[teamleaderleo]

This is a narrow fix-forward for the base-red policy regression exposed by #30081. The nightly hosted-Mac guard reads RUNNER_POOLS from runs-on expressions, but the runner-label policy treated that JSON object as an unvalidated non-label variable.

RUNNER_POOLS is now parsed as pool metadata: _dead timestamps are ignored, while every pool member is checked for hosted macOS labels and self-hosted fleet labels. Empty configuration remains allowed, trusted Blacksmith Linux/macOS pool members remain allowed, malformed non-empty JSON fails closed, and no blanket exemption was added.

Leo’s routing rule is that paid runners are bounded overflow and hosted Macs are not part of the route. This keeps the policy test aligned with that rule without changing workflow permissions or runner trust.

Validation:

• python3 tests/test_ci_nightly_no_hosted_mac.py — 5 passed
• focused runner policy classes — 20 passed
• git diff --check — passed
• Full tests/test_runner_label_policy.py still reports the pre-existing CI_CONTROL_RUNNER report-list drift on this base; the new structured-pool tests pass.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes the base-red policy regression from #30081 by validating RUNNER_POOLS as structured JSON pool metadata in the nightly runner-label policy. Previously the JSON object was treated as an unvalidated non-label variable, letting hosted Macs slip through pool definitions.

_dead metadata timestamps are ignored; every other pool label is checked for hosted macOS and self-hosted fleet labels. Empty configuration and trusted Blacksmith Linux/macOS pools remain allowed. Malformed JSON, non-object values, and non-string labels all fail closed. No blanket exemption was added; workflow permissions and runner trust are unchanged.

^{Written for commit 1359211. Summary will update on new commits.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 1359211: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr30164 -f ref=lane/runner-pool-policy-fix -f platform=macos -f backend_mode=local

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4130052256501 (28aa638015)

[teamleaderleo]

Review (subagent, gpt-6-astra): SHIP at 1359211. Arrays/objects fail closed; macOS and ARM64 remain rejected; approved Blacksmith labels and _dead metadata pass. No workflow or trust-setting changes.

[blacksmith-sh]

Found 33 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmpk06w7jhz/summary-missing.json (live):/summary-missing.json (live):	View Logs
/tmp/tmpm_86253v/summary-fail.json (live):/summary-fail.json (live):	View Logs
1 runner guard check(s) failed:/1 runner guard check(s) failed:	View Logs
1 runner guard check(s) failed:/1 runner guard check(s) failed:	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs
convention violations found (ERROR lines above)./ convention violations found (ERROR lines above).	View Logs
test_big_red (main.FleetRuleLints.test_big_red)/ test_big_red (main.FleetRuleLints.test_big_red)	View Logs

...and 23 more test failures. View all on Blacksmith: run 41274341617, run 41274341461

^{Need help on this PR? Tag @codesmith-bot with what you need.}