[teamleaderleo]

signer-dmg was pinned to Blacksmith Linux even though it receives release signing credentials, and the nightly Blacksmith-only debt test exempted it. That left a secret-bearing job outside the nightly fleet-first routing rule.

This routes the DMG signer through the existing drained owned-Mac signing picker, with the moving Blacksmith macOS label as overflow. The release environment is not widened to fleet Linux: this job keeps certificate and notarization credentials on the trusted signing Macs, in line with the rulebook's Linux, owned Macs, Blacksmith order and temporary credential handling. The checksum and base64 steps now work on both GNU/Linux and macOS. The routing and signing guards cover the regression and the Blacksmith debt exemption is removed.

Leo said: "why are changes to these not in my current nightly" and the freshness rule requires each feed's newest published build to stay within 30 minutes of the newest landing on its branch.

Validation: python3 -m unittest tests/test_nightly_signer_jobs.py tests/test_nightly_sign_runner.py tests/test_ci_nightly_off_blacksmith.py tests/test_ci_signing_owned_mac.py tests/test_ci_signing_keychain_is_deleted_before_bundle_code.py tests/test_release_signer_scripts.py (113 passed); workflow YAML parse and shell syntax checks pass.

Agent footer: agent session
🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Routes the nightly DMG signer through the fleet's owned Mac signing pool instead of pinned Blacksmith Linux, since the job holds release signing credentials and previously sat outside the nightly fleet-first routing rule. The Blacksmith macOS picker is now its overflow runner; fleet Linux is not added to the release environment.

Details

• New signer-build-macos job builds the macOS-native rcodesign artifact, since the Linux ELF cannot run on the Mac signing path; signer-dmg installs from that artifact.
• A claim-gate step holds the whole owned Mac before any credential and verifies the exclusive signing claim and the glaeda hook.
• The checksum, base64, and certificate-comparison steps are now portable across GNU/Linux and macOS, and the appcast generator skips its redundant OpenSSL Ed25519 check on macOS because the pure Python verifier runs right after.
• Tests updated to cover the new routing, the macOS build job, and the removal of the Blacksmith-only debt exemption for signer-dmg.

^{Written for commit cf67e8e. Summary will update on new commits.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review cf67e8e: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr29801 -f ref=lane/lane--nightly-signer-fleet -f platform=macos -f backend_mode=local

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4130052256501 (28aa638015)

[teamleaderleo]

Review (subagent): SHIP at cf67e8e

The native signer gate, macOS checksum/base64/Bash portability, mandatory pinned-key appcast verification, and warm-source declarations address the review findings. The owned-Mac claim gate fails closed before credentials. Fleet deployment must recognize signer-dmg in the glaeda signing hook before validating the owned signing route.

[teamleaderleo]

Review (subagent): SHIP at cf67e8e

[blacksmith-sh]

Found 20 test failures on Blacksmith runners:

Failures

Test	View Logs
1 runner guard check(s) failed:/1 runner guard check(s) failed:	View Logs
1 runner guard check(s) failed:/1 runner guard check(s) failed:	View Logs
nightly.yml job signer-build-macos never runs scripts/ select-ci-xcode.sh, so it builds with the image's default Xcode	View Logs
nightly.yml job signer-dmg never runs scripts/ select-ci-xcode.sh, so it builds with the image's default Xcode	View Logs
test_big_red (main.FleetRuleLints.test_big_red)/ test_big_red (main.FleetRuleLints.test_big_red)	View Logs
test_every_blacksmith_linux_label_fails_over (main.BlacksmithLinuxFailoverTest.test _every_blacksmith_linux_label_fails_over)/ test_every_blacksmith_linux_label_fails_over (main.BlacksmithLinuxFailoverTest.test _every_blacksmith_linux_label_fails_over)	View Logs
test_every_runner_variable_a_workflow_reads_is_reported (main.TheReportSeesEveryRun nerVariable.test_every_runner_variable_a_workflow_reads_is_reported)/ test_every_runner_variable_a_workflow_reads_is_reported (main.TheReportSeesEveryRun nerVariable.test_every_runner_variable_a_workflow_reads_is_reported)	View Logs
test_every_upload_is_short_lived_and_small_or_allowlisted (main.WorkflowTests.test_ every_upload_is_short_lived_and_small_or_allowlisted)/ test_every_upload_is_short_lived_and_small_or_allowlisted (main.WorkflowTests.test_ every_upload_is_short_lived_and_small_or_allowlisted)	View Logs
test_keychain (main.FleetRuleLints.test_keychain)/ test_keychain (main.FleetRuleLints.test_keychain)	View Logs
test_nightly_keeps_a_margin_under_the_limit (main.WorkflowFileSizeTest.test_nightly _keeps_a_margin_under_the_limit)/ test_nightly_keeps_a_margin_under_the_limit (main.WorkflowFileSizeTest.test_nightly _keeps_a_margin_under_the_limit)	View Logs

...and 10 more test failures. View all on Blacksmith

^{Need help on this PR? Tag @codesmith-bot with what you need.}