[teamleaderleo]

Workflow agent() and machine() calls reserve durable child identities before effects, reattach interrupted work, and preserve the exact final assistant reply or complete machine output. Parallel activities enqueue independently and receive distinct session names. A fallback after a stalled daemon retry reserves its own prompt identity before admission.

Agent replies get one schema correction; inactivity nudges once, then restarts on a configured permitted harness or route, then fails. Account, capacity and permission waits keep the existing recovery path. Exact child ownership prevents cancelling logical siblings, and waiting for a machine task cannot delay daemon shutdown. Uncertain machine launches fail closed.

This executor replaces one seam of #33755 and builds on the merged journal, reply policy, lifecycle and cancellation foundations. QuickJS, remote agent placement and public CLI/tool wiring remain separate PRs. CI placement stays refused here and is tracked in #33778. At 2,357 added lines this is one coupled executor state machine, its authenticated activity RPC, complete-output adapter and regression tests. The independent seams—QuickJS engine, CLI/tool wiring, remote placement and CI adapter—stay in their own PRs; splitting these handlers from their recovery tests would leave neither independently useful.

Validation: exact-head fleet run https://github.com/manaflow-ai/cmux/actions/runs/41662804193 passed at 46beb0d5c95d851ce9b590f42c3fae4fcbf8b4d6: the route-nudge crash regression fails with the persisted cancellation target omitted, the source is restored, then formatting, all 83 workflow tests, 15 background-task tests and strict acpmux all-targets clippy pass. Static prepush checks pass. The separate protocol IR check reports inherited drift for two MCP connect methods; its registry, source and committed spec are unchanged from the merged base, and all other protocol tests pass. The separate clippy job fails only the inherited indexing panic count: all emitted diagnostics were compared against this diff, with zero hits on added lines; strict all-targets clippy passes in the focused run.

Independent review: Opus 5.5 medium SHIP at 46beb0d5c95d851ce9b590f42c3fae4fcbf8b4d6: #33779 (comment).

Follow-up: complete machine output is retained in its spool but still collected and serialized whole in memory; #33851 tracks reading it in pages. Additional review follow-ups are #33976 (coalescing detached lock waits), #33977 (explicit-null placement semantics), and #33978 (validating an alternate before recording Restart). #33841’s route-nudge crash boundary is covered here. Signing, notarizing and publishing credentials remain outside the workflow runtime.

Leo-ask: ask-6ef2624788
Leo asked: “go do all those/help out where you can + examine how you can improve yourself and your available options and capabilities and speed”. Design: teamleaderleo/leo-workspace#624 §3.2–3.3.

🤖 Generated with Codex

Agent session: agent session

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 46beb0d: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr33779 -f ref=lane/native-workflow-executor -f platform=macos -f backend_mode=local

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4166687160001 (cd679bd6f0)
• cmux NEXT nightly 1.0.0-nightly.4166822316701 (a8aa75879e)
• cmux NEXT nightly 1.0.0-nightly.4167014501001 (63381baf63)
• cmux NEXT nightly 1.0.0-nightly.4167226066401 (c98a19b2a9)

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[teamleaderleo]

Review (subagent claude-opus-5-5 medium): SHIP at 644ca8e

Delta since the SHIP at 44b2ead: one hunk in workflow_activity.rs. When the stall deadline makes RecoveryAction::Restart, it clears waiting_for and route_nudge before the policy write.

Checked: current_id is state.waiting_for.clone().unwrap_or_else(..) (workflow_activity.rs:289), and automatic is waiting_for.is_some() (:326). Before this fix, the fallback attempt after continue 'attempt reused the daemon-retry id on the -restart session with a different route or harness. It also took the automatic admission path. That is the identity and input reuse fleet run 41658129526 hit. Now the fallback gets a fresh -g{epoch}-{gen}-{c} id, and it is persisted before the cancel, so recovery after the write also starts clean. This matches what the error-path Restart branch already did (:526-527). No legitimate wait is lost: the wait belonged to the original session's account, and that prompt is cancelled right after (:463-464). The Nudge and Wait paths are unchanged.

Findings:

• [follow-up] workflow_activity.rs:441-447: the delta adds no regression test. A hub test should cover an automatic daemon retry (waiting_for set) that stalls, gets nudged, stalls again and restarts onto fallbackHarness, and assert the fallback's prompt id is fresh and not waiting_for. The focused fleet re-run covers it only indirectly.
• [follow-up] workflow_activity.rs:441-460: the cleared state is persisted before the alternate check. With no fallback configured, the activity errors with waiting_for already gone. That is harmless today, because the terminal cancel still reaches the registered agent_prompt child. Checking alternate before the write would keep the record exact.
• Note: the PR currently shows CONFLICTING against feat-cmux-next, so a base merge is needed before landing. Checks at this head: 15/15 green.

Follow-ups: regression test for stalled automatic retry -> fallback prompt identity; check alternate before persisting the cleared wait.

[teamleaderleo]

Review (subagent claude-opus-5-5 medium): SHIP at bb14a21

Delta 644ca8e..bb14a21 is one commit (no base merge): Policy gains restart_prompt_id (#[serde(default)]), both Restart transitions set it in the same update_activity_policy write that clears waiting_for, and restart recovery cancels that exact id on the original session, falling back to the old computed id. It adds a regression test and fixes a clippy collapsible_if in server/workflow_activity.rs.

What I checked:

• Durability: in both the stall path (hub/workflow_activity.rs:449-453) and the route-failure path (:529-545), restart_prompt_id and waiting_for = None are set in the same serialized state, and that one store write happens before remove_queued/cancel_prompt. A crash after the write leaves the exact retry id on disk.
• Recovery (:212-220): with the field set, it cancels only that id on the original session. With an older row (None through serde default), it falls back to the previous computed id, so behaviour matches before. A stale id does nothing harmful: cancel_matching returns Ok without cancelling when the running turn's prompt_id differs (cancel.rs:343-348).
• Test (:1248-1342): it starts a real ~resume-1 retry on the original session, then persists a Restart-state policy with restart_prompt_id and runs workflow_execute with no in-process cancel. The old computed id (-g1-0-0) would not match the ~resume-1 retry, so the worker would never finish and session.turn() would stay set. The test therefore covers the crash window.
• Panics: the delta adds no unwrap or expect outside mod tests.

CI at bb14a21: 8 passed, 0 failed, 3 pending. GitHub reports the PR as CONFLICTING with feat-cmux-next, so it needs a base update before it can land.

Follow-ups: [follow-up] restart_prompt_id is never cleared. This is harmless today because only one restart is allowed and the cancel is exact-match, but clearing it once the fallback is admitted would keep the field from outliving its purpose.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[teamleaderleo]

Review (subagent claude-opus-5-5 medium, carried): SHIP at 0b9a897

This carries the SHIP at bb14a21 (#33779 (comment)). The new head merges base a34003d. I compared the PR's own diff against its base parent at both heads. Apart from the conflict resolution in adjacent bg_run.rs tests, which keeps both sides, the only difference is two lines in the regression test. The test now drives the real gap: a RouteError event and a -route-nudge~resume-1 retry id, where it used to use Stalled and ~resume-1. That makes the test stronger. Production code is unchanged.

Follow-ups: cmux#33976, cmux#33977, cmux#33978 (filed by the lane).

[teamleaderleo]

Review (claude-opus-5-5 medium, coordinator): SHIP at 46beb0d

This is a delta review from the carried SHIP at 0b9a897. The only new commit is 46beb0d, in bg_tasks.rs and workflow_activity.rs. It brings the stable-ID launch in line with the background description/notify arguments added on base by #33317.

• bg_start now passes both arguments through to bg_start_with_id. Before, the adapter dropped them, so after the base merge ordinary background tasks would have lost acpmux: a background task tells its chat when it ends; bg_* results lead with a summary line #33317's completion notice. This restores it.
• bg_start_with_id takes self: &Arc<Self>, which the notification watcher needs.
• Workflow children pass None, false, because they report completion through the workflow's own durable path.

There is no behaviour change beyond that. The exact-head run 41662804193 passed fmt, 83 workflow tests, 15 bg_ tests, strict clippy and the mutation proof.

Follow-ups: none new (cmux#33976, cmux#33977 and cmux#33978 stand).