[teamleaderleo]

A NEXT update can relaunch the app from macOS's code_sign_clone bundle. The daemon currently refuses its handoff as a temporary executable, leaving the old daemon running after its binary is deleted and every pane failing the server peer check.

Leo: "30+ seconds just for the chat to come back"

Leo's standing rule: "OUR F***ING STUFF IS HARDLY EVER GOING TO GO IDLE... ACCEPT IT BREAKING AT SOME POINT BUT IT RESUMES WHATEVER IT INTERRUPTED."

Recognize update clones only after full Security.framework validation of the clone and installed /Applications bundle and their executables. Their Apple-anchored Team IDs and signed identifiers must match this signed build. For handoff, the socket peer's audit-token-bound running code must also satisfy the installed executable's designated requirement. A copied unsigned or modified binary in a clone-shaped directory cannot pass. Missing/invalid signatures fail closed. Plain temporary executables and runner _work paths stay refused.

The app's AcpmuxServerPeer check remains unchanged: its unknown-peer error follows the deleted old executable. Allowing verified handoff lets that daemon stop normally. Starting at /Applications is deferred because the app enrolls only at its expected exact executable path; changing that independently would break enrollment.

Validation:

• Red: run 40856942331, 6eb8110057c3d8069e93f88b41fbd0bbb97a1848: 11 existing executable-path tests pass; sign_clone_start_and_handoff_require_signature_proof fails with the old refusal behavior.
• Green at 79a3cedbc3a6c5929d0ff5b95665298643b7a98a: run 40858609739, all 12 executable-path tests and all 41 cmux-link tests pass. cargo check -p cmux-link --target aarch64-apple-darwin also passes.
• Current head d8c52ff2e884e5090a8082b2cc7388784ebb7f06 simplifies two guard predicates to satisfy clippy without changing their behavior. Exact-head Linux regression/clippy is green: run 40859608901, including 12 executable-path tests, 41 cmux-link tests, and clippy for acpmux/cmux-link. Independent Astra high/fast review is SHIP at that exact head. Fleet macOS compile/tests also pass at this head: step 743bd914d4c3a88e0409a72b, nextest run 87710e22-ec12-4aee-b4a6-7993fd9b7004, scripts/ci/cmux-tui-rust-check.sh test sign_clone (profile ci), 4 selected tests passed, 0 failed, 12050 skipped. The tests cover clone signature matching, missing/mismatching signatures, temp/runner rejection, and start/handoff acceptance. The earlier overflow-routed step was cancelled before testing and supplies no evidence.
• The review also verified SecCodeCopyDesignatedRequirement in Xcode 26.6's Security header and framework export stub. This PR adds only that symbol to its cross-build stub.

Base CI warnings, compared by the coordinator: SDK generation fails test_live_raw_v12_layout_and_history_contracts_are_exact (new-pane-right); the SwiftUI guard flags HomeChatColorsPanel.swift and HomeChatColorsView.swift. None of those files or behaviors changes here. The two clippy nonminimal_bool errors introduced here are fixed and clippy passes at the current head.

Signature-decision unit tests use a fake reader of validated signature facts, so CI needs no signed app fixture. Production uses SecStaticCode and audit-bound SecCode validation; these tests do not claim a real signed-clone runtime reproduction.

Related app recovery work: #27283 (separate files). pr-overlap was attempted but its GraphQL read is unsupported by the lane broker; PR search found only that companion PR.

Risk: changes an executable trust decision. The exception requires cryptographic proof, is macOS-only, preserves the runner guard and existing app authorization rules, and never trusts a folder name alone.

Agent session: agent session

[blacksmith-sh]

Found 9 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmpdv68ds0h/summary-missing.json (live):/summary-missing.json (live):	View Logs
/tmp/tmpf47xtkl5/summary-fail.json (live):/summary-fail.json (live):	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs
test_live_raw_v12_layout_and_history_contracts_are_exact (test_ir.IrTests.test_live_raw _v12_layout_and_history_contracts_are_exact) (command='new-pane-right')/ test_live_raw_v12_layout_and_history_contracts_are_exact (test_ir.IrTests.test_live_raw _v12_layout_and_history_contracts_are_exact) (command='new-pane-right')	View Logs
test_live_raw_v12_layout_and_history_contracts_are_exact (test_ir.IrTests.test_live_raw _v12_layout_and_history_contracts_are_exact) (command='new-pane-right')/ test_live_raw_v12_layout_and_history_contracts_are_exact (test_ir.IrTests.test_live_raw _v12_layout_and_history_contracts_are_exact) (command='new-pane-right')	View Logs
test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)/ test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Bead cx-i5tutp created for this PR by the cmux coordinator.

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review d8c52ff: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr27377 -f ref=lane/hb-signclone -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); no finished base run on 8c5ab04 to compare; do not merge until green; see lane-rules

[teamleaderleo]

Review (gpt-6-astra, high, fast; independent Codex reviewer): SHIP at d8c52ff

All four review passes ran in one session:

• Full-diff review at 291e88f: its only blocker was the missing SecCodeCopyDesignatedRequirement export in scripts/ci/macos-stubs/Security.tbd, and it found no security blocker.
• Delta review 291e88f..79a3ced: SHIP. The fix adds exactly that stub export.
• SDK check at 79a3ced: SHIP. The declaration is at Xcode 26.6 SecCode.h:327, the export at Security.tbd:419, and no other exports were added.
• Delta review 79a3ced..d8c52ff: SHIP. Two De Morgan rewrites of the guards, same semantics.

Tests:

• Red: run 40856942331 shows the old refusal behaviour.
• Linux green at this head: run 40859608901 (12 exe_path tests, 41 cmux-link tests, clippy for acpmux and cmux-link).
• macOS fleet at this head: step 743bd914, nextest run 87710e22; all 4 sign_clone tests pass.

Remaining reds match base:

• test_ir new-pane-right (inventory, protocol contract)
• No-SwiftUI HomeChatColors
• release-notary test_digest on tool-audio-discovery.md, which came from #27362

Risk: the reviewer noted that the tests mock signature verification and never exercise a real signed clone. A follow-up should add a macOS test against a real ad-hoc-signed copy.

[github-actions]

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/40863444386 at e85bfbd failed: cmux-next checks (god files, concurrency, crash safety, l10n), cmux-next generated files.
Those jobs last passed at 3aae968. This pull request is one of 4 merged since: #27377, #27390, #27379, #27220.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.

[github-actions]

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4086548494201 (33dff862ca)
• cmux NEXT nightly 1.0.0-nightly.4086676923101 (661a3e605f)
• cmux NEXT nightly 1.0.0-nightly.4086860262501 (4039e29ac7)