[teamleaderleo]

Changelog

Production image workflows no longer read FREESTYLE_PROD_ANCHOR. They require a trusted production snapshot already recorded in repository channel data: a key must resolve its name to the recorded id, and a key that resolves the dev snapshot is refused. No production record means refusal, including a third-account key returning 404 and a dev key whose recorded snapshot has been deleted. There is no trust-on-first-use bootstrap.

Production promotion checks repository identity before recording the downloaded candidate, so that candidate cannot provide its own account anchor. Bake checks identity before creating resources. Malformed production pointers fail closed; normal previous: null, team-only records, and dev rollback pointers remain supported.

The protected environment gate is unchanged: dispatch from refs/heads/feat-cmux-next, existing cmux-next-vm-image-prod, custom branch policies enabled, protected branches disabled, exactly branch:feat-cmux-next. No new secrets or permissions, no production signup, and no provider calls were made for this PR.

Setup and remaining work

Create the environment with that branch policy and supply FREESTYLE_API_KEY. Production remains inert until the team independently verifies and records a production snapshot through review. Removing the manual environment anchor does not remove this bootstrap prerequisite.

Item 2 remains blocked on a team-owned production Stack test account requiring the existing CMUX_UITEST_STACK_EMAIL and CMUX_UITEST_STACK_PASSWORD secrets. Their handling is unchanged. The staging cloud-capture path does not create a runtime account and cannot supply the production profile.

Validation

• Account-identity regression red: 40927834660, broker job 453ceae63c6047c3bb7d12b17f5f4007, at dc3a2c8f5c81adbe54cee391baa247ccfd002cee (new tests with old implementation). Exactly the third-account and deleted-dev-snapshot cases fail; 123 pass, 2 fail.
• Final focused suites and supply-chain security: SUCCESS, 127 tests passed, 0 failed, 504 assertions; supply-chain security passed. Run 40928134202, broker job 07c85e1a1b3c48cf8e07e6912531600e, at f5f926d6459246c0e5e5ad74dcb924e5f9260d11.
• Promote-ordering replay setup failed before tests (exit 128: old commit unavailable in CI snapshot checkout); not regression or base-red evidence. Run 40928476295, broker job 7cef3441afd742bdae16ecb634d2eb8c.
• Replacement ordering replay supplies the exact old workflow bytes directly, without relying on CI history: expected RED (exit 1): exactly requires repository identity before importing candidate identity and a refused account stops the step and removes its key file fail because the old workflow lacks the check step. Both pass in the final green run. 40929090050, broker job ebfacc8bf95d414b9ada2ef2d349e855.
• Fresh independent Astra high/fast review: SHIP at f5f926d6459246c0e5e5ad74dcb924e5f9260d11; recognized receipt posted on this PR. This supersedes the previous head's no-anchor P1 BLOCK.

Risk: production bootstrap is deliberately blocked without independently trusted channel identity. Production operation was not exercised.

Agent session: agent session

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review f5f926d: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr27207 -f ref=lane/hb-prod-anchor -f platform=macos -f backend_mode=local

Passes: CI passes on f5f926d645.

CI passes on f5f926d645 (run 40928112674 attempt 1).

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's; yours means the failing file is one this PR changes, also red on main that main's latest full suite fails the same way, seen on other PRs that it failed on another pull request's run lately.

red: cmux-next checks (god files, concurrency, crash safety, l10n); no finished base run on 2241229 to compare; do not merge until green; see lane-rules

[teamleaderleo]

Bead cx-b21oy5 created for this PR by the cmux coordinator.

[blacksmith-sh]

Found 6 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmp1twty9mg/summary-missing.json (live):/summary-missing.json (live):	View Logs
/tmp/tmp8iv1oyb6/summary-fail.json (live):/summary-fail.json (live):	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Review (codex gpt-6-astra high fast, independent box review-27207-5b79): BLOCK at 5b79e95

BLOCK

1. [P1] The first run fails open on account identity — web/scripts/cmux-vm-image/prod-copy.ts:124-129. With no production snapshot record, any key whose dev-snapshot lookup is not the exact dev ID is accepted. A third-account key normally gets 404, which freestyleResolve converts to undefined, so the copy proceeds. The workflow then bakes with that same key at cloud-vm-image-bake.yml:254-280. The environment gate validates only branch policy, not account identity; a missing/misconfigured production key can therefore create the production image in the wrong account. A missing dev snapshot record also lets the dev key pass this check. The no-anchor case must fail closed or retain an independently trusted production anchor.

[teamleaderleo]

Review (codex-review-box/gpt-6-astra high, lane-place): BLOCK at 5b79e95

BLOCK

1. [P1] The first run fails open on account identity — web/scripts/cmux-vm-image/prod-copy.ts:124-129. With no production snapshot record, any key whose dev-snapshot lookup is not the exact dev ID is accepted. A third-account key normally gets 404, which freestyleResolve converts to undefined, so the copy proceeds. The workflow then bakes with that same key at cloud-vm-image-bake.yml:254-280. The environment gate validates only branch policy, not account identity; a missing/misconfigured production key can therefore create the production image in the wrong account. A missing dev snapshot record also lets the dev key pass this check. The no-anchor case must fail closed or retain an independently trusted production anchor.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[teamleaderleo]

Independent Codex gpt-6-astra review, high reasoning / fast service, at head f5f926d6459246c0e5e5ad74dcb924e5f9260d11 (base 2241229c6708f7cb07bd2507f86806e49468febc). Verbatim reviewer verdict:

No actionable findings. The previous P1 is repaired:

• No production anchor now fails closed, including arbitrary-key 404s and a dev key whose snapshot was deleted.
• Production promotion checks trusted repository records before importing candidate identity; bake checks before creating resources.
• The exact environment gate and Stack secret handling are preserved. No signup flow is introduced.

Reviewed the repair delta, full base-to-head diff, call paths, and regression tests statically. No tests, builds, installs, provider calls, edits, or posts performed; separate CI results were not assessed.

SHIP at f5f926d

[teamleaderleo]

Review (codex gpt-6-astra high fast, independent review): SHIP at f5f926d

Independent Codex gpt-6-astra review, high reasoning / fast service, at head f5f926d6459246c0e5e5ad74dcb924e5f9260d11 (base 2241229c6708f7cb07bd2507f86806e49468febc). Verbatim reviewer verdict:

No actionable findings. The previous P1 is repaired:

• No production anchor now fails closed, including arbitrary-key 404s and a dev key whose snapshot was deleted.
• Production promotion checks trusted repository records before importing candidate identity; bake checks before creating resources.
• The exact environment gate and Stack secret handling are preserved. No signup flow is introduced.

Reviewed the repair delta, full base-to-head diff, call paths, and regression tests statically. No tests, builds, installs, provider calls, edits, or posts performed; separate CI results were not assessed.

SHIP at f5f926d

[github-actions]

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/40932085190 at 4efc389 failed: cmux-next checks (god files, concurrency, crash safety, l10n).
Those jobs last passed at 2289f95. This pull request is one of 5 merged since: #27052, #27207, #27484, #26875, #27007.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.

[github-actions]

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4093039481101 (7eb7c26087)
• cmux NEXT nightly 1.0.0-nightly.4093446036501 (6c1a5ab8bf)
• cmux NEXT nightly 1.0.0-nightly.4093630103101 (58286343a8)

[github-actions]

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/40931922742 at 52b0452 failed: cmux-next checks (god files, concurrency, crash safety, l10n).
Those jobs last passed at 2289f95. This pull request is one of 4 merged since: #27052, #27207, #27484, #26875.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.