[teamleaderleo]

What (part a4 of #23322)

This is part a4 of #23322 (sessions.allowFullAccess under MDM). a1 (#23322) has landed, and this PR is rebased onto feat-cmux-next after it. Review 46's four findings are fixed at c5e49d6, review 70's at f2a0075, review 71's at b332687, review 73's at 28d5566, review 74's at 20e1b04, review 75's at 46577ca, review 76's at 55df8e6, and review 77's at 3553cb9 (see the table and Tests). At about 1120 changed lines (about half of it tests) it is over the usual 800: the review-round fixes share the one bound and its tests, and splitting them now would land a partial bound. It was split out of a1 to keep a1 under about 800 lines, after review 25 of a1 found the three gaps below.

It builds the decision on #23322, quoted word for word:

"#23322 (sessions.allowFullAccess under MDM), decided: an MDM-managed value is an upper bound the user can't override. If MDM sets allowFullAccess=false, Full access is unavailable and the mode menu says "Managed by your organization". If MDM is unset, nothing changes. This only narrows access, so it needs no call from Leo."

a1 bounds every session's agent. This PR bounds the agents acpmux starts outside any session, which nothing in a1 or b ends:

• Model probes. The times the forced off began are counted in a watch, updated with start-mode.json under its lock (StartModeCell, Hub::full_access_off_watch). It is a count, not the current value, so an unset push that follows an off before a probe looks does not hide the off (review 46). probe_bound refuses a profile whose argv pins full access while the off holds, and otherwise hands the probe the watch. The ACP probe (probe_one) and the Claude and Codex live model lists (probe_live) check it once their folder is known, right before the spawn, and race it while they run (full_access_forced_off, which ends once the count passes the one the probe started under). An off that lands between the check and the spawn, or while the probe waits on its agent, ends the probe and its child. A profile that does not pin full access is never watched.
• What a probe's session came up in. The ACP probe also reads the mode and config options its session/new answer reports (FullAccessView::of_session_new). A profile that pins nothing but whose harness's own settings start it in full access keeps no models under the off, and the probe records why. The off is read once the session answers, so an off that lands during the handshake counts (review 32). It also counts every mode or option the harness reports in full access for its own session while it starts (StartReports). A mode from a harness that declares none counts too; a subagent's do not (review 41). Any such report counts, whatever the harness reported after it or answered with, in either order (review 46). StartReports keeps the sessions that reported, at most 16, not the updates themselves, so no report is dropped; past 16, or for a report that names no session, every session counts. The pool's check uses the same StartReports.
• The pool. A pooled agent whose argv, mode or config options run in full access (Pooled::runs_full_access, the one predicate) is not kept under the off: it is checked when its start completes, under the pool lock. The check also counts what the harness reported for the entry's own session while the entry was held (held.rs, StartReports), including a mode from a harness that declares none. A chat taking a claimed entry runs the same check first and starts cold instead, since cap_full_access may read the session before those held updates reach it (review 32). The push records the off, then takes that lock to drain, so an entry warming when the off lands is either drained or refused. A claimed entry that nobody took (a session/new that failed or was cancelled) ends instead of going back to the pool while the off holds, checked under the same lock (review 27 of b found the restore path). A ready or claimed entry that reports full access while it waits ends at once (holding_tap calls pool_end_reported). The entry is removed under the lock and ended outside it, through the bounded pool_discard (review 46).

With MDM unset nothing changes: probe_bound hands an unpinned profile no watch, a pinned one a watch that never fires, and the pool checks only under the off.

Past review findings this PR covers:

Round	Finding	Where it is covered
8 (on the restructure)	Probe launches skipped the pinned-profile refusal	PROBES "round 9: a profile pinning full access is not probed under the off"
9 (review 25 of a1, 7859e3f)	Claude live model lists bypassed the bound	PROBES "review 25: a Claude profile pinning full access is not started to list its models"
9	The ACP probe's check went stale across spawn_blocking(unattended_cwd), and its child belonged to nothing revocation ends	PROBES "review 25: a probe running when the off lands ends": with MDM unset, a refresh starts both pinned profiles, which hang; the off lands; the refresh answers within 8 s (not the probes' 50 s and 15 s) and both children end
9	A pooled agent that came up in full access (its harness's own settings) waited in the pool until a chat took it	session_pool under_an_mdm_off_a_pooled_agent_that_came_up_in_full_access_is_not_kept
review 27 of b (740fd4f)	A claimed entry returned after the drain waited in the pool again	the restore check (no deterministic test: the claim, the push and the return happen inside one request)
10 (review 32 of a4, 3e95ab5)	The ACP probe bound only argv; a neutral profile whose session/new reports a full-access mode or option completed under the off	PROBES "reviews 32, 41, 46: a probe in full access as its session starts keeps nothing" (self-full: no pinned argv, starts in full-access)
10	Pooled checks dropped the undeclared mode and the startup mode updates held until adoption	session_pool under_an_mdm_off_a_pooled_agent_that_reported_full_access_at_start_is_not_kept (a harness with no modes that reports bypassPermissions while its session starts, via the fake agent's new FAKE_STARTUP_MODE). The take-time check has no deterministic test of its own: an update has to arrive after completion and before the claim.
11 (review 41 of a4, f3640c5)	The ACP probe dropped the session/updates its harness sent while its session started, so a harness with no modes that reports bypassPermissions was probed under the off	the same PROBES case (self-reporter: no modes, FAKE_STARTUP_MODE=bypassPermissions). Updates are kept only until session/new answers.
12 (review 46 of a4, 8fbc7f2)	An update sent before the session/new answer was replayed after it, so an earlier asking mode overwrote the answer's full access (both the probe and the pool)	PROBES "reviews 32, 41, 46: a probe in full access as its session starts keeps nothing" (self-masked); session_pool under_an_mdm_off_a_pooled_agent_that_reported_full_access_at_start_is_not_kept (famask)
12	The probe kept only its first 256 updates, so a later full-access report was dropped	the same PROBES case (self-busy: 300 other updates first, via the fake agent's new FAKE_STARTUP_NOISE)
12	A ready pooled agent that reports full access after it completes waited in the pool until it was taken or evicted	session_pool under_an_mdm_off_a_ready_pooled_agent_that_reports_full_access_ends (the fake agent's new FAKE_LATE_MODE)
12	The off watch held only the current value, so an off followed by an unset before a probe looked was missed	lib an_off_ends_a_probe_though_an_unset_follows_it
13 (review 70 of a4, c5e49d6)	A full-access report under an empty session id was kept as a session named "", which never matched the real one, so the probe kept models and the pooled agent stayed ready	lib a_report_under_a_blank_session_id_counts_for_every_session; PROBES self-blank (the fake agent's new FAKE_STARTUP_SID); session_pool fablank
14 (review 71 of a4, f2a0075)	A probe whose argv pins nothing held no off watch: a harness that reported full access and held its session/new answer ran on past the off, and an unset after the off let it keep its models	PROBES "review 71: a probe that reported full access ends at the off, an unset after it too" (self-holder, via the fake agent's new FAKE_NEW_HOLD)
14	A report of full access arriving after the pool take's check and before the held lines went live reached no check, and the chat's cap could read the session before it	session_pool under_an_mdm_off_a_report_held_past_the_take_keeps_the_agent_from_the_chat (debug seam ACPMUX_TEST_POOL_ADOPT_REPORT_FILE)
15 (review 73 of a4, b332687)	A probe started while the off already held, whose harness reported full access only after an unset, kept its models: the off count had not changed	PROBES "review 73: a probe started under the off ends on a report that comes after an unset" (self-gated, via the fake agent's new FAKE_NEW_GATE)
15	A pooled agent that reported full access while it started and held its session/new answer ran on until it answered (up to the start budget), and an unset meanwhile could keep it	session_pool under_an_mdm_off_a_starting_pooled_agent_that_reports_full_access_ends_then
16 (review 74 of a4, 28d5566)	A session/new answer that named a blank session id was taken as a known session, so a report under the real id did not count (the ready pooled agent that reports full access later stayed ready)	lib a_report_under_a_blank_session_id_counts_for_every_session; session_pool falateblank. The probe (self-blank-new) and starting-pool (fablanknew) cases were already caught by the review 71/73 race, and they now guard it.
17 (review 75 of a4, 20e1b04)	A start read the off count and the off state in two steps, so an unset between them erased an off the start began under (off_latch, and the pinned probe's probe_bound)	lib an_unset_racing_a_start_does_not_erase_the_off_it_began_under (a test-only seam runs the unset between the reads)
18 (review 76 of a4, 46577ca)	A report that came while a chat claimed a pooled entry (out of both the ready and claimed sets) ended nothing, and an unset before the take let the chat adopt it. The completion and return checks also read the start-mode state under the pool lock	session_pool under_an_mdm_off_a_report_while_claimed_keeps_the_agent_from_the_chat_after_an_unset (debug seam ACPMUX_TEST_POOL_CLAIM_REPORT_FILE). The lock order change has no test: no path takes the two the other way round today, so nothing could deadlock; OffLatch::off now reads no state lock.
19 (review 77 of a4, 55df8e6)	A pinned probe read the off twice (the latch, then probe_bound), so an off that came and went between the reads started it. And a report made under the off after the take's check counted at the handoff only while the off still held	lib probe_off_tests::a_pinned_probe_never_starts_after_an_off_that_came_and_went_as_it_began; session_pool under_an_mdm_off_a_report_at_the_handoff_keeps_the_agent_from_the_chat_after_an_unset (the adopt seam's new unset word)

Tests

• Red at f74faa7 (a1 plus these tests, run 40378057503): full_access_managed fails the three PROBES cases, and session_pool fails under_an_mdm_off_a_pooled_agent_that_came_up_in_full_access_is_not_kept (the entry stayed ready).

• Green at 6f0e9e8 (run 40378057299): fmt and clippy are clean, lib passes 1101/1102, full_access_managed and hub_integration full_access (14/14) pass, and session_pool passes 18/18. 3e95ab5 adds the restore check (run 40379205351: fmt and clippy clean, session_pool 17/18 with only the base red pooled_sessions_end_with_the_daemon_and_after_a_crash). The lib red is base's agent_tools own_servers_run_under_the_daemon_prefix.

• Review 32 round: red at eced0d9 (3e95ab5 plus the two new tests, run 40387048972): full_access_managed fails only "review 32: a probe whose session comes up in full access keeps nothing under the off" (self-full kept models m1 and m2), and session_pool fails only under_an_mdm_off_a_pooled_agent_that_reported_full_access_at_start_is_not_kept (the entry stayed ready).

• Green at f3640c5: full_access_managed passes, hub_integration passes 491/491, and session_pool passes 18/19 (run 40387230158). Clippy with -D warnings is clean (run 40387230042). Lib passes 1101/1102 (run 40387230230). The only reds are base's pooled_sessions_end_with_the_daemon_and_after_a_crash and own_servers_run_under_the_daemon_prefix.

• Review 41 round: red at e2d07f9 (f3640c5 plus the new case, run 40397367018): full_access_managed fails only "review 41: a probe whose harness reports full access while it starts keeps nothing" (self-reporter kept models m1 and m2). Green at 6c4b155 (the head): full_access_managed passes, hub_integration passes 491/491, session_pool passes 18/19 with only the base red (run 40397483894); fmt and clippy -D warnings are clean and lib passes 1101/1102 with only the base red (run 40397484029).

• Review 46 round: red at ecb517d (8fbc7f2 plus the new tests, run 40405698379). All four fail for their stated reasons:

  • lib an_off_ends_a_probe_though_an_unset_follows_it: "the unset after the off hid it from the probe".
  • full_access_managed keeps models for self-masked and self-busy.
  • session_pool keeps the famask entry.
  • session_pool leaves the late reporter ready after 10 s.

• Green at c5e49d6 (the head):

  • Run 40405941405: fmt and clippy -D warnings are clean, full_access_managed passes, session_pool passes 19/20, and lib passes 1143/1144.
  • Run 40405945736: hub_integration passes 497/497 and durable_agents 57/57.
  • The only reds are base's pooled_sessions_end_with_the_daemon_and_after_a_crash and own_servers_run_under_the_daemon_prefix.

• Review 70 round: red at 616efff (c5e49d6 plus the new tests, run 40413774853). All three fail for the stated reason:

  • lib: "a report under "" was not counted";
  • full_access_managed keeps models for self-blank;
  • session_pool keeps the fablank entry.

• Green at f2a0075 (the head). A blank sessionId now counts for every session, as a missing one does.

  • Run 40413774863: fmt and clippy -D warnings are clean, full_access_managed passes, session_pool passes 20/20, and lib passes 1144/1145. The one lib failure is base's own_servers_run_under_the_daemon_prefix.
  • Run 40413774985: hub_integration passes 497/497 and durable_agents 57/57.

• Review 71 round: red at 904dec4 (f2a0075 plus the new tests, run 40416406224). Only the two new cases fail, each for its stated reason:

  • full_access_managed: "the refresh waited on a probe in full access past the off";
  • session_pool: "a chat took a pooled agent that reported full access under the off".

• Green at b332687 (the head):

  • A probe now ends once its harness reported full access under an off that holds, or that began while it ran, even if an unset followed (reported_under_off, full_access_off_since).
  • adopt_pooled reads the held lines under the tap's lock as they go live. A pooled agent whose lines report full access is stopped under the off before the chat gets it.
  • Run 40417772216: fmt and clippy -D warnings are clean, full_access_managed passes, session_pool passes 20/21, and lib passes 1144/1145.
  • Run 40417771524: hub_integration passes 497/497 and durable_agents 57/57.
  • The only reds are base's pooled_sessions_end_with_the_daemon_and_after_a_crash and own_servers_run_under_the_daemon_prefix.

• Review 73 round: red at a963ba9 (b332687 plus the new tests, run 40422410169). Only the two new cases fail:

  • full_access_managed: "the refresh waited on a probe the off started under";
  • session_pool: "a starting pooled agent in full access ran on under the off until it answered: 31.15s".

• Green at 28d5566 (the head):

  • OffLatch records, as a probe or pooled start begins, whether the off holds and the off count. The off holds for that start if it held then or began since, even if an unset followed.
  • A pooled start now races its handshake against a report of full access under the latch, as the probe does. It also judges what it came up in by the latch before it is kept.
  • Run 40422608707: fmt and clippy -D warnings are clean, full_access_managed passes, session_pool passes 21/22, and lib passes 1144/1145.
  • Run 40422608509: hub_integration passes 497/497 and durable_agents 57/57.
  • The only reds are base's pooled_sessions_end_with_the_daemon_and_after_a_crash and own_servers_run_under_the_daemon_prefix.

• Review 74 round: red at 937c571 (28d5566 plus the new tests, run 40426275239). Two tests fail:

  • lib: "a report did not count for the blank id """;
  • session_pool falateblank: "a ready pooled agent that reported full access stayed under the MDM off".

• Green at 20e1b04. StartReports::of treats a blank harness session id as unknown.

  • Run 40426275218: fmt and clippy -D warnings are clean, full_access_managed passes, session_pool passes 21/22, and lib passes 1144/1145.
  • Run 40426275089: hub_integration passes 497/497 and durable_agents 57/57.
  • The only reds are base's.

• Review 75 round: red at b14df5b (run 40428166677): "an unset during the latch's read erased the off".

• Green at 46577ca. Hub::full_access_off_now reads the count and the state together under the state lock, and both the latch and probe_bound use it.

  • Run 40428942089: fmt and clippy -D warnings are clean, full_access_managed passes, session_pool passes 21/22, and lib passes 1144/1146.
  • The lib failures besides base's are tailnet::cli_tests::every_cli_call_sets_tailscale_be_cli, a known flake; it passes alone at this head (run 40430713553).
  • Run 40428942162: hub_integration passes 497/497 and durable_agents 57/57.

• Review 76 round: red at c66101a (run 40431910858): "a chat took a pooled agent that reported full access under the off".

• Green at 55df8e6.

  • A pooled entry keeps a report it made while the off held (reported_off, set by the holding tap through pool_reported). pool_take_claimed_for and pool_return_claimed end such an entry even after an unset.
  • Completion and return judge the off with an OffLatch read before the pool lock.
  • Run 40432008970: fmt and clippy -D warnings are clean, full_access_managed passes, session_pool passes 22/23, and lib passes 1145/1146.
  • Run 40432008889: hub_integration passes 497/497 and durable_agents 57/57.
  • The only reds are base's.

• Review 77 round: red at 19896bc (run 40436342708). Both new tests fail:

  • "a profile pinning full access started after the off came and went";
  • "a chat took a pooled agent that reported full access under the off".

• Green at 3553cb9 (the head):

  • probe_bound takes the probe's own OffLatch instead of reading the off again.
  • ensure_child reads the entry's reported_off at the handoff, whatever the off says now.
  • Run 40436342833: fmt and clippy -D warnings are clean, full_access_managed passes, session_pool passes 23/24, and lib passes 1146/1147.
  • Run 40436342720: hub_integration passes 497/497 and durable_agents 57/57.
  • The only reds are base's.

Timers and loops: none new. The watch and the probe's Notify have no task of their own: each probe or pooled start awaits them inside its own bounded run (50 s, or the pool's start budget) and drops them when it ends.

No capture: no UI changes.

Base merge at a2c266d. a3 (#25538) landed meanwhile. The merge takes feat-cmux-next at 292779b and has one conflict, in full_access_bound.rs; both sides are kept: a4's probe_bound(latch, argv) and off_latch, then a3's full_access_turned_off(changed) with its barrier.

• Run 40440017410: fmt is clean, full_access_managed passes, session_pool passes 26/26, subsessions_delivery 1/1, send_steer 5/5, and lib passes 1282/1283 (only base's own_servers_run_under_the_daemon_prefix).
• Clippy reports one finding, base's own unnecessary_sort_by at pool/policy.rs:239 (from base 3c07730; this PR does not touch that line). With only that lint allowed, clippy -D warnings is clean (run 40440480415).
• Run 40440017370: hub_integration passes 507/507 and durable_agents 61/61.

Review: review 78 (Codex gpt-6-astra xhigh) found nothing blocking at 3553cb9 (SHIP). Review 79 (Codex gpt-6-astra xhigh) of the base merge found nothing blocking at a2c266d (SHIP).

Agent session: agent session

🤖 Generated with Claude Code

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[teamleaderleo]

Owned by an agent session · session

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[teamleaderleo]

Bead cx-abr1k created for this PR by the cmux coordinator.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 8fbc7f2: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr25549 -f ref=lane/hb-stale-trust-23322-a4 -f platform=macos -f backend_mode=local

[blacksmith-sh]

Found 7 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmpcglgwfbf/summary-missing.json (live):/summary-missing.json (live):	View Logs
/tmp/tmpyvzv042e/summary-fail.json (live):/summary-fail.json (live):	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs
test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)/ test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Review (codex gpt-6-astra xhigh, next-review): BLOCK at a2c266d

• cmux-tui/crates/acpmux/src/hub/pool/start.rs:46-48,113-143: The pinned-profile refusal and host spawn are separated by an async gap, while OffLatch is created only after the host has started. If MDM’s off arrives in that gap, a pinned full-access pooled agent launches under the forced-off policy; if it hangs before session/new, it can remain alive for the full 90-second start budget because no report is required to trigger termination.

[github-actions]

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4045474536502 (a6e613294e)
• cmux NEXT nightly 1.0.0-nightly.4048747891701 (2c7dda4036)
• cmux NEXT nightly 1.0.0-nightly.4048947256901 (273534101b)
• cmux NEXT nightly 1.0.0-nightly.4049353932801 (e7cbb89fab)