[teamleaderleo]

Why

signing-keychain-macos.yml triggers on every scripts/ci/**/*.sh, scripts/*.sh and scripts/cmux-next/*.sh change, because its Linux bash32-syntax job has to parse them all. The real-import job used the same triggers, so it ran on blacksmith-6vcpu-macos-26 too. That job only exercises the keychain tool, yet every script PR queued it. On 2026-10-27, nine of these sat queued on that label at once, ahead of nightly signing and DEV verify jobs on the same label. Under the routing order (Linux, then owned, then Blacksmith macOS last), they should not have been there.

What

• A new real-import-plan job runs on Linux (blacksmith-2vcpu-ubuntu-2404). It reads the compare API diff. real-import now needs it and runs only when one of these changed:
  • the tool: scripts/ci/signing-keychain.sh
  • what it sources or calls: the runtime guard, the intermediates importer, the certs, select-ci-xcode.sh
  • its test, plus the Sparkle helper test it runs
  • the workflow itself
• It fails open. workflow_dispatch, a new branch (zero before), a diff of 300 or more files, or an API error all run the real import, the same as before.
• tests/test_derive_sparkle_public_key.sh and scripts/derive_sparkle_public_key.swift are added to the triggers. The real import runs both, but neither was listed before.
• The new tests/test_signing_keychain_real_import_gate.py pins four things:
  • the plan runs on Linux;
  • real-import is gated on it;
  • the input list covers every file the real-import test references, so adding a dependency without listing it fails;
  • unrelated scripts skip the Mac.

bash32-syntax is unchanged and still parses every script on each trigger.

Risk

Low, CI routing only. The worst case is a keychain-tool dependency that isn't on the list: a change to it would skip the macOS import on its PR. The new test catches any new file the test script references. Indirect dependencies are listed by hand.

Checks

• tests/test_signing_keychain_real_import_gate.py and tests/test_bash32_linux_job.py pass, and actionlint is clean.
• test_ci_workflow_path_filter_parity.py (cmux-next.yml base_red_checks) and test_runner_routing_table.py (9 unclassified jobs, none of them this one) fail the same way on base.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 8c6f350: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr25997 -f ref=fanout-infra/keychain-mac-paths -f platform=macos -f backend_mode=local

[teamleaderleo]

Owned by an agent session · session

[blacksmith-sh]

Found 1 test failure on Blacksmith runners:

Failure

Test	View Logs
test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)/ test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Bead cx-446h0k created for this PR by the cmux coordinator.

[teamleaderleo]

Review (codex gpt-6-astra xhigh, independent): SHIP at 8c6f350

No blocking findings: plan shell fails open under bash -e (dispatch, zero before, force-push, new branch, API or jq error); INPUTS covers every file the real import runs; contents: read suffices for compare on fork PRs; no required-check reference to the macOS job.

[github-actions]

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/40472120369 at 5738daf failed: cmux app scheme compile (Debug).
Those jobs last passed at 2c480ab. This pull request is one of 3 merged since: #26019, #26027, #25997.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.

[github-actions]

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4048747891701 (2c7dda4036)
• cmux NEXT nightly 1.0.0-nightly.4048857346401 (fe6c4fe01a)
• cmux NEXT nightly 1.0.0-nightly.4048947256901 (273534101b)
• cmux NEXT nightly 1.0.0-nightly.4049353932801 (e7cbb89fab)