[teamleaderleo]

Leo, 2026-11-05: "JUST POINT ME TO THE ONE APP/THE ONE FEED", "THERE SHOULDN'T BE 2"; and "if we're only doing 1, just do the best app version to stick with". The app the team runs is cmux NIGHTLY (com.cmuxterm.app.nightly), with evidence in cmuxterm-hq#7156. So nightly-next now signs each build once, as cmux NIGHTLY, and publishes it to the feed that app polls. The cmux NEXT-identity build, its feed writes, and the second signing are gone. Carries out #33050.

One signing

• decide's nightly-next identity becomes cmux NIGHTLY: com.cmuxterm.app.nightly, cmux-nightly and cmux.nightly.entitlements. That means the NIGHTLY Developer ID profile, keychain group 7WLXT3NR37.com.cmuxterm.app.nightly and passkeys. sign_channel is nightly and profile_channel is NIGHTLY. This is the same path the NIGHTLY-identity notary probe already takes. The embed step refuses a profile for any other App ID.
• The cmux NEXT sign-in scheme override (LSEnvironment:CMUX_AUTH_CALLBACK_SCHEME) is dropped. cmux NIGHTLY takes its own default.
• Removed: the five copy jobs (legacy-identity-target, sign-, verify-, publish-nightly-identity-legacy, nightly-identity-legacy-published) and the 17 in-job copy steps. The sign job's budget goes from 320 back to 160 minutes.

One feed

• NIGHTLY_NEXT_FEED_BASE is https://files-next.cmux.com/nightly-next (R2 prefix nightly-next/). publish-nightly's compare-and-swap write, guard, ring tags, read-back and notes now all go to that feed.
• The release push uses feed=nightly-next-legacy, the id the app's ReleasePushListener gives that feed.
• The rolling DMG name is now moved by publish-nightly-next-github-names, only while the build is the feed's newest.
• The build-number checks read that feed plus classic NIGHTLY.
• Canary verdicts and pulled.json stay in nightly-next/next/, where the app reads them (UpdaterService.channelFolder).
• verdict, rollback and canary follow the one feed. verdict no longer retags the retired feed.
• The feed keeps the Nightly build before the newest (nightly_next_ring.py legacy, in both ring modes), so a launch crash has a build to roll back to. Today's live feed holds a single item, which leaves the launch smoke's decide() with nothing to serve. With the ring off, an unreadable live feed now warns and publishes the new build instead of stopping.

Handover for a stray cmux NEXT install

• Sparkle never installs a different bundle id. The app has no informational-update support, and a higher item with no enclosure would go down its normal install path.
• So the retired feed gets no appcast item. It gets a signed announcement card, release-notes/next/retired-feed-announcements.json, signed with the content key and written as nightly-next/next/notes/announcements.json. That is the one feed-side message the app shows. It is text only and points to cmux.com/next.

Not touched

• files.cmux.com/nightly and every classic-frozen path.
• The nightly runner routing.

The scheduled watchers that run from main move in #36228, which lands first.

Follow-ups

• Delete the copy's now-unused scripts and their unit tests.
• stable-next: its feed has never published; it reads the retired feed and expects a cmux NEXT DMG.
• The dev measurement tools that install "cmux NEXT.app".

Tests

• Rebased onto feat-cmux-next 4a2ed94e (ci(nightly): signing jobs queue only on the signer's label (held) #35918). Its signer-only routes are unchanged on every remaining job, and the signing-route test test_no_signing_job_ever_resolves_to_a_shared_label passes.
• Every nightly, signing and routing test passes except test_nightly_next_arm64_only.py, test_ci_upload_artifact_retention.py, test_short_timeout_guard.py and test_ci_signing_keychain_is_deleted_before_bundle_code.py. These four fail the same way on base 4a2ed94e.
• Rewritten for the new contract: test_nightly_next_identity.py, test_nightly_next_post_publish.py and test_nightly_next_rolling_dmg_identity.py.
• New: test_a_crash_rolls_back_on_the_one_feeds_shape (launch smoke decide() on a two-item cmux-next feed) and the ring tests for keeping the build before the newest.
• Checks on the removed jobs were dropped from the routing, coverage, runner and universal-build tests.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Signs every nightly-next build once, as cmux NIGHTLY (com.cmuxterm.app.nightly), and publishes it to the one feed the app polls, instead of building a cmux NEXT identity and re-signing a second copy for a separate feed. Implements #33050.

One signing, one feed

• Removes the NEXT-identity build, the second signing, and the copy jobs; the sign job's budget drops back to 160 minutes.
• The verdict workflow's retag now guards the one feed's own base (nightly-next/, where its DMGs sit) instead of the verdicts' folder, so it no longer refuses every promotion.
• The feed keeps the Nightly build before the newest one so a launch crash still has a build to roll back to, and an unreadable live feed now warns and publishes instead of stopping.
• The canary reads the one feed but pulls verdicts from the verdicts' folder (nightly-next/next/), where the app reads them; deriving that path from the feed matched nothing, so every scheduled tick re-ran the canary and dispatched another verdict.
• The retired feed holds a signed announcement card pointing stray cmux NEXT installs at cmux NIGHTLY; classic NIGHTLY (files.cmux.com/nightly) is untouched.
• Tests follow the one signing: the publish-path budget and rolling-name pins no longer reference the removed copy jobs.

^{Written for commit ed3c5dd. Summary will update on new commits.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review ed3c5dd: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr36287 -f ref=nightly-sign-once-as-nightly -f platform=macos -f backend_mode=local

[teamleaderleo]

Review (codex gpt-6-astra high, router-review): BLOCK at 71259b4

BLOCK at 71259b4

Visual verdict: no images; Leo tries the build

• [P1] [blocking] [category:correctness] [finding:F1] [outcome:pending] nightly-next-verdict.yml:53,160 configures nightly-next-guard.py with NIGHTLY_NEXT_FEED_BASE=https://files-next.cmux.com/nightly-next/next, but the appcast downloaded and retagged at line 151 comes from the bare /nightly-next feed and contains enclosure URLs under that bare prefix. The guard therefore rejects every changed appcast as “not a nightly-next download” before uploading the ring update, so canary verdict promotion fails whenever channels need changing. Use the bare feed base for the appcast guard while retaining /next for verdict lookups.

[teamleaderleo]

Review (Claude Opus 5.5 subagent, correctness first): SHIP at 07ce809

Scope: the full diff at this head, read through the API. Nothing was run locally.

Changes since cb6708c. That review found two reds. The compare shows a single commit (07ce809) that touches only the two tests behind them:

• tests/test_gh_budget_wait.py:348: PUBLISH_PATH no longer lists legacy-identity-target, sign-nightly-identity-legacy or publish-nightly-identity-legacy. Those jobs are gone from nightly.yml, which caused the KeyError. Every other publish-path job is still checked.
• tests/test_publish_release_assets_callers.py:91: the pin follows the script's new shape. It still requires the versioned DMG as --immutable, and it now also requires --alias "$rolling". That is stricter than before, not weaker, and it matches github-names-publish-rolling-name.sh at this head.

Correctness of the whole change

• Needs and outputs: I parsed nightly.yml at this head (44 jobs). Every needs: entry names a job that exists. Every needs.X. expression names a job in that job's own needs. Nothing references legacy_* outputs, steps.legacy-*, NIGHTLY_NEXT_LEGACY_* or the removed jobs. The &ring-token anchor moved into republish-nightly-deltas and has no alias earlier in the file.
• Signing: in decide, nightly-next now uses com.cmuxterm.app.nightly, cmux.nightly.entitlements, sign_channel=nightly and profile_channel=NIGHTLY. The embed step then picks APPLE_NIGHTLY_PROVISIONING_PROFILE_BASE64. The removed copy steps used that same secret in the release-next environment, so the secret is available there. The metadata checks in notarize-nightly-dmg.sh (lines 752 and 782) use CMUX_CHANNEL=nightly and so expect com.cmuxterm.app.nightly. What gets signed and notarized is exactly what ships.
• Feed for the installed cmux NIGHTLY: SUFeedURL is NIGHTLY_NEXT_FEED_BASE/appcast-arm64.xml, which is files-next.cmux.com/nightly-next/appcast-arm64.xml, the feed those installs already poll. The Sparkle key is the same; the removed copy job also signed with SPARKLE_NEXT_PRIVATE_KEY. The items keep the cmux-next / cmux-next-dev channel tags, which nightly-next-guard.py requires and the legacy installs accept. The guard's feed-url, appcast and r2-key checks all pass with the new base and prefix (nightly-next/). The older -nightlyid- DMG names still match cmux-nightly-next-macos-.
• The feed keeps the build before the newest: publish-next-feed-keep-nightly.sh now also runs with the ring off. current=() is reset on each pass, and only ring-off turns an unreadable feed into a warning. On the first publish after merge, the earlier item kept is the last legacy-signed build, so a rollback has a build to serve.
• Verdicts and pulled.json stay in nightly-next/next/, and verdict.yml still writes a copy beside the one feed. Rollback and canary follow the new base, and the retag in verdict.yml targets the one feed.
• Runners and concurrency: no runs-on or concurrency changed on any remaining job. The sign, recover, publish and names jobs keep their routes. pick-nightly-sign-runner now runs only when prepare-nightly-variant succeeds, which is correct because the legacy-only reason for it is gone. No cancel-in-progress was added.
• Prerequisite: ci(nightly-next): the watchers read the one cmux NIGHTLY feed #36228 (the watchers on main) merged at 2026-11-05T07:15:24Z.

Non-blocking

1. Transition only. recover-continue-pending-notarization.sh:49: a pending submission from before the merge is a cmux NEXT-identity build (com.cmuxterm.app.nightly.cmux-next). If it is recovered after the merge, notarize-nightly-dmg.sh:752 will refuse it with CMUX_CHANNEL=nightly. For an Accepted submission that refusal logs an ::error ("a check after acceptance failed"), and the candidate is skipped. It fails safe: no other-identity DMG reaches the feed. The annotation is noise until those pending artifacts expire.
2. Naming in nightly-next-verdict.yml:52-58: NIGHTLY_NEXT_FEED_BASE there now means the verdicts folder, and NIGHTLY_NEXT_LEGACY_FEED_BASE means the one feed. The step "Move the old feed's builds whose canary passed to Nightly" now writes the live feed. The behaviour is right, but the names invert their meaning in nightly.yml. Worth renaming in the follow-up.
3. In nightly.yml, NIGHTLY_NEXT_RETIRED_FEED_BASE and NIGHTLY_NEXT_VERDICTS_BASE hold the same value. That is fine today; keep them separate on purpose if the verdicts ever move.

agent-identity footer: claude-sr2-coord review subagent

[teamleaderleo]

Review (codex gpt-6.1-sol xhigh, router-review): BLOCK at 07ce809

BLOCK at 07ce809

Visual verdict: no images; Leo tries the build

1. [P1] [blocking] [category:reliability] [finding:F1] [outcome:pending] .github/workflows/nightly-next-canary.yml:41,142 now derives durable verdicts from /nightly-next/verdicts/, but nightly-next-verdict.yml writes them under /nightly-next/next/verdicts/. Scheduled canary runs therefore never see a readable verdict, so every five-minute tick reruns the canary and dispatches duplicate verdict jobs. Read from the retired verdicts path and update the canary test fixture accordingly.

[teamleaderleo]

Review (Claude Opus 5.5 subagent, correctness first): SHIP at ed3c5dd

Scope: compare 07ce809...ed3c5dd is one commit, ahead 1 / behind 0, two files (.github/workflows/nightly-next-canary.yml +4/-1, tests/test_nightly_next_canary_mode.py +7/-2). Nothing else moved, so the earlier SHIP at 07ce809 still covers the rest of the diff.

Checks:

• Path match. nightly-next-canary.yml:44 sets NIGHTLY_NEXT_VERDICTS_BASE: https://files-next.cmux.com/nightly-next/next, and :145 reads ${NIGHTLY_NEXT_VERDICTS_BASE}/verdicts/${BUILD}.json. nightly-next-verdict.yml:52-54,95 writes key nightly-next/next/verdicts/${BUILD}.json to bucket cmux-nightly-next, served at https://files-next.cmux.com/nightly-next/next/verdicts/<build>.json. Bucket, prefix, file name and build key all match. The build key is the same steps.feed.outputs.build the canary dispatches with (-f build="$BUILD"), and the reader also checks that d["build"] == BUILD and that the verdict is pass or fail.
• One value everywhere. nightly.yml:184 NIGHTLY_NEXT_VERDICTS_BASE, nightly-next-verdict.yml:52 NIGHTLY_NEXT_FEED_BASE (used as --verdicts-base for the retag at :153), nightly_next_train.py VERDICTS and the canary now all point at .../nightly-next/next. The retag call sites in nightly.yml, publish-next-feed-retag.sh and publish-next-feed-keep-nightly.sh all pass --verdicts-base "$NIGHTLY_NEXT_VERDICTS_BASE". Rollback writes pulled.json under NIGHTLY_NEXT_PULLED_PREFIX: nightly-next/next/, the same folder. Nothing that reads verdicts still uses the old ${FEED%/*} derivation.
• Notes stay on the bare feed. nightly-next-canary.yml:168 --notes-base "${NIGHTLY_NEXT_FEED%/*}/notes" gives nightly-next/notes, which is where release-notes-upload-to-r2.sh writes (NIGHTLY_NEXT_R2_PREFIX=nightly-next/). That is correct.
• The test is not a tautology. The curl stub records every https argument. The test feeds the step the env values read from the workflow YAML, then compares the fetched URL against the literal https://files-next.cmux.com/nightly-next/next/verdicts/4100.json?. It fails if the workflow's base value changes or if the step goes back to deriving the path from the feed. If curl is never called, the missing urls file raises, so that case fails too.

Notes (non-blocking):

• nightly-next-verdict.yml:116-125 also makes a best-effort copy at nightly-next/verdicts/<build>.json, so the old derivation hit that copy whenever the copy succeeded. "Never readable" overstated the earlier bug. Even so, reading the canonical copy (written under set -e, so a failed write fails the run) is the right fix, because the copy only warns when it fails.

agent-identity footer: claude-sr2-coord review subagent

[teamleaderleo]

Review (codex, router-review): SHIP at ed3c5dd

Reviewer: codex gpt-6-astra high, fast tier.

SHIP at ed3c5dd

Visual verdict: unchanged by this diff

Targeted nightly identity, feed, ring, publication, canary, rollback, recovery, and train tests pass (235 tests); changed shell and Python files also pass syntax checks.

Follow-ups: none

[cmux-bot]

cmux-bot approves ed3c5dd: an independent review passed this exact head (router-review receipt by teamleaderleo). A push needs a new review; a later BLOCK at this head dismisses this approval.