[lawrencecchen]

Base red, priority zero. The feat tip panic-ratchet is red since 92bf57a:

panic-ratchet: acpmux: clippy::string_slice 95 > baseline 94

The cause is #33209 (85ba3b5): format!("{PREFIX}{}", &hex[..HEX_LEN]) in cmux-tui/crates/acpmux/src/opaque_agent_id.rs. The ratchet denies string_slice. The hex is always 64 ASCII digits, so hex.get(..HEX_LEN).unwrap_or(&hex) gives the same 20 digits and has no panic path. The id does not change.

Owner of acpmux (PL-acpmux): this is a one-line change with no behavior change.

Changelog

none

Observed / Not run

• Observed: python3 scripts/cmux-next/prepush-gate.py: no new violations. In the 29 commits since the last green, the only added string slice in acpmux is this line.
• Not run: clippy and the acpmux tests (no cargo on this VM). The PR's own panic-ratchet and Rust test checks run them.

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review d51850b: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr33717 -f ref=base-red/opaque-id-string-slice -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); no finished base run on 0e4aafa to compare; do not merge until green; see lane-rules

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4163731153001 (b4970032cd)

[blacksmith-sh]

Found 1 test failure on Blacksmith runners:

Failure

Test	View Logs
test_every_compile_job_names_its_warm_sources (main.ThisTree.test_every_compile_job _names_its_warm_sources)/ test_every_compile_job_names_its_warm_sources (main.ThisTree.test_every_compile_job _names_its_warm_sources)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[lawrencecchen]

Review (independent-subagent): SHIP at d51850b

• The output is the same for every input. frontend_proof::hex writes two ASCII digits per byte of the 32-byte HMAC-SHA256, so hex is always 64 bytes. hex.get(..20) is always Some(&hex[..20]), so ids do not change and existing links still resolve. The unwrap_or(&hex) fallback cannot run.
• It matches the crate's convention for a fixed prefix of an ASCII string: sha.get(..8).unwrap_or(sha) (acpmux_mcp_pr.rs:186) and id.get(..8).unwrap_or(&id) (cli/run/parent.rs:99). Slicing the MAC bytes instead (hex(&mac[..10])) would only move the hit to indexing_slicing.
• Ratchet: in this PR's clippy (changed cmux-tui packages) run, the Rust panic ratchet on changed cmux-tui packages step passed. Its clippy JSON shows 94 acpmux string_slice hits (equal to the baseline) and none in opaque_agent_id.rs. Feat's own run at 7a0df84 reports acpmux: clippy::string_slice 95 > baseline 94.
• In 40a367ca8911..0e4aafa5911, the only line that adds a range slice in acpmux/src is this one. From then to the current feat tip (e4cf14d), the new range slices are &bytes[start..] / &out[start..] in native.rs (f6316fb). Both slice &[u8]/Vec<u8>, so they count as indexing_slicing, not string_slice. No other code adds a string_slice hit.
• Reds on this head are not from this change:
  • clippy (changed cmux-tui packages) fails on unused import notify::Watcher in login_env/watch.rs, which was fixed on feat by base red: the notify Watcher import is macOS-only (unused on Linux after #33406) #33664.
  • inventory and cmux-next checks fail on the stale phone lane field allowlist, fixed by cmux-next: regenerate the phone lane field table (move-tab-to-column pane_id, base red from #33184) #33718.
  • release-notary is also red on fix(sidebar): public import Observation in GroupJoinHold (compile red since #33578) #33697, Chief: a PR-merge watch waits through glaeda-gh instead of polling gh every 15 s #33713 and cmux-vm: receiver-policy read issues its independent queries together (22 serial DB round trips to 7) #33715 (base finding).