[cmux-bot]

glaeda pins these runner hooks (glaeda-disk's CMUX_NEXT_DRAIN_HOOK_SHA256), and scripts/ci/glaeda-signing-hooks.txt does not list them yet. Until it does, owned-Mac signing jobs on minis that run them fail their claim gate, and each run's Blacksmith twin signs.

• 3b7fc168de010536643ec01c34592c5487ff9a89776b434fa32b6db39aaf63f5: glaeda 63ace48b: runner-hook: a signing job its claim gate would refuse is refused before it drains the mini (Retry Warp display regression once before failing CI #1761)

Check before landing: each sha is the sha256 of scripts/glaeda-cmux-runner-hook at a reviewed glaeda main commit, and that hook still waits out an earlier job's leftover processes and gives signing jobs the exclusive claim. tests/test_ci_signing_owned_mac.py checks that every listed sha is a glaeda pin.

Written by cmuxterm-hq .github/workflows/fleet-reconciler-glaeda-signing-hooks.yml (tools/fleet-reconcilers/glaeda_signing_hooks_sync.py). It updates this branch when glaeda pins another hook, and never merges.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Adds glaeda runner hook 3b7fc168 to the trusted signing hooks list so owned-Mac signing jobs that run it pass their claim gate instead of failing it and having each run's Blacksmith twin sign.

^{Written for commit 955c6ee. Summary will update on new commits.}

[lawrencecchen]

Review (independent review subagent, Claude Opus 5.5): SHIP at 955c6ee

Evidence (read-only, gh api; glaeda was not cloned):

1. The sha is correct. sha256 of scripts/glaeda-cmux-runner-hook at glaeda 63ace48b60de3a1469aa1ce32f59890bff35613b = 3b7fc168de010536643ec01c34592c5487ff9a89776b434fa32b6db39aaf63f5. The hook at glaeda main has the same sha. glaeda-disk on main pins this sha as the last entry of CMUX_NEXT_DRAIN_HOOK_SHA256, so it is glaeda's newest pinned hook.
2. The commit is correct. 63ace48b is the merge commit of glaeda Retry Warp display regression once before failing CI #1761 (merged, title matches). It is the tip of glaeda main (compare status identical).
3. The diff is correct. The PR has one commit and adds one line to scripts/ci/glaeda-signing-hooks.txt, in the file's <sha256> <note> format. It has no other change.
4. The checks. The only red check is link ("Update the PR's review line"). It failed because pr_status.py got HTTP 403: API rate limit exceeded for installation when it posted a comment. This is an infrastructure failure, not a failure that the PR causes. nightly-guards / workflow-guard-tests / release-notary, risk evidence, ci-status and signing runner variables are ephemeral pass on this head.
5. The trust scope does not increase. Retry Warp display regression once before failing CI #1761 adds lines to the hook and removes none. For an exclusive (signing) job of the home repo, the hook reads scripts/ci/glaeda-signing-hooks.txt at GITHUB_SHA. If the list does not name the hook, the hook refuses the job before the drain. If the hook cannot read the list, or the list is empty, the behavior does not change (the claim gate decides). The change adds only an earlier refusal. It does not let more jobs sign, and it does not change admission, priority, reserves, drain bounds, the leftover-process wait or the exclusive claim.

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 955c6ee: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr28548 -f ref=auto/glaeda-signing-hooks -f platform=macos -f backend_mode=local

[github-actions]

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4114005995701 (cadce59781)
• cmux NEXT nightly 1.0.0-nightly.4114107274001 (775bfdad02)
• cmux NEXT nightly 1.0.0-nightly.4114274663601 (c4ad9e3975)