[teamleaderleo]

The four NEXT nightly signer jobs (signer-build, signer-app, signer-app-notary, signer-dmg) go back to the routes #29886 gave them, and that the hosted-runner guard (tests/test_ci_self_hosted_guard.sh, signer_route and signer_build_route) still allowlists:

• attempt 1: GitHub-hosted ubuntu-24.04
• re-run: blacksmith-4vcpu-ubuntu-2404, never 16 or 32 vCPU
• signer-build takes decide's early fleet placement first, then the same route

Each runs-on line now matches the guard's allowlisted line exactly. #30081 had moved the four jobs onto the sign picker's Blacksmith Linux 4/16/32 output, citing the older 2026-10-27 no-hosted rule. The 2026-11-01 rule below overrides that rule for signing.

The rule, verbatim:

"One measured exception to the two rules above: a small job that is not CPU-bound, such as signing and its runner pick, takes GitHub-hosted Ubuntu first. It's trusted like Blacksmith and free on a public repo. The fleet, or the smallest Blacksmith size that fits, is its re-run route, never 16 or 32 vCPU. It still needs a fallback so a hosted queue never stalls it: a re-run onto that route, or a twin that takes over (the nightly's macOS signer). Each such job is one exact line in the hosted-runner guard's allowlist (cmux tests/test_ci_self_hosted_guard.sh), with its measured wall time beside it."

The fallback is unchanged. A hosted signer that GitHub drops unstarted fails the pool path, and the macOS signer (build-sign-notarize-nightly) signs instead. A re-run takes Blacksmith 4 vCPU.

What does not change:

• pick-nightly-sign-runner's own route (ci(nightly): the sign picker and the visual gate router take the all-nightly reservation first #31642 put it on the all-nightly reservation first).
• The six other jobs that read the picker's route: keep-published-dsyms, publish-nightly-identity-legacy, republish-nightly-deltas, sign-release-notes, publish-release-notes and publish-nightly-reel.
• The signers' needs lists.
• Secrets, environments, permissions and runner trust lists.

Tests:

• tests/test_nightly_signer_jobs.py: the two tests ci(nightly): route credentialed signers through trusted Linux set #30081 added now assert the opposite. Each signer's runs-on equals the guard's exact line, never 16 or 32 vCPU, never LINUX_RUNNER or RUNNER_POOLS, and signer-build's early placement comes first.
• tests/test_nightly_trusted_routing.py: ci(nightly): signer jobs take GitHub-hosted Ubuntu, Blacksmith 4 vCPU on a re-run, never 16 or 32 #29886's test_signer_jobs_take_hosted_ubuntu_then_blacksmith_4vcpu_never_16_or_32 is back for the four signers. It evaluates each route whatever LINUX_RUNNER, RUNNER_POOLS or the picker's outputs hold.
• tests/test_ci_nightly_off_blacksmith.py: signer-build leaves the Blacksmith-only debt list, because it has an early fleet route again.

Run and passing: test_nightly_signer_jobs, test_nightly_trusted_routing, test_ci_nightly_off_blacksmith, test_nightly_sign_runner, test_ci_linux_single_size, test_runner_routing_table, test_runner_label_policy, test_supplychain_security, test_ci_signing_keychain_is_deleted_before_bundle_code and bash tests/test_ci_self_hosted_guard.sh. Of the 114 test files that mention nightly.yml or the signers, the 3 that fail here (missing bashlex, the scripts import path, no lipo) fail the same way on base.

Performance

metric	before	after	delta	harness or run link
queue per serial signer job (4 jobs)	~2-4 min each on blacksmith-4vcpu (picker placed 'unverified')	measured on the first nightly after merge	TBD	runs 41383305465, 41385114223
signer queue added to landing-to-feed time	8-15 min per nightly (30-min target)	measured on the first nightly after merge	TBD	runs 41383305465, 41385114223
Blacksmith minutes/day for signers	all four jobs on Blacksmith Linux (4 vCPU tonight, 16 vCPU earlier)	re-runs only	not measured yet (estimate: Blacksmith only on re-runs)	first nightly runs after merge

Agent session: agent session

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Route the four NEXT nightly signer jobs to GitHub-hosted Ubuntu on the first attempt and Blacksmith 4 vCPU on re-runs, replacing the sign picker’s 4/16/32 vCPU route. This reduces runner wait and Blacksmith use for signing jobs that are not CPU-bound.

• signer-build keeps decide’s early fleet placement before the signer route.
• If GitHub drops a hosted job before it starts, the existing macOS signer remains the fallback.
• The sign picker and other jobs that use its route are unchanged.
• Tests verify the runner expressions match the hosted-runner guard’s allowlist.

^{Written for commit c783a28. Summary will update on new commits.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review c783a28: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr31831 -f ref=lane/nightly-signers-hosted-first -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); base red: the same failure on the base b5060b4; does not block

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4139290103001 (a92c6ce841)
• cmux NEXT nightly 1.0.0-nightly.4139510839501 (d47dcbddc6)
• cmux NEXT nightly 1.0.0-nightly.4139567428201 (14a5e1b153)
• cmux NEXT nightly 1.0.0-nightly.4139686277401 (4e9b96d7dd)

[blacksmith-sh]

Found 8 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmpn81jdso1/summary-fail.json (live):/summary-fail.json (live):	View Logs
/tmp/tmpw3r_7pa9/summary-missing.json (live):/summary-missing.json (live):	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs
test_every_compile_job_names_its_warm_sources (main.ThisTree.test_every_compile_job _names_its_warm_sources)/ test_every_compile_job_names_its_warm_sources (main.ThisTree.test_every_compile_job _names_its_warm_sources)	View Logs
test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)/ test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Review (codex gpt-6.1-sol xhigh, router-review): SHIP at c783a28

Focused routing tests pass: 92 signer, trusted-routing and off-Blacksmith tests, and 88 routing and admission tests.

Follow-ups (cmux#31420):

1. [P2][follow-up] signer-build's early-fleet branch (nightly.yml:4716) can never fire. place-early-mac's JOBS lists only pick-nightly-build-runner and its FLEET_LINUX is empty, so signer-build always takes hosted Ubuntu on attempt 1. Either wire it into a placement that emits a vetted Linux route, or drop the branch and the claim.