[teamleaderleo]

Follow-ups F1 to F3 from the review of #35588 (receipt at b1d50f5), which added the republish path for a verified nightly-next build. This is item 2 of cmuxterm-hq#7061, "Republish with tip tooling".

F1, Chromium runtime pack. publish-nightly's "Select the build to publish" step now outputs cef, and both CEF steps gate on it instead of on vars.CMUX_NEXT_CEF_ON_DEMAND. Own and notarization-recovered builds still follow the switch. A republished build follows its source run: republish-nightly-next outputs cef, which is true when the source's signer uploaded cef-runtime-pack, the same condition under which the app was signed with an on-demand pin. Flipping the switch after the build therefore neither drops a pack the app needs nor fails on a pack the source never made.

F2, source archive. The cmux-next-source-archive artifact always carries the license trees. The tarball is in it only while CMUX_NEXT_PUBLISH_SOURCE_ARCHIVE was 1. republish-verified-nightly.py now outputs source_archive, true when exactly one cmux-next-source-*.tar.gz was restored. publish-nightly outputs source_archive: the switch, and for a republished build also that tarball. All three source-archive steps in publish-nightly-next-github gate on it. A republish of a source with no tarball now publishes no archive, instead of failing at mv nightly-out/source-archive after the feed was written. The variable stays the switch, and own and recovered builds behave as before.

F3, failure reporting. republish-nightly-next is now in report-nightly-failure's needs, so a failed fetch, which leaves publish-nightly skipped, opens the nightly failure issue. Its if already reports any failed need.

Tests

• tests/test_nightly_next_recovery.py: 78 pass, 4 of them new (pack and archive per switch and source, the tarball check, and a failed fetch reporting).
• Every other tests/test_nightly*.py, tests/test_ci_nightly*.py and tests/test_nightly_universal_build.sh passes, except test_nightly_next_arm64_only.py and test_nightly_owned_minis_only.py. Those two (OwnedWorkdirSteps) also fail at base 3e464b0.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Makes republished nightly-next builds match the build they republish: they now carry the same Chromium runtime pack and source archive, and a failed republish fetch opens the nightly failure issue.

• A republished build publishes the Chromium runtime pack its source run signed with, instead of following the current CMUX_NEXT_CEF_ON_DEMAND switch.
• With no source tarball, a republished build publishes no source archive instead of failing after the feed was written; the CMUX_NEXT_PUBLISH_SOURCE_ARCHIVE switch still gates own and recovered builds.
• republish-nightly-next is now a dependency of report-nightly-failure, so failed fetches produce the nightly failure issue.

^{Written for commit 104765a. Summary will update on new commits.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 533d1df: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr35735 -f ref=lane/nightly-republish-followups -f platform=macos -f backend_mode=local

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4190094575701 (036f8aa538)
• cmux NEXT nightly 1.0.0-nightly.4191131679101 (e01bbae5c9)

[teamleaderleo]

Review (codex, router-review): SHIP at 533d1df

Reviewer: codex gpt-6.1-sol xhigh, fast tier.

SHIP at 533d1df

Visual verdict: no images; Leo tries the build

Reviewed workflow gates and artifact provenance; focused recovery and source-archive tests pass.

Follow-ups: none

[blacksmith-sh]

Found 2 test failures on Blacksmith runners:

Failures

Test	View Logs
main.R2UploadRequestsTests.test_a_slow_large_put_is_bounded_by_idle_gaps_not_total_ time/test_a_slow_large_put_is_bounded_by_idle_gaps_not_total_time	View Logs
test_every_listed_hook_is_one_glaeda_released_with_the_check (main.SigningHooksInSt epWithGlaedaTests.test_every_listed_hook_is_one_glaeda_released_with_the_check)/ test_every_listed_hook_is_one_glaeda_released_with_the_check (main.SigningHooksInSt epWithGlaedaTests.test_every_listed_hook_is_one_glaeda_released_with_the_check)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Review (codex gpt-6-astra high, next-review, since=20261104T181841Z): SHIP at 104765a

SHIP at 104765a

Visual verdict: no images; Leo tries the build

Focused recovery tests pass (78 tests), including source-archive workflow checks.

Follow-ups: none