Define CMUX execution roles and workload capabilities

[teamleaderleo]

Stacked on #1067 / #1056.

Defines the CMUX-owned fleet execution-role and workload-capability contract without widening current v1 enrollment.

Role vocabulary

Closed set:

• cmux_macos_native_build
• cmux_macos_test
• cmux_linux_ci
• cmux_linux_agent
• artifact_cache
• background_replay
• benchmark
• diagnostic

Compile/release/dev-build, app-host, web CI, build-helper, and background verification remain semantic capabilities/operations under those roles.

Eligibility and generations

Role eligibility requires exact acceptance and binds:

• Support CMUX-owned hardware fleet enrollment, acceptance, and role eligibility #1056 enrollment generation;
• exact Glaeda generation;
• per-role reviewed acceptance-workload generation;
• execution capability generation;
• semantic toolchain profile -> exact accepted toolchain generation;
• reviewed CPU/memory/disk classes and required capabilities.

Enrollment by itself grants zero execution-role eligibility. Glaeda/workload/toolchain/capability changes stale affected canaries and measured capacity evidence.

Workload and capacity

glaeda-cmux-workload-requirement/v1 names platform/architecture, semantic toolchain profile, classed resources, capabilities, role, operation, and one of small|medium|large|exclusive. It contains no node selector or caller-controlled raw CPU/RAM/cgroup values.

glaeda-cmux-role-capacity/v1 binds #760-style measurements to exact node/role/profile/generation context: validated completions, p50/p90, CPU/memory pressure, swap, thermal behavior, unfinished work, measured concurrency, and an evidence digest.

Physical leases

Semantic operations compile locally to scarce claims including:

• mac_native_build_lane
• mac_app_host_test_slot
• artifact_publisher_slot
• linux_medium_slot
• linux_heavy_slot
• browser_ui_test_slot

local_admission is explicitly admission_only; scarce work reports the #1057 physical_execution_lease boundary and must acquire that lease before launch. Fresh critical pressure vetoes after remote selection.

Placement preference

Preference is a separate observation_only record for #546. It can rank already eligible, measured candidates; it cannot create eligibility. Platform cost and machine age have no policy fields.

Coverage

Focused tests cover exact eligibility, wrong Xcode/toolchain profile, CPU/memory class failure, failed/stale canaries, drain, toolchain/Glaeda/workload upgrades, shared scarce slots, profile-specific concurrency, ineligible external requests, pressure changing after selection, unmeasured/stale capacity evidence, synthetic Mac/Linux multi-role nodes, preference separation, and compact operator status.

Physical CMUX acceptance remains follow-up evidence: one Mac with two roles, one Linux node with two roles, plus clean incompatible-placement refusal.

Related: #1056 #1057 #1058 #546 #743 #760 #840.

Because this touches local admission / physical lease coordination, keep the PR gated on independent exact-head review and CI before merge.

[teamleaderleo]

Coordination with the new repository-owned corpus in manaflow-ai/cmux#13411 / #1071:

For CMUX roles, keep two generations distinct:

• CMUX semantic workload identity: repository-owned profile ID + generation (for example cmux.ci.guard@1);
• Glaeda role/admission policy generation: eligibility, capabilities, physical leases, resource classes, and machine acceptance policy.

A Glaeda “acceptance-workload generation” should reference/bind the CMUX profile identity rather than become a second semantic version for the CMUX command/result. The role-capacity and physical-lease work in this PR remains Glaeda-owned and composes cleanly outside the canonical cmux-workload-result/v1 digest.

That separation lets #546 compare eligible backends while preserving one source of truth for which CMUX tests/artifacts/validators constitute the operation.

[teamleaderleo]

Superseded by #1084, which is rebased on current main after #1056/#1071 merged and includes the exact #1056 acceptance-profile/receipt binding plus the #1057 physical-lease collision seam. Closing this stale diverged draft; retain its discussion as design history.