[teamleaderleo]

Leo, 2026-10-28: "Bro, I thought we already had logic to automatically route stuff. How can we still have pins like this? I hate pins. Like, just pin the set of the stuff that isn't hilariously slow."

cmux-next-ios-kit.yml's kit-tests runs on
... || vars.CI_PAID_MACOS_OVERFLOW == '1' && vars.MACOS_RUNNER_26 || 'blacksmith-6vcpu-macos-26': one fixed Blacksmith macOS label, with no owned Mac first and no stall-aware failover. None of the runs-on checks caught it:

• tests/test_ci_runs_on_fallback.py refuses only single-host labels (a glaeda-runner-* label or a mini's name) and the 12 vCPU Blacksmith Mac as a last resort.
• scripts/ci/runs_on_values.py refuses only runner-name variables that are read bare.
• scripts/ci/runner_routing_table.py counted only a bare vars.CI_SIDE_LANE_RUNNER / CI_LIGHT_LANE_RUNNER as bypassing placement.

A Blacksmith 6 vCPU macOS literal is none of those, so a job that moved off the owned pool onto a fixed Blacksmith label passed every check.

Change. runner_routing_table.check() now also fails a macOS job whose runs-on (plus its matrix, when it reads one) reads no picker output. A picker output is a needs.<job>.outputs.<x> other than the static capability map, or a caller's inputs.*. Each failure names the pickers to use: ios_runner_pool.py, simple_pool_picker.py or side_lane_placement.py.

The 42 macOS jobs pinned this way today each get a picker_followup in .github/runners.json. Like linux_followup and placement_followup, a followup that no longer applies fails, so the list only shrinks. The release-signing jobs are marked as needing a signing picker (per-job keychain, exclusive claim). A placement bypass already has its placement_followup and is not counted twice.

Red/green.

• The new fixture test test_a_macos_job_on_a_fixed_label_fails fails on the exact kit-tests expression.
• Before kit-tests got its followup, the tree test test_the_tree_classifies_every_macos_job failed and named cmux-next-ios-kit.yml#kit-tests runs on macOS from a fixed label.
• kit-tests now carries a picker_followup that points at ci: route iOS kit tests through the runner pool #28145, so this guard can land now and refuse new pins. ci: route iOS kit tests through the runner pool #28145 routes the job through ios_runner_pool.py: owned simulator Macs first, Blacksmith on retry, with the owned-pool rescue watch, whose main-side half ci: rescue iOS kit runs from main pool watcher #28431 has merged. With ci: route iOS kit tests through the runner pool #28145's workflow overlaid on this tree, the check reports kit-tests no longer runs on a fixed label; remove its picker_followup, so ci: route iOS kit tests through the runner pool #28145 drops that one line when it lands.

New fixture tests cover:

• the exact kit-tests expression;
• a bare literal, a variable plus a literal, and the capability map;
• a literal matrix against a picked matrix;
• a picker output and a caller's input;
• a stale followup;
• no double count with a placement bypass.

Validation: tests/test_runner_routing_table.py, test_ci_runner_capability_resolver.py, test_runs_on_labels.py, test_ci_no_github_hosted_macos.py and test_feat_ci_guard_group.py were run locally. test_ci_change_areas.py has one failure (test_repository_helpers_route_by_where_they_run), which is the same on base. No workflow file changes.

No capture: CI routing check only.

Agent session: agent session

🤖 Generated with Claude Code

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review e7fde0e: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr28600 -f ref=dep-fleet-3/ios-kit-picker -f platform=macos -f backend_mode=local

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4115755828101 (7c0adaf184)
• cmux NEXT nightly 1.0.0-nightly.4115843934401 (8b3fa55ef5)
• cmux NEXT nightly 1.0.0-nightly.4115962701801 (631d310eb9)

[blacksmith-sh]

Found 5 test failures on Blacksmith runners:

Failures

Test	View Logs
main.DeveloperIdAppTests.test_download_prints_the_active_profile_only/ test_download_prints_the_active_profile_only	View Logs
stubs: /System/Library/Frameworks/Security.framework/Versions/A/Security has no stub/ Security has no stub	View Logs
stubs: CoreFoundation.tbd: install-name /System/Library/Frameworks/ CoreFoundation.framework/Versions/A/CoreFoundation, missing 1: ['_CFRetain']/ CoreFoundation, missing 1: ['_CFRetain']	View Logs
stubs: CoreFoundation.tbd: install-name /System/Library/Frameworks/ CoreFoundation.framework/Versions/A/CoreFoundation, missing 1: ['_log2']/ CoreFoundation, missing 1: ['_log2']	View Logs
test_the_ten_first_party_gpl_crates_are_named_exactly (main.AppCrateLicenseGate.tes t_the_ten_first_party_gpl_crates_are_named_exactly)/ test_the_ten_first_party_gpl_crates_are_named_exactly (main.AppCrateLicenseGate.tes t_the_ten_first_party_gpl_crates_are_named_exactly)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Follow-ups from the independent review (Codex gpt-6-astra high, SHIP at eda4401). Neither one blocks:

1. A condition inside an indexed call is still read as a picker. In fromJSON(needs.p.outputs.ok == 'true' && '["macos-26"]' || '["macos-15"]')[0] the output appears only in a condition, so the value is a literal label, yet the check counts it as picked. Fix: apply the value-position analysis beneath indexing too.
2. Bracket property access gives false failures. needs.pick.outputs['runner'] and matrix['runner'] read the same values as the dot forms, but the check reports them as fixed labels.

No workflow in the tree uses either shape today.