[teamleaderleo]

Summary

Asked by claude-sr2 (relayed by held-queue triage), 2026-10-21. Leo approved #22781 after the fact and said that update-channel and dev-build settings changes like it do not feel high-risk to him. The decision: keep the updater's install, signing and feed-verification code at risk:high, and let a settings-only channel toggle that reuses the existing signed feeds be normal. The gate has no "medium" tier; normal is the middle tier.

scripts/ci/risk_tier.py now has a normal rule, ahead of the high update-path rule, for the two files that only hold the channel and preference values:

• CmuxUpdater/UpdateRing.swift: the user's ring, the updates.channel setting (Stable, Nightly, Canary or Dev) and the Sparkle channels each ring accepts;
• CmuxNextUpdater/UpdatePreferences.swift: install-on-quit, how to notify, how many versions to keep.

Every other updater code file stays high (the updater's views, share sheet and strings were already normal or low and are unchanged), including:

• UpdateTrack.swift, the build's own release line, which also decides whether Sparkle runs at all;
• AppcastParser, AppcastSelector, UpdateProber and UpdaterService+Flow;
• UpdateInstallPreflight, RollbackSwap and UpdateTransfer.

The settings schema and CmuxNextSettings were already normal or low. docs/ci/risk-tiers.md records the distinction.

#22781 itself would still grade high, since it also changed the appcast parser and the prober.

The CmuxUpdater package is now high too (coord-deputy, 2026-10-21: in this PR, so the risk gate changes once). Before this PR no high rule covered Packages/macOS/CmuxUpdater/, so these files graded normal:

• the channel switch's AppSignatureVerification and SecurityAppSignatureInspector;
• UpdateFeedResolver;
• the Sparkle driver (UpdateDriver*);
• the install code (UpdateController+InstallAttempt, +BackgroundInstall, InstallWatchdog).

The high update-path rule now includes Packages/macOS/CmuxUpdater/*. UpdateRing.swift stays normal, because the channel rule sits above it, and the package's Tests/ stay low.

Nothing else changes: no other path changes tier.

Testing

python3 tests/test_risk_tier.py on huge-blue: 31 tests OK. On the base risk_tier.py, both new tests fail (12 failures).

test_an_update_channel_setting_is_normal_and_the_update_path_stays_high checks two things:

• a channel PR made only of these files and the settings schema grades normal;
• adding any one of eight update-path files (UpdateTrack.swift among them) grades it high.

test_the_cmux_updater_package_is_the_update_path checks that each of these grades high on its own: the signature check, the signature inspector, the channel switcher, the feed resolver, the three Sparkle driver files, the two install-attempt files, InstallWatchdog and Package.swift. It also checks that UpdateRing.swift is normal and that the package's tests are low.

Observed / Not run

Observed: the test runs above, and prepush-gate.py with no new violations. Not run: the risk-tier workflow on a real channel-only PR.

Changelog

none

Agent session: cosmic-gray

🤖 Generated with Claude Code

[teamleaderleo]

Owned by ci-speed on cosmic-gray · session

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review b75370c: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr23371 -f ref=ci-speed/risk-tier-update-channel -f platform=macos -f backend_mode=local

[teamleaderleo]

Review (independent subagent, correctness first): SHIP at 34b13f3. Nit carried forward: the high-table note in docs/ci/risk-tiers.md says "CmuxNextUpdater (except the channel and preference values below)" while UpdateRing.swift lives in CmuxUpdater; the bullet below names both paths correctly. This PR edits risk_tier.py, so it is risk:high and waits for a collaborator approval or risk:human-ok.

[teamleaderleo]

Bead cx-zl5dq created for this PR by the cmux coordinator.

[teamleaderleo]

Review (independent subagent, correctness first): SHIP at 0b7d7fe. All 44 non-test CmuxUpdater files except UpdateRing.swift grade high, its tests grade low, and nothing outside the updater changes tier. Nits, not fixed: docs/ci/risk-tiers.md says Package.resolved grades normal, but CmuxUpdater/Package.resolved (the Sparkle pin) now grades high, which is intended. UpdateRing.acceptedSparkleChannels grading normal follows the requested channel decision. risk:high: this waits for a collaborator approval or risk:human-ok.

[teamleaderleo]

Review (independent subagent): SHIP at 0b7d7fe

[blacksmith-sh]

Found 1 test failure on Blacksmith runners:

Failure

Test	View Logs
test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)/ test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Review (independent subagent, correctness first): SHIP at b75370c

Re-review of the feat merge into the reviewed 0b7d7fe: same changed lines (3 files, +57/-3); feat has no commits to risk_tier.py, test_risk_tier.py or risk-tiers.md since the old base; tests/test_risk_tier.py 31 OK at the merged head (huge-blue). The fast-tier red (run 39597903330: PaletteMenuVocabularyTests.swift #expect without try) is in a file this PR does not touch.

[github-actions]

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.3969476605401 (28c01c3aaa)
• cmux NEXT nightly 1.0.0-nightly.3969569695701 (3955ea8e00)