[teamleaderleo]

Problem

The same-tree cmux-tui failure in #25251 recommended pushing a PR merge commit to cmux-tui-pin-*. That promotes PR-controlled workflow code to a privileged push context. Run 40267752094 reproduced the path on #22883's merge SHA: preflight obtained an OIDC-authenticated tree claim before cancellation.

Change

Remove the push advice and helper-ref creation. Refuse pin refs before preflight, build, or publication; stop retrying pin publishers; and stop the batch controller from creating them. The recovery guidance now says to land the reviewed change, then wait for trusted feat-cmux-next publication. Fleet app builds can bundle their own daemon, but cannot publish an unmerged PR tree.

Repository ruleset 25855210 is already active: creation and updates of refs/heads/cmux-tui-pin-* are restricted with no bypass actors. A probe push of the guarded head was rejected by GH013; no ref was created. This also blocks old commits that lack the workflow guard.

Validation

• Regression-only commit bc9700cb91ddb fails on the unsafe advice; fixed head passes.
• python3 -m unittest discover -s tests -p test_tui_publish_workflow_security.py: 81 passed.
• python3 tests/test_cmux_tui_artifacts_retry.py: 8 passed.
• python3 tests/test_cmux_tui_feat_publish_order.py: passed, including pin push/dispatch refusal.
• Shell regressions pin-cmux-tui-dispatch.test.sh, pin-cmux-tui-probe.test.sh, pin-cmux-tui-windows-fetch.test.sh, and pin-cmux-tui-run-check.test.sh: passed.
• Workflow YAML parsing, shell syntax, pre-push gate and diff whitespace: passed.
• test_next_batch.py / test_next_batch_groups.py: 155/160 passed; the same five review-gate failures reproduce with base implementation 522db45a7a35.

Observed / Not run

Observed on 4d33d8bd8478753062b9a119678fecf92ad8a2c4: focused portable checks above. Run 40267752094 completed/cancelled; all R2 publish jobs had zero steps, while preflight returned owner=40267752094 granted=true. Provider audit and claim-state reconciliation are pending the controller owner; no credentials have been rotated.

Not run: native builds/tests locally. An attempted fleet build for #22883 was not submitted: the deleted merge ref has no branch, and source ingest refused this host's fleet identity. It would only bundle a local daemon, not publish the PR tree.

Changelog

none

Related: #25251, #22883

Agent session: agent session

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[teamleaderleo]

Bead cx-vh7d7 created for this PR by the cmux coordinator.

[teamleaderleo]

cmux-next fast gates / post cmux-next/fast-gates is red on 20 of 26 fresh feat-cmux-next PR heads in the last 2:00:00, so it is most likely a base red, not this PR's. The base-reds lane has it; a base merge picks up the fix once it lands.

[blacksmith-sh]

Found 9 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmpanwkzb8q/summary-fail.json (live):/summary-fail.json (live):	View Logs
/tmp/tmpv7s2aqaq/summary-missing.json (live):/summary-missing.json (live):	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs
bench OTHER_SWIFT_FLAGS is 'OTHER_SWIFT_FLAGS=$(inherited) -DCMUX_BENCH_HOOKS -DCMUX_BL OCKING_CHECKS'/ bench OTHER_SWIFT_FLAGS is 'OTHER_SWIFT_FLAGS=$(inherited) -DCMUX_BENCH_HOOKS -DCMUX_BL OCKING_CHECKS'	View Logs
bench OTHER_SWIFT_FLAGS is 'OTHER_SWIFT_FLAGS=$(inherited) -DCMUX_BENCH_HOOKS -DCMUX_BL OCKING_CHECKS'/ bench OTHER_SWIFT_FLAGS is 'OTHER_SWIFT_FLAGS=$(inherited) -DCMUX_BENCH_HOOKS -DCMUX_BL OCKING_CHECKS'	View Logs
convention violations found (ERROR lines above)./ convention violations found (ERROR lines above).	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[teamleaderleo]

Review (Codex subagent review_safe_pin_advice, correctness first): SHIP at 4d33d8b

Independent current-runtime review found no remaining actionable defects after repairing the inaccurate fleet-publication guidance and the pin-dispatch retry selector. Verified 81 security tests, the publication-order and Windows-fetch regressions, three actual jq selection cases, shell syntax, and diff whitespace. The five batch review-gate failures also reproduce with base implementation 522db45.

Primary inspection confirms the focused diff. The separately requested acpmux xhigh session is waiting on the cmux NEXT folder-trust prompt; this receipt does not claim that session completed. The repository ruleset and GH013 refusal are primary-agent operational evidence, not independently re-queried by this reviewer. Provider audit and owner-claim reconciliation remain pending the controller owner.

[teamleaderleo]

cmux-next fast gates / post cmux-next/fast-gates is red on 18 of 23 fresh feat-cmux-next PR heads in the last 2:00:00, so it is most likely a base red, not this PR's. The base-reds lane has it; a base merge picks up the fix once it lands.

[teamleaderleo]

cmux-next / cmux-next checks (god files, concurrency, crash safety, l10n) › Package dependency lists sorted is red on 7 of 10 fresh feat-cmux-next PR heads in the last 2:00:00, so it is most likely a base red, not this PR's. The base-reds lane has it; a base merge picks up the fix once it lands.

[teamleaderleo]

cmux-next / cmux-next checks (god files, concurrency, crash safety, l10n) › Script tests (pin-cmux-tui, embed-cef, ensure-cef store) is red on 7 of 10 fresh feat-cmux-next PR heads in the last 2:00:00, so it is most likely a base red, not this PR's. The base-reds lane has it; a base merge picks up the fix once it lands.

[teamleaderleo]

The reported aggregate red was isolated from run 40268024050 job 121394579503 (head bc470552e6b884562d04f58c992c022c517b732f): every pin-cmux-tui, embed-cef, and ensure-cef sub-test passed. The failing sub-test was scripts/cmux-next/tests/release-compile-derived-data.test.sh; its fixture still expected only -DCMUX_BENCH_HOOKS while the hardened shared bench definition also emits -DCMUX_BLOCKING_CHECKS. That base red is fixed by #25324 (bda03f49cb4a2c701612176c7039ee9e050ead93), now present on feat-cmux-next; the same sub-test passes there. No pin-push advice or publisher path is restored in this PR.

[teamleaderleo]

Review (Codex xhigh via acpmux nx-ci-final-xhigh-review): SHIP at 4d33d8b

Postmerge audit of the complete pinned diff (merged as fcfb54ec5655aa198352f13279b01825d74da39b) found no actionable security or correctness defects. The acpmux session used Codex at xhigh and reviewed the supplied exact diff; it ran no commands or probe pushes. This receipt is postmerge and does not replace the independent current-runtime review performed before landing.

A real postmerge same-tree job (40282488815 / 121438893858) now reports only the GitHub API read failure and re-run this check; its log contains no pin-push advice. Repository ruleset 25855210 already rejects creation/update of cmux-tui-pin-*; an actual probe was rejected with GH013 and created no ref.

Exposure clarification: run 40267752094 minted and used OIDC audience cmux-ci-tree-claim; the authenticated claim grant at 04:11:34Z proves that. No R2 publish or static-secret step ran. No credentials were rotated. Additional cloud-provider exchange audit and controller claim reconciliation remain unconfirmed because the supported read-only API exposes neither audit nor release.

[github-actions]

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4030749448501 (b781e3b4a0)
• cmux NEXT nightly 1.0.0-nightly.4031371403702 (1dc93b2657)