[teamleaderleo]

After hq#2830, #23472 at 7e68847 still got "could not read #23472". Its hook already runs scripts/ci/guards-from-base.sh from origin/feat-cmux-next (#23316), but the merge guard it runs is a copy in this repository. A copy here reaches a worktree only through a fetch or a base merge, so a fix in it can lag behind. Decision (deputy-2, 2026-10-21): every merge guard runs from the copy guards-sync installs from cmuxterm-hq main (every 10 minutes), never from a copy in a worktree.

The installed landing gate (require-cmux-guards, cmuxterm-hq tools/agent-guards) already enforces every rule merge_compile_guard.py did, on the exact head of a feat-cmux-next PR that changes Swift:

• It requires a green cmux-next Release compile (Xcode 26), using the same Swift file set.
• Its gh reads bypass the PATH guard's repeat throttle (CMUX_GH_GUARD_DISABLE=1).
• All its reads share one bounded budget.

Any merge merge_compile_guard.py refused, the gate refuses too, so its rules have nothing left to move.

So this PR:

• Merges go to the installed gate. guards-from-base.sh no longer runs a merge guard from the repo. For a merge it does one of three things:
  • Gate registered in this account's settings (${CLAUDE_CONFIG_DIR:-~/.claude}/settings.json, checked the same way install.py checks): it defers, because Claude Code runs the gate itself. That avoids a second set of GitHub reads.
  • Gate file installed but not registered: it runs ~/.claude/hooks/require-cmux-guards.sh itself.
  • Gate not installed (no file, or a registration with no file behind it): the merge goes ahead with a warning that names guards-sync and install.py. That follows merge-compile-guard: only a compile that finished red refuses; a slow read or a pending compile warns and merges #24265: no guard blocks a merge it can't judge, only a compile that finished red. A gate that crashes or exits non-zero is a warning too.
• Refusals and warnings are combined as merge-compile-guard: only a compile that finished red refuses; a slow read or a pending compile warns and merges #24265 does: a refusal from the gate is printed right away, before the update-branch warning runs. Otherwise every warning is joined into one answer, so a merge warning never hides the update-branch warning in the same command.
• The update-branch warning is unchanged. It still runs from origin/feat-cmux-next.
• Removed: scripts/ci/merge_compile_guard.py, its hook, and its test. The CI step and the test-execution entry for them go too.
• Workflow comments: the fleet workflows' comments now say what gates the merge.
• Reach: every worktree whose settings include cmux guards: run merge guard hooks from the feat-cmux-next tip #23316 gets this on its next merge-time fetch. A worktree cut before cmux guards: run merge guard hooks from the feat-cmux-next tip #23316 keeps running its own copy until its next base merge.

Not carried over: merge_compile_guard let a fleet compile-check pass stand in for a queued Release compile. Neither the installed gate nor next-autoland ever accepted that, so it was already dead wherever the gate is installed. Accepting it would loosen the gate, and that is a separate decision.

Takes back #22947: it added the in-repo merge guard and its CI test entries; this PR removes that guard on purpose, since the installed landing gate from cmuxterm-hq judges every merge.
Takes back #23423: only its edit to tests/test_merge_compile_guard.py, which goes with the guard.
Takes back #23827: only its edit to tests/test_merge_compile_guard.py, which goes with the guard.
Takes back #24265: only its edits to the removed guard and its test; its rules (only a red compile refuses, everything else warns) are kept in guards-from-base.sh.

Base merge (2026-10-26, adopted by the stall reconciler): the merge with feat-cmux-next conflicted with #24265, which had loosened the repository guard this PR removes. I resolved it toward both: the repository still keeps no merge guard, and guards-from-base.sh follows #24265's rules (above). #24265's tests were ported to the installed gate. tests/test_guard_hooks_from_base.py passes 22/22 and tests/test_base_merge_warning.py passes at aa84860.

Earlier tests (cmux16; the test needs timeout on PATH, which Linux CI has and macOS lacks):

• Red at 476c453: 10 of 15 failed.
• Green at a8230d0: tests/test_guard_hooks_from_base.py passes 15/15 on Python 3.13 and on /usr/bin/python3 3.9, and tests/test_base_merge_warning.py passes 10/10.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Merges are now judged by the landing gate installed from cmuxterm-hq (require-cmux-guards), never by a copy of the merge guard in this repository.

For a merge, guards-from-base.sh defers to the gate when registered in this account's settings, runs the installed gate file when present but not registered, and refuses the merge with install instructions when the gate is missing. The update-branch warning still runs from origin/feat-cmux-next.

Removed: scripts/ci/merge_compile_guard.py, its hook, tests, and the CI step that ran them. The old guard let a fleet compile-check pass stand in for a queued Release compile; the installed gate never accepted that, so that behavior is dropped too.

^{Written for commit a8230d0. Summary will update on new commits.}

[teamleaderleo]

Bead cx-bsped created for this PR by the cmux coordinator.

[teamleaderleo]

Owned by an agent session · session

[teamleaderleo]

Orphaned: no activity for 14 h, and no lane holds a lease on it. The orphan sweep could not merge feat-cmux-next in: conflicts in .github/workflows/cmux-next.yml, scripts/ci/guards-from-base.sh, scripts/ci/merge_compile_guard.py, tests/test-execution.toml, tests/test_guard_hooks_from_base.py, tests/test_merge_compile_guard.py. Listed for a lane to resolve.

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review de377cf: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr23858 -f ref=lane-host/merge-guard-installed -f platform=macos -f backend_mode=local

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[teamleaderleo]

Review (Codex gpt-6-astra xhigh, via review-router): SHIP at 81033a4

Four rounds. Rounds 1 to 3 said FIX FIRST, and each finding was fixed with a regression test that fails on the code before it:

• ee1ba22: when the settings hook couldn't read the launcher, an installed gate's refusal was lost. Also, the merge fetch now falls back to gtimeout where macOS has no timeout.
• de377cf: merges through GraphQL (mergePullRequest, enablePullRequestAutoMerge) now reach the gate. A registration now counts only under a matcher that covers Bash.
• 81033a4: a registration is now a command that runs the gate's file, not one that only mentions it.

Round 4 found nothing. tests/test_guard_hooks_from_base.py passes 28/28 and tests/test_base_merge_warning.py passes.
Out of scope: disguised commands such as gh pr me''rge. Base matches merges the same way, and these hooks guard against mistakes by cooperating agents, not deliberate evasion.

[github-actions]

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4044337729102 (b195c241a9)
• cmux NEXT nightly 1.0.0-nightly.4045227375101 (53f8928b83)
• cmux NEXT nightly 1.0.0-nightly.4045248345901 (ab883bf956)
• cmux NEXT nightly 1.0.0-nightly.4045474536502 (a6e613294e)
• cmux NEXT nightly 1.0.0-nightly.4048947256901 (273534101b)
• cmux NEXT nightly 1.0.0-nightly.4049353932801 (e7cbb89fab)