[teamleaderleo]

Problem

The merged Huge Blue staging snapshot still had two production blockers: legacy token foreign keys on existing staging branches and a staging harness that could not compose the current runtime or return a usable short-lived attach capability.

Change

• add the current Drizzle/Huge Blue staging composition and flock-backed SSH lease transport;
• remove the conflicting legacy attach-token foreign key idempotently;
• make the loopback staging attach route mint and envelope the short-lived relay capability;
• reject attach while a workspace is suspended.

Validation

• cd web && bun run typecheck
• 29 focused Huge Blue/provider/relay/persistent-workspace/runtime-composition tests
• Big Red API and broker systemd health
• Huge Blue relay/proxy health
• route-driven Huge Blue soak: create/replay, native attach, crash/reconnect retained output, rotation, suspend/resume, token expiry, stop/replay cleanup

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes the Huge Blue staging flow so the merged runtime composes correctly and returns a usable short-lived attach capability.

• Adds the current Drizzle/Huge Blue staging composition, a flock-backed SSH lease transport, and an HTTP loopback that mints attach tokens and rechecks them against the database on every upgrade.
• Drops the legacy attach-token runtime FK idempotently; attach is scoped to the owned persistent workspace and huge-blue is enforced as the provider.
• Attach is rejected with 409 unless a workspace is in a running state; rotation returns a freshly minted target envelope.
• Validation: cd web && bun run typecheck, 29 focused provider/relay/runtime-composition tests, and a route-driven soak covering create/replay, native attach, crash/reconnect, rotation, suspend/resume, token expiry, and stop/replay cleanup.

^{Written for commit b4f2f62. Summary will update on new commits.}

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 696165fe-9def-4497-aa67-b627515fc50e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[blacksmith-sh]

Found 12 test failures on Blacksmith runners:

Failures

Test	View Logs
test_every_mac_job_reads_the_placement (main.CmuxNextWiring.test_every_mac_job_read s_the_placement) (job='cmux-scheme-compile')/ test_every_mac_job_reads_the_placement (main.CmuxNextWiring.test_every_mac_job_read s_the_placement) (job='cmux-scheme-compile')	View Logs
test_every_mac_job_reads_the_placement (main.CmuxNextWiring.test_every_mac_job_read s_the_placement) (job='daemon-test')/ test_every_mac_job_reads_the_placement (main.CmuxNextWiring.test_every_mac_job_read s_the_placement) (job='daemon-test')	View Logs
test_every_mac_job_reads_the_placement (main.CmuxNextWiring.test_every_mac_job_read s_the_placement) (job='generated-files')/ test_every_mac_job_reads_the_placement (main.CmuxNextWiring.test_every_mac_job_read s_the_placement) (job='generated-files')	View Logs
test_every_mac_job_reads_the_placement (main.CmuxNextWiring.test_every_mac_job_read s_the_placement) (job='release-compile')/ test_every_mac_job_reads_the_placement (main.CmuxNextWiring.test_every_mac_job_read s_the_placement) (job='release-compile')	View Logs
test_every_mac_job_reads_the_placement (main.CmuxNextWiring.test_every_mac_job_read s_the_placement) (job='swift-test')/ test_every_mac_job_reads_the_placement (main.CmuxNextWiring.test_every_mac_job_read s_the_placement) (job='swift-test')	View Logs
test_every_shadow_job_is_compare_only (main.ShadowJobTests.test_every_shadow_job_is _compare_only) (workflow='cmux-tui-artifacts.yml', shadow='macos-cross-runtime-x86_64') /test_every_shadow_job_is_compare_only (main.ShadowJobTests.test_every_shadow_job_i s_compare_only) (workflow='cmux-tui-artifacts.yml', shadow='macos-cross-runtime-x86_64' )	View Logs
test_every_shadow_job_is_compare_only (main.ShadowJobTests.test_every_shadow_job_is _compare_only) (workflow='cmux-tui-artifacts.yml', shadow='macos-cross-shadow')/ test_every_shadow_job_is_compare_only (main.ShadowJobTests.test_every_shadow_job_is _compare_only) (workflow='cmux-tui-artifacts.yml', shadow='macos-cross-shadow')	View Logs
test_fork_pull_requests_into_manaflow_ai_never_reach_an_owned_runner_label (main.Fo rkRunnerRoutingTests.test_fork_pull_requests_into_manaflow_ai_never_reach_an_owned_runn er_label)/ test_fork_pull_requests_into_manaflow_ai_never_reach_an_owned_runner_label (main.Fo rkRunnerRoutingTests.test_fork_pull_requests_into_manaflow_ai_never_reach_an_owned_runn er_label)	View Logs
test_no_workflow_falls_back_to_blacksmith_outside_manaflow_ai (main.ForkRunnerRouti ngTests.test_no_workflow_falls_back_to_blacksmith_outside_manaflow_ai)/ test_no_workflow_falls_back_to_blacksmith_outside_manaflow_ai (main.ForkRunnerRouti ngTests.test_no_workflow_falls_back_to_blacksmith_outside_manaflow_ai)	View Logs
test_outsider_triggered_workflows_pin_a_hosted_runner (main.ForkRunnerRoutingTests. test_outsider_triggered_workflows_pin_a_hosted_runner)/ test_outsider_triggered_workflows_pin_a_hosted_runner (main.ForkRunnerRoutingTests. test_outsider_triggered_workflows_pin_a_hosted_runner)	View Logs

...and 2 more test failures. View all on Blacksmith: run 39115675352, run 39115675562

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[github-actions]

CI fast guards failed on b4f2f62dab (https://github.com/manaflow-ai/cmux/actions/runs/39115675562). It does not block the merge; a red guard merged into main breaks it for every open PR.
The log named no failed step; see the run.

Agents: python3 scripts/ci/guard_attribution.py fix applies the mechanical fixes locally. This comment is updated in place on each push.

[github-actions]

Probably yours: Fast static checks failed: a static check failed, FAILED localization (0.67s).

CI failed on b4f2f62dab (run 39115675562 attempt 1): 1 code, 5 unknown.

Job	Verdict	Why
Fast static checks	code	a static check failed
guards / workflow-guard-tests / preflight	unknown	no known signature; failed step: Validate macOS runner guards
guards / workflow-guard-tests / quality-determinism	unknown	no known signature; failed step: Validate test determinism gate
guards / workflow-guard-tests / ci	unknown	no known signature; failed step: Propagate failed independent fast guard
web / web-db-migrations	unknown	no known signature; failed step: Database behavior tests
tests	unknown	no known signature; failed step: Check platform workflow routing

Matched log lines

Fast static checks: FAILED localization (0.67s)

Not re-run automatically: Fast static checks, guards / workflow-guard-tests / preflight, guards / workflow-guard-tests / quality-determinism, guards / workflow-guard-tests / ci, web / web-db-migrations are not machine failures.

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's; yours means the failing file is one this PR changes, also red on main that main's latest full suite fails the same way, seen on other PRs that it failed on another pull request's run lately.

[teamleaderleo]

merge-override: Exact-head local typecheck focused tests and live staging soak pass; red guard and database checks are inherited base-branch fixtures

[teamleaderleo]

merge-override: Exact-head local typecheck focused tests and live staging soak pass; red guard and database checks are inherited base-branch fixtures