[cmux-bot]

glaeda pins these runner hooks (glaeda-disk's CMUX_NEXT_DRAIN_HOOK_SHA256), and scripts/ci/glaeda-signing-hooks.txt does not list them yet. Until it does, owned-Mac signing jobs on minis that run them fail their claim gate, and each run's Blacksmith twin signs.

• df0e90b42c73838e01855a51636b7ed5c47fd918faf76ab815b5ce78aec54e57: glaeda 548d71ae: runner hook: a borrower whose repack finds its store damaged is reset and borrows again once (fix(keyboard): support CJK input methods for custom shortcuts #1770)

Check before landing: each sha is the sha256 of scripts/glaeda-cmux-runner-hook at a reviewed glaeda main commit, and that hook still waits out an earlier job's leftover processes and gives signing jobs the exclusive claim. tests/test_ci_signing_owned_mac.py checks that every listed sha is a glaeda pin.

Written by cmuxterm-hq .github/workflows/fleet-reconciler-glaeda-signing-hooks.yml (tools/fleet-reconcilers/glaeda_signing_hooks_sync.py). It updates this branch when glaeda pins another hook, and never merges.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Adds the glaeda runner hook df0e90b4 (glaeda 548d71ae) to scripts/ci/glaeda-signing-hooks.txt so owned-Mac signing jobs that run it pass their claim gate instead of failing and letting each run's Blacksmith twin sign.

The hook resets a borrower whose repack finds its store damaged, allowing it to borrow once more.

^{Written for commit 5758129. Summary will update on new commits.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 5758129: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr29332 -f ref=auto/glaeda-signing-hooks -f platform=macos -f backend_mode=local

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4121152269601 (d3f317b93c)
• cmux NEXT nightly 1.0.0-nightly.4121223757501 (9a6e1c2aa1)
• cmux NEXT nightly 1.0.0-nightly.4121347027401 (644491fdf9)
• cmux NEXT nightly 1.0.0-nightly.4121400491301 (43c10b88a7)

[lawrencecchen]

Review (independent subagent, Opus 5.5 claude-opus-5-5): SHIP at 5758129

Base red: feat-cmux-next's own guards push runs 41200287738, 41199731009 and 41199330679 fail SigningHooksInStepWithGlaedaTests.test_every_listed_hook_is_one_glaeda_released_with_the_check, because glaeda's newest hook df0e90b4 is not listed. This PR clears that red.

• Red first: at origin/feat-cmux-next 3bcae6c, python3 tests/test_ci_signing_owned_mac.py SigningHooksInStepWithGlaedaTests fails (1 failure). At this head it passes, and the full file passes 19/19 (Linux VM, portable Python).
• The reviewer checked independently: the sha256 of scripts/glaeda-cmux-runner-hook at glaeda 548d71ae9c86 is df0e90b4, and it is the last entry in glaeda main's CMUX_NEXT_DRAIN_HOOK_SHA256. The previous hook (parent 1cd373c3) hashes to 49b5d9f5. The hook diff changes only borrow_mirror (job-completed store reset and one retry). The leftover-process wait, the exclusive claim, and the GLAEDA_JOB_CLAIM/GLAEDA_HOOK_SHA256 exports did not change. No workflow names the sha.
• Note for glaeda (non-blocking): the reset_damaged_borrower docstring says "store whole on OSError". That is not true when there are no submodule stores (rmtree comes before git init).
• No compile is needed: this PR changes only a data file that the claim gates read.

[lawrencecchen]

Fleet compile at the exact head 5758129: cmux-ci compile-check --app --ref 57581293c6fba73fabb339a4d508f25810f72763. Job 1cf8f9823586f46bbe7ab33f: compile check app: passed (81 s). The risk:high evidence is now complete: the independent receipt (comment above) and a green compile at this head.

[lawrencecchen]

Review (claude-rereview): SHIP at 5758129

No findings.

What the PR does: it adds one line to scripts/ci/glaeda-signing-hooks.txt (line 24), so that owned-Mac signing jobs trust the glaeda runner hook df0e90b4... (glaeda 548d71ae, #1770).

What I checked:

• The sha is correct. I downloaded scripts/glaeda-cmux-runner-hook at glaeda 548d71ae9c8648d38e1904bdc838610d6179be61 and its sha256 is df0e90b42c73838e01855a51636b7ed5c47fd918faf76ab815b5ce78aec54e57. That commit is the current glaeda main tip.
• glaeda pins it: scripts/glaeda-disk at that commit lists the sha in CMUX_NEXT_DRAIN_HOOK_SHA256 (line 861).
• The hook change is safe for signing. The diff from the last trusted hook (1cd373c3, Allow configurable tab/surface label font size #1768) to 548d71ae changes only borrow_mirror: on a repack error that names an unreadable object, it resets the checkout's git store and borrows one more time. The reset runs inside the existing try/except Exception of borrow_mirror, so it cannot fail a job. The exclusive whole-mini claim (export_job_claim, GLAEDA_JOB_CLAIM, GLAEDA_HOOK_SHA256), the signing-hooks pre-check and the leftover-process wait are not changed.
• python3 tests/test_ci_signing_owned_mac.py at this head: 19 tests, OK (run locally; it is a Python test).
• PR checks on this head: no failed check. tooling-tests, risk evidence, signing runner variables are ephemeral and the nightly guards pass; the rest skip for a data-only change; next-autoland / verdict is pending.
• risk:high compile: fleet compile check job 09e070c29d7fa7ad63e22f51 at this exact head passed (CmuxNext 223 s, app 89 s, cmux-tui 11 s).
• The rules for Swift and UI (main thread, motion, dialogs, keys, fonts, try!) do not apply: no code changes in this repo. No BSL server directory changes. It is not a bug fix, so no red-first test is needed.

What I did not check:

• I did not run a real signing job on an owned Mac with this hook.
• I did not review the whole glaeda hook, only the change since the last trusted hook.