[teamleaderleo]

Cloud first sends now identify their project when asking the platform for a machine, so two workspaces from the same project can receive and retain the same machine. Git SSH/HTTPS remotes normalize to a lowercase host/repository key; other folders use a canonical folder identity scoped to a persisted installation ID. GitHub repository metadata still drives snapshot setup.

Leo's direction (2026-11-02): “these are really good ... the other things i think are reasonable to build rn?” — including “Copy Shelley's best ideas: every machine gets its own URL for what's running on it, one-step sharing, and one machine per project.”

The platform owns sharing. Local fallback creation and explicit machine selection keep their existing behavior; existing send pins and first-writer workspace pins remain intact. The installation ID lives beside the existing client ledger, so older clients rewriting their ledger cannot drop it. No Swift or UI changes.

Design: design/cloud.md in leo-workspace. Replaces the default exclusivity from #30020 for platform-managed project machines; preserves #32244's create and pane retry safeguards.

Validation: focused tests cover SSH/HTTPS normalization, credential stripping, rejected ambiguous remotes, stable folder identities across restarts and symlinks, separation across installations, non-GitHub/non-git folders, and shared machine pins across two workspaces. Scoped pre-push checks pass. Fleet run 41587382442 compiled the Rust target and passed all 47 link::start_chat_cli tests at 5fd6ebb8fda37cf25339b4bb8a0d442fac4daf29. The specification-inventory checker also passed all 32 tests on that exact tree. General preflight reports unchanged localization debt and workspace package grouping at base 53921ff.

Agent session: agent session

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 5fd6ebb: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr33128 -f ref=lane/machine-per-project-client -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); base red: the same failure on the base ecd03e4; does not block

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4160373381601 (d485585f77)
• cmux NEXT nightly 1.0.0-nightly.4160614853601 (0e8eb9bf99)

[blacksmith-sh]

Found 7 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmpw503i593/summary-missing.json (live):/summary-missing.json (live):	View Logs
/tmp/tmpyphrvcjb/summary-fail.json (live):/summary-fail.json (live):	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs
test_event_stream_drift_is_rejected (main.InventoryContractTests.test_event_stream_ drift_is_rejected)/ test_event_stream_drift_is_rejected (main.InventoryContractTests.test_event_stream_ drift_is_rejected)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Review (subagent claude-opus-5-5 medium): SHIP at 5fd6ebb

Checked: SSH and HTTPS remotes normalize to git:<host>/<path> in lowercase, and the username and password are dropped. A non-standard port, a local path, file://, .., ? or # falls back to the folder key. The folder key is a SHA-256 of a per-device installation UUID plus the canonical path, or the common git dir for a worktree. The UUID is made once under the ledger lock, in its own file (temp file then rename, 0600, O_NOFOLLOW). The output matches the platform's normalizeProjectKey. Ensure now runs for any project folder on the personal account with the credential on stdin. On platform main, repo is optional and unknown keys are ignored, so an older backend still answers. claim_project skips held_by_another only after an ensure succeeds; the pin fallback still goes through claim, so the App's own create still gives each workspace its own machine. An existing pin still wins, and create_key and the made_no_machine rules are unchanged, so retries and fallbacks behave as before. Fleet run 41587382442 passed all 47 start_chat_cli tests at this head. Both CI reds (inventory selection-changed metadata, gallery host name) reproduce on merge base ecd03e4.

Visual verdict: unchanged by this diff (no UI code).

Follow-ups:

• [follow-up] git_common_dir walks up through parent folders, so a folder under a parent .git that has no origin (for example a ~/.git dotfiles repo) shares that repo's folder key, and unrelated folders share one machine.
• [follow-up] installation_id rejects an ID file with a trailing newline, which refuses every new folder send with ledger_failed. It should trim before parsing. Also fsync the folder after the rename.
• [follow-up] The project key is worked out for every Destination::New, including team and no-credential sends, so a rare canonicalize or ledger error refuses sends that never needed it.
• [follow-up] The CLI normalize_key allows folder IDs up to 1024 characters in mixed case; the platform allows 256 and lowercases them.

[teamleaderleo]

Validation at 5fd6ebb8fda37cf25339b4bb8a0d442fac4daf29: fleet run 41587382442 compiled the target and passed all 47 link::start_chat_cli tests. The exact tree also passes all 32 spec inventory checker tests and the scoped pre-push gate.

Both remaining CI failures were reproduced individually at the merge tree's base parent ecd03e420a17e4bd422607c7a2e28911b05eb781:

• InventoryContractTests.test_event_stream_drift_is_rejected: same error, runtime event selection-changed has no discoverable stream metadata.
• check-fixture-host-names.py: same unrelated fixture at webviews/src/agent-session/acpmux/HarnessStatusCard.gallery.tsx:50.

The base-to-merge diff changes only the four Cloud start-chat Rust files. Neither failure hides the focused compile/test result above.