[teamleaderleo]

Summary

Base red: the devbox drift check fails every Web tests (1/4) run (27 of 27 in the last 24h, seen on #19549) and the Cloud VM image contract job's devbox:manifest:check. The test is web/tests/vm-image-manifest.test.ts, "every default was baked from this checkout's devbox sources".

The Freestyle defaults are the freestyle-cmux-devbox-20261003-130941 ladder, baked from desktop sources 082484bccc9a. Walking the commits that touch the devbox sources shows the digest moved three times with no bake promoted:

• 3690d43a9383 at 0174c11
• 6421b50e38b1 at 0c91f5f
• 4b22f8bbeb1b at 2190154

The first two are cx-6so.49 L1 and the last is the devbox metadata service.

The real fix is a rebake and promotion, which is an outward-facing Freestyle operation in Lawrence's image pipeline. This PR doesn't do that and doesn't change the drift logic. It adds DEVBOX_AWAITING_REBAKE in devbox-image-common.ts. Each entry excuses exactly one drift: defaults baked from baked against this checkout's current digest.

• devbox:manifest:check and the manifest test filter devboxSourceDriftProblems through it. promote stays strict.
• A further source change, or any other ladder, still fails.
• A new test fails once an entry is no longer needed, either because its rebake is promoted or because the sources move again.
• The validator's success line names the sources awaiting their rebake.
• The devbox README documents the entry.

Testing

• Base 0acdf31: vm-image-manifest.test.ts gives 21 pass, 1 fail, and bun scripts/validate-devbox-ladder.ts exits 1 with 12 drift lines.
• This branch: vm-image-manifest.test.ts plus vm-devbox-image.test.ts give 61 pass, 0 fail. The validator exits 0 with "sources awaiting their rebake: desktop 4b22f8bbeb1b…".
• This branch, one line appended to desktop/desktop-env.sh: 2 tests fail (the drift check and the pending check) and the validator exits 1. The guard still catches new drift.

Correctness review: the first version excused the drift only in the test, so the contract job's validate step would have stayed red. That's fixed in b3d22b8, which also takes the review's nits (match the baked digest, check each entry on its own).

Changelog

none

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 50b38b08-ff8d-4395-8a7c-73777c9bef05

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}