Accept CMUX repository-owned workload profile requests

[teamleaderleo]

CMUX needs one stable operation vocabulary shared by CI, developer machines, fleet acceptance, routing experiments, and performance work. The semantic definitions now live in the paired CMUX change, manaflow-ai/cmux#13411.

This adds the Glaeda-side boundary for those repository-owned profiles without copying CMUX command lines or pass/fail rules.

Result

scripts/cmux_workload_request.py accepts a bounded semantic request containing exact CMUX commit/tree, CMUX profile ID/generation, benchmark state class, and bounded semantic parameters.

It resolves only the fixed cmux-repository-profile/v1 adapter:

• repository runner: scripts/ci/cmux_workload_profile.py;
• semantic result contract: cmux-workload-result/v1.

Caller correlation and reuse hints stay outside the execution binding. A profile generation change changes that binding. The request surface has no caller-provided argv, cwd, machine/backend, resource override, cache root, or redispatch authority.

After physical execution, observe accepts only canonical CMUX semantic-result bytes and verifies exact source, profile ID/generation, parameters, benchmark state, semantic validator presence, artifact collection, and cleanup evidence. It stores the exact CMUX result digest and projects the CMUX terminal vocabulary without re-evaluating CMUX validity.

Synthetic proof

docs/experiments/cmux-workload-profile/ contains a deterministic synthetic request and plan for cmux.ci.guard@1. The OIDs are synthetic so this proves the request/plan boundary without claiming a physical worker ran.

The docs also map the initial acceptance roles:

• cmux_linux_ci -> cmux.ci.guard@1;
• cmux_macos_native_build -> cmux.macos.dev-check@1.

Physical dispatch is the next slice: exact source materialization, CMUX runner preflight, Glaeda-owned backend/cache placement, CMUX runner execution, then a Glaeda physical receipt wrapping the CMUX semantic-result digest.

Validation

• local contract suite: 7 tests passed;
• tests cover fixed adapter resolution, zero caller execution authority, correlation/reuse exclusion from execution identity, generation-sensitive identity, rejection of execution controls, exact result correlation, and repository fixture round-trip;
• CI now compiles and runs the adapter/test pair.

Related: #148, #546, #547, #1056, #1057, #743.
Paired CMUX implementation: manaflow-ai/cmux#13411.

[teamleaderleo]

Independent exact-head review: ACCEPT 94e7545e066ec24a1632d199bef14e7858a69fa5. Reviewed the complete adapter boundary and CI wiring. Requests bind exact CMUX source/profile generation/state/parameters to a fixed repository adapter, expose no caller argv/cwd/backend/resource/cache/redispatch authority, and observations accept only canonical self-consistent cmux-workload-result/v1 bytes while preserving CMUX semantic ownership. Verify, Cultist, and CodeRabbit are green. Merge sequencing: land paired manaflow-ai/cmux#13411 first so the fixed repository runner exists on CMUX main.

[teamleaderleo]

Final review receipt for exact head 8ef278fdee71c0b0a1580c28a2979a3539eee830 against base 32662ad2decde73a5a0207f6b65c31ed8a081933.

The adapter now validates the shared cmux-workload-result/v1 integrity envelope before projecting CMUX's terminal vocabulary: closed nested shape, exact source/profile/parameters, runtime/artifact identities, recomputed toolchain + semantic/context identities, positive CPU/resource shape, timestamp/cleanup consistency, and passed-result exit/artifact requirements. The wrong-profile regression recomputes CMUX's own comparison identities before proving Glaeda still rejects request drift.

Authority remains planning/observation only; no argv/backend/resource/cache/host controls are exposed. Exact-head Verify, Cultist advisory, and CodeRabbit are green.

[teamleaderleo]

Exact-head follow-up on 8ef278fdee71c0b0a1580c28a2979a3539eee830: Verify and Cultist are green after the failed Verify job was rerun. The original failure came from native_hot_run_deadline_contract losing an environmental CPU observation and poisoning its shared test lock; current main is green on that same test family, and the rerun passed without adapter changes. The CMUX workload-profile adapter itself is clean on this head.

[teamleaderleo]

Independent exact-head ACCEPT verdict for 8ef278fdee71c0b0a1580c28a2979a3539eee830.

Review fence:

• closed caller-neutral CMUX request grammar;
• exact source/profile/generation/state-class execution binding;
• no caller argv/cwd/backend/machine/resource/cache-root controls;
• complete canonical cmux-workload-result/v1 validation;
• recomputation of CMUX semantic/comparison identities using the same field set and canonical JSON bytes as the current CMUX runner;
• exact source/profile/parameter/state correlation before observation;
• result/cleanup consistency, including ambiguous forced-cleanup handling;
• bounded digest-only outer observation with zero execution/host-selection/resource/redispatch authority.

The current paired CMUX producer still exposes cmux.ci.guard@1 and cmux.macos.dev-check@1, result contract cmux-workload-result/v1, and matching semantic/context-key algorithms.

Exact-head hosted checks:

• Verify run 35635927962: success;
• Cultist advisory run 35635927873: success.

The earlier Verify failure was the unrelated native hot-run empty-file test race, repaired and merged separately in #1086. I found no remaining blocker in this adapter fence. GitHub cannot record an APPROVE event because the implementation agents share the PR owner's account; this COMMENT records the implementation-independent verdict.