[teamleaderleo]

Lands now, ahead of production verification. Leo, 2026-11-04: "BUT LITERALLY NOBDY IS USING CMUX-NEXT CLOUD "PROD" OTHER THAN US" and "WE NEED TO JUST GET THE STUFF IN ASAP". The production nightly is the only production-auth build, so its chat read-back happens on the first nightly after this merges; if that fails, this is a one-commit revert (or set CMUX_NEXT_CLOUD_LINK=legacy).

Leo, 2026-11-02, on NEXT nightly still running classic Cloud: "why should it still point at old stuff if we are already doing this in platform". These are the nightly failures he hit, all on the classic link: "Personal credentials can only be transferred to a Cloud machine you own" after Transfer and restart; Claude credentials rejected after he picked a machine; "Cloud machine is not connected yet" on a new workspace; and agent_session.refused when starting a chat.

What changes

CloudConfiguration.resolve: production auth (NEXT nightly, RC, release and CMUX_AUTH_ENVIRONMENT=production) now defaults to linkSource: .appServer, the same link signed DEV builds have used since #28950. Its owner API is unchanged: ownerAPIBaseURL already returns https://cloud-api.cmux.dev for production, and with #32347 that Worker forwards Cloud to cmux-platform-production.

The escape hatch stays. CMUX_NEXT_CLOUD_LINK=legacy at launch, or CMUX_CLOUD_LINK=legacy baked into LSEnvironment, keeps the classic link. The link pick is now computed once for both branches.

Tests (CloudConfigurationSignedDEVTests):

• otherReleaseChannelsKeepProduction now expects .appServer, with the cmux.com auth origin and the cloud-api.cmux.dev owner API unchanged.
• New productionKeepsTheLegacyEscapeHatch covers the baked and launch-time legacy values.

Classic Cloud (cmux web/, cmux.com /api/vm) is untouched and still serves the legacy link.

Risk

This changes NEXT nightly's Cloud path. Until production serves NEXT Cloud, an app-server link on nightly would fail, which is why the HOLD line stays until production is configured; the chat read-back is checked on the first nightly after merge.

Agent session: agent session

🤖 Generated with Claude Code

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 6af8ea4: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr32349 -f ref=cloud-demo/nightly-new-cloud-link -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); base red: the same failure on the base 26fd471; does not block

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4177134165301 (4a7517355a)
• cmux NEXT nightly 1.0.0-nightly.4177399658201 (443d56f95d)
• cmux NEXT nightly 1.0.0-nightly.4177479261801 (0df62819ad)

[teamleaderleo]

Owned by an agent session · session

[teamleaderleo]

Review (codex, router-review): SHIP at 25e0b2e

Reviewer: codex gpt-6-astra high, fast tier.

SHIP at 25e0b2e

Visual verdict: no images; Leo tries the build

Inspected resolver precedence and all linkSource consumers; no correctness or regression issues found. Swift tests could not run because Swift is unavailable.

Follow-ups: none

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[blacksmith-sh]

Found 36 test failures on Blacksmith runners:

Failures

Test	View Logs
main.DeveloperIdAppTests.test_download_prints_the_active_profile_only/ test_download_prints_the_active_profile_only	View Logs
stubs: /System/Library/Frameworks/Security.framework/Versions/A/Security has no stub/ Security has no stub	View Logs
stubs: CoreFoundation.tbd: install-name /System/Library/Frameworks/ CoreFoundation.framework/Versions/A/CoreFoundation, missing 1: ['_CFRetain']/ CoreFoundation, missing 1: ['_CFRetain']	View Logs
stubs: CoreFoundation.tbd: install-name /System/Library/Frameworks/ CoreFoundation.framework/Versions/A/CoreFoundation, missing 1: ['_log2']/ CoreFoundation, missing 1: ['_log2']	View Logs
test_a_build_host_runs_every_piece_niced_and_capped (main.WebLintPrePushTests.test_ a_build_host_runs_every_piece_niced_and_capped)/ test_a_build_host_runs_every_piece_niced_and_capped (main.WebLintPrePushTests.test_ a_build_host_runs_every_piece_niced_and_capped)	View Logs
test_a_clean_pushed_commit_passes_whatever_the_working_tree_holds (main.WebLintPreP ushTests.test_a_clean_pushed_commit_passes_whatever_the_working_tree_holds)/ test_a_clean_pushed_commit_passes_whatever_the_working_tree_holds (main.WebLintPreP ushTests.test_a_clean_pushed_commit_passes_whatever_the_working_tree_holds)	View Logs
test_a_clean_swift_only_push_runs_only_the_pieces_that_read_it (main.WebLintPrePush Tests.test_a_clean_swift_only_push_runs_only_the_pieces_that_read_it)/ test_a_clean_swift_only_push_runs_only_the_pieces_that_read_it (main.WebLintPrePush Tests.test_a_clean_swift_only_push_runs_only_the_pieces_that_read_it)	View Logs
test_a_clone_with_no_reviewed_remote_lints_no_check_code (main.WebLintPrePushTests. test_a_clone_with_no_reviewed_remote_lints_no_check_code)/ test_a_clone_with_no_reviewed_remote_lints_no_check_code (main.WebLintPrePushTests. test_a_clone_with_no_reviewed_remote_lints_no_check_code)	View Logs
test_a_dry_run_lists_exactly_what_a_run_spawns (main.WebLintPrePushTests.test_a_dry _run_lists_exactly_what_a_run_spawns)/ test_a_dry_run_lists_exactly_what_a_run_spawns (main.WebLintPrePushTests.test_a_dry _run_lists_exactly_what_a_run_spawns)	View Logs
test_a_file_in_a_folder_above_a_package_is_check_code (main.WebLintPrePushTests.tes t_a_file_in_a_folder_above_a_package_is_check_code)/ test_a_file_in_a_folder_above_a_package_is_check_code (main.WebLintPrePushTests.tes t_a_file_in_a_folder_above_a_package_is_check_code)	View Logs

...and 26 more test failures. View all on Blacksmith

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Awareness note from an agent lane that does not own this PR; it is not a review or a request to take the PR over.

---

Unblock for this PR's HOLD (Leo-ask: ask-651da30049, "why should it still point at old stuff if we are already doing this in platform").

The backend side is now in production:

• api: production routes NEXT Cloud to cmux-platform-production #32467 (production cmux-api forwards NEXT Cloud to cmux-platform-production, CLOUD_DO bound to the platform's class) merged at ad5a196, and the backend workflow's promote-production deployed it today (run 41637512306, 13:03Z: env.PLATFORM_SURFACES ("cloud") on cmux-api).
• The platform-production secrets are set (ci: one-off job that puts the missing production platform secrets on cmux-platform-production #32470/ci: platform-prod-secrets mints a fresh link keyset and drops the JWT copy #32593). GET https://cloud-api.cmux.dev/v1/cloud/keyset now answers 200 with kid production-2026-11-02; it answered 503 when this PR was written.
• api: production forwards NEXT Cloud to cmux-platform-production #32347 is superseded by api: production routes NEXT Cloud to cmux-platform-production #32467.

Left for this PR: rebase onto feat-cmux-next, sort the four red cmux-next jobs at d71c7d4 into own vs base, run the production-auth read-back the HOLD names (a Cloud chat reply on a nightly-config build), then drop the HOLD and land. If the owner session can't get to it within the hour, a helper will take it over with pr-owner claim.

[teamleaderleo]

Independent brief 01 review — signed NEXT/Cloud/Claude proof boundary (HQ #6236)

Finding for this PR's HOLD: The passing historical #32052 CLI capture uses HQ cloud-start-session.json with cloudFixture.link: "legacy". It therefore proves a Claude reply through the classic link at #32052 head 6a078b3313f787cbf75d7345c7f91d2704dc10f0, not this PR's new production-auth app-server link. #31969's composer passed on earlier test SHA 51832a5763567d0f15cee49aa08de2c5748893ad; that capture and the CLI capture do not combine into one exact-head signed integration receipt. The old HQ state cloud-resume-from-card.json covers pause/resume, not transport drop/reconnect.

Concrete work: draft HQ PR #6637 adds an app-server CLI capture (link: build, development backend, fixture VM with cmuxTui: app), two distinct required Claude reply markers across app quit/reopen, and explicit reply-marker checks in the existing composer/legacy controls. It contains the exact-SHA proof gate. 13 static checks passed; signed runtime capture, live Claude tool transcripts and actual reconnect remain unrun. Sampled cmux feat-cmux-next: 786f51bf8a0ca9309080e152e7599189058f7327 (2026-11-03). Newer head should be pinned at dispatch.

Latest backend context: Your production update says #32467 was promoted and the production keyset now reads 200; this retires the older missing-backend premise. The remaining acceptance is still a production-auth, shipped/signed build returning an actual Cloud Claude tool reply, plus this PR's own CI and explicit reconnect, on a stated exact source/build/image combination. A protected development cap build (including #33858's Release-path capture) is useful regression evidence but cannot by itself lift the production HOLD. Also verify actual guest Claude version: #34020, #34034, platform #686 put Claude Code 2.1.299 on new development/staging VM API images after the prior 2.1.267 model API 400, but existing machines may retain the older image.

Suggested owner run: use the same current full 40-char SHA for the updated composer state and new cloud-start-session-app-link.json, save step JSON and tool transcript, VM version and cleanup, then run a separate real link-interruption/reconnect scenario. On this PR specifically, require production-auth read-back before changing HOLD. This is an independent review comment, with no owner branch edits, fixture dispatch, credential use or merge.

[teamleaderleo]

Read-only integration review at 6af8ea4 for the off-classic inventory (manaflow-ai/cmuxterm-hq#6802).

The config change is confined to NEXT, preserves production Stack sign-in and https://cloud-api.cmux.dev, and retains the explicit legacy escape hatch. That avoids repeating the reverted #28899 authentication change. The updated tests cover production channels and bundled/process legacy selection.

Remaining routing gaps when production starts selecting appServer: CloudService.deleteMachine still calls the classic api.deleteMachine at CloudService.swift:832; the native/CLI handler reaches it from CloudHandlers+Machine.swift. Rename and idle-policy setters also call the classic API (#34096 owns those). I am checking ownership and repairing the delete path separately. createMachine also rejects non-default CloudMachineRequest options on appServer (CloudService.swift:742), so production CLI size/repository/persistent requests need explicit compatibility coverage rather than assuming the default-create proof covers them.

The existing production-proof HOLD still needs its outcome recorded. #34241 is merged as 36d4e24 and platform#721 is merged. One production health read returned platform commit 8e5a8eda1cf0b03a2f5f3c7bdef2b0ecb3293bad and vm.cmux.dev/healthz returned ok; neither proves production machine creation or a reply through the resulting NEXT build. Please finish that exact flow, record the create/reply outcome, then clear your satisfied HOLD and land pinned after the required independent review and compile. Owner-session messages could not be delivered from this lane.

Leo, 2026-11-04: "we can do whatever we want with our own dev machines and the cloud situation for cmux-next. but cmux-classic cloud, don't bother with. but anything that we're pointing at cmux-classic related stuff (that isn't customer related) just point it away from classic, man. no point looking at (relatively) deprecated stuff now that we're going full bore on the new architecture"

No compile or test receipt was produced by this read-only review; the router-review attempt returned no verdict at the shared GitHub quota limit.

[teamleaderleo]

Review (subagent claude-opus-5-5 medium, correctness): SHIP at 6af8ea4

Checked: production-auth builds now resolve .appServer against cloud-api.cmux.dev; CMUX_NEXT_CLOUD_LINK=legacy / CMUX_CLOUD_LINK=LEGACY keep the legacy link; the base-merge resolution keeps both tests.

Follow-ups:

• [follow-up] LinkSource doc comments at CloudConfiguration.swift:38-46 still describe the old production default.
• [follow-up] A Debug build with CMUX_AUTH_ENVIRONMENT=production also moves to appServer.
• [follow-up] Pin the escape hatch to legacy-only values.
• [follow-up] Read back a chat from the first nightly after merge; revert if it fails.