[teamleaderleo]

NEXT control jobs cannot authenticate the private controller from a runner outside its network. Consume its authenticated GitHub Check Run instead: require the existing publishing App, exact run, attempt, source, jobs and canonical lease identity, plus the controller's terminal decision and clocks. Missing or invalid publication fails placement; it never becomes a no-start receipt or a paid runner choice.

Leo: “FOR OUR NIGHTLIES ARE THEY END TO END ON OUR FLEET? WE CAN'T BE RELYING ON BLACKSMITH THAT CUTS OUT”.

CI_NIGHTLY_ADMISSION_CHECKS=1 opts ordinary NEXT builds in through a run/source-bound workflow title. The controller uses that marker and the actual current-attempt bootstrap job to admit demand before a runner starts. Dedicated-fleet jobs retain first priority and skip this reader. Unsigned-resume titles and routing remain compatible with the existing retry tracker. Downstream controls require a verified receipt from their own attempt, so a failed-jobs rerun cannot reuse stale placement and fall through to paid capacity.

The only permission addition is checks: read on the existing metadata job, needed to authenticate the Check Run's App identity. No App permission, credential, runner trust or release-environment change is made. Read-only permissions from #30248 are retained. Existing routes remain when the opt-in is disabled. Activation stays off until the controller demand and publisher changes are deployed.

The reader makes at most two authenticated GitHub requests, with one delayed retry only when publication is absent. Its 210-second publication allowance covers the controller's 180-second lease and delivery margin; the job timeout also bounds the operation. API calls have a 15-second timeout and 1 MiB response limit, and reject redirects. There is no polling loop, background timer, dispatch or cancellation. Existing warm sources and compile caches are unchanged; this adds no build.

Validation: the same focused missing-receipt regression fails on base f818cf72352 (it selects a fallback despite opt-in) and passes at this head. New receipt/workflow tests (18), legacy admission (26), trusted routing (37), dedicated routing (7), routing policy (33), nightly routing (20), fork routing (23) and promotion-queue cases (9) pass. The live routing-table check, diff validation and pre-push checks pass. Job-scoped permissions (5), reusable permissions, workflow-size (2) and source-archive policy checks also pass. Two identical license steps now use YAML anchors to retain workflow-size headroom; the parsed workflow is unchanged by that deduplication. Coverage includes wrong App, identity/attempt/source mismatch, ambiguous or truncated publication, malformed JSON, nanosecond clock boundaries, missing/stale downstream outputs, dedicated priority, and anchored unsigned-resume titles.

Observed / Not run

Observed: 173 focused tests and cases pass; the missing-receipt policy has a base/head regression. Not run: an enabled production nightly consuming the new publication. That proof follows controller deployment and explicit opt-in activation. Prior art: preserves #30085's identity-bound leases, #30173's disabled-mode fallback, #30249's dedicated priority and #30248's read-only metadata permissions.

Performance	Before	After	Delta	Evidence
GitHub admission reads per opted-in placement	No public receipt reader	At most two	Bounded authenticated reads	Reader tests
Blacksmith minutes/day	Not measured	Not measured	Paid overflow requires controller no-start proof when enabled	Routing tests; live activation pending

Changelog

• Authenticate fleet admission receipts before routing opted-in NEXT nightly controls.

Agent session: agent session
🤖 Generated with Claude Code

[teamleaderleo]

Owned by an agent session · session

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[cubic-dev-ai]

1 issue found and verified against the latest diff

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="scripts/ci/nightly_admission_receipt.py">

<violation number="1" location="scripts/ci/nightly_admission_receipt.py:54">
P1: `validate` accepts a well-formed lease ID for a different request, so the private controller path can route from a stale or cross-request receipt. Compare the receipt ID with `lease_id(request)` before using its runner map or overflow decision.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

P1: validate accepts a well-formed lease ID for a different request, so the private controller path can route from a stale or cross-request receipt. Compare the receipt ID with lease_id(request) before using its runner map or overflow decision.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At scripts/ci/nightly_admission_receipt.py, line 54:

<comment>`validate` accepts a well-formed lease ID for a different request, so the private controller path can route from a stale or cross-request receipt. Compare the receipt ID with `lease_id(request)` before using its runner map or overflow decision.</comment>

<file context>
@@ -0,0 +1,169 @@
+        if type(receipt.get(key)) is not type(request[key]) or receipt[key] != request[key]:
+            raise ValueError(f"admission receipt mismatches {key}")
+    lease = receipt.get("lease_id")
+    if not isinstance(lease, str) or not re.fullmatch(r"[0-9a-f]{24}", lease):
+        raise ValueError("invalid lease identity")
+    created, expires = timestamp_ns(receipt.get("created_at")), timestamp_ns(receipt.get("expires_at"))
</file context>

[cubic-dev-ai]

1 issue found and verified against the latest diff

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="tests/test_nightly_admission_receipt.py">

<violation number="1" location="tests/test_nightly_admission_receipt.py:144">
P2: This test does not verify that `get()` installs `NoRedirect`; removing that handler would still pass because the mocked opener accepts every request. Capture the factory mock and assert its first argument is a `NoRedirect` instance.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: This test does not verify that get() installs NoRedirect; removing that handler would still pass because the mocked opener accepts every request. Capture the factory mock and assert its first argument is a NoRedirect instance.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At tests/test_nightly_admission_receipt.py, line 144:

<comment>This test does not verify that `get()` installs `NoRedirect`; removing that handler would still pass because the mocked opener accepts every request. Capture the factory mock and assert its first argument is a `NoRedirect` instance.</comment>

<file context>
@@ -0,0 +1,243 @@
+    def test_get_is_authenticated_bounded_and_cannot_follow_redirects(self):
+        opener = mock.Mock()
+        opener.open.return_value = io.BytesIO(json.dumps(payload(check())).encode())
+        with mock.patch.object(reader.urllib.request, "build_opener", return_value=opener):
+            reader.get(REQUEST, "token")
+        call = opener.open.call_args.args[0]
</file context>

[teamleaderleo]

Review (codex gpt-6-astra high): SHIP at 1155460. Independent subagent reviewed the exact clean merged head. Authenticated receipt authority, identity, schema, terminal clocks and bounded API reads pass; strict same-attempt gates, dedicated priority, legacy routes and unsigned resumes are preserved. Focused receipt, routing, permission, size and source-archive checks pass. No blocking findings.

[cubic-dev-ai]

3 issues found and verified against the latest diff

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="tests/test_nightly_admission_receipt.py">

<violation number="1" location="tests/test_nightly_admission_receipt.py:1">
P2: This new test file is missing from `tests/test-execution.toml`, so the preflight registry validator fails the PR even though `ci-guards.yml` invokes it directly. Add a `linux-guard` registry entry for this file.</violation>
</file>

<file name=".github/workflows/ci-guards.yml">

<violation number="1" location=".github/workflows/ci-guards.yml:925">
P2: This invocation is unreachable: `workflow-guard-tests` excludes `group: ci`, while this step runs only for `matrix.group == 'ci'`. The new receipt regression therefore never runs; remove that exclusion for this lane or move the command to the job that owns the `ci` group.</violation>
</file>

<file name="scripts/ci/nightly_linux_admission.py">

<violation number="1" location="scripts/ci/nightly_linux_admission.py:27">
P2: This import replaces the legacy validator for opt-out controller receipts too, but the new validator rejects finite float `no_start_seconds` values that the existing path accepted. Keep the published-receipt validator separate, or preserve the legacy validation rules when `CHECK_RECEIPTS` is disabled.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: This new test file is missing from tests/test-execution.toml, so the preflight registry validator fails the PR even though ci-guards.yml invokes it directly. Add a linux-guard registry entry for this file.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At tests/test_nightly_admission_receipt.py, line 1:

<comment>This new test file is missing from `tests/test-execution.toml`, so the preflight registry validator fails the PR even though `ci-guards.yml` invokes it directly. Add a `linux-guard` registry entry for this file.</comment>

<file context>
@@ -0,0 +1,243 @@
+#!/usr/bin/env python3
+"""Only the controller App's exact terminal lease can route a nightly job."""
+import copy
</file context>

[cubic-dev-ai]

P2: This invocation is unreachable: workflow-guard-tests excludes group: ci, while this step runs only for matrix.group == 'ci'. The new receipt regression therefore never runs; remove that exclusion for this lane or move the command to the job that owns the ci group.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/ci-guards.yml, line 925:

<comment>This invocation is unreachable: `workflow-guard-tests` excludes `group: ci`, while this step runs only for `matrix.group == 'ci'`. The new receipt regression therefore never runs; remove that exclusion for this lane or move the command to the job that owns the `ci` group.</comment>

<file context>
@@ -922,6 +922,7 @@ jobs:
         run: |
           python3 tests/test_ci_portable_job_placement.py
           python3 tests/test_nightly_linux_admission.py
+          python3 tests/test_nightly_admission_receipt.py
           python3 tests/test_nightly_dedicated_mini.py
 
</file context>

[cubic-dev-ai]

P2: This import replaces the legacy validator for opt-out controller receipts too, but the new validator rejects finite float no_start_seconds values that the existing path accepted. Keep the published-receipt validator separate, or preserve the legacy validation rules when CHECK_RECEIPTS is disabled.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At scripts/ci/nightly_linux_admission.py, line 27:

<comment>This import replaces the legacy validator for opt-out controller receipts too, but the new validator rejects finite float `no_start_seconds` values that the existing path accepted. Keep the published-receipt validator separate, or preserve the legacy validation rules when `CHECK_RECEIPTS` is disabled.</comment>

<file context>
@@ -22,6 +23,8 @@
 import portable_job_placement as portable
 from fleet_admission_transport import exchange
+import nightly_admission_receipt as published
+from nightly_admission_receipt import validate
 
 FLEET_LINUX = "cmux-fleet-linux-x64"
</file context>

[blacksmith-sh]

Found 4 test failures on Blacksmith runners:

Failures

Test	View Logs
main.DeveloperIdAppTests.test_download_prints_the_active_profile_only/ test_download_prints_the_active_profile_only	View Logs
stubs: /System/Library/Frameworks/Security.framework/Versions/A/Security has no stub/ Security has no stub	View Logs
stubs: CoreFoundation.tbd: install-name /System/Library/Frameworks/ CoreFoundation.framework/Versions/A/CoreFoundation, missing 1: ['_CFRetain']/ CoreFoundation, missing 1: ['_CFRetain']	View Logs
stubs: CoreFoundation.tbd: install-name /System/Library/Frameworks/ CoreFoundation.framework/Versions/A/CoreFoundation, missing 1: ['_log2']/ CoreFoundation, missing 1: ['_log2']	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Review (codex gpt-6-astra high): SHIP at 558dd1f. Independent subagent delta review confirms the only change since reviewed 1155460 registers the receipt policy test under linux-guard. Test execution registry validation, receipt 18, admission 26 and diff checks pass. No production behavior or activation changes; no blocking findings.

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 558dd1f: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr30284 -f ref=lane/nightly-check-receipt-consumer -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); base red: the same failure on the base 783c672; does not block

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4130052256501 (28aa638015)

[lawrencecchen]

Base red from this PR (seen on every feat-cmux-next PR in nightly-guards / workflow-guard-tests / release-notary). Two tests fail at the tip:

1. python3 tests/test_nightly_ghostty_helper_cache.py: test_helper_never_takes_a_hosted_mac_and_skips_compile_on_hit requires resolve-nightly-ghostty-cli-helper.if == build-nightly-ghostty-cli-helper.if. This PR added the admission clause && (github.repository != 'manaflow-ai/cmux' || ... early_admission_ready == 'true') to the lookup job only.
2. python3 tests/test_nightly_workflow_size.py: nightly.yml is 508,735 bytes. The test allows 508,000 (GitHub's limit is 512,000).

I did not fix these in #30624, because each one needs a decision from the owner:

• Item 1: should the helper build job get the same admission clause, or should the test allow the lookup to be stricter?
• Item 2: which repeated block should become a YAML anchor or a script to cut about 1 KB? The other alternative is to change the headroom.

#30624 fixes the other base reds.

[lawrencecchen]

Follow-up to my comment above. The lead decided (12:06Z) not to wait. #30824 fixes both reds:

• build-nightly-ghostty-cli-helper now uses the same if: as resolve-nightly-ghostty-cli-helper, including your admission conjunct. The helper never builds while its lookup waits for admission.
• nightly.yml goes back under the 508,000 headroom (505,604 bytes). The three cache R2 env values that were repeated 6 times each are now YAML anchors and aliases, like &pub-feeds. The parsed workflow does not change, no step is removed, and no limit changes.
  If you meant the helper to run without admission, please say so on base red: release-notary green (helper admission gate, nightly.yml size, universal build pin, warm sources, promotion admission, highlight) #30824.