[teamleaderleo]

Leo, 2026-10-30: "can you guys just do it", "like the initial 0 to 1 chat auto it sends to cloud".

Evidence: #28111 (comment). On a fresh devbox VM, cmux link sync push failed with fs.unavailable … fs-v1 is not served here, which breaks #28111's Cloud first send (cloud.startChat) and Move to Cloud on every new machine.

Root cause

The daemon serves fs-v1 only on a Cloud host that knows its model plane identity (CMUX_CODEROUTER_URL and CMUX_VM_ID). It looked for them only in its own environment and in ~/.config/cmux/model-plane.env. Since #11813 the image bakes a static /etc/cmux/model-plane.env (no CMUX_VM_ID, the same bytes for every machine) and create writes nothing into the guest. The daemon's unit carries neither key, and a shell only writes the per-home file from a boot env, which Freestyle never gives. So a fresh VM's daemon never had an identity.

Fix

• coderouter_usage::machine_source() resolves each key from the first place that has it: the process env, ~/.config/cmux/model-plane.env, the image's /etc/cmux/model-plane.env, and for CMUX_VM_ID last the bound /etc/cmux/daemon-instance-id. The bind agent (cmux-devbox-boot, cmux-host) writes that id before it starts the daemon, and rewrites it and restarts the daemon on a clone. cloud_fs (the fs-v1 gate) and the machine spend poller both use it. The root-owned image stamp is still required, so a Mac or plain host stays unchanged.
• Nothing is written to the guest's home. In the live exercise, a per-home file holding only the identity keys shadowed /etc for the shell and broke both agents. This fix leaves the shell's model plane alone.
• Cloud diagnostics (cloud.machines row): the new file_ops field, and fs-v1 listed in missing_features with compatibility limited on a Cloud machine whose daemon lacks it. Before this, the row said compatibility: current, so the app could not see the problem before the sync.

No image rebake is needed. The fix ships with the guest's cmux-tui (in-place machine update, or the next image).

Tests

• Unit: fresh_vm_resolves_from_the_image_env_and_the_bound_id, earlier_layers_win_per_key_and_bad_bound_ids_are_ignored (coderouter_usage).
• Linux journey: a_fresh_image_vm_serves_fs_v1_from_the_baked_env_and_the_bound_id (cloud_move_journey). A daemon with only the baked env does not serve fs-v1. Once daemon-instance-id exists it does, link sync push succeeds, and no per-home model-plane.env is written.
• Swift: aCloudMachineWithoutFileOpsIsReportedBeforeTheSync (CloudCLITargetTests).

Verified on a Cloud VM

On a devbox VM with the manual ~/.config/cmux/model-plane.env removed (nothing in ~/.config/cmux) and the daemon restarted:

• before, the image's build c230bb58: identify lists no fs-v1;
• after, this branch's Linux build 51b333f (the Rust at the PR head is unchanged since): identify lists fs-v1, and cmux link sync push of a git repo with an untracked file returns ok: true (14 files written). Still no per-home model-plane.env. The machine was paused again afterwards.

No capture: the only app change is two fields in the cloud.machines / Cloud diagnostics JSON row (AppControl+Cloud.swift); no view, layout or string changes.

Risk: the fs-v1 gate now also passes on a Cloud-stamped host whose only identity is the root-owned /etc/cmux files. Before, a user-writable per-home file was enough, so the gate is no looser than it was.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes a fresh Cloud VM's daemon never serving fs-v1, so cmux link sync push (Move to Cloud, Cloud first send) failed with fs.unavailable on every new machine.

The daemon now resolves its model plane identity (CMUX_CODEROUTER_URL and CMUX_VM_ID) from the process env, the per-home model-plane.env, the image's baked /etc/cmux/model-plane.env, and for the VM id the bound /etc/cmux/daemon-instance-id written by the bind agent before it starts the daemon. No per-home file is written, so the shell's model plane is left alone. Cloud diagnostics' machine row reports a file_ops field and lists fs-v1 as a missing feature on a Cloud machine whose daemon lacks it. The capability check now treats fs-v1 as conditional (served only on a Cloud host), so the isolated identify probe no longer requires it.

^{Written for commit 185cd29. Summary will update on new commits.}

[teamleaderleo]

Owned by an agent session · session

[teamleaderleo]

Review (codex gpt-6-astra high, router-review): BLOCK at 51b333f

BLOCK at 51b333f

Visual verdict: Not applicable; no view or layout changes.

1. [P1] [blocking] CloudCLITargetTests.swift:264 — The new test deterministically fails. Assigning connectionState = .connected(...) does not populate store.identity, which cloudMachineRow reads. Consequently, both file_ops boolean assertions receive .null, and missing_features lacks fs-v1. Use noteHandshake to seed identity and supply the required capabilities: the current fullIdentity() fixture would otherwise produce .incompatible, skipping the missing-feature branch. Use a fresh fixture for the final unknown-state assertion, because identity persists through reconnects.

Review completed by source inspection; Rust and Swift toolchains were unavailable, so tests were not executed.

[blacksmith-sh]

Found 3 test failures on Blacksmith runners:

Failures

Test	View Logs
test_a_picked_signing_label_has_a_rerun_alternative (main.RunsOnFallbackTests.test_ a_picked_signing_label_has_a_rerun_alternative)/ test_a_picked_signing_label_has_a_rerun_alternative (main.RunsOnFallbackTests.test_ a_picked_signing_label_has_a_rerun_alternative)	View Logs
test_every_listed_hook_is_one_glaeda_released_with_the_check (main.SigningHooksInSt epWithGlaedaTests.test_every_listed_hook_is_one_glaeda_released_with_the_check)/ test_every_listed_hook_is_one_glaeda_released_with_the_check (main.SigningHooksInSt epWithGlaedaTests.test_every_listed_hook_is_one_glaeda_released_with_the_check)	View Logs
test_no_runs_on_chain_ends_on_the_reserved_side_label (main.RunsOnFallbackTests.tes t_no_runs_on_chain_ends_on_the_reserved_side_label)/ test_no_runs_on_chain_ends_on_the_reserved_side_label (main.RunsOnFallbackTests.tes t_no_runs_on_chain_ends_on_the_reserved_side_label)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 2340929: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr28823 -f ref=lane/cloud-vm-fs-v1 -f platform=macos -f backend_mode=local

Not verified: macOS jobs did not run: compile and app tests were skipped on 185cd29032; ci-status is green without them.

CI passes on 185cd29032 (run 41185054816 attempt 1).
macOS jobs did not run: compile and app tests were skipped: Fast static checks skipped (the macos job needs both to succeed). Re-run CI once they pass, before merging.

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's; yours means the failing file is one this PR changes, also red on main that main's latest full suite fails the same way, seen on other PRs that it failed on another pull request's run lately.

web and size checks: green

Default changes

This pull request changes 2 defaults at 185cd290326f (what everyone gets without configuring anything):

• tunable-source.CmuxNextApp/Control/AppControl+Cloud.swift:cloudFileOpsCapability: (none) -> "737c3914f3ff0e414357cab07a036bc9a3b4c58ad03ab7dd19592e9393fe0718"
• tunable-source.CmuxNextApp/Control/AppControl+Cloud.swift:cloudMachineRow: "bbcfa7736fead0f55c5c17aafc869b5948636baf10c2e53543d9c137f23e5bae" -> "3c145083c906db9c6af8a5959063d52dc2257be50c6e72a054c4f8355c6f37d7"

Signed off on this commit by review (codex, router-review).

Merge receipt: merged as 67a26d4aacd1 with these defaults changed, signed off by review (codex, router-review).

Regenerate the snapshot with python3 scripts/ci/defaults_guard.py snapshot.

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4118647226102 (5da935675f)
• cmux NEXT nightly 1.0.0-nightly.4118757870202 (49199c2f17)
• cmux NEXT nightly 1.0.0-nightly.4119158082902 (5ada6804dc)

[teamleaderleo]

Review (codex, router-review): SHIP at 412a0f2

SHIP at 412a0f2

Visual verdict: No rendered UI changes; screenshot review is not applicable.

No findings.

Follow-ups: none

[teamleaderleo]

Review (codex, router-review): SHIP at 63192aa

SHIP at 63192aa

Visual verdict: No visual change; the PR’s no-capture rationale matches the diff.

No findings.

Follow-ups: none

router-review: gh api graphql failed: gh-quota: refused for session:claude-13 (budget 600/h, used 622 in the last hour): the shared GraphQL quota is under 15%; only gh pr merge and a single gh pr view run until it resets. Cached reads: glaeda-gh status run OWNER/REPO/RUN_ID --jobs (cache: ~/.cache/glaeda/gh/cache). Policy: machines/

[exited with code 0]

[teamleaderleo]

Independent review (gpt-6.1-sol high) at 63192aa: SHIP. No correctness findings.

[teamleaderleo]

Review (codex gpt-6-astra, router-review): SHIP at 2340929

Visual verdict: no images; Leo tries the build.

No correctness findings. The capability-reference check passes.

Follow-ups: none

[teamleaderleo]

Review (codex, router-review): SHIP at 185cd29

Reviewer: codex gpt-6-astra high, fast tier.

SHIP at 185cd29

Visual verdict: no images; Leo tries the build

No correctness or regression findings. Checked identity precedence, bind-agent startup ordering, the Cloud security gate, and capability diagnostics.

Capability-reference validation and its test suite passed. Rust and Swift tests could not run because their toolchains are unavailable.

Follow-ups: none