[teamleaderleo]

Leo: "BUT WHY THE FING ARE THERE SO MANY TESTS IN FING SWIFT / IT'S CLOUD CODE / WHY IS IT NOT IN RUST". New logic goes in Rust; Swift stays a thin shell.

Step B of #32436: re-pins the app FFI to cmux-app-ffi-17b75935f08e (built from #32436's merge; check-app-ffi-pin.sh --verify-release passes). The Swift copies of the decisions now in cmux-cloud-start-core become calls, and their tests go. Each is a 1:1 port with no behavior change.

1. Fixes Cloud start harness login: FFI helper failures should record ffi-failed #32416: one harness login call. CloudHarnessLoginDecision holds the raw facts: the build and its setting, the harness, the guest probe's stdout and the machine login probe's output. It asks cloud_harness_login once per step and reads the gate, the provider, the guest kind, the machine login and the probe text off that one answer. The app no longer calls cloud_harness_login_provider, cloud_guest_kind or cloud_guest_kind_probe, so an FFI that does not answer always records ffi-failed and never reads as no-transfer-for-harness or guest-kind-unread. The passesHarnessLogin(isDogfoodBuild:setting:) precedence moves to Rust; Swift keeps only the defaults read.
2. Start checks. CloudStartChat.refusal, accountText and checkAccount, CloudMoveFolder.isTooBroad and AgentPaneCloudStart.uploads call CloudStartCore (new, in CmuxNextCloud, which now links CCmuxAppFFI). Swift keeps the disk reads: standardizing, realpath and the working copy's git folders, the last only when Rust asks for it.
3. vm-kind word. CloudAttachEndpoint.callerOwnsVM and callerIsTeammate and CloudMachineLink.vmKindArguments call it. So do the app server's connect answer (CloudConnectOpResolver) and the two vmKind == "owner" reads (CloudService.callerOwnsVM, the Codex broker target), which now use callerOwnsVM.
4. Machine login. CloudMachineLogin.parse and needsLogin are gone. The probe output goes into the decision, and fingerprint calls Rust.

When the FFI does not answer, each call fails safe: no login is passed, the start is refused or stops, nothing is copied, and the machine stays sandboxed.

Not touched: CloudMachineCreateFlow, CloudConfiguration, and AgentSessionAttachClient.startParams. startParams is the daemon client's start for every session, local ones too; CmuxNextDaemon does not link the FFI, so its three tests in CloudVmKindTests stay.

Swift tests removed (their cases are cargo tests from #32436)

• CloudStartChatLoginTests.theSettingWinsElseOnlyDogfoodBuildsPassALogin → the_setting_wins_else_only_dogfood_builds_pass_a_login
• CloudStartChatAppLinkTests.aStartOnTheAppServerLinkIsNotRefused, CloudStartChatMachineTests.aCloudStartIsRefusedOnlyWhenCloudIsOffOrNobodyIsSignedIn → a_cloud_start_is_refused_only_when_cloud_is_off_or_nobody_is_signed_in
• CloudStartChatMachineTests.aSendIsKeptUnderTheAccountItBeganInAndChecksItAtEveryStep → a_send_is_kept_under_the_account_it_began_in_and_checks_it_at_every_step
• CloudStartChatMachineTests.aPageNamedFolderIsCopiedOnlyAsItsCheckedUploadRoot → a_page_named_folder_is_copied_only_as_its_checked_upload_root, a_tabs_own_folder_is_copied_only_as_itself_below_home, the_home_check_reads_every_spelling, the_home_folder_and_the_disks_root_are_too_broad
• CloudVmKindTests.onlyOwnerStartsTheLinkAtTheVMBoundary, anOlderServerKeepsTheSandboxAndAMalformedValueIsNeverOwner → vm_kind tests. The decoder half (a non-string value fails the attach) stays in Swift as one test.
• CloudMachineLoginTests.onlyAMissingOrRejectedLoginIsReplaced, theProbesWordIsTheAnswerElseItsExitCode → machine_login tests

Two thin wiring tests replace them: CloudStartChatMachineTests.theStartsChecksComeFromTheRustRules and the rewritten CloudStartChatLoginTests.theDecisionComesFromTheRustRules.

Tests

• cmux-ci compile-check --package CmuxNext at 71b4041 (this change before the re-pin; the C header is unchanged): passed.
• cmux-ci run --script scripts/ci/run-swift-testing-suites.sh at 2e8856c (this head, the new FFI pin), CMUX_SWIFT_TEST_SUITES=CloudStartChatLoginTests,CloudMachineLoginTests,CloudStartChatMachineTests,CloudStartChatAppLinkTests,CloudMoveAppLinkOwnerTests,CloudVmKindTests,CloudStartSessionTests: 7 suites passed, 0 failed. That includes the scratch-machine probe tests, which now read the probe's output through the decision call, and theSessionsMachineTakesTheHarnessLoginStep.

Observed / Not run

Observed: the compile check, the pin verification, the seven suites above at this head, and #32436's cargo runs. Not run: the full CmuxNext suite (this PR's CI runs it) and a DEV build Cloud start.

Changelog

none

Agent session: agent session

🤖 Generated with Claude Code

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 2e8856c: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr32476 -f ref=cloud-start-core-moves-b -f platform=macos -f backend_mode=local

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4149439773601 (6ad4953200)
• cmux NEXT nightly 1.0.0-nightly.4149622662301 (72e65a53e0)
• cmux NEXT nightly 1.0.0-nightly.4149719270001 (ccb777fdde)
• cmux NEXT nightly 1.0.0-nightly.4149824422001 (f6b340f97a)
• cmux NEXT nightly 1.0.0-nightly.4150011005501 (fbf9260854)
• cmux NEXT nightly 1.0.0-nightly.4150109776501 (ae802cfe75)
• cmux NEXT nightly 1.0.0-nightly.4150231832001 (9b07402606)

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/41493651131 at f561b65 failed: cmux-next checks (god files, concurrency, crash safety, l10n).
Those jobs last passed at bf3fbd9. This pull request is one of 3 merged since: #31921, #32476, #32477.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.

[teamleaderleo]

Review (codex, router-review): SHIP at 2e8856c

Reviewer: codex gpt-6-astra high, fast tier.

Follow-ups: 2. Each lands as an issue in this repo that links this receipt; the lane that opened the PR fixes it forward.

SHIP at 2e8856c

Visual verdict: no images; Leo tries the build

Static review covered the Rust FFI schemas and changed Swift call sites; Swift/Cargo were unavailable for local tests.

Follow-ups:

1. [P2] [follow-up] [CloudHarnessLoginDecision.swift:94] verdict invokes cloud_harness_login on every property access. passHarnessLogin accesses it repeatedly, so this does not implement the promised single decision call and can produce inconsistent state if an FFI call changes or fails. Cache one verdict per step.

2. [P2] [follow-up] No after screenshots were supplied, so visual comparison was unavailable.

[teamleaderleo]

Review (codex gpt-6-astra high, sweep, via the review router; full diff from merge base afaa4ae to this head): SHIP at 2e8856c

No P1/P2 findings.