#18313 Never point a non-production Cloud machine's edge at production coderouter

The reflection 401 flood (~41k per 30 min, 2.0M on 2026-10-06) is not credential expiry. After https://github.com/manaflow-ai/cmux/pull/18307 deployed, every refusal on /api/vm/reflection/name reports cmux.coderouter.auth_failure_detail = signed_unverified (4,138 in 3 min, 0 not_live): the edge injects a signed x-cmux-authorization that production cannot verify.

Cause: dev-backend stacks sign machine credentials with their own key (CMUX_VM_AUTH_SIGNING_KEY_ID=dev-backend-1 in the curated dev env) and set no CMUX_CODEROUTER_EDGE_ORIGIN, so resolveEdgeOrigin fell back to https://coderouter.dev. Every Freestyle machine a dev stack creates (same Freestyle account) therefore sends its reflection, resource-usage and model traffic to production with a token production refuses, for the machine's whole life, also after its dev stack is stopped or purged (299 registered stacks). The guest retries the refusal every 8 s (https://github.com/manaflow-ai/cmux/pull/18308 fixes that for new snapshots).

Fix: without an explicit origin, only production defaults to coderouter.dev and a Vercel preview to its branch URL. Any other deployment provisions no edge rule and mints no token, with a warning naming CMUX_CODEROUTER_EDGE_ORIGIN. Production can verify neither a dev key nor a dev database row, and the Freestyle edge cannot reach the private dev host, so such a rule could never work. A guest with no rule gets a DNS failure for reflection.cmux.internal and never reaches production.

Diagnostics: a refused signed token now records its unverified key id (cmux.coderouter.auth_key_id) and signed_unknown_key when this deployment holds no such key, so the remaining traffic from already-running dev machines can be confirmed and counted in Axiom.

Red/green on cmux-lawrence-2: tests/coderouter-vm-model-plane.test.ts and tests/coderouter-request-telemetry.test.ts fail at e0bbc24, pass at head. Every coderouter*, vm-reflection*, vm-principal*, vm-model*, vm-freestyle-provider*, vm-create*, vm-route-workflow* test file passes individually. Typecheck, complexity gate and eslint pass (two pre-existing unused-import warnings in the model-plane test).

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Stops dev and local deployments from wiring their machines' edge to production coderouter, ending the reflection 401 flood caused by production refusing tokens signed with dev keys.

Previously any deployment without CMUX_CODEROUTER_EDGE_ORIGIN defaulted to coderouter.dev, so every machine a dev backend created dialed production with a token it cannot verify, forever. Now only production defaults to coderouter.dev and Vercel previews to their branch URL; other deployments provision no edge rule and mint no token, with a warning naming the env var.

Diagnostics

• Refused signed tokens now record their unverified key id (cmux.coderouter.auth_key_id) and a new signed_unknown_key detail when the deployment holds no such key.

---

[!NOTE]
Medium Risk
Changes VM create provisioning and edge-origin defaults (fewer rules on dev stacks); production and preview behavior is preserved, but misconfigured CMUX_CODEROUTER_EDGE_ORIGIN could leave machines unwired.

Overview
Stops dev/local Cloud VM creates from installing Freestyle edge rules that forward guest traffic to production coderouter.dev when the stack signs VM JWTs with its own key and DB—those requests were failing as signed_unverified and flooding reflection 401s.

Model plane: resolveEdgeOrigin now returns null outside production and Vercel preview unless CMUX_CODEROUTER_EDGE_ORIGIN is set; provisionVmModelPlane then skips token minting and returns no edge rules (with a console warning). Production still defaults to coderouter.dev; previews still use the branch URL.

Auth telemetry: Refused signed x-cmux-authorization tokens record the unverified JWT kid on the span (cmux.coderouter.auth_key_id) and use a new detail signed_unknown_key when this deployment does not hold that signing key, via unverifiedVmAuthorizationKeyId / isKnownVmAuthorizationKey and signedRefusal in route token auth.

Docs and tests cover the unwired non-prod path and the unknown-key diagnostic.

^{Reviewed by Cursor Bugbot for commit 98dabbbcfc6545aeea018edb74cbbbff1004b29d. Bugbot is set up for automated code reviews on this repo. Configure here.}