[teamleaderleo]

Fixes a red in CI fast guards that every main PR now hits (for example #27022, run 40924337122):

FAIL: test_every_nightly_sign_verify_and_dmg_job_on_blacksmith_macos_is_rescued (tree='origin/feat-cmux-next')
{'sign-nightly-identity-legacy-blacksmith': 'not in NIGHTLY_SIGN_ALTERNATES'}

#27357 (merged into feat-cmux-next) added sign-nightly-identity-legacy-blacksmith, a same-run Blacksmith signer that takes over when the owned-Mac legacy identity attempt is refused. The test reads both branches' nightly.yml and requires main's scripts/ci/owned_pool_rescue.py to know every Blacksmith macOS sign or verify job, so the rescue can move it off a stalled label and the job can't hold the run's other stalled jobs in place. This adds the job to NIGHTLY_SIGN_ALTERNATES with _LEGACY_ALTERNATE, which its runs-on already has.

Risk: low. The rescue only touches this job when it is queued with no runner past the Blacksmith stall time and every other job in the run has finished. The job has if: github.run_attempt == 1, so a rescue re-run skips it. The re-run also re-runs sign-nightly-identity-legacy, which failed its claim gate on attempt 1, and on attempt 2 that job signs on the legacy alternate label, so the legacy DMG is still signed once. Without the entry the job stays queued, and as unfinished work it also keeps the rescue from moving the run's other stalled signing jobs.

Tests: tests/test_ci_owned_pool_sources.py and tests/test_ci_owned_pool_rescue.py pass locally.

🤖 Generated with Claude Code

Agent session: agent session

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes the red test_every_nightly_sign_verify_and_dmg_job_on_blacksmith_macos_is_rescued guard that hits every main PR since feat-cmux-next added sign-nightly-identity-legacy-blacksmith.

Registers sign-nightly-identity-legacy-blacksmith in NIGHTLY_SIGN_ALTERNATES with _LEGACY_ALTERNATE, matching its runs-on. The job only runs on attempt 1, so a rescue re-run skips it and re-runs the failed legacy signer on its alternate label. The rescue only acts when the job is stalled and nothing else in the run is pending, so impact is minimal.

^{Written for commit 1291c19. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 10 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: manaflow-ai/cmux
• Branch: ci/rescue-legacy-blacksmith-sign
• File: .coderabbit.yaml
• Commit: 1291c19
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: fe6152f1-a6b3-401c-a3df-e3abacb4ba88

Commits

Reviewing files that changed from the base of the PR and between d2ddfe1 and 1291c19.

Files selected for processing: 1

• scripts/ci/owned_pool_rescue.py

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[teamleaderleo]

Owned by an agent session · session

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[teamleaderleo]

Review (claude-opus subagent): SHIP at b122275

• Entry is right. On feat-cmux-next's nightly.yml the job has no name: (the anchors are concurrency, permissions, outputs, env and steps only) and no matrix, so its jobs-API name is the job id. sign_job_key() matches it exactly and does not confuse it with sign-nightly-identity-legacy (that prefix match needs a following " ("). Its runs-on contains _LEGACY_ALTERNATE verbatim, so sign_stall_gate() passes it.
• Attempt 1: the rescue only acts once the job is queued with no runner past the stall time and every listed job of the run has finished. The twin only queues after sign-nightly-identity-legacy failed its claim gate (exit 1 before any credential), so cancelling the run loses no signing work. The re-run of failed jobs then skips the twin (run_attempt == 1). It also re-runs sign-nightly-identity-legacy itself, because that job's conclusion is failure despite continue-on-error. On attempt 2 that job takes legacy-identity-target.outputs.sign_alternate, and its claim gate passes on Blacksmith with no claim=owned. Verify and publish key off its outputs (twin skipped falls through to sign-nightly-identity-legacy.result). So in the usual case the legacy DMG still gets signed in the rescue's own attempt, and nothing signs it twice.
• Attempt 2 and later: the twin is always skipped, so it can't stall again, and SIGN_RESCUE_LAST_ATTEMPT bounds the rescue. No loop.
• Without the entry, a stalled twin also counted as unfinished work that blocked rescue of any other stalled signing job in the run. That is what the source test guards.
• Nit (body and code comment only): "the feed watch re-runs the legacy job" is a backstop, not the main path. nightly_next_feed_watch.legacy_rerun() re-runs the earliest failed job in LEGACY_JOBS (the twin isn't in that list; sign-nightly-identity-legacy is) once the run has finished and the cmux NIGHTLY feed is more than 15 min behind. The main path is the rescue's own attempt 2 re-running sign-nightly-identity-legacy on its alternate label, as above. This does not block the merge.
• tests/test_ci_owned_pool_sources.py (9) and tests/test_ci_owned_pool_rescue.py (336) pass at this head.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[teamleaderleo]

Review (claude-opus subagent): SHIP at 1291c19

Delta from b122275 is one comment line in scripts/ci/owned_pool_rescue.py; no code change.

The new comment is accurate against feat-cmux-next nightly.yml:

• sign-nightly-identity-legacy-blacksmith has if: ... github.run_attempt == 1 ..., so on the rescue's re-run (attempt 2+) it is skipped.
• sign-nightly-identity-legacy fails at its claim gate (exit 1) when the owned Mac is refused, so the rescue's re-run of failed jobs picks it up, and its runs-on takes github.run_attempt > 1 && needs.legacy-identity-target.outputs.sign_alternate.

python3 tests/test_ci_owned_pool_sources.py: 9 tests OK.

Nit (body only, not blocking): the cubic summary now says the right thing, but the author's Risk paragraph still says "the nightly-next feed watch re-runs the legacy job when the cmux NIGHTLY feed falls behind". It should say the same as the code comment: the rescue re-run skips the Blacksmith twin and re-runs the failed legacy signer on its alternate label.

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Merge receipt for 1291c19b24: every check was green at merge (10 verified; 16 skipped by policy). Full suite runs on main after merge.