[teamleaderleo]

NEXT Cloud's CloudDO is moving to cmux-platform in production (development and staging already passed). cmux-platform-production needs JWT_PRIVATE_JWK and CLOUD_LINK_SIGNING_KEYS equal to cmux-api production's, plus CLOUD_FREESTYLE_API_KEY.

This reuses the pattern of #30461 (platform-dev-secrets.yml, removed in #30813) for production:

• environment cmux-next-production (branch policy: feat-cmux-next), runs once on the push that lands it (path-filtered to this file) since GitHub registers dispatch workflows only from main.
• writes only those three names on cmux-platform-production, only when the Worker lacks the name: it never overwrites an existing secret.
• a name the environment holds no copy of is skipped with a warning, never minted. Today cmux-next-production holds FREESTYLE_API_KEY only, so this run places CLOUD_FREESTYLE_API_KEY; the JWK and link keys can be placed by a later dispatch once their production copies are in the environment.
• values go through stdin to wrangler secret put; the job prints secret names only.
• no permission or runner changes (contents: read, same runner expression as ci: dispatch-only job that puts the dev JWT and Freestyle keys on cmux-platform-development #30461).

A follow-up drops the push trigger (dispatch-only).

Agent session: agent session

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Adds a one-off GitHub Actions workflow that copies the production platform secrets onto cmux-platform-production for NEXT Cloud's CloudDO move into cmux-platform in production.

• Pipes JWT_PRIVATE_JWK, CLOUD_LINK_SIGNING_KEYS, and CLOUD_FREESTYLE_API_KEY from the cmux-next-production environment via stdin to wrangler secret put, printing only secret names.
• Writes each name only when the Worker lacks it; existing secrets are never overwritten.
• Skips with a warning any name the environment doesn't hold; it never mints new values.
• Runs once on the push that lands it (path-filtered to this file) because GitHub registers dispatch workflows only from main; a follow-up drops the push trigger.

^{Written for commit 75a7ea9. Summary will update on new commits.}

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 75a7ea9: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr32470 -f ref=ci/platform-prod-secrets -f platform=macos -f backend_mode=local

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4149201285601 (93019ed976)
• cmux NEXT nightly 1.0.0-nightly.4149439773601 (6ad4953200)
• cmux NEXT nightly 1.0.0-nightly.4149622662301 (72e65a53e0)
• cmux NEXT nightly 1.0.0-nightly.4149719270001 (ccb777fdde)

[teamleaderleo]

Owned by an agent session · session

[blacksmith-sh]

Found 2 test failures on Blacksmith runners:

Failures

Test	View Logs
test_no_workflow_adds_a_single_size_linux_job (main.WorkflowTests.test_no_workflow_ adds_a_single_size_linux_job)/ test_no_workflow_adds_a_single_size_linux_job (main.WorkflowTests.test_no_workflow_ adds_a_single_size_linux_job)	View Logs
test_no_workflow_falls_back_to_blacksmith_outside_manaflow_ai (main.ForkRunnerRouti ngTests.test_no_workflow_falls_back_to_blacksmith_outside_manaflow_ai)/ test_no_workflow_falls_back_to_blacksmith_outside_manaflow_ai (main.ForkRunnerRouti ngTests.test_no_workflow_falls_back_to_blacksmith_outside_manaflow_ai)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Review (codex, router-review): SHIP at 75a7ea9

Reviewer: codex gpt-6.1-sol xhigh, fast tier.

Follow-ups: 1. Each lands as an issue in this repo that links this receipt; the lane that opened the PR fixes it forward.

SHIP at 75a7ea9

Visual verdict: no images; Leo tries the build

1. [P2][follow-up] .github/workflows/platform-prod-secrets.yml:49-51 The list-then-put check is not atomic. If another operator or rotation job creates a missing secret after the initial list, this workflow overwrites it, violating the “never overwrites” guarantee. Use a create-only operation or coordinate/recheck immediately before each write.

Follow-ups:

• [P2][follow-up] Make the missing-secret check and write atomic to prevent concurrent creation from being overwritten.