[teamleaderleo]

The release-pool path for nightly-next had two Mac jobs between the pool signer and the fallback decision: signer-dmg-image (builds the DMG), then signer-verify (checks the final DMG). The macOS signer could not start until both had run. This change leaves one Mac job before that decision.

• signer-dmg (release pool) now hands on the notarized DMG, the appcast and the signed-app handoff under the names build-sign-notarize-nightly uses. build-sign-notarize-nightly runs whenever signer-dmg did not pass.
• signer-verify is gone. Its checks of the final DMG (codesign, Gatekeeper's notarized source, Apple's checks of the app inside including the copied Computer Use helper, and the appcast's Sparkle signature against the pinned key) move to a step in verify-final-dmg-nightly that runs only for a pool-signed DMG (scripts/ci/nightly-steps/signer-final-dmg-checks.sh). Publish already needs that job.
• signer-dmg-image is the pool path's one Mac job, routed like the verify jobs: on attempt 1 of a nightly-next push, a free owned fleet Mac first (the owned-pool rescue watches it there); otherwise the Blacksmith macOS label with a moving queue, and on a rerun the other size.
• The canonical uploads in signer-dmg never overwrite, so after a rerun the macOS job's verified output stands.

Outside the pool path nothing changes. Comparing the expanded workflow with base, the only differences are the signer-verify → signer-dmg name in the four jobs that read it, and the new step in verify-final-dmg-nightly, which is gated on needs.signer-dmg.result == 'success'. nightly.yml shrinks from 488,751 to 485,729 bytes.

Trade-off: a failure in the final DMG's Mac checks now fails the run's publish instead of falling back to the macOS signer. The same app was already checked on a Mac before the DMG was built, so such a failure is rare, and the next tip builds.

Before (run 40556126172): pushed 18:01, published 20:52. The sign job queued 73 min on blacksmith-6vcpu-macos-26. After: measured on the first opted-in run at this tip.

Tests: tests/test_nightly_signer_jobs.py pins the one hand-off point, the fallback condition, the pool-only final-DMG step and its checks, and the overwrite rules. The sign-runner, recovery, coverage and retention tests are updated. Every other red guard here fails the same way on base.

Risk: high (release workflow). Nothing changes unless the sign_pool input or vars.CI_NIGHTLY_NEXT_SIGN_POOL opts in.

Review (codex gpt-6-astra xhigh): SHIP at b8b7e93

Agent session: agent session

🤖 Generated with Claude Code

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review b8b7e93: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr26491 -f ref=ib/nightly-next-signer-mac-leg -f platform=macos -f backend_mode=local

[teamleaderleo]

Owned by an agent session · session

[blacksmith-sh]

Found 4 test failures on Blacksmith runners:

Failures

Test	View Logs
build_only must be a conjunctive exclusion on the helper, signing, and publication jobs , and must not gate the unsigned app build/ build_only must be a conjunctive exclusion on the helper, signing, and publication jobs , and must not gate the unsigned app build	View Logs
nightly.yml must derive the embedded key and sign every appcast through the helper/ nightly.yml must derive the embedded key and sign every appcast through the helper	View Logs
test_the_nightly_is_covered (main.NightlyStepCoverageTests.test_the_nightly_is_cove red)/ test_the_nightly_is_covered (main.NightlyStepCoverageTests.test_the_nightly_is_cove red)	View Logs
test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)/ test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Bead cx-bjaxti created for this PR by the cmux coordinator.

[github-actions]

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4062181672501 (f2500c8ab0)
• cmux NEXT nightly 1.0.0-nightly.4062224162001 (0c8336391b)