A Dev build request workflow records green merges and supports a manual one-shot trigger for verification; native compilation stays on the managed fleet and the runner is selected safely on forks.
• Operators must create a dedicated Sparkle EdDSA key pair, expose only its public key to the controller, and install the mode-0600 worker secret file with R2 write credentials before enabling publication.

^{Written for commit da84d53. Summary will update on new commits.}

Summary by CodeRabbit

• New Features

  • Added support for publishing Classic and Next development builds, with a page to view published builds and their details.
  • Development update feeds are recognized, and manual downloads can use the matching development recovery archive.
  • Development builds can display the “cmux DEV” app name.

• Bug Fixes

  • Improved update handling to keep development feeds and downloads on the correct channel.

---

Migrated from #17473 after correcting the PR author identity. The original head commit da84d53 is preserved.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 27 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: ab87878a-054b-4002-8f29-243869b349d5

📥 Commits

Reviewing files that changed from the base of the PR and between ccefb63 and da84d53.

📒 Files selected for processing (10)

• .github/workflows/dev-build-request.yml
• Packages/macOS/CmuxUpdater/Sources/CmuxUpdater/UpdateController.swift
• Packages/macOS/CmuxUpdater/Sources/CmuxUpdater/UpdateFeedResolver.swift
• Packages/macOS/CmuxUpdater/Sources/CmuxUpdater/UpdateManualDownloadRecovery.swift
• Packages/macOS/CmuxUpdater/Tests/CmuxUpdaterTests/DevStagingUpdateGatingTests.swift
• Packages/macOS/CmuxUpdater/Tests/CmuxUpdaterTests/InstallWatchdogTests.swift
• Packages/macOS/CmuxUpdater/Tests/CmuxUpdaterTests/UpdateFeedResolverTests.swift
• scripts/publish-dev-build.sh
• scripts/reload.sh
• scripts/verify-app-bundle-channel-metadata.sh

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Note

Pull Request opener @azooz2003-bit is not an author or co-author of any commit in this PR (commit identities: teamleaderleo). The CLA check will still proceed and requires every listed identity plus @azooz2003-bit to have signed.

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}