[lawrencecchen]

Fixes the base red that #30337 left on feat-cmux-next: 5 of its own acpmux tests fail at the feat tip.

Summary

#30337 (cloud turn rewind client) merged at 10:32Z before its exact-head acpmux test run ended. Two causes, 5 reds:

• agent-session-turn-prepare and agent-session-turn-abandon are served (server/requests.rs) and covered by the agent-session-turn-rewind-v1 capability, but not declared in protocol::registry(). Red: protocol::tests::protocol_registry_names_every_served_method, capabilities::tests::every_covered_name_is_in_the_protocol_registry.
• CloudTurnClient::new builds a reqwest client with no rustls crypto provider installed ("No rustls crypto provider is configured"). Red: the 3 cloud_rewind::tests::preparation_*.

Changes:

• protocol/mod.rs: declare both methods (untyped requests, like _acpmux/set_turn_cap).
• cloud_rewind.rs: install the ring provider before the client is built, as mesh_http.rs, route_probe.rs and catalog/fetch.rs do.
• Generated: spec/acpmux-protocol.json and webviews/.../protocol/generated/methods.ts (2 entries each).

How the generated files were made (repo generators, not hand edits):

1. IR: protocol_ir_is_current (protocol/tests.rs) prints the fresh IR between BEGIN/END markers when it runs without write access. The fleet ci-step allowlist refuses ACPMUX_PROTOCOL_BLESS, so the file is that block, byte-for-byte (the log's 4-space capture indent removed), from fleet run 2a48cc82b675aa6805013d10 at 5b1c039. Proof that it equals ir_text(): protocol_ir_is_current passes at this head (run below). The equivalent local command is ACPMUX_PROTOCOL_BLESS=1 cargo test -p acpmux --lib protocol_ir_is_current.
2. Web types: bun run acpmux-protocol:codegen in webviews/; bun run acpmux-protocol:check passes.

Testing

Focused command: scripts/ci/cmux-tui-rust-check.sh test <filter> on the fleet (macOS, isolated), filters protocol::, capabilities::, cloud_rewind::.

• Red at feat 265c68a (the base): 8c5bf667f544ea404b8e418a (protocol_registry_names_every_served_method FAIL), 5cdda2e2785da5d36c8ccee4 (every_covered_name_is_in_the_protocol_registry FAIL), db3c63775b9e241201b0176b (3 preparation_* FAIL).
• Green at 5b1c039 (code fix): 28c24e4089d29baf6dd4353c capabilities 5/5, 1900477d153c7a03ec6a00f6 cloud_rewind 7/7; 2a48cc82b675aa6805013d10 protocol: only protocol_ir_is_current failed (stale IR, expected before step 1).
• Green at this head (IR + types): protocol:: 890b171cb59bfca95fe81f51, clippy 3d88138e5fba177e04405af2 (results in a comment below).

Observed / Not run

• Observed: the fleet runs above; bun run acpmux-protocol:check passes locally; the webviews bun run check reds (browser-lanes, design-tokens, type-scale, fmt, lint, vp check) are identical at base 265c68a and at this head, so they are base findings.
• Not run: the full acpmux suite at this head (the change touches only the registry list, the provider install and generated files).

Changelog

none

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes the base red that #30337 left on feat-cmux-next: 5 of its own acpmux tests fail because the Cloud turn methods were never registered in the protocol registry and the Cloud turn client builds its reqwest client without a rustls crypto provider.

• Declares agent-session-turn-prepare and agent-session-turn-abandon in protocol::registry() alongside the other untyped requests.
• Installs the ring rustls provider in CloudTurnClient::new before building the reqwest client, matching what mesh_http.rs, route_probe.rs, and catalog/fetch.rs do.
• Regenerates spec/acpmux-protocol.json and the webview method types from the repo generators rather than by hand.

Migration

• The generated files in spec/acpmux-protocol.json and webviews/src/agent-session/acpmux/protocol/generated/methods.ts were produced with the repository's own generators (ACPMUX_PROTOCOL_BLESS and bun run acpmux-protocol:codegen); no manual edits.

^{Written for commit 977eaa9. Summary will update on new commits.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 977eaa9: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr30811 -f ref=fix/acpmux-cloud-turn-registry-tls -f platform=macos -f backend_mode=local

Gallery before/after for 977eaa9: 16 states rendered, 0 images differ, 2796 more touched states not rendered. Images are in the run's artifact, not on this public PR; the independent review of this head reads them on its own, so the PR needs no hand-made screenshots of these states.

gh run download 41299891873 -R manaflow-ai/cmux -n gallery-advisory-30811-977eaa9db922a4f8e2c173ce4d1f1124324f64c6 (then read gallery-review.json)

States

State	Theme	Status	Diff	Picked by
agent-pane.live-chat-watch/choice-alone	Apple System Colors Light	unchanged	0%	imports methods.ts (1 hops)
agent-pane.live-chat-watch/choice-alone	Apple System Colors	unchanged	0%	imports methods.ts (1 hops)
agent-pane.live-chat-watch/view-only	Apple System Colors Light	unchanged	0%	imports methods.ts (1 hops)
agent-pane.live-chat-watch/view-only	Apple System Colors	unchanged	0%	imports methods.ts (1 hops)
agent-pane.live-chat-watch/take-over-refused	Apple System Colors Light	unchanged	0%	imports methods.ts (1 hops)
agent-pane.live-chat-watch/take-over-refused	Apple System Colors	unchanged	0%	imports methods.ts (1 hops)
agent-pane.approval-edits/single	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/single	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/grouped	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/grouped	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/single-multiedit	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/single-multiedit	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/grouped-multiedit	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/grouped-multiedit	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/single-long	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/single-long	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/grouped-long	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/grouped-long	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/signed-in	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/signed-in	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/signed-out	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/signed-out	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/expired	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/expired	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/unknown	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/unknown	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.chat-width/standard	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.chat-width/standard	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.chat-width/wide	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.chat-width/wide	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.chat-width/wide-blocks	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.chat-width/wide-blocks	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)

_{Pick other states with a Gallery: entry.id, entry.id/variant line in the PR body.}

[cubic-dev-ai]

No issues found across 4 files

_{View guided diff | Turn on auto-fix | Re-trigger cubic}

[lawrencecchen]

Review (claude-review-subagent-cw3): SHIP at 977eaa9

Correctness (read at the exact head; no Rust built or run on this machine):

• cmux-tui/crates/acpmux/src/protocol/mod.rs:308-309: untyped(method::AGENT_SESSION_TURN_PREPARE, Request) and ..._ABANDON are correct. Both are request/response arms in server/requests.rs:2022 and :2114 that return a JSON value. Their params (sessionId/prompt_id/...) are read ad hoc from Value, so untyped is right. They are the only two entries in capabilities.rs:205 (agent-session-turn-rewind-v1). They are also the only method constants that Cloud: add fenced turn rewind client ledger #30337 (9af95f3) added to rpc.rs:471-472. That commit adds no other _acpmux/, catalog. or acp. literal to the served sources, so protocol_registry_names_every_served_method and every_covered_name_is_in_the_protocol_registry have nothing else to flag. The registry is read at runtime only to serve _acpmux/protocol (ir()), so this change has no effect on authorization or dispatch.
• cmux-tui/crates/acpmux/src/cloud_rewind.rs:84: let _ = rustls::crypto::ring::default_provider().install_default(); before reqwest::Client::builder() is correct. The workspace reqwest uses rustls-no-provider (cmux-tui/Cargo.toml:282), and install_default returns Err only when a provider is already installed. This matches mesh_http.rs:176, catalog/fetch.rs:68, route_probe.rs:179 and the 7 other sites. It is the only reqwest build in the module (for_machine clones http), and hub/turns.rs:694 gets the fix through new.
• cmux-tui/crates/acpmux/spec/acpmux-protocol.json:967-978: these are exactly what ir() emits for an untyped Request (kind, name, params: true, result: true, keys in canonical order, no acp). They sit between _acpmux/set_turn_cap and _acpmux/inbox_threads, the same order as the registry.
• webviews/src/agent-session/acpmux/protocol/generated/methods.ts:147-148, 440-441: these are consistent with the IR. bun run acpmux-protocol:check passes locally at this head.

Non-green checks on this head:

• api-compat is red: "spec/api-compat.surface.json is stale". This is a base finding, not from this PR. The check reads cmux-tui/spec/sdk-schema.json, which this PR does not touch, and Cloud: add repository picker and recovery UI #30357 (7d5f3ae) changed that file without refreshing the surface. The same check is red on Cloud start and move: put the project on the machine with link seed push #30812 and Re-land #29670: remove the 15 MiB message cap (31 MiB), with its fixtures sized from the limit #30808.
• The other checks were pending when I reviewed.

Nit (does not block): the new comment at protocol/mod.rs:307 is 104 columns. rustfmt does not fail on a long comment, so cargo fmt --check is not affected.

[lawrencecchen]

Fleet results at head 977eaa9:

• protocol:: 890b171cb59bfca95fe81f51: 49/49 PASSED, protocol_ir_is_current among them. This proves that the committed IR equals ir_text().
• clippy 3d88138e5fba177e04405af2: red only at cmux-tui-cloud-conversations/src/environments.rs:89 (nonminimal_bool). That is a base finding from Cloud: add repository picker and recovery UI #30357 (7d5f3ae), which the revert Revert "Cloud: add repository picker and recovery UI" #30791 takes out; this PR does not touch that crate.
• api-compat red: also from Cloud: add repository picker and recovery UI #30357's sdk-schema.json change; Revert "Cloud: add repository picker and recovery UI" #30791 restores the file byte-for-byte, so it clears when Revert "Cloud: add repository picker and recovery UI" #30791 lands.
  With the review SHIP above and red at the base (8c5bf667, 5cdda2e2, db3c6377) / green here (28c24e40, 1900477d, 890b171c), this PR is ready to land.

[lawrencecchen]

Conflict wave: feat-cmux-next already has this fix. 6c53035 (#30775, "fix(acpmux): register Cloud turn methods and TLS provider") landed the same two changes: both methods are in protocol::registry(), and the ring provider is installed in CloudTurnClient::new. This PR is now redundant and conflicts with it, so I removed ready-to-land. I did not close it; a person can close it.

[lawrencecchen]

Closing as a duplicate (lead): #30775 (6c53035) landed the same fix on feat-cmux-next first: the same protocol registry entries, the same ring provider install in CloudTurnClient::new and the same IR entries.

[blacksmith-sh]

Found 6 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmpgzwmz4be/summary-fail.json (live):/summary-fail.json (live):	View Logs
/tmp/tmpqlo6t0ir/summary-missing.json (live):/summary-missing.json (live):	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}