[teamleaderleo]

HOLD: superseded by #28859 (carries all of this plus the ratchet fixes and both Astra P1 fixes). Do not land this PR.

Leo (2026-10-28), on T3 Code's "Share with guest": "we want to be having, be able to do this kind of flow for CMux multiplayer ... we can work on the agent chat multiplayer." In that flow the owner shares a chat by link, "each message they send waits for you", and the owner approves each one: Approve sends it to the agent, Decline drops it.

This is the first PR of the plan in manaflow-ai/cmuxterm-hq#4766 (section 4, "First PR to build"). It changes acpmux only: no UI and no proxy change.

What it does

• Guest author. _meta.acpmux.author also accepts guest:<opaque> ids, for a link guest who is on no tailnet and has no account. It also accepts approval: "owner". Any other approval value gets author.value_refused. The prompt's person_message provenance keeps approval: "owner", and the hold is keyed on that field, not on the id prefix.
• The hold. A prompt whose author carries approval: "owner" always goes into the queue, even when nothing is running. Its queued record has awaitingOwner: true, revision: 0, and its prompt_accepted says awaitingOwner.
  • It is never steered in and never stops the running turn, whatever steer, steerNow or interrupt it asks for (prompt_unless_held).
  • Every path that takes prompts out of the queue passes it by (QueuedPrompt::aside): turn order, the digest of agent messages, the busy check of a retry or continuation, and a restart.
• _acpmux/queue_approve {sessionId, promptId, revision}. The prompt waits no more and runs in its place in the queue as an ordinary queued prompt, never as a steer. The log records queue_approved {promptId, turnId, revision, approvedAt}.
  • If revision is not the current one, the request gets queue.stale (data.revision is the current one). The owner can only approve the words they saw.
• _acpmux/queue_decline {sessionId, promptId}. The prompt leaves the queue and never runs.
  • Its waiting session/prompt gets an error (-32000) with data {reason: "queue.declined", promptId, turnId}.
  • The log records queue_declined {promptId, turnId, revision, declinedAt}, then queue_removed {reason: "declined"}.
• Owner only.
  • A request with any _meta.acpmux.author gets queue.owner_only.
  • From Web, approve and decline count as controlling the chat (remote_guard.rs, the same check as a Web prompt).
  • Like a prompt, both are held to the Full-access machine (full_access_hold).
  • Approve, decline and the author's remove are decided under the queue lock. A later answer to a prompt that no longer waits gets queue.not_found (-32002) with data.decided (approved, declined or removed) once the log says which.
• The guest's own changes.
  • Edit still works. It keeps the prompt held at revision + 1, and the queue_updated record carries awaitingOwner and revision.
  • Remove still works.
  • Move, send now and interrupt get queue.awaiting_owner.
  • An edit after approval gets queue.approved.
  • The owner editing the prompt still gets queue.not_author.
• Cap. One author can have at most 16 prompts waiting for the owner. The 17th gets queue.too_many_held before it is recorded.
• Resend. A resend of the same prompt id while the prompt is held waits on the first one through the prompt ledger, and no second copy is queued.
• Restart. The waiting state is rebuilt from the log alone: queued {awaitingOwner, revision}, then edits, then queue_approved for that revision, queue_declined, or a removal.
• Surface.
  • QueuedPromptSummary (session summary queue) and _acpmux/composers expose awaitingOwner and revision.
  • New records queue_approved and queue_declined are transcript kinds.
  • New capability queue-approval-v1 and feature queueApproval.
  • Updated: docs/acpmux-schema.json, the README method list, spec/acpmux-protocol.json, and the TS types regenerated with bun scripts/acpmux-protocol-codegen.ts.
• _acpmux/queue_remove moved unchanged into server/requests/queued.rs, next to the two new methods. That keeps requests.rs from growing.

Not touched: the files of cmux#26707 (claude_stdio/steer_batch.rs, hub/steer_end.rs). The cmux host share proxy (agent_proxy.rs) only lets through a fixed list of agent-session-* commands, so a teammate cannot reach the new methods. Stamping approval: "owner" for an asker role comes in the next PR (plan item 2).

Risk

risk:high (labelled). Queue scheduling now skips prompts that wait for the owner, the same way it skips held ones. For a prompt with no approval, nothing changes: the new paths only run when the provenance carries approval: "owner", which only a stamped author sets today. The approval methods sit behind owner-only, Web-control and Full-access checks.

Tests

tests/hub_integration/prompt_approval.rs:

• A held prompt asked as a steer and interrupt still waits while the owner's own prompt runs past it. A resend of its id is a duplicate. Approve at its revision runs it under its author, not as a steer. An authored approve gets queue.owner_only, and a stale revision gets queue.stale.
• Decline answers queue.declined, and the turn never starts.
• The guest's edit keeps the prompt held at a new revision. Move, send now and interrupt get queue.awaiting_owner, the owner's edit gets queue.not_author, an edit after approval gets queue.approved, and a late answer gets queue.not_found with decided. The 17th held prompt gets queue.too_many_held.
• A restart between an edit and the approve keeps the new revision held, and the owner's prompt still runs past it.
• racing_edits_are_logged_in_revision_order: two clients edit the held prompt 20 times each, concurrently. The log's queue_updated records name revisions 1 to 40 in log order. An edit is now logged under the queue lock that gave it its revision, as queue_approved and queue_declined already were (review BLOCK at f86a848: an edit logged after the lock let a slower, older edit land last, and a restart then paired a later approval with other words).
• a_restart_never_rolls_an_edit_back_to_an_older_revision: a log that holds revision 1's edit after revision 2's (as an older daemon could write it) restores revision 2's words. An approval of revision 1 gets queue.stale, and approving revision 2 runs "second rewrite".

Ran on the merged head with cargo test -p acpmux --test hub_integration -- prompt_approval: 14 passed. cargo test -p acpmux --lib protocol (the IR check): 9 passed. Red on the tests-only commit d890b18 (the fix left out): a_restart_never_rolls_an_edit_back_to_an_older_revision FAILED, left: (true, 1) right: (true, 2), the restart restored the older revision. racing_edits_are_logged_in_revision_order passed there too: the race needs an unlucky interleaving and did not hit in 20 rounds, so it guards the order without proving the old bug.

A second base merge (234b0a8) resolved conflicts with #27523 (inbox digest), #27660 (queue remove fromAgentsOnly) and #27685 (Stop holds agent messages):

• A queued prompt's wait loop keeps base's digest answer (gone_reply) and the owner's decline (gone_or_declined). A prompt that still waits for the owner (take_queued → Ok(None)) frees its turn and waits on.
• queue_remove's new fromAgentsOnly moved into server/requests/queued.rs with it.
• An inbox digest never takes a prompt that waits for the owner (digestible).
• logged_prompt's new-incarnation arm also clears the digest a requeued copy left.
• cargo clippy -p acpmux --tests -D warnings is clean. This VM's test runs hit its own TMPDIR/home permission checks (private-store refusals), so the merged head's acpmux tests are CI's.

The first base merge resolved conflicts with #27519 (_acpmux/queue_text) and #27536 (a carried turn queues behind it). Both methods stay registered, and base's two new enqueue calls take the held-prompt cap's error like the others.

Also: unit tests in author.rs, and the IR and capability tests. Results are in the cmux-ci receipt below.

No capture: nothing on screen changes. The only webview file touched is the generated protocol method list (webviews/src/agent-session/acpmux/protocol/generated/methods.ts, two new _acpmux/queue_approve / queue_decline entries); the Approve / Decline card is #26742.

Changelog

none

Agent session: agent session

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Adds owner approval for prompts that link guests send in acpmux, the first step toward the guest chat flow in manaflow-ai/cmuxterm-hq#4766. A prompt whose author carries approval: "owner" queues and waits for the owner: it is never steered in, never stops the running turn, and the queue runs past it. Prompts without that flag behave exactly as before.

Changes

• _acpmux/queue_approve runs the prompt in queue order at the revision the owner saw; stale revisions get queue.stale; _acpmux/queue_decline drops it and its writer answers queue.declined. Both are owner-only, hold to Web control and Full-access rules, and the approved prompt runs under the approver's rules too (stricter control, trust gate, Full-access machine), recorded in queue_approved and restored on restart.
• Every queued, approved, declined and edited record is logged under the queue lock that changed the queue, so a concurrent decline or edit cannot be lost to a restart; approve and decline bind to the specific queued prompt by its turn id, and queue_approved / queue_declined are indexed transcript kinds.
• Guests can edit (bumps the revision, still waits) or remove their prompt; move, send now and interrupt get queue.awaiting_owner. At most 16 prompts wait per author (queue.too_many_held); a restart rebuilds the state from the log (a slower, older edit never rolls back a newer revision), a waiting prompt wakes no child and holds no notice back, and summaries expose awaitingOwner and revision.
• A held prompt and the owner's answer go only to the peer that listed queueApproval at handshake; an older peer gets queue.approval_unsupported and nothing is forwarded. A chat with a held prompt cannot move (transfer.held_prompts), checked against every bundle log segment.

^{Written for commit 4dd329b. Summary will update on new commits.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 126b2d0: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr26747 -f ref=lane/mp-hold -f platform=macos -f backend_mode=local

Passes: CI passes on 4dd329b42e.

CI passes on 4dd329b42e (run 41176644337 attempt 1).

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's; yours means the failing file is one this PR changes, also red on main that main's latest full suite fails the same way, seen on other PRs that it failed on another pull request's run lately.

web and size checks: green

Gallery before/after for 4dd329b: 16 states rendered, 3 images differ, 2587 more touched states not rendered. Images are in the run's artifact, not on this public PR; the independent review of this head reads them on its own, so the PR needs no hand-made screenshots of these states.

gh run download 41176644212 -R manaflow-ai/cmux -n gallery-advisory-26747-4dd329b42e295fa4eecd86aa1e0c2bffb6c7978b (then read gallery-review.json)

States

State	Theme	Status	Diff	Picked by
agent-pane.live-chat-watch/choice-alone	Apple System Colors Light	unchanged	0%	imports methods.ts (1 hops)
agent-pane.live-chat-watch/choice-alone	Apple System Colors	unchanged	0%	imports methods.ts (1 hops)
agent-pane.live-chat-watch/view-only	Apple System Colors Light	unchanged	0%	imports methods.ts (1 hops)
agent-pane.live-chat-watch/view-only	Apple System Colors	unchanged	0%	imports methods.ts (1 hops)
agent-pane.access-offer/turn-no-credits	Apple System Colors Light	unchanged	0%	imports types.ts (2 hops)
agent-pane.access-offer/turn-no-credits	Apple System Colors	unchanged	0%	imports types.ts (2 hops)
agent-pane.access-offer/turn-low-credits	Apple System Colors Light	unchanged	0%	imports types.ts (2 hops)
agent-pane.access-offer/turn-low-credits	Apple System Colors	unchanged	0%	imports types.ts (2 hops)
agent-pane.access-offer/turn-no-offer	Apple System Colors Light	unchanged	0%	imports types.ts (2 hops)
agent-pane.access-offer/turn-no-offer	Apple System Colors	unchanged	0%	imports types.ts (2 hops)
agent-pane.auth-health/signed-in	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/signed-in	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/signed-out	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/signed-out	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/expired	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/expired	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/unknown	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/unknown	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.card-copy/prompt-rest	Apple System Colors Light	unchanged	0%	imports types.ts (2 hops)
agent-pane.card-copy/prompt-rest	Apple System Colors	unchanged	0%	imports types.ts (2 hops)
agent-pane.card-copy/prompt-hover	Apple System Colors Light	unchanged	0%	imports types.ts (2 hops)
agent-pane.card-copy/prompt-hover	Apple System Colors	unchanged	0%	imports types.ts (2 hops)
agent-pane.card-copy/prompt-copied	Apple System Colors Light	unchanged	0%	imports types.ts (2 hops)
agent-pane.card-copy/prompt-copied	Apple System Colors	unchanged	0%	imports types.ts (2 hops)
agent-pane.card-copy/message-rest	Apple System Colors Light	changed	0.0888%	imports types.ts (2 hops)
agent-pane.card-copy/message-rest	Apple System Colors	unchanged	0%	imports types.ts (2 hops)
agent-pane.card-copy/message-hover	Apple System Colors Light	changed	3.06%	imports types.ts (2 hops)
agent-pane.card-copy/message-hover	Apple System Colors	changed	2.82%	imports types.ts (2 hops)
agent-pane.card-copy/message-copied	Apple System Colors Light	unchanged	0%	imports types.ts (2 hops)
agent-pane.card-copy/message-copied	Apple System Colors	unchanged	0%	imports types.ts (2 hops)
agent-pane.card-copy/quiet-rest	Apple System Colors Light	unchanged	0%	imports types.ts (2 hops)
agent-pane.card-copy/quiet-rest	Apple System Colors	unchanged	0%	imports types.ts (2 hops)

_{Pick other states with a Gallery: entry.id, entry.id/variant line in the PR body.}

[blacksmith-sh]

Found 3 test failures on Blacksmith runners:

Failures

Test	View Logs
test_a_picked_signing_label_has_a_rerun_alternative (main.RunsOnFallbackTests.test_ a_picked_signing_label_has_a_rerun_alternative)/ test_a_picked_signing_label_has_a_rerun_alternative (main.RunsOnFallbackTests.test_ a_picked_signing_label_has_a_rerun_alternative)	View Logs
test_every_listed_hook_is_one_glaeda_released_with_the_check (main.SigningHooksInSt epWithGlaedaTests.test_every_listed_hook_is_one_glaeda_released_with_the_check)/ test_every_listed_hook_is_one_glaeda_released_with_the_check (main.SigningHooksInSt epWithGlaedaTests.test_every_listed_hook_is_one_glaeda_released_with_the_check)	View Logs
test_no_runs_on_chain_ends_on_the_reserved_side_label (main.RunsOnFallbackTests.tes t_no_runs_on_chain_ends_on_the_reserved_side_label)/ test_no_runs_on_chain_ends_on_the_reserved_side_label (main.RunsOnFallbackTests.tes t_no_runs_on_chain_ends_on_the_reserved_side_label)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[teamleaderleo]

Bead cx-polhq8 created for this PR by the cmux coordinator.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[teamleaderleo]

Review (codex gpt-6.1-sol high fast, next-review; Sol because Astra through SR2 hangs fleet-wide): SHIP at ce95f4a

No blocking findings.

Reviewed against the merge base, after a base merge for #28016/#28141/#28172 (peer feature flags, person Stop). Local on this head: clippy -D warnings clean; prompt_approval 14/14, peer_integration 51/51, peer_queue_approval 1/1, lib peer/queue_approve/person_stop 233/233.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[teamleaderleo]

Review (independent Codex gpt-6.1-sol, high, via the review router; full diff from merge base 8f5dfe0 to this head): BLOCK at f856ef2.

[P2] cmux-tui/crates/acpmux/src/hub/queue.rs:632 - enqueue releases the queue lock before appending the durable queued record. The owner can decline during this gap, causing queue_declined/queue_removed to be logged before queued; after restart, the late queued record resurrects the declined prompt and may run it without approval. - Keep the initial queued append serialized with queue insertion/decision, or make restore treat terminal records seen before a late queued record as authoritative.

[teamleaderleo]

Review (codex gpt-6-astra high, router-review): BLOCK at 726c942

BLOCK

1. cmux-tui/crates/acpmux/src/hub/inbox.rs:379: prompt_waits still checks !q.held instead of !q.aside(). An awaitingOwner prompt therefore blocks inbox notices from steering into a running turn, even though owner-held prompts are supposed to be skipped like held prompts. This delays agent messages until the turn ends and is inconsistent with the new queue semantics.

2. cmux-tui/crates/acpmux/src/hub/subsessions.rs:421: waking_children subtracts only q.held. A child whose only queued prompt awaits owner approval is counted as consuming a parent concurrency slot, potentially preventing unrelated child sessions from starting until that guest prompt is approved or declined.

[teamleaderleo]

Lander note at 726c942: under the 2026-10-30 rule, this PR's BLOCK findings are P2 or edge-case P1 and can land with follow-up issues. It conflicts with feat-cmux-next and update-branch cannot merge it. Next step for the owner: resolve the conflicts. The new head then needs a fresh independent review and its own reds checked against base.

[teamleaderleo]

Review (independent Codex gpt-6.1-sol, high, via the review router; full diff from merge base c4fd833 to this head): SHIP at 126b2d0.

No P1/P2 findings.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[teamleaderleo]

Review (codex gpt-6.1-sol high fast, review-router; started by the backlog lander): BLOCK at 4dd329b

BLOCK

1. P2 — Transfers to older daemons drop approval restrictions. queue_approve.rs:216 permits transferring approved prompts that still wait to run. However, the stricter control and trustGate applied by approval exist only in queue_approved. A daemon without queueApproval ignores that record and restores the original queued rules, allowing a Web-approved prompt to bypass Web control and folder-trust checks. Require target compatibility or export restrictions in a format older daemons enforce.

2. P2 — Resends can return an earlier incarnation’s result. prompt_ledger.rs:144 resets replay state only for another queued record. Complete prompt p, restart, reuse p without resend for an immediate turn, then restart and resend it. The second turn has only a user_message, which replay ignores because the first turn already set started and ended. Removing the previous last_turn shortcut therefore makes the resend return the first turn’s outcome—even if the second failed or was cancelled.

3. P2 — Approval cannot start restored prompts in protected folders. queued.rs:61 approves without releasing the session’s protected-folder hold. After restarting with an unseen chat in a protected folder, resume_restored_as skips spawning its queue tasks. Owner approval through the socket returns success, but its notification wakes nobody; the prompt remains stuck until a separate view or owner prompt releases the hold. Successful approval should release that hold and resume the restored work.

[teamleaderleo]

Thanks for the update-branch and the review. This PR is superseded by its carry, #28859 (same commits with authorship kept, plus a base merge and the ratchet fix), so please don't land #26747 itself. Its branch can't be pushed from the carrying lane: the claim names an earlier owner.
#28859 already has what you listed:

• the 30 serde_json::Value indexing hits replaced with .get() / JsonSet::set (commit 3bece34a), including author.rs, hub/queue_approve.rs and hub/prompt_ledger.rs;
• hub/queue_edit.rs uses saturating_add.
  At 2ef4629, clippy -D warnings is green, and none of the 694 acpmux indexing hits falls on a line the PR adds (evidence: acpmux: a guest's prompt waits for the owner (carry of #26747) #28859 (comment)).
  The three Sol P2 follow-ups (acpmux: transferring an approved prompt to an older daemon drops the approval's control and trustGate #29041, acpmux: a resend can return an earlier incarnation's turn result #29042, acpmux: owner approval does not start restored prompts in protected folders #29043) apply to the same code in acpmux: a guest's prompt waits for the owner (carry of #26747) #28859. I'll carry them as fix-forwards after acpmux: a guest's prompt waits for the owner (carry of #26747) #28859 lands.

[teamleaderleo]

Superseded by its carry #28859 (this PR's own HOLD says not to land it). Review and landing happen there. Closing this copy.