[lawrencecchen]

Summary

Base red (priority zero). On feat-cmux-next, acpmux hermetic_daemon_guard::every_test_binary_runs_in_the_hermetic_environment (tests/hermetic_daemon_guard.rs:123) fails: tests/socket_owner.rs does not include tests/support/daemon_env.rs and has no HERMETIC constant. Base job 5472a06e7265dc6ae1ebaa3d.

Culprit: 22f3792 (#31593) added tests/socket_owner.rs without the hermetic include.

Fix (test only): socket_owner.rs includes support/daemon_env.rs and defines const HERMETIC: daemon_env::Process = daemon_env::Process::deny();, as daemon_single_owner.rs does. Before main the binary now starts itself again with the bare environment: no host PATH (no real agent CLI can be found), a scratch HOME, ACPMUX_AGENT_LAUNCH=deny. The test starts no daemon; it calls acpmux::server::bind_unix in a temp home and runs a python3 lock holder, and the hermetic PATH links python3 first. The guard and its rules are unchanged; no allow-list entry.

FYI @teamleaderleo: this is your #31593 test file.

Testing

cmux-ci run --class isolated --os linux --script scripts/ci/cmux-tui-rust-check.sh --ref SHA --arg test --arg FILTER:

• Red at the base 09a0685c7bad, filter every_test_binary_runs_in_the_hermetic_environment: FAIL, and the message names tests/socket_owner.rs. Step 173ac35ac58ef50eadafe1e2.
• Green at the head d80d9fce06b, the same filter, 5 of 5 (each 1/1 PASS): steps 576efb89187feea5b9ea187d, 562a791c6dc0b27a936bbfe2, cca7dbe4c5dc90a7fa9a7a3e, e5ad747ad76d92c04554d4c0, a4c888496629d55269f28215.
• socket_owner's own test at the head, now in the hermetic environment, filter a_bind_that_does_not_hold_the_lock_never_unlinks_the_holders_socket, 2 of 2 PASS: steps 004b83b22853f286fbf018a1, 5a51cd4973f4ec8efb8acade.
• Panic ratchet (--arg panic) at the head: pass, step e4c0c1bb98809bf02cb59150.

Non-green checks at the head are base findings, not caused by this PR:

• defaults-snapshot (cmux-next guards): the failing step is "Menu rows run registered actions" on AgentPaneSessionInfoContent.swift, from cmux NEXT: draw Session Info with native AppKit glass #31930. It is red on unrelated open PRs too; fix: route native Session Info menu rows through ActionRegistry #32072 and Session Info: row menu runs through the shared menu-action helper, not an inline selector (base red) #32073 fix it.
• clippy (changed cmux-tui packages): too_many_arguments on cmux-tui-core snapshot_written, from fix(cmux-tui): a host reconnect ends the output store's tail, so a kill right after it restores the gap's output #31931. Fixed by fix(cmux-tui-core): snapshot_written takes the snapshot's end as one value (base red: clippy too_many_arguments) #32092 (merged).

Observed / Not run

• Observed: the fleet step logs above (nextest PASS/FAIL lines); python3 scripts/cmux-next/prepush-gate.py passes at the head.
• Not run: no local build or test on this VM (fleet only). macOS was not run: the test file is cfg(unix) and the guard reads files only; Linux is the route cmux-tui.yml gates.

Changelog

none

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review d80d9fc: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr32064 -f ref=base-red-hermetic -f platform=macos -f backend_mode=local

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4142821761901 (937b52c218)
• cmux NEXT nightly 1.0.0-nightly.4143019763401 (17e607bf23)
• cmux NEXT nightly 1.0.0-nightly.4143038272801 (912566a91a)
• cmux NEXT nightly 1.0.0-nightly.4143282790301 (50298238a3)

[lawrencecchen]

Review (subagent, correctness first): SHIP at d80d9fc

Checked (read only, no local build or test):

• Guard every_test_binary_runs_in_the_hermetic_environment: socket_owner.rs now has #[path = "support/daemon_env.rs"], mod daemon_env; and const HERMETIC: daemon_env::Process. That is all it looks for. The layout is the same as daemon_single_owner.rs.
• Guard only_the_hermetic_helper_starts_the_acpmux_binary: the file does not name CARGO_BIN_EXE_acpmux or daemon_env::bin(). No allow-list entry was added, and the helper and the guard are not changed. The guard is not weaker.
• Build: the helper needs libc, tokio, acpmux::cli::entry::WORKER_STACK_BYTES, acpmux::protected_folders and acpmux::cpu_class::ENV. Many other test binaries already use all of them. #![allow(dead_code)] covers the unused helpers. tempfile is a dev-dependency.
• #![cfg(unix)] on the crate root removes the whole file on Windows, so the helper's #[cfg(windows)] const _: Process = super::HERMETIC; is never compiled. Other unix-only test binaries do the same.
• Hermetic run: the .init_array / __mod_init_func re-exec runs before main, so #[tokio::test] builds its runtime in the hermetic process.
  • PATH is <tmp>/amx-bin-<pid>-python3:/usr/bin:.... The link points to the real interpreter, which the helper finds before it clears the environment. The pid stays the same after exec, so the link folder stays valid. Command::new("python3") finds it, as in chats.rs and cua_v2_stale_endpoint.rs. The holder script uses only the stdlib (fcntl, os, sys, time).
  • The test uses tempdir_in("/tmp"), so TMPDIR does not change where it works, and the socket path stays short.
  • HOME=<scratch>/home, so config::home() is <scratch>/home/.acpmux. refuse_lost_home(home()) passes because no home is held. socket_held_by_other checks home()/daemon.lock (missing, so no match) and then <socket dir>/daemon.lock, which is the python holder's lock. The bind then fails with the holder's pid, as the test expects. Before this PR, the test read the real ~/.acpmux/daemon.lock of the host. Now it reads only its own scratch files.
• Feat tip still has socket_owner.rs without the include. No other open or merged PR fixes it.

Findings (they do not block):

• The PR body's ## Testing section still has the placeholder EVIDENCE. The PR shows no fleet red or green result yet. Add the fleet result for both guard tests and socket_owner, or say on the PR that they were not run.
• defaults-snapshot is red on this head. This diff changes one Rust test file only, so it cannot cause that check to fail. Look at the base for the cause.