[teamleaderleo]

HQ brief 09: complete the safe CloudDO settings routes

Source inspection at cmux feat-cmux-next@6c3fe3648ba4b44e7bf38c4982a665ec2d5d5712 and cmux-platform main@794483e7aaee755341c8cbfaf334a7b2148111df. Follow-up to cmux#32866, which already moved app-server Pause/Resume to CloudDO.

Problem

CloudService.renameMachine and CloudService.setIdlePause still unconditionally call the classic CloudAPIClient (PATCH /api/vm/{id} and PUT /api/vm/{id}/idle-pause). NEXT app-server creates/listing use cloud.machine.create/list with CloudDO vm_<20> IDs; these classic routes require the older registry.

Change

• In .appServer mode route rename to cloud.machine.rename {machine,name} and idle policy to cloud.machine.idle_policy.set {machine,idle_seconds}, each with one mutation key and verified app user origin. Classic mode keeps its original API calls.
• Validate the machine ID and resulting name/policy in CloudDO's acknowledgement before mutating the app's local record. Errors continue to surface to the calling action. Empty names on CloudDO follow the server's MachineName contract (1–80 characters).
• Decode idle_policy.idle_seconds from CloudDO records into the existing app minute field, so a list refresh preserves a setting. Fractional-minute policies remain unspecified in the app's minute-only display.
• Add four transport contract tests (op/ID/argument unit/answer/fail-closed) and one CloudDO record-decoding test.

Explicit exclusions

deleteMachine still requires a separate G8 person-approved cloud.machine.delete flow. It must preserve the native destructive confirmation, team pin, same-key retries across approval.pending and mutation.indeterminate, and tombstone/list reconciliation. This draft intentionally leaves deletion for its owning issue. Also, the app-server create currently rejects nondefault requests, including --persistent (CloudMachineRequest.isDefault); this PR changes the existing idle-policy set operation only.

Validation / review

• Source contracts cross-checked: cmux-platform/src/server/cloud/domain/Cloud.ts handles both settings as update with mayManage; the vendored protocol requires idle_seconds and returns {machine}.
• GitHub compare from the pinned base shows exactly five files, 5 commits. No live VMs, owner tokens, production requests, deployments, or merges.
• Swift tests and macOS app runtime unverified in this environment; request macOS focused tests CloudMachineSettingsTests and CloudIdlePauseTests plus a genuine app-server machine check before shipping. Kept draft deliberately.

Refs: HQ #6236 brief 09, cmux-platform #510, cmux #32866.

🤖 Investigated and proposed via ChatGPT.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Routes machine rename and idle-pause settings through CloudDO for app-server machines, which the classic CloudAPIClient routes can't handle because they require older registry IDs.

• App-server mode now calls cloud.machine.rename and cloud.machine.idle_policy.set; classic mode keeps the original API calls.
• Each operation verifies the machine ID and returned value in CloudDO's acknowledgement before updating the local record; mismatches fail closed.
• Idle policy is exchanged as seconds and decoded into the app's existing minute field; fractional-minute policies remain unspecified in the minute-only display.
• Added transport contract tests (op, arguments, acknowledgement checks, invalid input) and CloudDO record-decoding tests.

^{Written for commit a773784. Summary will update on new commits.}

[teamleaderleo]

Validation receipt for HQ brief 09 (2026-11-03): swiftc -swift-version 6.2 is available on Linux. The new CloudMachineSettings helper and its four Swift Testing cases typechecked under Swift 6 using minimal local CloudAppOp/JSONValue interface stubs, and a standalone executable smoke probe passed the rename route, idle minutes→seconds, same machine ID, and wrong-machine reply rejection. Exact smoke result: PASS: CloudDO rename & idle-policy route, minute-to-second conversion, fail-closed response (stubbed ops). This is an isolated contract test, not a build or run of the actual macOS NEXT package and not an authenticated CloudDO call. PR remains draft until macOS CloudMachineSettingsTests and CloudIdlePauseTests, package checks, and source review run. feat-cmux-next advanced by 4 commits while the draft was authored; the PR was mergeable on inspection, with a pinned comparison base at 6c3fe364….

[teamleaderleo]

Independent review — CloudDO settings route (continuation of HQ #6236 / brief 34)

Exact head: a77378425d7c1ac855c70b49c63912d5c9156554 · Source-contract verdict: no new blocking defect found in the rename/idle-policy path. Runtime verdict: macOS/Cloud integration unverified, so retain the PR's draft/HOLD state pending its own focused suites and one app-server readback.

I independently traced the complete 5-file change into the current platform reducer and vendored protocol:

• CloudMachineSettings.swift sends cloud.machine.rename with {machine,name} and cloud.machine.idle_policy.set with {machine,idle_seconds}; both use a unique key, request .user origin, and demand an acknowledgement for the same machine and exact new value before CloudService updates its local row.
• Platform cmux-platform main@794483e7aaee755341c8cbfaf334a7b2148111df, src/server/cloud/domain/Cloud.ts:632–654, implements both ops with creator/admin mayManage authorization and a {machine:publicMachine(row)} result. Its pinned protocol accepts names 1–80 characters and idle seconds 0–604800. The client's 0–10080 minutes conversion matches exactly.
• CloudAppLinks.ops(local:) downgrades a requested .user to .script unless connection.userOriginAllowed; the local client cannot simply assert user provenance on an untrusted connection. Classic mode retains its /api/vm path.
• The Cloud page already uses the canonical CloudDO operations and trims/refuses blank rename values. This PR fixes the native CloudService route, rather than duplicating page logic. A cleared machine name remains unsupported by CloudDO's 1–80-character contract, as the PR author acknowledges.
• List refresh decodes idle_policy.idle_seconds into integer-minute UI values; for an existing 61-second policy the code intentionally shows nil, and leaves a fractional policy unchanged server-side.

Executed bounded experiment: Swift 6.2.1 on Linux, compiling the 32-line exact production CloudMachineSettings helper body with minimal JSON/CloudAppOp test doubles (no actual platform connection). 12/12 assertions passed: rename, idle settings 0/15/1440/10080 minutes; negatives −1 and 10081 rejected before a call; wrong machine ID and wrong policy acknowledgements refused; exactly five accepted calls; unique nonempty mutation keys and .user request origin; 15 min = 900 seconds. This executes the actual helper logic, but tests only a stubbed transport and does not validate the Swift package integration, platform authorization, signed binary, or a real machine.

Targeted next checks for the owner:

1. Run the PR's CloudMachineSettingsTests and CloudIdlePauseTests on macOS, including exact success/refusal transport cases, then an app-server readback after a list refresh.
2. Exercise account/team changes and a scripted/non-user-origin request: owner/server rejection must leave the machine row unchanged.
3. Test the native rename action's empty/whitespace name explicitly: CloudDO rejects it; the Cloud page blocks it. Either provide a clear validation error before the request or intentionally exclude the clear-name action.
4. Confirm the current CloudDO 24 h idle backstop is visible even if a machine policy is 7 days or 0.

Actual work: cross-repo contract inspection plus executed isolated Swift assertions, no code pushed to the existing owner branch, no VM, credentials, merge or deployment.