ci(owned-pool guard): a RUNNER_POOLS read isn't an owned pool by austinywang · Pull Request #32636 · manaflow-ai/cmux

austinywang · 2026-11-02T23:04:57Z

Summary

CI fast guards has failed since #32457 landed on feat-cmux-next, which made nearly every runner selection read vars.RUNNER_POOLS. The guard counts vars.RUNNER_POOLS as able to take an owned pool, so it reported 116 workflows as unwatched. That failure makes the macOS admission gate refuse app builds and app tests on pull requests to main. feat-cmux-next has its own copy of the guard: #32649.

scripts/ci/runner_pools.py rejects any pool member that isn't an ephemeral Blacksmith label, so these reads can't land on an owned Mac. This stops counting them. fast-checks.yml was watched only because of that read, so its entry is removed, as the guard's other check requires. The rescue does nothing for a run with no owned job, so no routing changes.

Testing

python3 tests/test_ci_owned_pool_sources.py with origin/feat-cmux-next at 25db344:

Base: fails test_every_owned_workflow_is_watched.
Head: 9 tests pass.

python3 tests/test_ci_owned_pool_rescue.py has the same 2 SpendLess errors locally on base and head (KeyError: 'file', this Mac's Python 3.9), so CI is the check for those.

The _POOL_READ_WHY entries in feat-cmux-next's copy of the rescue become unnecessary; they do no harm and are left for that branch.

Changelog

No entry: CI only.

Base 21dcc2b, head 681b9dd. Agent: Claude Code.

🤖 Generated with Claude Code

Summary by CodeRabbit

Bug Fixes
- Updated CI workflow classification: fast checks are no longer treated as side-lane workflows by the rescue process.
- Runner pool configuration alone no longer marks a workflow as owned. Other eligible pool-switch, policy, and extra configuration variables continue to count toward owned-workflow classification.

feat-cmux-next's #32457 made nearly every runner selection read vars.RUNNER_POOLS, and the guard counted each as able to take an owned Mac, so CI fast guards failed on main and on every pull request, and the macOS admission gate then refused them. runner_pools.py rejects any pool member that isn't an ephemeral Blacksmith label, so these reads can't reach one. fast-checks.yml was watched only for that read, so its entry goes too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

github-actions · 2026-11-02T23:05:10Z

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

coderabbitai · 2026-11-02T23:10:45Z

No actionable comments were generated in the recent review.

Recent review info

Run configuration

Source mode: Auto
Repository: manaflow-ai/cmux
Branch: main
File: .coderabbit.yaml
Commit: 21dcc2b
Layers: Repository YAML
Review profile: ASSERTIVE
Plan: Advanced
Run ID: ab5233c8-ffa4-484b-ae9e-1249d8bb4be4

Commits

Reviewing files that changed from the base of the PR and between 25fb044 and 681b9dd.

Files selected for processing: 1

scripts/ci/owned_pool_sources.py

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 2 remain after this review.

Walkthrough

The owned-variable matcher now excludes RUNNER_POOLS. The side-workflow set no longer includes .github/workflows/fast-checks.yml.

Changes: Owned-pool classification

Layer / File(s)	Summary
Update owned-pool classification `scripts/ci/owned_pool_sources.py`, `scripts/ci/owned_pool_rescue.py`	The matcher excludes `RUNNER_POOLS` from owned-variable detection. The side-workflow set no longer includes `.github/workflows/fast-checks.yml`.

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Bug fix

Possibly related issues

Issue 30131 — Reports a test_every_owned_workflow_is_watched failure for workflows that read vars.RUNNER_POOLS. This change excludes that read from owned-pool detection.
Issue 31981 — Reports a persistent-pool rescue guard failure for workflows that read vars.RUNNER_POOLS. This change excludes that read from owned-pool detection.

Possibly related PRs

manaflow-ai/cmux#27129 — Introduces RUNNER_POOLS and workflow reads that this change alters how the owned-pool guard classifies.
manaflow-ai/cmux#26585 — Adds the runner-pool declaration and reconciler related to this classification change.
manaflow-ai/cmux#30840 — Adds a rescue guard exception for a workflow that reads RUNNER_POOLS.

Suggested reviewers: teamleaderleo

Merge Risk: Minimal · up to 681b9

The classification change removes false owned-runner matches without an established loss of applicable rescue behavior. Mergeable subject to normal checks.

Pre-merge checks: 24 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 24 passed

Check name	Status	Explanation
Title check		The title clearly identifies the main change: `vars.RUNNER_POOLS` reads no longer count as owned-pool usage in the CI guard.
Description check		The description explains the failure, intended behavior, implementation, testing results, known local test limitation, and changelog status. It omits the template’s Proof and Checklist sections, but t…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Cmux Cloud Persistent Session And Early Input		PASS. The review-scoped diff changes only CI owned-pool classification: it removes `fast-checks.yml` from `SIDE_WORKFLOW_PATHS` and excludes `RUNNER_POOLS` from `Markers.variables` in `scripts/ci/owne…
Cmux Swift Actor Isolation		The PR changes only two Python CI scripts: `scripts/ci/owned_pool_rescue.py` and `scripts/ci/owned_pool_sources.py`. The reviewed diff contains no Swift files or Swift actor-isolation changes, so this…
Cmux Swift Blocking Runtime		The pull request changes only two Python CI scripts. The authoritative diff contains no Swift files and introduces no semaphores, waits, sleeps, delayed dispatch, polling, main-queue synchronization, …
Cmux Browser Automation Off-Main		PASS: The reviewed diff changes only `scripts/ci/owned_pool_rescue.py` and `scripts/ci/owned_pool_sources.py`. It does not modify `Sources/TerminalController.swift`, `ControlCommandExecutionPolicy.swi…
Cmux Expensive Synchronous Load		The pull request changes only `scripts/ci/owned_pool_rescue.py` and `scripts/ci/owned_pool_sources.py`. The diff contains no Swift files, agent-history loads, workspace scans, or interactive-path chan…
Cmux Cache Substitution Correctness		PASS: The authoritative PR diff changes only `scripts/ci/owned_pool_rescue.py` and `scripts/ci/owned_pool_sources.py`, both Python CI guard code. It does not change production Swift, TypeScript, or Ja…
Cmux No Hacky Sleeps		PASS: The pull request changes only CI guard classification in two Python scripts. The diff removes one workflow path and excludes `RUNNER_POOLS` from owned-variable matching. It introduces no sleep, …
Cmux Algorithmic Complexity		The diff only changes two Python CI scripts. It removes one fixed workflow-path entry and subtracts the fixed `BLACKSMITH_ONLY_VARIABLES` set from a marker set. It introduces no nested scalable-collec…
Cmux Swift Concurrency		The pull request changes only two Python CI scripts: `scripts/ci/owned_pool_rescue.py` and `scripts/ci/owned_pool_sources.py`. The diff contains no Swift files or Swift concurrency code, so it does no…
Cmux Swift `@Concurrent`		PASS: The pull request changes only two Python files (`scripts/ci/owned_pool_rescue.py` and `scripts/ci/owned_pool_sources.py`). It introduces no Swift code, `@concurrent` annotation, `nonisolated asy…
Cmux Swift Package Boundaries		The pull request changes only two Python CI scripts: `scripts/ci/owned_pool_rescue.py` and `scripts/ci/owned_pool_sources.py`. The diff contains no Swift changes, so the Swift package-boundary check d…
Cmux Swiftpm Lockfiles		PASS. The reviewed diff changes only two CI Python scripts. It changes no Package.swift, Package.resolved, .gitignore, Xcode project, workspace, workflow, or dependency file, and adds no SwiftPM or Xc…
Cmux Swift Logging		PASS: The pull request changes only two Python files: `scripts/ci/owned_pool_rescue.py` and `scripts/ci/owned_pool_sources.py`. The reviewed range contains no Swift files and adds or changes no Swift …
Cmux User-Facing Error Privacy		The diff changes only internal CI rescue and workflow-analysis logic. It adds internal comments and excludes `vars.RUNNER_POOLS` from owned-pool detection, and removes one CI workflow path. The change…
Cmux Full Internationalization		PASS. The PR changes only `scripts/ci/owned_pool_rescue.py` and `scripts/ci/owned_pool_sources.py`. The changes remove a workflow path and alter CI source-detection logic and developer comments. They …
Cmux Swiftui State Layout		PASS: The pull request changes only two Python CI scripts: `scripts/ci/owned_pool_rescue.py` and `scripts/ci/owned_pool_sources.py`. The diff contains no SwiftUI or Swift files, so the SwiftUI state-l…
Cmux Architecture Rethink		The pull request changes only Python CI scripts: `scripts/ci/owned_pool_rescue.py` and `scripts/ci/owned_pool_sources.py`. The diff contains no Swift, AppKit, or SwiftUI changes and introduces none of…
Cmux Swift Auxiliary Window Close Shortcuts		The pull request changes only `scripts/ci/owned_pool_rescue.py` and `scripts/ci/owned_pool_sources.py`. The diff contains no Swift, NSWindow, NSPanel, NSWindowController, SwiftUI `Window`, or `WindowG…
Cmux Source Artifacts		The diff changes only two hand-written Python CI scripts: `scripts/ci/owned_pool_rescue.py` and `scripts/ci/owned_pool_sources.py`. It removes one workflow entry and updates owned-pool policy logic. N…
Cmux No Test Or Debug Seam In Production Source		The pull request changes only two Python files: `scripts/ci/owned_pool_rescue.py` and `scripts/ci/owned_pool_sources.py`. The diff contains no Swift file under a production `Sources/` path, so it cann…

Full details: Description check

Explanation

The description explains the failure, intended behavior, implementation, testing results, known local test limitation, and changelog status. It omits the template’s Proof and Checklist sections, but the missing sections are non-critical for this CI-only change.

Full details: Cmux Cloud Persistent Session And Early Input

Explanation

PASS. The review-scoped diff changes only CI owned-pool classification: it removes fast-checks.yml from SIDE_WORKFLOW_PATHS and excludes RUNNER_POOLS from Markers.variables in scripts/ci/owned_pool_sources.py. It does not change Cloud terminal creation, cmux-tui transport, renderer readiness, input routing, authentication, idempotency, revision fences, or leases. The custom rule therefore does not apply to a failing behavior.

Full details: Cmux Swift Actor Isolation

Explanation

The PR changes only two Python CI scripts: scripts/ci/owned_pool_rescue.py and scripts/ci/owned_pool_sources.py. The reviewed diff contains no Swift files or Swift actor-isolation changes, so this check is not applicable.

Full details: Cmux Swift Blocking Runtime

Explanation

The pull request changes only two Python CI scripts. The authoritative diff contains no Swift files and introduces no semaphores, waits, sleeps, delayed dispatch, polling, main-queue synchronization, or manual locks.

Full details: Cmux Browser Automation Off-Main

Explanation

PASS: The reviewed diff changes only scripts/ci/owned_pool_rescue.py and scripts/ci/owned_pool_sources.py. It does not modify Sources/TerminalController.swift, ControlCommandExecutionPolicy.swift, browser socket commands, worker routing, or policy tests. The browser automation WebKit-waits rule is therefore not applicable.

Full details: Cmux Expensive Synchronous Load

Explanation

The pull request changes only scripts/ci/owned_pool_rescue.py and scripts/ci/owned_pool_sources.py. The diff contains no Swift files, agent-history loads, workspace scans, or interactive-path changes. The custom check is therefore not applicable.

Full details: Cmux Cache Substitution Correctness

Explanation

PASS: The authoritative PR diff changes only scripts/ci/owned_pool_rescue.py and scripts/ci/owned_pool_sources.py, both Python CI guard code. It does not change production Swift, TypeScript, or JavaScript code, and it does not substitute a cached value in a persistence, history, undo, or snapshot path.

Full details: Cmux No Hacky Sleeps

Explanation

PASS: The pull request changes only CI guard classification in two Python scripts. The diff removes one workflow path and excludes RUNNER_POOLS from owned-variable matching. It introduces no sleep, timer, polling loop, fixed delay, or wall-clock wait. Existing timing code is not worsened.

Full details: Cmux Algorithmic Complexity

Explanation

The diff only changes two Python CI scripts. It removes one fixed workflow-path entry and subtracts the fixed BLACKSMITH_ONLY_VARIABLES set from a marker set. It introduces no nested scalable-collection scan, batch rescan, hot-path sort/filter, in-memory join, or slower algorithm for user-owned records. The existing sorted(...) call is unchanged.

Full details: Cmux Swift Concurrency

Explanation

The pull request changes only two Python CI scripts: scripts/ci/owned_pool_rescue.py and scripts/ci/owned_pool_sources.py. The diff contains no Swift files or Swift concurrency code, so it does not introduce or expand any listed legacy async pattern.

Full details: Cmux Swift `@Concurrent`

Explanation

PASS: The pull request changes only two Python files (scripts/ci/owned_pool_rescue.py and scripts/ci/owned_pool_sources.py). It introduces no Swift code, @concurrent annotation, nonisolated async work, or Swift call-site changes covered by the rule.

Full details: Cmux Swift Package Boundaries

Explanation

The pull request changes only two Python CI scripts: scripts/ci/owned_pool_rescue.py and scripts/ci/owned_pool_sources.py. The diff contains no Swift changes, so the Swift package-boundary check does not apply.

Full details: Cmux Swiftpm Lockfiles

Explanation

PASS. The reviewed diff changes only two CI Python scripts. It changes no Package.swift, Package.resolved, .gitignore, Xcode project, workspace, workflow, or dependency file, and adds no SwiftPM or Xcode package-reference change. Therefore the SwiftPM lockfile failure conditions do not apply.

Full details: Cmux Swift Logging

Explanation

PASS: The pull request changes only two Python files: scripts/ci/owned_pool_rescue.py and scripts/ci/owned_pool_sources.py. The reviewed range contains no Swift files and adds or changes no Swift logging.

Full details: Cmux User-Facing Error Privacy

Explanation

The diff changes only internal CI rescue and workflow-analysis logic. It adds internal comments and excludes vars.RUNNER_POOLS from owned-pool detection, and removes one CI workflow path. The changed text is not an app UI, product CLI, or product API message. The repository shows these scripts run from internal GitHub Actions and CI guard tests, so the user-facing error privacy rule does not apply.

Full details: Cmux Full Internationalization

Explanation

PASS. The PR changes only scripts/ci/owned_pool_rescue.py and scripts/ci/owned_pool_sources.py. The changes remove a workflow path and alter CI source-detection logic and developer comments. They add no user-facing Swift, web, API, markdown, changelog, or localization text, and they require no locale or catalog updates.

Full details: Cmux Swiftui State Layout

Explanation

PASS: The pull request changes only two Python CI scripts: scripts/ci/owned_pool_rescue.py and scripts/ci/owned_pool_sources.py. The diff contains no SwiftUI or Swift files, so the SwiftUI state-layout rules do not apply.

Full details: Cmux Architecture Rethink

Explanation

The pull request changes only Python CI scripts: scripts/ci/owned_pool_rescue.py and scripts/ci/owned_pool_sources.py. The diff contains no Swift, AppKit, or SwiftUI changes and introduces none of the listed Swift architecture patterns.

Full details: Cmux Swift Auxiliary Window Close Shortcuts

Explanation

The pull request changes only scripts/ci/owned_pool_rescue.py and scripts/ci/owned_pool_sources.py. The diff contains no Swift, NSWindow, NSPanel, NSWindowController, SwiftUI Window, or WindowGroup code. The auxiliary-window shortcut rule is therefore not applicable.

Full details: Cmux Source Artifacts

Explanation

The diff changes only two hand-written Python CI scripts: scripts/ci/owned_pool_rescue.py and scripts/ci/owned_pool_sources.py. It removes one workflow entry and updates owned-pool policy logic. No logs, screenshots, caches, build output, temporary directories, dependency checkouts, or other artifact paths enter source control.

Full details: Cmux No Test Or Debug Seam In Production Source

Explanation

The pull request changes only two Python files: scripts/ci/owned_pool_rescue.py and scripts/ci/owned_pool_sources.py. The diff contains no Swift file under a production Sources/ path, so it cannot introduce a test or debug seam covered by this check.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 1 files.

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches

Generate docstrings

Commit to this branch
Create a new PR

Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

CodeRabbit Verify

Run CodeRabbit Verify to test the changes in this pull request.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

austinywang · 2026-11-02T23:22:56Z

Correctness review (subagent; replayed both branches' guard code against both trees, not run in CI on a feat-cmux-next PR) of 25fb044. Resolutions are on 681b9dd.

Finding	Verdict	Resolution
`feat-cmux-next`'s copy of the guard still counts `RUNNER_POOLS`, so that branch stays red	Confirmed	Companion PR opened
Guard gap: `fleet-compile-check.yml`, `fleet-test-compile.yml` and `cmux-next-tip-test-compile.yml` on `feat-cmux-next` read a gateway variable (`CI_COMPILE_CHECK_GATEWAY` and similar) whose live value is a `glaeda-gateway-*` label, and the guard doesn't count those variables	Confirmed, predates this PR	Open. Only the `RUNNER_POOLS` read was flagging them. `fleet-test-compile.yml`'s unrescued reason, saying no owned Mac is involved, is also wrong. Needs a decision on how the rescue should treat them
Comment overstated pool members (hosted pools exist)	Plausible, minor	Fixed

Clean: no owned route through a pool, no rescue behaviour change from removing fast-checks.yml, no failure on main (stale-entry warnings only).

austinywang · 2026-11-03T00:26:26Z

Combined into #32585 at the requester's ask.

This was referenced Nov 2, 2026

0.65.3 prep: hide Chief behind a flag, keep the TLS hotfix on main #32585

Merged

Keep the iroh relay TLS hotfix on main #32589

Closed

ci(owned-pool guard): say which runners a pool can hold

681b9dd

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

austinywang mentioned this pull request Nov 2, 2026

ci(owned-pool guard): a RUNNER_POOLS read isn't an owned pool (feat-cmux-next) #32649

Open

austinywang mentioned this pull request Nov 2, 2026

Bound the first transcript read in bytes and make it cancellable #32652

Open

1 of 4 tasks

austinywang closed this Nov 3, 2026

Navigation Menu

Repository navigation

ci(owned-pool guard): a RUNNER_POOLS read isn't an owned pool - #32636

ci(owned-pool guard): a RUNNER_POOLS read isn't an owned pool#32636
austinywang wants to merge 2 commits into
mainfrom
ci-runner-pools-not-owned

austinywang commented Nov 2, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

github-actions Bot commented Nov 2, 2026

Uh oh!

coderabbitai Bot commented Nov 2, 2026 •

edited

Loading

Uh oh!

austinywang commented Nov 2, 2026

Uh oh!

austinywang commented Nov 3, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

austinywang commented Nov 2, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Changelog

Summary by CodeRabbit

Uh oh!

github-actions Bot commented Nov 2, 2026

Uh oh!

coderabbitai Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CodeRabbit Verify

Uh oh!

austinywang commented Nov 2, 2026

Uh oh!

austinywang commented Nov 3, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

austinywang commented Nov 2, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Nov 2, 2026 •

edited

Loading