[teamleaderleo]

Fixes two base reds on feat-cmux-next, both from 6b29137 ("nightly: ship the opt-in Cloud Tunnel on a channel with a profile"), which added a Prepare the Cloud Tunnel extension step to nightly.yml and a CMUX_CLOUD_TUNNEL env on Build nightly app (Release):

• cmux-next guards / nightly-guards / workflow-guard-tests / release-notary
  • tests/test_nightly_universal_build.sh: FAIL: nightly still handles the legacy tunnel extension. The check greps the expanded workflow (step scripts inlined), and the new cloud-tunnel-prepare.sh mentions SystemExtensions. The check now skips that one step and still fails on tunnel handling anywhere else.
  • tests/test_nightly_step_coverage.py: the new step had no entry in .github/nightly-step-coverage.json. It is nightly_only (secret tunnel profile, signing entitlements).
• cmux-next / cmux-next checks (Script tests): tests/test_nightly_release_product_reuse.py test_skipped_steps_read_no_unkeyed_decide_output failed on notary_probe and profile_channel, which the Release build step now reads. notary_probe never reaches a product lookup (the lookup condition excludes it), and profile_channel is derived from notary_probe, track and channel (both keyed; '' on nightly-next), so neither can change a reused app without changing its key. Both are allowed, with a comment saying why. This red first showed at Chief: a first-run Bring your history screen #33215 only because that was the first run of the job after the Cloud Tunnel series; Chief: a first-run Bring your history screen #33215 does not touch these files.

Tests and a registry only; no workflow or Cloud Tunnel code changes. All three tests pass locally.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes three nightly guard failures on feat-cmux-next caused by the new "Prepare the Cloud Tunnel extension" step added to nightly.yml.

• Registers the step in .github/nightly-step-coverage.json as nightly_only.
• Skips that step in test_nightly_universal_build.sh so the legacy tunnel check still catches other tunnel handling.
• Allows notary_probe and profile_channel as unkeyed Release build inputs in test_nightly_release_product_reuse.py; they cannot change a reused app without changing its key.

^{Written for commit a6f40ec. Summary will update on new commits.}

[teamleaderleo]

Owned by an agent session · session

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review a6f40ec: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr34201 -f ref=fix/nightly-cloud-tunnel-guards -f platform=macos -f backend_mode=local

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4173568006501 (cb6b71feab)
• cmux NEXT nightly 1.0.0-nightly.4173689456801 (4c71330ed9)
• cmux NEXT nightly 1.0.0-nightly.4173805520001 (cf0fddef88)

[teamleaderleo]

Review (subagent claude-opus-5-5 medium): SHIP at a6f40ec

Checked that the product lookup and record run only on nightly-next with notary_probe != 'true', so profile_channel is '' and CMUX_CLOUD_TUNNEL is empty on every reusable build. The awk skip covers only the Prepare step, up to the next step. All three tests pass. (The router review was unavailable because the Codex review lanes were idle-stopped. This is a small, tests-only change.)

Follow-ups: the awk skip could also stop at a job boundary (skip && /^ [^ ]/ { skip=0 }) in case the step ever becomes the last one in its job.

[teamleaderleo]

Review (codex, router-review): SHIP at a6f40ec

Reviewer: codex gpt-6-astra high, fast tier.

SHIP at a6f40ec

Visual verdict: unchanged by this diff

Checked the targeted reuse, coverage, and universal-build tests; all pass. The new reuse exemptions are constrained to values that cannot vary for reusable nightly-next builds.

Follow-ups: none